<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 9 May 2016, at 21:31, Clem Cole <<a href="mailto:clemc@ccc.com" class="">clemc@ccc.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Mon, May 9, 2016 at 3:42 AM, Sampsa Laine <span dir="ltr" class=""><<a href="mailto:sampsa@mac.com" target="_blank" class="">sampsa@mac.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">How the hell does someone as theoretically techie as the people on this list get their freaking email address compromised?</blockquote></div><br class=""><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Be careful with over arching statements. It's trivial to forge someone else's email address. Yes, most of us set up our systems so that the rcvr should do sender authentication, but not all receiving systems do, and it's optional etc. So stuff happens. As someone with a 40+ year domain name its still a problem - forgeries are ripe.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br class=""></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">I think the better question is techie's should be able to recognize most junk that get's through the filters. The good news is that most of it does get stopped, but those messages that do make it thru, we need to be "always watching."</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br class=""></div></div></div></div></blockquote><br class=""></div><div>Actually my bad - SMTP is so broken it’s not even funny.</div><div><br class=""></div><div>I remember we were having a few beers in the Students Union during my MSc and I figured that since there’s no requirement to define how much data a message contains, it would be pretty easy to just open 100+ connections to a mail server and keep feeding it crap until it falls over. So off to the testing lab we went.</div><div><br class=""></div><div>In 2004 with 100 connections on 100 Mbps LAN, I think it took sendmail ABOUT 4 minutes.</div><div><br class=""></div><div>Sampsa</div><div><br class=""></div><div><br class=""></div><br class=""></body></html>