North American Fruit Explorers mailing list at ibiblio

["Greg Miller" <gsmiller@cet.com>]

> So if you cannot verify the sender of an virus laden email, how can a
> person be banned,or even accumulate strikes against them?   

Tom:

I'm pretty sure that "xyz", who has been unsubscribed, was the right 
person, and my reasons are listed below.  Note that "xyz" can 
resubscribe at any time on their own initiative without my 
involvement.  They can also subscribe under a different email address 
if they wish.  The main effect is that messages cannot be POSTED from 
that address.  There is no total defense against having someone who 
wants to subscribe and has no interest in having viruses sent to the 
list.

Here's why I think it was "xyz"

1.  I'm familiar with the KLEZ virus, including its spoofing ability. 
 I get KLEZ attachments all the time.  I've also helped 3 friends get 
their computers cleaned up, which made finding the links for tools 
pretty easy.  Although the virus has the ability to spoof email 
addresses, it does sometimes send an email with the infected user in 
the from field.

2.   In the past, I have read the headers of the offending email to 
try to figure out who the REAL sender is--this has been helpful in 
breaking the bad news to people who thought they had things solved.  
In doing so with the forwarded message, the only headers that matched 
subscribers to the list was the name in the FROM header.  
Unfortunately IBIBLIO strips many of the headers from the original 
email when it forwards messages, but it's the best I can go on.

3.  To have messages forwarded from the IBIBLIO server, it has to be 
sent from a user who is subscribed to the list.  Either "xyz" sent 
the message (and was recognized as a subscriber by IBIBLIO) or 
someone else who is subscribed to the list and has "xyz" in their 
addressbook sent the message.  Unless that other theoretical person 
cleans up their computer, I will get other posts to IBIBLIO.  I don't 
know whether IBIBLIO validates the FROM field, but there is clearly 
something more than how people configure their FROM headers in how it 
decides who belongs.  We may all know the answer to that one if we 
get other infected messages.

If the suspended user "xyz" simply scans his or her system (or for 
that matter says to heck with it and takes no steps), he or she can 
resubscribe AT ANY TIME.  I am not blocking any one from using the 
list.  But if someone takes no steps to cleanse their system, and 
repeatedly floods the list with computer viruses, there needs to be 
some point at which it is said "ENOUGH!"  I think it's most fair to 
let people know ahead of time that this is a serious matter that 
should be addressed seriously.

Worst case scenario:  "xyz" is innocent.  Hopefully along with 
resubscribing they will send a message to me as the list admin, so 
that I can take it into account for tallying future "dings."  At most 
they miss a few messages, which can be viewed on line at a later 
time.

If "xyz" is infected and doesn't take any steps, I should know about 
it soon, as my email address (in the message I sent to that user) 
will probably be a target for KLEZ.  Luckily, the list shouldn't be 
getting any of those infected messages.

GREG MILLER
list administrator