Something doofuzzled in a * ^To: line.

2009-02-23 Thread Gene Heskett
Greetings; Using fetchmail-procmail | spamc |procmail - user mailbox or /dev/null. I've had zip luck getting a trigger line based on Undisclosed Recipients:, or Unlisted Recipients: here, so I called up my .procmailrc and tried to enter the check phrase by doing a copy/paste from the kmail

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Theo Van Dinter
It sounds like an issue w/ kmail/vim and not so much a nefarious spammer ability. And I'm not sure what you mean by unlisted header. If you mean: [other headers] To: unlisted header Then the answer is unlisted header is actually the first line of the body. On Mon, Feb 23, 2009 at 5:55 PM,

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Theo Van Dinter
Oh, and having a sample mail via pastebin/etc would be handy if you want more commentary about the mail. :) On Mon, Feb 23, 2009 at 6:52 PM, Theo Van Dinter felic...@apache.org wrote: It sounds like an issue w/ kmail/vim and not so much a nefarious spammer ability. And I'm not sure what you

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Martin Gregorie
On Mon, 2009-02-23 at 17:55 -0500, Gene Heskett wrote: Anybody got an idea how the spammers have managed that? Sorry, I can't help with the invisible stuff, but I do know a little about the other part of your question: And better yet, how to defend against it as I'd like to /dev/null any

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread John Hardin
On Tue, 24 Feb 2009, Martin Gregorie wrote: On Mon, 2009-02-23 at 17:55 -0500, Gene Heskett wrote: And better yet, how to defend against it as I'd like to /dev/null any message with an unlisted header. Bad idea to poison-pill that. IMO the appearance of Undisclosed recipients: in a list

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Joseph Brennan
Martin Gregorie mar...@gregorie.org wrote: The string Undisclosed recipients: is actually a legal group address name. No, it is not. It needs to be closed with ';' to be legal. This... To: Undisclosed recipients:; ... conforms to standard, with or without spaces around the ':' and ';'

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Karsten Bräckelmann
On Mon, Feb 23, 2009 at 5:55 PM, Gene Heskett wrote: [...] by doing a copy/paste from the kmail displayed line when in show all headers mode. On Mon, 2009-02-23 at 18:52 -0500, Theo Van Dinter wrote: Oh, and having a sample mail via pastebin/etc would be handy if you want more

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Martin Gregorie
On Mon, 2009-02-23 at 20:00 -0500, Joseph Brennan wrote: Martin Gregorie mar...@gregorie.org wrote: The string Undisclosed recipients: is actually a legal group address name. No, it is not. It needs to be closed with ';' to be legal. This... To: Undisclosed recipients:; ...

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Gene Heskett
On Monday 23 February 2009, Theo Van Dinter wrote: Oh, and having a sample mail via pastebin/etc would be handy if you want more commentary about the mail. :) http://pastebin.ca/1345467 Thanks. The question is how to craft a procmail rule that will trigger on the 'unlisted' bit. On Mon, Feb

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Gene Heskett
On Monday 23 February 2009, Martin Gregorie wrote: On Mon, 2009-02-23 at 17:55 -0500, Gene Heskett wrote: Anybody got an idea how the spammers have managed that? Sorry, I can't help with the invisible stuff, but I do know a little about the other part of your question: And better yet, how to

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Gene Heskett
On Monday 23 February 2009, Karsten Bräckelmann wrote: On Mon, Feb 23, 2009 at 5:55 PM, Gene Heskett wrote: [...] by doing a copy/paste from the kmail displayed line when in show all headers mode. On Mon, 2009-02-23 at 18:52 -0500, Theo Van Dinter wrote: Oh, and having a sample mail via

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Duane Hill
On Mon, 23 Feb 2009, Gene Heskett wrote: I've seen both. but I didn't see a Bcc: line at all. There is no Bcc: line (email header). Therefore, a Bcc: is supplied as a RCPT TO during SMTP time and that is it.

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread John Hardin
On Mon, 2009-02-23 at 21:41 -0500, Gene Heskett wrote: On Monday 23 February 2009, Martin Gregorie wrote: In the last year I haven't seen any mail with Unlisted recipients, just variations on Undisclosed recipients. I've seen both. but I didn't see a Bcc: line at all. You wouldn't, the

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Martin Gregorie
On Mon, 2009-02-23 at 21:41 -0500, Gene Heskett wrote: Sounds neat, but I know squat about java, sorry. OK, I think something like this should match: header UNDISC_RECIP To ~= /un(disclos|list)ed( |-)recipient[:;]{1,2}/i Disclaimer: this has not been tested or compiled As I said before, I

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread SM
At 18:38 23-02-2009, Gene Heskett wrote: The input line looks like this: To: unlisted-recipients:; (no To-header on input)@gmail-pop.l.google.com Is your MTA or POP3 client adding the @gmail-pop.l.google.com at the end of that line? You could add a rule to catch the no To-header comment.

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread Gene Heskett
On Tuesday 24 February 2009, SM wrote: At 18:38 23-02-2009, Gene Heskett wrote: The input line looks like this: To: unlisted-recipients:; (no To-header on input)@gmail-pop.l.google.com Is your MTA or POP3 client adding the @gmail-pop.l.google.com at the end of that line? Not that I know of.

Re: Something doofuzzled in a * ^To: line.

2009-02-23 Thread SM
At 22:08 23-02-2009, Gene Heskett wrote: Not that I know of. Fetchmail occasionally squawks about a race in the PEEK_MSG function, maybe a couple times a day. ~/.procmailrc has no such edit line in it. Obviously it did come in through my gmail account. The MSG_PEEK is used on sockets and