3 ms·

Wasn't it shown yesterday that posterous has basically no security at all? http://news.ycombinator.com/item?id=1441997 http://news.ycombinator.com/item?id=1441

• convel 16y ago
  This security hole is now fixed. We had a specific problem with the way we dealt with SPF records. Dustin didn't set any up, and there was a specific way that Robin Duckett's email server responded that caused us to flag it as a false negative for spoofing. http://news.ycombinator.com/item?id=1443143 http://news.ycombinator.com/item?id=1443143
  • MichaelApproved 16y ago
    What keeps someone else behind the same smtp server from spoofing an email?
    • _delirium 16y ago
      A lot of SMTP servers implementing SMTP AUTH will add an annotation "(Authenticated sender: localusername)" or similar, which will let you distinguish between different users of the same mail server, even when they spoof the From: header. Not sure if that's the solution Posterous is using, or how widespread it is, though.
• risotto 16y ago
  No it was shown there was a bug. Plus this validates the OPs question. It's not hard to receive emails somewhere, but it is hard to clean them, validate the sender with SPF and a few other email non-standards. I've been using google app engines email service but it chokes and rejects a ton of emails that I forward to it. Maybe Posterous could spin off an email cloud service? It'd be a distraction from their core competency, but I could see a lot of value.
  • risotto 16y ago
    Or maybe sendgrid already is this? Haven't used it but they are a big name in cloud email services