4 ms·

For this to fail, wouldn't the mailing list have to send the message on to its subscribers listing it as "From" the Yahoo email address? In that case, it's the

For this to fail, wouldn't the mailing list have to send the message on to its subscribers listing it as "From" the Yahoo email address? In that case, it's the mailing list doing it 'wrong' (in the eyes of SPF, DKIM, et al, anyway), as they should be sending it 'from' their mailing list email address, not the original person who sent the message. This isn't a new problem as SPF has required mailing lists to do this for years now. *UPDATE: Clarified 'wrong' wrt the various protocols.

ChuckMcM 13y ago
They often do that (resend with the receiver being the person). Mailing lists have intense debates over the correctness of replying to the sender by default or to the list by default (and whether or not you want to add cc or not). Many also munge the subject line with things like [The AWESOMEList] because forever and ever people's mail clients could only filter on subject lines or body text and rarely additional headers. I appreciate where Yahoo's heart is, but this wasn't really well thought out on their part.
throwaway2048 13y ago
Breaking the entire world and then complaining that "they are doing it wrong" goes over like a lead balloon. Its a messy state of affairs to have to workaround issues that dont match your particular models, but its often necessary to have things work at all. Do note that mailing lists and the way they send mail predate DMARC, DKIM and SPF by far, why don't they better account for this extremely prevalent model of email usage. Why is it that mailing lists that are "broken".
- JohnTHaller 13y ago
  Mailing lists are a tiny, tiny fraction of email and used mostly by us techie types. So, I thinking 'breaking the entire world' is a bit hyperbolic. I'd meant 'broken' with respect to DKIM, SPF et al (and have updated the post to reflect that).
  - dfc 13y ago
    I am going to take a guess and say that you are not/have not been involved in any somewhat serious activism. Activists love mailing lists.
    - JohnTHaller 13y ago
      I'd wager the vast majority of folks on the internet don't even know what a participatory mailing list is. And I say that as someone who has been a part of multiple lists for nearly 20 years.
      - comex 13y ago
        As an anecdote, both of my parents have dealt with (unrelated) private "listservs" associated with their work.
      - tragic 13y ago
        I'm on ten or twelve different mailing lists. Only two have anything whatsoever to do with tech. The rest are - as per dfc above - politics-related. So I don't view lists as somehow a techie habit - quite the opposite, in fact. They work for politics because the technical 'barrier to entry' is very low. You don't need to know anything more about computers than how to send and receive email in a client of your choice. Given that in most political groups you're dealing with students, pensioners and everyone in between, this is a distinct evolutionary advantage. I have no idea how the total volume of list-mail breaks down between tech stuff and muggle concerns. But in any situation where you have to communicate between people of different generations with wildly different technical expertise, lists are an ideal lowest-common-denominator. Until, that is, Yahoo or whoever cut their users off, and muggins here has to explain to uncomprehending people why their messages aren't appearing. Guess it's going to be a long week for me. sigh
      - chalst 13y ago
        With just my eldest, 10-yo daughter, I have subscribed to 9 mailing lists at 3 different schools in two countries, to discuss things with various groups of parents, with none of these lists being started by tech folk.
dragonwriter 13y ago
> For this to fail, wouldn't the mailing list have to send the message on to its subscribers listing it as "From" the Yahoo email address? Yes, which many mailing lists do. > In that case, it's the mailing list doing it wrong Is it? Not having the actual originator as the "From:" seems to be "doing it wrong".
- deleted 13y ago
  [deleted]
- vidarh 13y ago
  Exactly, and "From:" has "always" been expected to possibly be a different identity to the sender of the e-mail: We have "Sender:" to indicate where the message was sent from when "From:" does not.
thaumaturgy 13y ago
The mailing lists I am subscribed to -- openbsd-misc, roundcube-dev, and backuppc-users -- all do this. So does the mailing list I admin, for a local hackers group. As well as every other mailing list in recent memory. (Including the LKML. I just checked.) Whether it's "right" or "wrong" might be an argument that someone will find worth having, but I don't think it can be argued that this isn't common practice.
- meepmeep 13y ago
  We shouldn't have to keep this giant security hole in email (spoofing) just because mailing lists, which predate the spam and spoofing issues, don't want to update how they operate. Accommodating =reject DMARC policy is simple for the mailing lists. A policy of "Because that's the way we always did it" is dumb. We didn't use to recycle, now we do...because it is better. DMARC is better than allowing spoofing. Update your mailing list. Stop forging sender. Move on.
gkoz 13y ago
I think SPF is happy if the bounce address (envelope from) is replaced but the From: header is intact.
- toast0 13y ago
  To pass DMARC, you need to have either DKIM pass, or SPF pass when the envelope sender and the From: header are aligned (whatever aligned means... generally within the same domain). Because the envelope from headers are very likely changed to the mailing list, the SPF pass doesn't help with DMARC. And since the mailing lists very likely alter the messages (to put footers), the messages probably don't pass DKIM either.
zhemao 13y ago
What? Every mailing list I've ever subscribed to has the original sender in the "From" field and the mailing list address in the "To" field. Otherwise how would you know who sent the message to the list?
PhasmaFelis 13y ago
That's bizarre. Correct behavior used to be to send "from" the original sender, with the list address in the "reply-to" field. That way everyone knows who posted it, but discussion is still directed to the list.
- zAy0LfpBZLC8mAC 13y ago
  No, it's not. A maling list should not ever touch the Reply-To: header field. See also: http://www.unicom.com/pw/reply-to-harmful.html http://www.unicom.com/pw/reply-to-harmful.html
  - comex 13y ago
    Note the (also very old) opposing argument: http://marc.merlins.org/netrants/reply-to-useful.html http://marc.merlins.org/netrants/reply-to-useful.html Personally, I've almost never wanted to privately reply to a mailing list posts (and I'm under the impression that doing so in most contexts is vaguely rude), but redundant CCs in reply-all chains are ugly, so I prefer munging Reply-To.
    - zAy0LfpBZLC8mAC 13y ago
      Except the opposing argument is severely broken, of course. It starts with not even comprehending the RFC he is quoting ("include the address of that service in the "Reply-To" field of all messages submitted to the teleconference", which clearly does not sanction the "teleconference" itself munging the header), and after that essentially turning logic on its head and appealing to ignorance ("People who don't know how what the working solution looks like are asking for a broken solution! If software does something else than it should do by definition, it's the user's mistake, and therefore the user's fault! [...]"). As for redundant Ccs: That is what Mail-Followup-To is there for, see also: http://cr.yp.to/proto/replyto.html http://cr.yp.to/proto/replyto.html edit: Oh, and also, in particular, he completely ignores the fact that Reply-To munging deletes existing Reply-To headers, and thus breaks things in a way that even the best MUA cannot possibly work around - the original Reply-To isn't there anymore, so it cannot possibly offer you an option to reply to the original Reply-To or to the munged Reply-To.

ChuckMcM 13y ago

They often do that (resend with the receiver being the person). Mailing lists have intense debates over the correctness of replying to the sender by default or to the list by default (and whether or not you want to add cc or not). Many also munge the subject line with things like [The AWESOMEList] because forever and ever people's mail clients could only filter on subject lines or body text and rarely additional headers. I appreciate where Yahoo's heart is, but this wasn't really well thought out on their part.

throwaway2048 13y ago

Breaking the entire world and then complaining that "they are doing it wrong" goes over like a lead balloon. Its a messy state of affairs to have to workaround issues that dont match your particular models, but its often necessary to have things work at all. Do note that mailing lists and the way they send mail predate DMARC, DKIM and SPF by far, why don't they better account for this extremely prevalent model of email usage. Why is it that mailing lists that are "broken".

JohnTHaller 13y ago
Mailing lists are a tiny, tiny fraction of email and used mostly by us techie types. So, I thinking 'breaking the entire world' is a bit hyperbolic. I'd meant 'broken' with respect to DKIM, SPF et al (and have updated the post to reflect that).
- dfc 13y ago
  I am going to take a guess and say that you are not/have not been involved in any somewhat serious activism. Activists love mailing lists.
  - JohnTHaller 13y ago
    I'd wager the vast majority of folks on the internet don't even know what a participatory mailing list is. And I say that as someone who has been a part of multiple lists for nearly 20 years.
    - comex 13y ago
      As an anecdote, both of my parents have dealt with (unrelated) private "listservs" associated with their work.
    - tragic 13y ago
      I'm on ten or twelve different mailing lists. Only two have anything whatsoever to do with tech. The rest are - as per dfc above - politics-related. So I don't view lists as somehow a techie habit - quite the opposite, in fact. They work for politics because the technical 'barrier to entry' is very low. You don't need to know anything more about computers than how to send and receive email in a client of your choice. Given that in most political groups you're dealing with students, pensioners and everyone in between, this is a distinct evolutionary advantage. I have no idea how the total volume of list-mail breaks down between tech stuff and muggle concerns. But in any situation where you have to communicate between people of different generations with wildly different technical expertise, lists are an ideal lowest-common-denominator. Until, that is, Yahoo or whoever cut their users off, and muggins here has to explain to uncomprehending people why their messages aren't appearing. Guess it's going to be a long week for me. sigh
    - chalst 13y ago
      With just my eldest, 10-yo daughter, I have subscribed to 9 mailing lists at 3 different schools in two countries, to discuss things with various groups of parents, with none of these lists being started by tech folk.

dragonwriter 13y ago

> For this to fail, wouldn't the mailing list have to send the message on to its subscribers listing it as "From" the Yahoo email address? Yes, which many mailing lists do. > In that case, it's the mailing list doing it wrong Is it? Not having the actual originator as the "From:" seems to be "doing it wrong".

deleted 13y ago
[deleted]
vidarh 13y ago
Exactly, and "From:" has "always" been expected to possibly be a different identity to the sender of the e-mail: We have "Sender:" to indicate where the message was sent from when "From:" does not.

thaumaturgy 13y ago

The mailing lists I am subscribed to -- openbsd-misc, roundcube-dev, and backuppc-users -- all do this. So does the mailing list I admin, for a local hackers group. As well as every other mailing list in recent memory. (Including the LKML. I just checked.) Whether it's "right" or "wrong" might be an argument that someone will find worth having, but I don't think it can be argued that this isn't common practice.

meepmeep 13y ago
We shouldn't have to keep this giant security hole in email (spoofing) just because mailing lists, which predate the spam and spoofing issues, don't want to update how they operate. Accommodating =reject DMARC policy is simple for the mailing lists. A policy of "Because that's the way we always did it" is dumb. We didn't use to recycle, now we do...because it is better. DMARC is better than allowing spoofing. Update your mailing list. Stop forging sender. Move on.

gkoz 13y ago

I think SPF is happy if the bounce address (envelope from) is replaced but the From: header is intact.

toast0 13y ago
To pass DMARC, you need to have either DKIM pass, or SPF pass when the envelope sender and the From: header are aligned (whatever aligned means... generally within the same domain). Because the envelope from headers are very likely changed to the mailing list, the SPF pass doesn't help with DMARC. And since the mailing lists very likely alter the messages (to put footers), the messages probably don't pass DKIM either.

zhemao 13y ago

What? Every mailing list I've ever subscribed to has the original sender in the "From" field and the mailing list address in the "To" field. Otherwise how would you know who sent the message to the list?

PhasmaFelis 13y ago

That's bizarre. Correct behavior used to be to send "from" the original sender, with the list address in the "reply-to" field. That way everyone knows who posted it, but discussion is still directed to the list.

zAy0LfpBZLC8mAC 13y ago
No, it's not. A maling list should not ever touch the Reply-To: header field. See also: http://www.unicom.com/pw/reply-to-harmful.html http://www.unicom.com/pw/reply-to-harmful.html
- comex 13y ago
  Note the (also very old) opposing argument: http://marc.merlins.org/netrants/reply-to-useful.html http://marc.merlins.org/netrants/reply-to-useful.html Personally, I've almost never wanted to privately reply to a mailing list posts (and I'm under the impression that doing so in most contexts is vaguely rude), but redundant CCs in reply-all chains are ugly, so I prefer munging Reply-To.
  - zAy0LfpBZLC8mAC 13y ago
    Except the opposing argument is severely broken, of course. It starts with not even comprehending the RFC he is quoting ("include the address of that service in the "Reply-To" field of all messages submitted to the teleconference", which clearly does not sanction the "teleconference" itself munging the header), and after that essentially turning logic on its head and appealing to ignorance ("People who don't know how what the working solution looks like are asking for a broken solution! If software does something else than it should do by definition, it's the user's mistake, and therefore the user's fault! [...]"). As for redundant Ccs: That is what Mail-Followup-To is there for, see also: http://cr.yp.to/proto/replyto.html http://cr.yp.to/proto/replyto.html edit: Oh, and also, in particular, he completely ignores the fact that Reply-To munging deletes existing Reply-To headers, and thus breaks things in a way that even the best MUA cannot possibly work around - the original Reply-To isn't there anymore, so it cannot possibly offer you an option to reply to the original Reply-To or to the munged Reply-To.