procmail
[Top] [All Lists]

Re: Base64 Spam.

2003-06-16 11:51:54
On Fri, Jun 13, 2003 at 12:25:21AM +0200, Dallman Ross wrote:

      :0  # 030504 () where's the "multipart"?  There's just one encoded part
       *                  CTYPE  ??  ^^multipart/mixed
       *          2^0  B         ??  ^Content-Transfer-Encoding:(.*\<)?\
                                      (base64|7bit)
       * $ -$MAXINT^0
       *         -1^0  B         ??  ^Content-Type:(.*\<)?text/plain
       *         -1^1  B         ??  ^Content-Type:
       * $  $MAXINT^0
       { RX = "${RX:+$RX, }UBE.B+CT.MISMATCH:1" }

I think I get what this is doing, but wouldn't something like this be
simpler?

  :0
  * ^Content-Type: multipart/
  {
    :0 B
    * 1^1   ^Content-Type:
    { PARTS=$= }

    :0 A
    * PARTS ?? ^^1^^
    { W = "multipart: just one part" }

    :0 E
    * PARTS ?? ^^0^^
    { W = "multipart: no parts" }
  }

system.  Typing "man -k base64" gives me one installed on my system:
it's called, oddly enough, "base64".

 12:21am [~/Mail] 482[0]> echo foo | base64 | base64 -d
foo

I'm curious as to where that came from -- but another solution for this
is mimedefang from http://www.roaringpenguin.com/mimedefang/.

I still don't think decoding base64 is worth the bother.  It's sort
of like strip-searching people you find have broken into your house
at 3 a.m. to see if they have any burglary tools on 'em.  Hell, if
they're in your house uninvited at 3 a.m., that's damning enough.
And if someone sends text-only or HTML mail base64-encoded, that's
damning enough.

Or ... strip-searching folks that phone you at 3AM.  Unfortunately, 3AM
in my timezone is the middle of the business day in parts of Asia.  You
can't block a whole technology just because spammers are using it.  Even
base64-encoded text/plain has its place, if the charset warrants it.


-- 
  Paul Chvostek                                             
<paul(_at_)it(_dot_)ca>
  Operations / Abuse / Whatever
  it.canada, hosting and development                   http://www.it.ca/


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>