Subject: Changes in CCL distribution

From: jkl..at..ccl.net
Date: Sun, 10 Jul 2005 02:13:32 -0400 (EDT)

Dear CCL,

As some of you know, the CCL runs from my home for a few months.
So, there are nobody around to do CCL chores when I am in travel
Since I am taking off for Europe for five weeks on the 11th, we
have a problem:

 A) If one of the key computers dies, there is nobody around to push
    the button or fix it (e.g., replace the disk from backup). This
    is quite  a real possibility, since it is hot here, and the
    thunderstorms in Ohio are frequent and intense.

 B) I will be visiting 4 countries, and I also plan to shed some fat
    hiking, i.e., I may only be occasionally on the Internet.

CCL gets about 3000 spam messages a day. Moreover, the attacks are getting
quite annoying. For example, the crackers place viruses on your Windows
computers. Those boxes send messages with viruses and/or spam with the
chemistry..at..ccl.net on the From: line. On the To: line, they place some
random addresses from your address book, or from internal virus cache.
The target machines bounce this junk mail to the CCL. Since the bounce
comes from the legitimate machine, the blacklists do not work.
BTW, educate your system administrators that bouncing mail that they
consider a spam or virus to a header or envelope From address does not
make any sense. In 99% of cases spam/virus do not provide a real addresses
of the sender.

To keep the CCL running, I had to make dramatic changes in its distribution.
I will replace current scripts to reflect a new mode of distribution
(I am still testing them, and my wife tells me that I should pack...).
We will be debugging the stuff as we go. Sorry... (Some of you know that
I am very busy lately). The main changes will be:

1) The address of the original author of the message does not appear on the
   From: line of the CCL message. The From: line and envelope MAIL FROM
   will be always coming from: owner-chemistry..at..server.ccl.net. Obfuscated
   (i.e., with the @ sign replaced by RANDOM strange characters) author's
   address will still be available on the X-Original-From: header line
   and as the first line of the message body. If you want to reply to the
   author, you need to cut/paste and then edit his/her address manually.
   Why: a) so your infected/zombified computers do not collect addresses
   automatically. b) so the bouncing mail from your defunct computers
   or defunct e-mail addresses can be processed automatically by the
   script collecting mail at owner-chemistry address. c) to make it
   not cost effective for the malware that resides on your computer
   to collect e-mail addresses from your mailbox (Do not say that
   you do not have spyware on your Windows, you just do not know
   about it...).

2) When you send an e-mail message to chemistry..at..ccl.net or use the web
   form to post message to CCL forum, you will get back the request for
   confirmation. This step is necessary, since faking the From: address
   on the e-mail is trivial, and due to spammers, well over half of the
   mail on the Internet does not have a true e-mail address. Those of
   you who posted to CCL via the web form are already familiar with the
   confirmations. You can either confirm your message via Web link provided
   in the confirmation request, or by replying to the confirmation message.
   When you use replay, please do not edit/change the message in any way.

3) After CCL gets the confirmation from you, the message will be posted
   to subscribers only if you posted to CCL before from the same address.
   If this is the first post from your address, your message will be held
   until human (me) releases it to the list. As you know, the beauty (and
   challenge) of CCL is that you do not have to be subscribed to CCL to post
   to it. You can view messages at:
       http://www.ccl.net/chemistry/resources/messages/index.shtml
   and submit messages via Web form at:
       http://www.ccl.net/cgi-bin/ccl/send_ccl_message
   The only way to ordain you to be the bona fide uncensored poster is that
   you post something sensible to CCL successfully. If you post something
   that violates CCL rules:
       http://www.ccl.net/chemistry/aboutccl/rules/
   you will be removed from the blessed contributors list very soon {:-(}

4) Each CCL message will be sent individually to every subscriber, i.e.,
   the e-mail address and name with which you are subscribed to CCL
   will appear on the To: header line of CCL message (I am sure that
   some long-timers will be surprised what they see there). Moreover,
   the To: (and the Message-Id:) line will contain a "secret" {:-)}
   code that will allow you to unsubscribe via Web or by sending e-mail
   to a special address without human intervention. It will also allow
   the scripts to unsubscribe you automatically when the mail starts
   bouncing from your e-mail address. This is still under development...

5) Attachments with MIME application/ANYTHING will not be posted.
   Please do not sign your messages (you will not be on the From
   line anyhow), do not attach beloved MS-WORD files and PostScript,
   etc... There are scores of exploits in different applications, and
   I just cannot take a risk. All the malware checkers by definition play
   the catch-up game, and the jerks are always ahead.

6) If something if found wrong with your message (or perceived wrong
   by my buggy perl scripts), you will not get any answers. I do not
   want to flood innocent people with messages in case someone wants
   to crack my software. In other words, the filters will DROP, not
   REJECT. But I will constantly study what is happening. Bug me if
   your message does not appear on the list.

In short... Expect the unexpected... Otherwise, the CCL would have to
take vacations, but you probably do not want this. I hope we will not
experience any irresponsible posts on CCL. If we do, however, these
messages will not be anonymous (the message cannot be posted unless
you confirm that you are you), and therefore, the abusers cannot hide
(unless they brake into someone's computer, including mine). If this
becomes a problem, I will keep plugging the holes. One more thing...
I am getting scores of bounces that do not like this or that in the
CCL message at random times for wrong reasons [false positives in
spam filters]. For example: "Nobody speak Chinese here", or
"Too many messages today", etc. Please whitelist the CCL... I do not
remember when the spam message was last posted on the CCL. You do not
risk much, especially with application MIMEs forbidden on the list.

If something goes very wrong, I will allow some people to issue the
"shutdown" command  when I am not around. But then, the lights will
go down until I come back. I do not have the network wake-up installed
yet on the boxes that run CCL, though I plan to do it one day.

Expect many improvements when I return from my travels, though it will
take some time. I hope to have more time to spend on CCL with your help
and I will try to update/restore many services that used to run on CCL,
but that had to be disabled or neglected since I still need to sleep at
least 5 hours a day on average...

All the best and have fun, even if it is hard to be worry free in these
brutal world...

Your CCL serviceman

Jan K. Labanowski
jkl..at..ccl.net