Last Friday someone spoofed a message to the Computing announcements
mailing list maintained by ACNS. This is a Listserv list known as
[log in to unmask] It's a low-volume, announcement-only list.
The message had a Subject of "MSU-Campus Map" and it urged people to
visit a particular Web site. In addition to a Google Maps mashup, the
site had a suggestion form that asked for a sender's e-mail address;
in effect, the site offered an open relay for spoofing mail from any
address. The site owner has rectified that problem.
To protect against this form of spoofing, Listserv offers a "confirm"
feature. The option sends a message back to the address of the
apparent sender with a special key. If the author does not reply with
the key, the message is discarded.
If you are the owner of an announcement-only mailing list, you may
wish to consider enabling this option. We have done this for the
Computing list, and will do so for other announcement lists. You may
wish to select this option for certain other mailing lists if you want
to avoid spoofing; however, every posting will require author
confirmation. To set the option,
-- Log into the mailing list management interface at list.msu.edu
-- Select the Edit Configuration button
-- Change this line:
Send= Owners
... to look like this:
Send= Owners, Confirm
-- Click the Save button.
If you have any questions, please contact the ACNS Help Desk (432-6200
or help.msu.edu).
/rich
