Sunday, May 8, 2005

Challenge Response for NNTP

A few weeks ago we enabled posting to mailing lists via Google Groups. In looking to expand that to the rest of the NNTP enabled world, we've settled on implementing a Challenge/Response system for verifying email addresses. (It really isn't fun when you reply on a mailing list and find out the email address you're replying to is fake.) Because we generally require posting from the subscribed address to the mailing lists, we know those are valid addresses.

So... Last night I attempted to implement TMDA. It is very easy to setup... but... I hit a roadblock. The envelope from/return path on NNTP gated postings is generally the gateway, not the original poster. So, TMDA had to be modified to use the From address instead. I had it mostly working after a few hours, alternately tweaking the scripts (something I didn't want to do -- makes it hard to upgrade) and writing procmail wrappers. Finally, I gave up, after TMDA made it clear that it wasn't happy if I sent a message from address A, and then sent the verification message from address B.

Next step is either to:

a) write my own Challenge/Response system just for this.

b) find another system that works

c) give up, letting the 3 or 4 people a wek who post via a NNTP server that is not send their emails directly to the mailing list.

No comments:

Post a Comment