🚀 go-pugleaf

I have argued strenuously that by limiting the automatic response
to sendsys messages only to those whose Reply-to: or From: address
have as their destination 'sendsys', we can eliminate almost all
of the malicious uses of sendsys. Bombing a machine is still
possible, but is less rewarding if it is on the Internet, and
the resultant mail more easily filtered, and bombing a person's
mailbox becomes impossible (unless their address is 'sendsys',
which probably is a poor choice anyway).

Similar things should be done for version and senduuname, but
better to see what the net thinks of this effort first.

Here is a script that will do it for C news. It is simply the
original sendsys script with another case statement in it:

#! /bin/sh
# sendsys - mail sys file to sender identified in stdin's headers

# =()<. ${NEWSCONFIG-@<NEWSCONFIG>@}>()=
. ${NEWSCONFIG-/usr/lib/news/bin/config}
export NEWSCTL NEWSBIN NEWSARTS
PATH=$NEWSCTL/bin:$NEWSBIN/relay:$NEWSBIN:$NEWSPATH ; export PATH
umask $NEWSUMASK

SENDER="`newsreply`"

case "$SENDER" in
*!sendsys|sendsys@*)

(echo "Subject: response from `newshostname` to your sendsys"; echo "";
case "$1" in
"")	cat $NEWSCTL/sys ;;
*)	awk -f $NEWSBIN/relay/canonsys.awk $NEWSCTL/sys | egrep "^$1:" ;;
esac ) | mail "$SENDER"
echo "$NEWSCTL/sys file has been sent to $SENDER.  Remain calm." | mail $NEWSMASTER

;;
*) echo "$SENDER is probably the target of a sendsys bomb. sys not sent." | mail $NEWSMASTER

;;

esac

-- 
Nick Sayer <mrapple@quack.sac.ca.us> | Nick's law of academics:
N6QQQ @ N0ARY.#NOCAL.CA.USA.NOAM     | 
37 19 49 N / 121 57 36 W             |      k*GPA=1/IQ
+1 408 249 9630, log in as 'guest'   |