That Inbox Buddy Tutorial About Spam ...

I blogged it over here.  You do need to make your window fairly large due to the pictures (and that's a definite problem with this template design.

1:20:52 PM      Google It!   comment []    IM Me About This   

Inbox Buddy Update

That new project I mentioned has kept me from blogging much about Inbox Buddy but I thought a quick update is in order.  The product is doing well although we do have some installation issues tied to Microsoft's lack of a view creation API for Outlook 2000 (sigh.  APIs for lots of things but not that).  We've got a new release coming out this week that adds a bunch of new features and after it goes through some more qa I'll post the 0.904 release.  One of those features will be BCC warning so you at least know that you are replying to everyone on a BCC.  Think about it -- we've all done that.  Your boss BCC's (blind carbon copy) you on an email and then you think you are part of the conversation and accidentally reply.  Oops.  When I worked at the late, lamented Dataware this happened all the time.

Oh and there has been some confusion about why Spam isn't automatically routed to a folder in Inbox Buddy.  That's an easy thing to do and I'll blog a tutorial on it over on the Inbox Buddy Blog.  This almost certainly should be a default although the natural developer fear of false positives has scared us away from it (we'll probably do it soon).  Thanks to Matt Mower over at Novissio for righteously hammering me on this early this morning.

7:49:04 AM      Google It!   comment []    IM Me About This   

Ah... If You Recently Installed Sendmail

I'd go read this document:

The CERT/CC has received confirmation that some copies of the source code for the Sendmail package have been modified by an intruder to contain a Trojan horse.

The following files were modified to include the malicious code:

sendmail.8.12.6.tar.Z
sendmail.8.12.6.tar.gz

These files began to appear in downloads from the FTP server ftp.sendmail.org on or around September 28, 2002. The Sendmail development team disabled the compromised FTP server on October 6, 2002 at approximately 22:15 PDT. It does not appear that copies downloaded via HTTP contained the Trojan horse; however, the CERT/CC encourages users who may have downloaded the source code via HTTP during this time period to take the steps outlined in the Solution section as a precautionary measure.

The Trojan horse versions of Sendmail contain malicious code that is run during the process of building the software. This code forks a process that connects to a fixed remote server on 6667/tcp. This forked process allows the intruder to open a shell running in the context of the user who built the Sendmail software. There is no evidence that the process is persistent after a reboot of the compromised system. However, a subsequent build of the Trojan horse Sendmail package will re-establish the backdoor process.

[ More ]

Before anyone rails on Open Source being such an informal thing that it allows this type of stuff to happen I'd point out the many, many security advisories from Microsoft alone this year.  Each approach has it's pros and cons and even Microsoft can have malicious staff members.  I'd also suspect that this event will force many Open Source staffers to crack down more on the build process.

And, in closing, I'd comment that Sendmail has had issues for a long time and perhaps it's time to look at Qmail.  Qmail is Open Source and just plain awesome although I'll admit it can be a prick to install and configure.  Once up though it's absolutely rock solid.  I got my buddy Apokalyptik to install and support it for me on a contract basis and it's been stellar.  Apparently it's also been more than a year (I think it's actually several years) without a security alert.  Recommended.

6:35:30 AM      Google It!   comment []    IM Me About This   

Reposting: Hey !  I Can Find that Blog on the Radio

(I know it's bad form to repost an entire entry but this happens today so I thought it appropriate.  I hope you can tune in; I suspect that it's short, probably only 10 minutes or so).

I wrote that title with the deepest apologies to REM.  Sorry guys but it seemed the perfect lead in to letting folks know that if you listen to AnchorDesk's David Coursey on CNET Radio, I'll be interviewed about O'Reilly's Essential Blogging on next Wednesday, 10/9, at 12:00 pm PST.  You can find it at CNET Radio.   The real topic is Essential Blogging but I suspect that it will also cover basic blogging questions (and why to blog) and comments on tools.

6:27:09 AM      Google It!   comment []    IM Me About This