Explaining Yourself
Our company mailserver runs qmail. We use a stock program call qmail-queue-scanner or something like that which does some rudamentary scanning on incoming e-mails as one step (of a few) against spam and virii. One thing this script does is check for attachments with certain extensions, like .HTM or .VBS, and if it sees them it rejects the e-mail back to the sender.
Now, this may not be desirable behavior a lot of the time, since the sender can be a faked address, but if it receives a message BACK saying that the corresponding address it rejected to was invalid then the whole cycle stops and everything is over.
I have another e-mail address, @gentoo.org, that I use for Gentoo related purposes. I have it set up to forward mails to my company mail address. Pretty straightforward.
Last week at some point someone sent my @gentoo.org email address an attachment that then was forwarded to my work email and rejected. However, the sender also faked the reply-to address as my gentoo.org address, so it got rejected back to the address that sent it. Well, just a few minutes later it would try to redeliver that same mail to me again and sure enough, reject it back to my gentoo address which then would send it on to me again. Everytime this happened it added a small error message to the top of the mail, adding about 1K. Over time, this meant that the email was getting bigger and bigger and bigger. Eventually when I caught it, there was a 4MB email and a 2mB email stuck in this loop. The problem is that qmail can’t reject the attachment until the whole email is sent. So, we were basically being bombarded by a non-stop email loop and the email was slowly growing bigger and bigger.
I nixed that issue by setting up my gentoo to reject emails from MAILER-DAEMON, which is how our local system sends them out when there’s an error. It’s not the best solution, but it’s the only way I knew how to stop the cycle.
Now, the only reason I even knew about this or investigated was because this whole process had made our internet connection at work slow to a crawl. Like everyone was bugging me about why it was so slow. I had attributed it to the fact that we have a lot of customers on site these days, and they all have wireless access and use their intranets and VPNs and whatnot when they’re doing work. This is mostly true, but it didn’t explain why at 7:30 in the morning with only 10 people were at work the thing was still so slow. So I investigated a bit, and found out about the e-mail problem.
Here’s the point of this story. Once I fixed it, people noticed it was a much better. And they praised me. Then, quite a few of them asked “what did you do to fix it?”. Now, I really hate this question when it comes from someone who would not in any way appreciate my answer. It’s not really worth my time to take 10 minutes to explain to them how the whole process works. Nor do I think they really care. I’d rather they just be happy it’s fixed - perhaps throw in a “nice job Caleb” if they really feel keen on it, and be done with it. Move on.
This is starting to become more and more prevalent in what I do, it seems. People asking me how I did something, that to them looks like voodoo. And I’d be happy to explain it, if it would make sense to them, but 98% of the people I work with wouldn’t understand. It makes me think back to college and differential equations classes and some of the problems I had to solve (which I probably wouldn’t stand a chance of solving now). I couldn’t begin to explain to my mother how I solved those problems.
So, when answering that question I try to be as nice as possible, but also terse. “It was an email issue, and I killed the connection”. That seemed to work. One person asked me “how do you kill connections?”. Oh come on, do you really want to know? Anything I say at this point is wrong. I can go into a 20 minute speech about networking and the like. Or I can say “carefully”, sound smug with myself, and piss the person off.
When asked “how I fixed” this issue for the eleventeenth time, I finally just decided to say “magic”. This builds on the mystery of just how the whole internet and computer thing works for a lot of people. It also gets the point across to them, albeit a tad rudely, that it’s beyond what you’d understand. And I don’t mean it in an insincere way, but they left me no choice!
I think that since there are so many other aspects in life where the phrase “what’s wrong” and “how did you fix it” work for people (the doctor, the auto mechanic, etc) that they just continue the trend. But people can get their head around the body and the car because they know and understand them. Most people can understand “I changed the brake fluid”. Someone may not know HOW they changed the brake fluid, but they know what brake fluid is and that it should probably be changed at some point.
This isn’t the same with technology though. Try explaining to your grandmother how in order to fix the problem you “had to restart the cron job because the batch process didn’t update from the database server over night”. Wha?
Surely I’m not the only one who deals with this. What’s the solution here. Do we continue leaving people in the dark about things or do we try and get them better educated?
I think the next time someone truly asks me one of these questions, I’m going to drop what I’m doing and spend the next 20 minutes bringing them completely up to speed on everything they need to know to understand the answer to the question. It will either help them completely understand, or keep them from ever asking again.
January 28th, 2006 at 9:44 am
Sending any kind of response or bounce to email creates “backscatter” spam. You don’t seem to consider the case where the forged From: contains a valid email. I tend to receive a ton of this crap and let me tell you I don’t think very highly of mailservers which are misconfigured and send it out,
Please fix yours.
January 28th, 2006 at 10:17 am
I consider that case a lot, but there is no viable alternative - save for modifying qmail to reject the mail before it’s accepted from the SMTP program. If you give me a qmail patch, I’ll gladly apply it.
January 28th, 2006 at 11:11 am
Look into qpsmtpd — It’s a modular perl replacement for qmail-smptd so you can reject viruses/spam/whatever at the SMTP transaction. Works great for me.
January 28th, 2006 at 12:08 pm
Instead of just a simple answer of what you did, prefix it with, “It’s complicated, but basicly …..”. This usually nips the question of how you actually did it. If it doesn’t, offer to explain it to them at a later time (because you are busy). They will usually forget. If they don’t forget, and ask about it later, then they really want to know, so explain it to them.
January 28th, 2006 at 10:23 pm
I also love being the ‘victim’ address forged in the From of a piece of spam. Getting very random bounces from very random servers that I’ve never sent mail to. If smtp servers would resolve the From domain, and compare that to the most recent received header … and reject if they’re not equal. Unless I don’t get the entire process, that would fix it.
When anyone that wouldn’t understand the answer asks the question, explain it at the level you would expect it explained to you
That gets rid of the problem rather quickly, and maybe seem frustrated if they ask branching questions, about the reason or “…but how did you know…”, heh.
January 29th, 2006 at 3:26 am
Re qmail-queue-scanner, if you keep it updated (see the ebuild), you can configure for which virii it sends bounces, and you should usally tell it which virii forge source email addresses, so then it doesn’t send out to those forged addresses.