{"thread":{"id":"32793","subject":"[feature request] git-daemon http connection filtering of client types","startedAt":"2013-01-31T12:46:55Z","lastAt":"2013-01-31T18:11:18Z","messageCount":3,"participants":["porpen+git@gmail.com","Erik Faye-Lund"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"208352","messageId":"CAANzHtT83JXhQ8XRifdK5ah7NrnD6hvrCjBO4PnPx=qC=DTT9A@mail.gmail.com","threadId":"32793","inReplyTo":null,"subject":"[feature request] git-daemon http connection filtering of client types","fromName":"","fromEmail":"porpen+git@gmail.com","sentAt":"2013-01-31T12:46:55Z","receivedAt":"2013-01-31T12:46:55Z","isPatch":false,"sender":{"key":"porpen+git@gmail.com","avatar":null},"body":"Hey folks,\n\nWhen I checked for false positives in my spam this morning, I spotted\nan interesting malformed img link at the top of a spam message.\n\n{snip}\n> \n>\n> Employ a medal tiffany bracelet <{snip}> a is\n{snip}\n\nSo, apparently git-daemon's http features are being used by spammers.\nIn most cases, spam filters will correctly identify this junk.\n\nI wonder if there is a better way... In my mental sandbox, git-daemon\nhttp could have a set of deny/allow rules for incoming connection\nclient types.\ne.g.:\n\ngit: allow\ngit-http: allow\nthunderbird: deny\noutlook express: replace linked file with rickroll.jpg\n\nand so on.. An out-of-the-box install probably should default to\nallow all to keep backward compatibility.\n\nWhile I'd love a chance to hack something out, I sadly doubt I'll ever\nhave the time for it. Perhaps there is a student hacker looking for a\nproject.\n\nCheers!\n-phil\n\np.s. appologies to anyone who now has Astley's song stuck in their\nhead. This was not intentional.\n"},{"id":"208354","messageId":"CABPQNSYq-OO0CrEPjEcH5v+OSTqxYfRbdtaoSER3v+dCHzgyUA@mail.gmail.com","threadId":"32793","inReplyTo":"CAANzHtT83JXhQ8XRifdK5ah7NrnD6hvrCjBO4PnPx=qC=DTT9A@mail.gmail.com","subject":"Re: [feature request] git-daemon http connection filtering of client types","fromName":"Erik Faye-Lund","fromEmail":"kusmabite@gmail.com","sentAt":"2013-01-31T13:22:15Z","receivedAt":"2013-01-31T13:22:15Z","isPatch":false,"sender":{"key":"kusmabite@gmail.com","avatar":"https://avatars.githubusercontent.com/u/47073?v=4"},"body":"On Thu, Jan 31, 2013 at 1:46 PM, wrote:\n> Hey folks,\n>\n> When I checked for false positives in my spam this morning, I spotted\n> an interesting malformed img link at the top of a spam message.\n>\n> {snip}\n>> \n>>\n>> Employ a medal tiffany bracelet <{snip}> a is\n> {snip}\n>\n> So, apparently git-daemon's http features are being used by spammers.\n\nNot at all. You appear to be referring to the message from\nhttp://git.661346.n2.nabble.com/tiffany-bracelet-On-your-Significant-other-td7575440.html\n\nThis isn't a running instance of git-daemon, it's a web front-end for\nthe mailing list. It seems nabble allows image-attachments, and that's\nwhat you're seeing; an attached image to a spam-email that was sent to\nthe git-mailing list through nabble.\n\nThe message contains HTML to display the image, and the git mailing\nlist rejects HTML messages. So the only ones who should be able to get\nthese spam-emails are users who subscribe through nabble. If you\nsubscribe through vger instead\n(http://vger.kernel.org/vger-lists.html#git), you should get less\nspam.\n\n> In most cases, spam filters will correctly identify this junk.\n>\n> I wonder if there is a better way... In my mental sandbox, git-daemon\n> http could have a set of deny/allow rules for incoming connection\n> client types.\n> e.g.:\n>\n> git: allow\n> git-http: allow\n> thunderbird: deny\n> outlook express: replace linked file with rickroll.jpg\n>\n> and so on.. An out-of-the-box install probably should default to\n> allow all to keep backward compatibility.\n>\n\nGit-daemon doesn't have an http-feature. You are probably thinking\nabout git-http-backend, but that's an CGI; the http-daemon invoking it\nshould already be able to filter connections. So, I don't think\nthere's anything that needs to be done to be able to block spammers\nfrom git-servers. Blocking spammers from nabble is a different manner,\nand is something you'll have to take up with the nabble staff.\n"},{"id":"208376","messageId":"CAANzHtRVn0FndXaw4TECPbBR6bF5LY63KNLR_H4YsjtUzBdY=Q@mail.gmail.com","threadId":"32793","inReplyTo":"CABPQNSYq-OO0CrEPjEcH5v+OSTqxYfRbdtaoSER3v+dCHzgyUA@mail.gmail.com","subject":"Re: [feature request] git-daemon http connection filtering of client types","fromName":"","fromEmail":"porpen+git@gmail.com","sentAt":"2013-01-31T18:11:18Z","receivedAt":"2013-01-31T18:11:18Z","isPatch":false,"sender":{"key":"porpen+git@gmail.com","avatar":null},"body":"Hey folks,\n\nOn 31 January 2013 08:22, Erik Faye-Lund wrote:\n>\n> This isn't a running instance of git-daemon, it's a web front-end for\n> the mailing list. It seems nabble allows image-attachments, and that's\n> what you're seeing; an attached image to a spam-email that was sent to\n> the git-mailing list through nabble.\n\noops.. yes, I see it now. I should have spotted that earlier. Sorry\nabout the list noise.\n\n> The message contains HTML to display the image, and the git mailing\n> list rejects HTML messages. So the only ones who should be able to get\n> these spam-emails are users who subscribe through nabble. If you\n> subscribe through vger instead\n> (http://vger.kernel.org/vger-lists.html#git), you should get less\n> spam.\n\nI have never subscribed to anything via nabble. ^Zcat blessings | wc -l\n\n> Git-daemon doesn't have an http-feature. You are probably thinking\n> about git-http-backend, but that's an CGI; the http-daemon invoking it\n> should already be able to filter connections. So, I don't think\n> there's anything that needs to be done to be able to block spammers\n> from git-servers. Blocking spammers from nabble is a different manner,\n> and is something you'll have to take up with the nabble staff.\n\nAgreed.. and I won't waste my time with nabble. I'll just set\nprocmeil to file new threads from nabble into a \"penalty box\" for now\nand start a whitelist. Perhaps I'll come up with something more\nelegant/automated later.\n\nSo, I guess my \"feature request\" is \"resolved\".\n\nCheers!\n-phil\n"}]}