From: Bill Cole (postfixlists-070913billmail.scconsult.com)
Date: Tue Oct 30 2007 - 21:37:41 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

At 7:56 PM -0500 10/30/07, Steven F Siirila imposed structure on a
stream of electrons, yielding:
>On Tue, Oct 30, 2007 at 08:51:13PM -0400, Victor Duchovni wrote:
>> On Tue, Oct 30, 2007 at 06:08:57PM -0600, Sean Kennedy wrote:
>>
>> > I need to setup a catch-all address so that any email sent to an
>>address at
[...]
>>
>> DON'T implement catch-alls, they are a terrible idea.
>
>They're great for one-user systems (e.g. hobbyist servers) where you
>want an unlimited number of predefined aliases. :)

They are only great until the first dictionary attack. At that point,
the catch-all is extremely painful. Even microdomains get hit by
dictionary attacks, it is just a matter of time if a domain gets used
in any real mail.

>For example, when Joe's Pizza insists on an e-mail address before allowing
>me to order online, you could give him 'joespizzamydomain.com' without
>having to create the alias, and without worrying about getting it created
>before they attempt to send e-mail to it!

You can get a near-equivalent with microdomains by limiting the
catch-all to patterns that aren't likely to be hit much by dictionary
attackers.
--
Bill Cole
billscconsult.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]