Security of server-side code?

[Shmuel (Seymour J.) Metz]

Back in the innocent days of the last century, I would have used a
mailto link in my web page to allow people to cancel me. In the era of
mass harvesting of addresses by spammers and other criminals, that is
no longer prudent. I'd like to write a small CGI that will mail a
message without exposing my address to web spiders. The question is
whether the code for the CGI can still be retrieved via HTTP. Any
information would be appreciated.

BTW, am I reinventing the wheel?

--
Shmuel (Seymour J.) Metz, SysProg and JOAT <http://patriot.net/~shmuel>

Unsolicited bulk E-mail subject to legal action. I reserve the
right to publicly post or ridicule any abusive E-mail. Reply to
domain Patriot dot net user shmuel+news to contact me. Do not
reply to sp******@librar y.lspace.org

[kaeli]

In article <41************ *************** @news.patriot.n et>,
sp******@librar y.lspace.org.in valid enlightened us with...

Back in the innocent days of the last century, I would have used a
mailto link in my web page to allow people to cancel me. In the era of
mass harvesting of addresses by spammers and other criminals, that is
no longer prudent. I'd like to write a small CGI that will mail a
message without exposing my address to web spiders. The question is
whether the code for the CGI can still be retrieved via HTTP. Any
information would be appreciated.

BTW, am I reinventing the wheel?

Mailto is bad for a variety of reasons, the least of which is spam
harvesting.
Spiders will not find the mailer addy because it's in server-side code. The
server passes out html to the requester, be it a browser or a spider. The
address isn't IN the html. It's in the params to the mailer.

Yes, you ARE reinventing the wheel. ;)
If you have CGI, use Formmail.pl or similar. If you're using ASP, use CDONTS.
If JSP, JavaMail.

--
--
~kaeli~
Every calendar's days are numbered.
http://www.ipwebdesign.net/wildAtHeart
http://www.ipwebdesign.net/kaelisSpace

[Shmuel (Seymour J.) Metz]

In <MP************ ************@nn tp.lucent.com>, on 08/20/2004
at 02:23 PM, kaeli <ti******@NOSPA M.comcast.net> said:

Spiders will not find the mailer addy because it's in server-side
code.
Are you saying that there's no way for them to access anthing in
public_html/cgi-bin via HTTP, or just that their spamware doesn't
normally do so?
If you have CGI, use Formmail.pl

doesn't it have security issues?

--
Shmuel (Seymour J.) Metz, SysProg and JOAT <http://patriot.net/~shmuel>

Unsolicited bulk E-mail subject to legal action. I reserve the
right to publicly post or ridicule any abusive E-mail. Reply to
domain Patriot dot net user shmuel+news to contact me. Do not
reply to sp******@librar y.lspace.org

[Neal]

On Sun, 22 Aug 2004 00:07:26 -0300, Shmuel (Seymour J.) Metz
<sp******@libra ry.lspace.org.i nvalid> wrote:

If you have CGI, use Formmail.pl

doesn't it have security issues?

Use the NMS version. It's as secure as you can get AFAIU.

[Stephen Poley]

On Sun, 22 Aug 2004 00:07:26 -0300, "Shmuel (Seymour J.) Metz"
<sp******@libra ry.lspace.org.i nvalid> wrote:

In <MP************ ************@nn tp.lucent.com>, on 08/20/2004
at 02:23 PM, kaeli <ti******@NOSPA M.comcast.net> said:

Spiders will not find the mailer addy because it's in server-side
code.

Are you saying that there's no way for them to access anthing in
public_html/cgi-bin via HTTP, or just that their spamware doesn't
normally do so?

If the server is correctly configured it is not possible for anyone
external to access cgi-bin. If it is incorrectly configured,
address-harvesters still wouldn't find the address unless someone has
linked to the file concerned.

If you have CGI, use Formmail.pl

doesn't it have security issues?

The original Matt Wright version does; there are other versions around
with a better reputation.

Actually spam harvesters are not very sophisticated. There was an
investigation done a while ago (a year?) which concluded that you could
adequately hide your address just by replacing a character or two in the
address (especially the '@') by its numeric equivalent.

--
Stephen Poley

http://www.xs4all.nl/~sbpoley/webmatters/

[Spartanicus]

Stephen Poley <sb************ ******@xs4all.n l> wrote:

Actually spam harvesters are not very sophisticated. There was an
investigatio n done a while ago (a year?) which concluded that you could
adequately hide your address just by replacing a character or two in the
address (especially the '@') by its numeric equivalent.

http://www.cdt.org/speech/spam/030319spamreport.shtml

--
Spartanicus

[Brian]

I seem to be missing a message from this thread, so apologies if I've
missed something important.

Stephen Poley wrote:

"Shmuel (Seymour J.) Metz" wrote:

kaeli said:

Spiders will not find the mailer addy because it's in server-side
code.
Are you saying that there's no way for them to access anthing in
public_html/cgi-bin via HTTP,

If the server is correctly configured it is not possible for anyone
external to access cgi-bin.

This doesn't make any sense. If the public cannot access /cgi-bin/,
what purpose can it serve?
If it is incorrectly configured, address-harvesters still wouldn't
find the address unless someone has linked to the file concerned.

There will always be at least one reference to a formmail script from
the html page that contains the form. You could use rewrite to hide even
that reference, but ultimately, there must be a cgi script, it must be
accessible via http, and you must grant read and execute privelages to
all. You can, however, hide the cgi script's configuration files outside
of the document root, and only place email addresses, and sensitive
server info, in those configuration files.

BTW, I don't know of any spider that tried to look at cgi scripts for
addresses. But, if configured correctly, this should not be an issue.

If you have CGI, use Formmail.pl

doesn't it have security issues?

The original Matt Wright version does; there are other versions
around with a better reputation.

Namely, NMS Formmail. You can also consider NMS TFmail. Lots more options.

http://nms-cgi.sourceforge.net/

--
Brian (remove ".invalid" to email me)
http://www.tsmchughs.com/

[Tim]

Stephen Poley wrote:

If the server is correctly configured it is not possible for anyone
external to access cgi-bin.

Brian <us*****@juliet remblay.com.inv alid> posted:
This doesn't make any sense. If the public cannot access /cgi-bin/,
what purpose can it serve?

I think he meant that the public can't access the files themselves in
there, merely interact with them. i.e. They can't read the program code,
just send it data and see the results.

--
If you insist on e-mailing me, use the reply-to address (it's real but
temporary). But please reply to the group, like you're supposed to.

This message was sent without a virus, please delete some files yourself.

[kaeli]

In article <1g************ *************** ***@40tude.net> ,
ti*@mail.localh ost.invalid enlightened us with...

Stephen Poley wrote:

If the server is correctly configured it is not possible for anyone
external to access cgi-bin.

Brian <us*****@juliet remblay.com.inv alid> posted:

This doesn't make any sense. If the public cannot access /cgi-bin/,
what purpose can it serve?

I think he meant that the public can't access the files themselves in
there, merely interact with them. i.e. They can't read the program code,
just send it data and see the results.

Exactly.

Just like people can see the RESULTS of my JSP pages, but they can't read the
actual Java code that produced them. They can type in the URL and they'll see
a page, but that page has nothing on it for the client except HTML. Yet the
JSP page on the server has all kinds of beans and tags. Neat, eh? ;)
--
--
~kaeli~
The definition of a will?... (It's a dead giveaway.)
http://www.ipwebdesign.net/wildAtHeart
http://www.ipwebdesign.net/kaelisSpace

[Brian]

Tim wrote:

Stephen Poley wrote:

If the server is correctly configured it is not possible for
anyone external to access cgi-bin.

Brian posted:

If the public cannot access /cgi-bin/, what purpose can it serve?

I think he meant that the public can't access the files themselves in
there, merely interact with them. i.e. They can't read the program
code, just send it data and see the results.

Oh, right. Apologies to M. Poley, I lost my head. Still, I prefer to put
the script in a publicly accessible place with little or no sensitive
information. I keep that outside of the document root.
-- home -- www files -- foo (scripts, no passwords etc.)
| |--bar (scripts, no sensitve info)
|
|
--config files for scripts, *outside* of document root

--
Brian (remove ".invalid" to email me)
http://www.tsmchughs.com/