On Sun, 01 Feb 2004 22:31:34 CST, "Good, Donald" <[log in to unmask]>  said:
> You say "Yes, the list was send=owner" like that gives you some kind of
> protection.  If the list is not send=whatever,confirm then you only get a
> false sense of security.

Yes, I know that.  And most of our biggest lists *do* have ,confirm.  Notice
that I put a smiley on there, precisely because I realized that Murphy had
stopped by to have lunch.  The *last* big worm outbreak, we didn't have
this problem, because the address scrapers never managed to actually put
the list name in the To: and the legitimate owner in the From: (although
we had a few bewildered list owners when the worm managed to do the
reverse.. ;)

How do I know it was Murphy? Because lists with 20 or 30 or 200 subscribers
only got 1 or 2 at most, and our second biggest list attracted the attention of
56 or so of the critters... (And yes, I'm also aware of the fact it's actually
likely, simply because the large list is more likely to have its address on the
disk of an infected machine... we've done *that* modelling already ;)

Or as Homer Simpson so eloquently put it:  "D'Oh!"  :)