[plug] Microsoft introduces the AutoSubscribe.B feature to Outlook users

[Craig Ringer]

>>UserB is now on list (which in one case throws between 50 and 200 emails 
>>a day).
> 
> Coincidently (I'm not sure if is related to that particular virus), I
> have been amused to witness list servers 'chatting' to each other
> across lists (thereby 'spamming' all list subscribers). Basically,
> list C asking list B to subscribe to list C, etc.

Another amusing/infuriating scenario is:

User: mails subscribe-list-name at listserver.net
User: sets evil out-of-office autoreply and leaves for the weekend
Mailserver: sends confirmation
User: autoreplies, quoting confirmation
Mailserver: begins sending list traffic
User: begins autoreplying to list traffic
MAIL LOOP

I've seen this where the user in question is on a university pipe, and 
the mailserver is a colo. Ugly, especially for those on mere ADSL. 
Neither mailserver had any facility to detect mail loops, nor did the 
listserver system.

This is why, if you let your users have an autoreply feature at all, it 
MUST not reply with the original subject or any part of it, nor 
include/quote any of the original body text. My solution at work: no 
autoreplies. If the user doesn't reply, they're probably not there or 
too busy - just like snail mail. I hate autoreplies.

That worm is awfully funny, though. It'd only work on lists where the 
list was in the Reply-To: or From: headers - like PLUG, but not LIAS, 
for example. When will people stop using Lookout?

Craig