Password, trust and user notification

[placid]

Hi all,

I was going to write this script for a friend that notifies him via
logging onto his Gmail account and sending him an email to his work
email about some events occurring in the execution of the script.
If you enter your password into a script as input how can someone trust
the programmer that he will not send a email to himself containing his
password? Assuming this person does not know anything about programming
and this person knows nothing about programming ethics.

This is coming from the fact that i need to notify the user in someway
that does not require her to constantly watch the execution of the
script, for example when a user signs in to Windows Live Messenger pop
up.


Cheers


1. http://libgmail.sourceforge.net/ This is the library i use to
access a Gmail account via Python

 

[Gabriel Genellina]

placid ha escrito:

I was going to write this script for a friend that notifies him via
logging onto his Gmail account and sending him an email to his work
email about some events occurring in the execution of the script.
If you enter your password into a script as input how can someone trust
the programmer that he will not send a email to himself containing his
password? Assuming this person does not know anything about programming
and this person knows nothing about programming ethics.

You DON'T need the password for the receiving account just to send him
an email!
And you don't even need that special Gmail library, smtplib should be
fine.

 

[placid]

Gabriel Genellina wrote:

You DON'T need the password for the receiving account just to send him
an email!
And you don't even need that special Gmail library, smtplib should be
fine.

Yes you dont need a password to receive email, but to access Gmail and
send an email you do. Yes you do need the Gmail library to access Gmail
because the script will run on a computer that doesnt have a smtp
server.

Is there other way's of notifying the user?


Cheers

 

[Gabriel Genellina]

Yes you dont need a password to receive email, but to access Gmail and
send an email you do. Yes you do need the Gmail library to access Gmail
because the script will run on a computer that doesnt have a smtp
server.

Is there other way's of notifying the user?

Use the standard SMTP class to connect to the destination SMTP server.
To determine the right server, issue a DNS request for MX records on
the destination domain. (You may have to search for any suitable DNS
module since none is available in the standard Python distribution).

If you are really too lazy and you *know* the destination will
*always* be a gmail account and you don't bother if things go wrong
tomorrow, these are some current MX records for gmail.com:
- Name=gmail.com
Preference=5, Mail Exchange=gmail-smtp-in.l.google.com
Preference=10, Mail Exchange=alt1.gmail-smtp-in.l.google.com
Preference=10, Mail Exchange=alt2.gmail-smtp-in.l.google.com
Preference=50, Mail Exchange=gsmtp163.google.com
Preference=50, Mail Exchange=gsmtp183.google.com


--
Gabriel Genellina
Softlab SRL

__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis!
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar

 

[Gabriel Genellina]

While what you said is technically correct, I think you misread
their original question. They want to send email *from* the Gmail
account *to* the work account. I suggested that he use Gmail's SMTP
server to send the email.

They were concerned about putting sensitive information (password)
inside the script, in order to connect to Gmail to send the mail notifications.
I say that there is no need to use Gmail smtp services: to send mail
*to* (e-mail address removed), you only have to connect to the right SMTP
server for anywhere.com. The *from* email address is irrelevant and
can even be faked.
Of course a spam filter could block such mails, but you have to test it.


--
Gabriel Genellina
Softlab SRL

__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis!
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar

 

[placid]

This is correct.

They were concerned about putting sensitive information (password)
inside the script, in order to connect to Gmail to send the mail notifications.
I say that there is no need to use Gmail smtp services: to send mail
*to* (e-mail address removed), you only have to connect to the right SMTP
server for anywhere.com. The *from* email address is irrelevant and
can even be faked.
Of course a spam filter could block such mails, but you have to test it.

I was concerned that how does the person who will enter her password
trust the script or the developer in that the script will not create an
email containing her details i.e password and send it off to himself?
(See the assumptions i also posted above in my original post)

Is there any other way of notifying the user of events occurring in the
script which will run as a daemon process.


Cheers

 

[Dennis Lee Bieber]

Is there any other way of notifying the user of events occurring in the
script which will run as a daemon process.

Typically, relay using the local SMTPd (which usually is configured
to accept outgoing email from any internal address, and to accept
incoming mail to anyone with a local [internal] email address).
--
Wulfraed Dennis Lee Bieber KD6MOG
(e-mail address removed) (e-mail address removed)
HTTP://wlfraed.home.netcom.com/
(Bestiaria Support Staff: (e-mail address removed))
HTTP://www.bestiaria.com/

 

[Dennis Lee Bieber]

While what you said is technically correct, I think you misread their
original question. They want to send email *from* the Gmail account *to* the
work account. I suggested that he use Gmail's SMTP server to send the email.

The most confusing thing is that is sounds very much like they want
to use the /recipient's/ Gmail account to send email to the
/recipient's/ work email account -- rather than connecting directly to
the recipient's work account mail server. (Of course, it may be that
their own ISP blocks pass-through SMTP -- that's a different matter)
--
Wulfraed Dennis Lee Bieber KD6MOG
(e-mail address removed) (e-mail address removed)
HTTP://wlfraed.home.netcom.com/
(Bestiaria Support Staff: (e-mail address removed))
HTTP://www.bestiaria.com/

 

[placid]

The most confusing thing is that is sounds very much like they want
to use the /recipient's/ Gmail account to send email to the
/recipient's/ work email account -- rather than connecting directly to
the recipient's work account mail server. (Of course, it may be that
their own ISP blocks pass-through SMTP -- that's a different matter) --

Ok, everyone now forget that i even asked about connecting to Gmail and
sending an email back to the work email, for some reason you guys are
not answering my question.

Is there any other way (other than email's !) to notify a user of
events within a script?

Thanks for all the help.
Cheers

 

[Gabriel Genellina]

Is there any other way (other than email's !) to notify a user of
events within a script?

- Any IM like Jabber, MSN Messenger, ICQ...
- Cell phone SMS
- A telephone call delivering a prerecorded message or using
text-to-speech technology
- Reversed: keep a remotely accesable log of events and let the user
look at it whenever he wants.
- Variant: an RSS feed
- Telegram
- Smoke or dum signals


--
Gabriel Genellina
Softlab SRL

__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis!
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar