🚀 go-pugleaf

>The last comment on the use of PGP raises in my mind a question about
>authenticating posts to CIPS-L.  Is it somehow possible to

Hey Tom, weren't you the one saying PGP should be outlawed for
The Greater Good of our children, and our children's children?

:)

(sorry, couldn't resist)

>"authenticate" posters to that list  (Kind of like a "secret
>handshake" -- only those who know get in)?

Several mailing lists and mail server (anon.penet.fi, InfoWar,
etc.) require pass phrases before being accepted.  I have not
installed majordomo or listserv or the equivallent, so I do
not know how difficult this would be.  At any rate, I do
not think that this will fit with the newsgroup.

The way Usenet handles this problem is to use moderators that
are supposed to approve of new postings to a group (rec.humor.funny,
comp.risks, as a couple of examples).  Instead of directly
posting, submittors send mail to the moderator, and he/she
decides whether to approve the post.  *This* could be done
(though I will *not* advocate it)--posters would have to
be authendicated using PGP or a pass phrase before being
approved.

I don't think this will work because:

*       It discourages participants, which as a small mailing list
        is not something that I think we wish.

*       Usenet security is easy to bypass by forging the "Approved-By"
        headers (rec.humor got spammed by the infamous "Green Card"
        attack a few months ago)

*       Mail security is easy to bypass by getting a legitimate
        account (with a forged email address) on the list before spamming.

*       It requires much more active involvement by a moderator.  I
        don't think that our discussion are formal enough to
        warrant this.



There have been a couple of proposals to prevent spams such as this,
but I've not seen one that is entirely satisfactory.  There
are programs such as CancelMoose that hits Usenet and trys to block
spams by canceling them, however this doesn't do much for mailing
lists, where spams are more annoying.  One gentleman proposed
some checks that majordomo should perform before forwarding, but
they involved a few minor checks (which consumed a major amount
of bandwidth and CPU time) that basically ensured that mail came from
legitimate addresses.  However, most "good" spams have forged headers
so they appear to come from legitimate addresses, so this won't
work, even if it was practical.

It looks like the only way to protect ourselves is to join moderated lists,
flame spammers, and support cancel bots.

Adrian.
--
Adrian Powell    Adrian.Powell@NorwestLabs.com
home:            http://ugweb.cs.ualberta.ca/~adrian
phone:           (403) 438-5522
fax:             (403) 434-8586