🚀 go-pugleaf

In article <19950401.141115.83@musicbox.demon.co.uk>, richard@musicbox.demon.co.uk (Richard Birkett) writes:
> Tom Hughes <tom@compton.demon.co.uk> said:
> 
> > They are allowed to rewrite header for NNTP POST, but not for IHAVE. In
> > particular, the adding of X-Nntp-Posting-Host is a *very* good idea, as
> > it enables better tracking of messages if people try forging, spamming
> > or other net abuse.
> 
> I fully support an *extra* header line added as a security measure, and
> perhaps X-Nntp-Posting-Host or something similar should be added even to
> IHAVE articles for this reason (the RFCs weren't written with much
> security in mind, so could safely be "interpreted" here, as they seem
> to have been elsewhere anyway!).  However, I do object to existing lines
> being changed, or indeed anything else that may affect the functionality
> or meaning of the message (eg. adding a Sender: line may mess up mailing
> list bounces; also, insisting on a spurious Organization: line is
> *contrary* to RFC1036 which states that this header is optional).
>
A number of American service provides add Sender: lines as another way
of allowing net-abuse to be traced. The From: field is easily forged, but
with Sender: added by the server it gives a way of telling exactly which
user posted the message. Unfortunately demon doesn't seem to use it like
this.
> 
> ObAcorn: !TTFN putting in a "Distribution: world" line is just as bad. 
> At least the user has a chance to delete or change that before sending.
> 
Using the Distribution: line to limit propogation of your message is
somewhat flawed as most distributions leak out to world eventually
anyway.

Simon