🚀 go-pugleaf

In article <832105803snz@siberia.demon.co.uk>
           philip@siberia.demon.co.uk "Philip McNab" writes:

> However, I'm a bit wary of allowing too powerful a cancel feature:
> I'd like to see some fairly tight restrictions built-in, such as only
> allowing cancelling of messages from your own site, though I
> appreciate this might be a wee bit complex for sites with the
> mail-forwarding option (myco.demon.co.uk=myco.co.uk).  However, I'd
> not like to see users too readilu enabled to issue cancels for other
> peoples postings.  Note that I don't suggest checking the
> X-NNTP-Posting-Host header: it should be possible to cancel forged
> postings.

My suggestion wouldn't lead to an *easy* way to create forged
cancellation messages.  Extract from RFC1036:

3.1.  Cancel

                     cancel <Message-ID>


    If a message with the given Message-ID is present on the local
    system, the message is cancelled.  This mechanism allows a user to
    cancel a message after the message has been distributed over the
    network.

    If the system is unable to cancel the message as requested, it
    should not forward the cancellation request to its neighbor systems.

    Only the author of the message or the local news administrator is
    allowed to send this message.  The verified sender of a message is
    the "Sender" line, or if no "Sender" line is present, the "From"
    line.  The verified sender of the cancel message must be the same as
    either the "Sender" or "From" field of the original message.  A
    verified sender in the cancel message is allowed to match an
    unverified "From" in the original message.

SNews would continue to generate its normal From and Path lines, and
wouldn't add a Sender line, so there'd be nothing there to make posting a
forged cancel any easier than doing it all by hand.

> Another good idea might be the ability to post an article to
> supersede an existing one.  This could generate the correct headers
> and bring up the original text without quote-marks or sig: it would
> be useful not just for announcements, but for those embarrassing
> occasions when a typo creeps into the first line (sorry, Brian
> <grin>).

Indeed that might be handy too :-)

It would be very handy for those valiant souls who post FAQs at regular
intervals.  I remember the hassle I had to use supersedes and expires
when I was posting my ISP PoPs list FAQ last year.

-- 
Brian {Hamilton Kelly}                                         bhk@dsl.co.uk
                       "A language is a dialect that has an army and a navy"    
                                                          --  Samuel Johnson