🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In fl.config Howard Goldstein <hgoldste@mpcs.com> wrote:
> On Sat, 14 Apr 2001 16:05:42 GMT, Kenneth Pangborn <kenpangborn@earthlink.net> wrote:
> : 
> : "Howard Goldstein" <hgoldste@mpcs.com> wrote in message
> : news:987257846.8669@news.queue.to...
> : > On Sat, 14 Apr 2001 07:51:01 GMT, admin@mixmaster.shinn.net.no.spam.to
> : <admin@mixmaster.shinn.net.no.spam.to> wrote:
> : >  : Again, look at the headers.  These a posts from the Frog remailer
> : >  : gatewayed by our mail2news gateway.
> : >
> : > I understand.  Getting a handle on the common point of abuse dispersal
> : > works in similar situations however (as for ex. with open wingates,
> : > fucked up DNEWS installs, open mail relays, and the like) You're in an
> : > unenviable position here.  It's likely you don't condone the forgeries
> : > but I don't see how you can avoid responsibility for them by virtue of
> : > their haivng been gatewayed.  It's not clear how they'd get into fl.*
> : > but for the gateway.
> : >
> : >  : One simple e-mail to us would
> : >  : suffice to have thge forged from: lines blocked, but thats not
> : >  : going to solve the problem of that from: line being forged the Frog
> : >  : remailer (and any other host we do not have control over).
> : 
> : 
> : Howard it is simple, Shinn won't do anything to spare the infected
> : newsgroups from the abuse.
> 
> I don't recall him saying he wouldn't consider some mechanism to deal
> with forged From: addresses *before* they were used.  Authentication
> of some kind should be manadatory.  

Not practical.  We run a gateway for other systems which recieve their
content from either other systems or the user directly.  Autheticating
server to server traffic is not practical in our case because it wouldn't
prove anything.

Additionally, I'm not aware of many NNTP servers, for example, that
auithenticate from: lines for their users (including many large ISPs).
If you want to really authenticate someone on usenet, then you need to
use cryptographic signatures. 

Regardless, we can and will block forged e-mail addresses once they have
been reported to us.  

> Given how few significant sites
> honor cancels these days, the damage is done once it leaves the gateway
> and most after the fact remedies are IMO inadequate.

With all due respect, cryptographic signatures would solve all your
problems.  Relying on from: lines alone is always going to be a problem
on usenet no matter what you do.  The trust boundary in that model 
never extends to the users client, so the user can never prove to
themselves that the from: line is trustworthy.

- -- 
Shinn.net Anonymous Remailer Admin      
PGP Key 1 ID: 0x736D4146             PGP Key 2 ID: 0x59FD8B75
Key 1 print = 043E 1ADA 5B71 EECC3753 6274 3ADF 478D 736D4146
Key 2 print = 6055 D1EC FA25 C8D555B2 7F76 817A FC55 59FD8B75

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQA/AwUBOti6IDrfR41zbUFGEQLcYgCgv26rHES6sjyq6s6/2oleeFzazjUAoPQf
2yaozqKAfBc7ndGMnheWfhT7
=XUZb
-----END PGP SIGNATURE-----