Q: Why is "X-Originating-IP" being abused by ISPs?

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 08.05.2006 05:00:44 von Alan Connor

On comp.mail.misc, in , "D. Stussy" wrote:
> Path: newsspool2.news.pas.earthlink.net!stamper.news.pas.earthlink .net!elnk-nf2-pas!newsfeed.earthlink.net!newshub.sdsu.edu!bo rder1.nntp.dca.giganews.com!nntp.giganews.com!wn12feed!world net.att.net!bgtnsc04-news.ops.worldnet.att.net.POSTED!f8c70c c1!not-for-mail
> Newsgroups: comp.mail.misc
> From: "D. Stussy"
> Reply-To: "D. Stussy"
> Subject: Q: Why is "X-Originating-IP" being abused by ISPs?
> Message-ID:
> X-Spam-This: spam@bde-arc.ampr.org
> X-No-Archive: Yes
> MIME-Version: 1.0
> Content-Type: TEXT/PLAIN; charset=US-ASCII
> Lines: 8
> NNTP-Posting-Host: 421df371480e742823d55a9229c09d5b
> X-Complaints-To: abuse@worldnet.att.net
> X-Trace: bgtnsc04-news.ops.worldnet.att.net 1147050840 421df371480e742823d55a9229c09d5b (Mon, 08 May 2006 01:14:00 GMT)
> NNTP-Posting-Date: Mon, 08 May 2006 01:14:00 GMT
> Organization: AT&T Worldnet
> Date: Mon, 08 May 2006 01:14:00 GMT
> Xref: news.earthlink.net comp.mail.misc:77337
> X-Received-Date: Sun, 07 May 2006 18:14:00 PDT (newsspool2.news.pas.earthlink.net)

http://slrn.sourceforge.net/docs/README.offline>

Why do people like you abuse the "X-No-Archive: yes"
header?

You have no legitmate reason for using it. You are just
hiding your tracks and from your posting history.

That tells any sensible person that you are not to be trusted
and that there is no point in reading your articles at all.

I'd guess that the ISP's abuse that header because their
clientele is composed mostly of corrupt and hypocritical and
dishonest and cowardly people like you.

http://groups.google.com/advanced_group_search
D. Stussy
Results 1 - 60 of 60 posts in the last year
2 alt.apache.configuration
4 comp.mail.sendmail
1 comp.os.vms
52 misc.taxes.moderated
1 rec.video.satellite.tvro

Now there's the posting history of a troll's sockpuppet.

This vermin posts at least 60 times a _day_ under various
aliases.

It _looks_ as if this person hasn't posted here in a long
time, but he certainly has.

[Note: I don't read the articles of "Sam" or his numerous
sockpuppets or his 'friends', nor any responses to them, and
haven't for years. He follows me all over the Usenet, and I
still don't read his articles. This _really_ pisses him off.
.]

Oh. And stay out of my mailboxes as well as my newsreader.

Done.

Alan

--
http://home.earthlink.net/~alanconnor/contact.html
Other URLs of possible interest in my headers.

Bigfoot Update (was Re: Q: Why is "X-Originating-IP"being abused by ISPs?)

am 08.05.2006 05:16:33 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--=_mimegpg-commodore.email-scan.com-32074-1147058193-0002
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Usenet Beavis writes:

>

>
> Why do people like you abuse the "X-No-Archive: yes"
> header?

Why do people like you remember to breathe, every other second, or so?

> You have no legitmate reason for using it. You are just
> hiding your tracks and from your posting history.

Beavis: you have no legitimate reason to metabolize proteins, yet you
persist in doing so. Why?

> http://groups.google.com/advanced_group_search
> D. Stussy
> Results 1 - 60 of 60 posts in the last year

Searched all groups Results 1 - 10 of 23,900 for usenet beavis (0.20 seconds)

You win, Beavis.

> Now there's the posting history of a troll's sockpuppet.
>
> This vermin posts at least 60 times a _day_ under various
> aliases.

Beavis FAQ entry #6, below.

> It _looks_ as if this person hasn't posted here in a long
> time, but he certainly has.

He's also hiding under your bed.

> [Note: it's not my fault that I'm a complete dumbass. I was dropped on my
> head as a child. See http://www.pearlgates.net/nanae/kooks/ac/ for
> more information]
>
> Oh. And stay out of my mailboxes as well as my newsreader.

Beavis FAQ #12

> Done.

All your newsposts are belong to us, Beavis.

============================================================ =============

FAQ: Canonical list of questions Beavis refuses to answer (V1.50)

This is a canonical list of questions that Beavis never answers. This FAQ is
posted on a semi-regular schedule, as circumstances warrant.

For more information on Beavis, see:

http://www.pearlgates.net/nanae/kooks/ac/

Although Beavis has been posting for a long time, he always remains silent
on the subjects enumerated below. His response, if any, usually consists of
replying to the parent post with a loud proclamation that his Usenet-reading
software runs a magical filter that automatically identifies anyone who's
making fun of him, and hides those offensive posts. For more information
see question #9 below.

============================================================ ================

1) If your Challenge-Response spam filter works so well, why are you munging
your address, when posting to Usenet?

2) If spammers avoid forging real E-mail addresses on spam, then where do
all these bounces everyone reports getting (for spam with their return
address was forged onto) come from?

3) If your Challenge-Response filter is so great, why do you still munge
when posting to Usenet?

4) Do you still believe that rsh is the best solution for remote access?
(http://tinyurl.com/5qqb6)

5) What is your evidence that everyone who disagrees with you, and thinks
that you're a moron, is a spammer?

6) How many different individuals do you believe really post to
comp.mail.misc? What is the evidence for your paranoid belief that everyone,
except you, who posts here is some unknown arch-nemesis of yours?

7) How many times, or how often, do you believe is necessary to announce
that you do not read someone's posts? What is your reason for making these
regularly-scheduled proclamations? Who do you believe is so interested in
keeping track of your Usenet-reading habits?

8) When was the last time you saw Bigfoot (http://tinyurl.com/23r3f)?

9) If your C-R system employs a spam filter so that it won't challenge spam,
then why does any of the mail that passes the filter, and is thusly presumed
not to be spam, need to be challenged?

10) You claim that the software you use to read Usenet magically identifies
any post that makes fun of you. In http://tinyurl.com/3swes you explain
that "What I get in my newsreader is a mock post with fake headers and no
body, except for the first parts of the Subject and From headers."

Since your headers indicate that you use slrn and, as far as anyone knows,
the stock slrn doesn't work that way, is this interesting patch to slrn
available for download anywhere?

11) You regularly post alleged logs of your procmail recipe autodeleting a
bunch of irrelevant mail that you've received. Why, and who exactly do you
believe is interested in your mail logs?

12) How exactly do you "enforce" an "order" to stay out of your mailbox,
supposedly (http://tinyurl.com/cs8jt)? Since you issue this "order" about
every week, or so, apparently nobody wants to follow it. What are you going
to do about it?

13) What's with your fascination with shit? (also http://tinyurl.com/cs8jt,
and http://tinyurl.com/qv296)?

14) You complain about some arch-nemesis of yours always posting forged
messages in your name. Can you come up with even a single URL, as an example
of what you're talking about?

15) You always complain about some mythical spammers that pretend to be
spamfighters (http://tinyurl.com/br4td). Who exactly are those people, and
can you post a copy of a spam that you supposedly received from them, that
proves that they're really spammers, and not spamfighters?

--=_mimegpg-commodore.email-scan.com-32074-1147058193-0002
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQBEXrgRx9p3GYHlUOIRAqOxAJ93ZcdNfztAId5sCaeqhe7NK82O6QCf ZUbe
FTMPbw7wDg421Kxu9iL2+Tw=
=hEHW
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-32074-1147058193-0002--

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 08.05.2006 20:48:50 von Tim

Alan Connor wrote:

>
> Why do people like you abuse the "X-No-Archive: yes"
> header?

Please stop trolling Mr Connor. It is not within your remit to
dictate who is or isn't allowed to use the ''X-No-Archive: yes''
header.

>
> You have no legitmate reason for using it. You are just
> hiding your tracks and from your posting history.

You do not have a bona fide reason for making such an
accusation. Please desist from further such abusive and
infantile behaviour.

>
> That tells any sensible person that you are not to be trusted
> and that there is no point in reading your articles at all.

You have summed yourself up well.

>

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 08.05.2006 21:35:35 von Alan Connor

On comp.mail.misc, in <4c9i4vF14dq4pU1@individual.net>, "Tim" wrote:

http://slrn.sourceforge.net/docs/README.offline>

This is the same dickless troll, hiding behind a common name
so that his real posting history (which he is rightfully
ashamed of) is lost among those of all the others that have
used the same name.

[Note: I don't read the articles of "Sam" or his numerous
sockpuppets or his 'friends', nor any responses to them, and
haven't for years. He follows me all over the Usenet, and I
still don't read his articles. This _really_ pisses him off.
.]

Alan

--
http://home.earthlink.net/~alanconnor/contact.html
Other URLs of possible interest in my headers.

Re: Q: Why is "X-Originating-IP"being abused by ISPs?

am 08.05.2006 23:42:20 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--=_mimegpg-commodore.email-scan.com-12932-1147124540-0002
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Usenet Beavis writes:

> On comp.mail.misc, in <4c9i4vF14dq4pU1@individual.net>, "Tim" wrote:
>
>

>
> This is the same dickless troll, hiding behind a common name
> so that his real posting history (which he is rightfully
> ashamed of) is lost among those of all the others that have
> used the same name.

Of course, Beavis, you always post with your real name and address.

For alt.free.newsserver's benefit, read the Beavis FAQ here:

http://www.pearlgates.net/nanae/kooks/ac/

> [Note: it's not my fault that I'm a complete dumbass. I was dropped on my
> head as a child. See http://www.pearlgates.net/nanae/kooks/ac/ for
> more information]
>
> Beavis

http://www.nst.com.my/Current_News/nst/Sunday/National/20060 507075145/Article/index_html

# Book has Bigfoot pictures
# 07 May 2006
# By R. Sittamparam
#
# JOHOR BARU: A book on the Johor Bigfoot, said to include exclusive
# photographs of the elusive creature, has caused a stir among
# cryptozoologists around the world.

See the exclusive pictures here: http://www.geocities.com/suhatrasabib/

# "All I can say is that the photographs are convincing and all visible
# signs point towards the possibility that the Johor Bigfoot could be a
# variant of the Homo erectus species of hominids (creature resembling
# humans), thought to have gone extinct some 50,000 years ago or that it is
# an unknown hominid."

That's our Beavis, to a "t".

Now, Beavis, since the subject header of this message does not refer to
Bigfoot, and you did not read this post, wouldn't it be funny if, suddenly,
you reply with a whine that somehow refers to Bigfoot?

Oops, now that I predicted your next post, you won't post anything at all.

Oops, now that I predicted your next non-post, you'll have to figure out
what to post.

Poor Beavis.

--=_mimegpg-commodore.email-scan.com-12932-1147124540-0002
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQBEX7s8x9p3GYHlUOIRAgAhAJ0VIZaeHQfOvo43I+NagVMEezFiaACf W/1Y
Su164XpjoKAk461HsdewWvY=
=ycHO
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-12932-1147124540-0002--

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 00:17:05 von Tim

Alan Connor wrote:
> On comp.mail.misc, in <4c9i4vF14dq4pU1@individual.net>, "Tim" wrote:
>
>

> http://slrn.sourceforge.net/docs/README.offline>
>
> This is the same dickless troll, hiding behind a common name
> so that his real posting history (which he is rightfully
> ashamed of) is lost among those of all the others that have
> used the same name.

Alan Connor is a common christian name and surname combination
please explain in words of one syllable(to use two syllable words would
be beyond your capability) why you choose to troll over
the issue of common names whilst using such a common combination yourself.

I do not give in to bullies,thugs,and abusive sociopaths.
You are all three.

I will use whatever name i choose to post in.

Now FOAD .

>
> [Note: I don't read the articles of "Sam" or his numerous
> sockpuppets or his 'friends', nor any responses to them, and
> haven't for years. He follows me all over the Usenet, and I
> still don't read his articles. This _really_ pisses him off.
> .]
>
> Alan
>

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 01:42:24 von unknown

Post removed (X-No-Archive: yes)

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 02:39:13 von Mark Crispin

On Mon, 8 May 2006, D. Stussy wrote:
> Now, can we get to the question: Do we want to have some major ISPs
> abuse this extension header to the point where it becomes useless (as
> already demonstrated in the earthlink example where it interferes with
> domainkeys), or does no one actually care?

The status of message header field names that start with "X-" is nebulous.
RFC 822 specifically reserved this for "user-defined" that would never be
assigned as an extension field. RFC 2822 is silent on the matter.

My opinion: if this functionality is desired, there should be an RFC
(preferably standards-track, but at least experimental) that defines it
and its syntax; and also assigns a name that does not start with "X-".

I am neutral on whether or not this functionality is desirable; on how
this functionality is purported to be abused; and on the overall topic of
domainkeys.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 04:05:17 von david

D. Stussy wrote:

> Now, can we get to the question: Do we want to have some major ISPs abuse
> this extension header to the point where it becomes useless (as already
> demonstrated in the earthlink example where it interferes with
> domainkeys), or does no one actually care?

I don't care. Any information in an X-Originating-IP: header can
(should) also appear in a Received: header. And either header can be
faked, so neither is particularly trustworthy.

Regards,

David.

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 07:37:07 von unknown

Post removed (X-No-Archive: yes)

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 07:37:17 von Alan Connor

On comp.mail.misc, in , "Mark Crispin" wrote:

http://slrn.sourceforge.net/docs/README.offline>

I killscored this person a long time ago because he refuses to
use a proper delimiter on his sig, forcing people who don't
want to see sigs to see his.

This is a straightforward violation of the Netiquette, and I
gathered that he felt that because he was an academic that
he was above the Netiquette.

That means I don't download his articles, nor those of any
responses to his posts, unto the Nth generation.

I think he is responding to that obvious troll because academics
and trolls have this in common: All they can do is run their
mouths. So if one makes them wear a gag when they are in one's
newsreader, they are essentially castrated.

And this really upsets him. He doesn't think I have a right
to killscore him for forcing his egotistical sig on me.

He's wrong. I do have that right and I enforce it.

[Note: I don't read the articles of "Sam" or his numerous
sockpuppets or his 'friends', nor any responses to them, and
haven't for years. He follows me all over the Usenet, and I
still don't read his articles. This _really_ pisses him off.
.]

Alan

--
http://home.earthlink.net/~alanconnor/contact.html
Other URLs of possible interest in my headers.

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 07:47:43 von unknown

Post removed (X-No-Archive: yes)

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 08:23:03 von Alan Connor

On comp.mail.misc, in , "D. Stussy" wrote:

http://slrn.sourceforge.net/docs/README.offline>

When you're ready to do something besides sit on your fat butts
and post verbal farts that I don't even read, email me. I'll send
you the directions to my place.

Until then, you'll just have to live with what I choose to do,
and that includes leaving your articles, and any responsest to
them, on the server.

You don't know anything I can't find out elsewhere in a blink,
and you aren't any threat of any kind.

No one who can do anything but sit on their fat butt and post
verbal farts that I don't even read even reads your articles.

You may stink up someone else's downloads, but not mine.

Feel free to post sophomoric insults on the subject line. But
you'll have to get it all into the first 16 characters (including
spaces) because that's all that I will see before I delete the
headers and kill the subthread by reference.

I hope you are doing a good job of keeping my website up-to-date:

http://www.pearlgates.net/nanae/kooks/ac/

$ wget -U MSIE --spider http://www.pearlgates.net/nanae/kooks/ac/
--23:18:07-- http://www.pearlgates.net/nanae/kooks/ac/
=> `index.html.1'
Resolving www.pearlgates.net... done.
Connecting to www.pearlgates.net[82.92.180.13]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5,380 [text/html]
200 OK

Good! It's still up.

Because I don't read trolldung, I've never even looked at the
site. Nor does anyone but dipschitt trolls, who are the only
people that care what dipschitt trolls publish on the Internet.

Any barely literate child can publish anything on the Internet
with the help of an ignorant-consumer friendly operating system
like Windows.

Have you been catching the absurd articles I post just to give
you new material? Did you like the one about being abducted
by aliens? That was _primo_. If you don't have it up on your
site you just aren't doing your job.

[Note: I don't read the articles of "Sam" or his numerous
sockpuppets or his 'friends', nor any responses to them, and
haven't for years. He follows me all over the Usenet, and I
still don't read his articles. This _really_ pisses him off.
.]

Alan

--
http://home.earthlink.net/~alanconnor/contact.html
Other URLs of possible interest in my headers.

Re: Q: Why is "X-Originating-IP"being abused by ISPs?

am 09.05.2006 13:02:18 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--=_mimegpg-commodore.email-scan.com-21679-1147172537-0004
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Usenet Beavis writes:

> On comp.mail.misc, in , "D. Stussy" wrote:
>
>

>
> When you're ready to do something besides sit on your fat butts
> and post verbal farts that I don't even read, email me.

Why in the world would anyone in their mind E-mail you, for any reason?

> I'll send
> you the directions to my place.

Holy shit. Did you break up with Bigfoot, or something?

> Until then, you'll just have to live with what I choose to do,

Whistle Dixie out of your ass?

> and that includes leaving your articles, and any responsest to
> them, on the server.

Don't forget to leave your sanity, either.

> You don't know anything I can't find out elsewhere in a blink,
> and you aren't any threat of any kind.

That's right, Beavis. You are the smartest moron on this newsgroup.

> No one who can do anything but sit on their fat butt and post
> verbal farts that I don't even read even reads your articles.

It's amazing, Beavis, how you never read anything, yet amazingly know
exactly what it says.

> You may stink up someone else's downloads, but not mine.

Stinking up your downloads, Beavis, is like stinking up the NYC subways.

Too late.

> Feel free to post sophomoric insults on the subject line. But
> you'll have to get it all into the first 16 characters (including
> spaces) because that's all that I will see before I delete the
> headers and kill the subthread by reference.

That's your story, and you're sticking to it.

> I hope you are doing a good job of keeping my website up-to-date:
>
> http://www.pearlgates.net/nanae/kooks/ac/

It's not his web site, Beavis.

> $ wget -U MSIE --spider http://www.pearlgates.net/nanae/kooks/ac/
> --23:18:07-- http://www.pearlgates.net/nanae/kooks/ac/
> => `index.html.1'
> Resolving www.pearlgates.net... done.
> Connecting to www.pearlgates.net[82.92.180.13]:80... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 5,380 [text/html]
> 200 OK
>
> Good! It's still up.

Beavis demonstrates his expert HTTP skills. The audience aws in amazement.

> Because I don't read trolldung, I've never even looked at the
> site.

Of course not, Beavis. And you've never met Bigfoot, either. *giggle*

> Nor does anyone but dipschitt trolls, who are the only
> people that care what dipschitt trolls publish on the Internet.

Beavis, what's your fascination with schitt?

> Any barely literate child can publish anything on the Internet
> with the help of an ignorant-consumer friendly operating system
> like Windows.

Case in point: Beavis.

> Have you been catching the absurd articles I post just to give
> you new material?

Your absurd posts are _ALWAYS_ source for good, fresh, material.

> Did you like the one about being abducted
> by aliens? That was _primo_. If you don't have it up on your
> site you just aren't doing your job.

Beavis, do you have a message ID?

> [Note: it's not my fault that I'm a complete dumbass. I was dropped on my
> head as a child. See http://www.pearlgates.net/nanae/kooks/ac/ for
> more information]
>
> Beavis

--=_mimegpg-commodore.email-scan.com-21679-1147172537-0004
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQBEYHa5x9p3GYHlUOIRAtDdAJ98fXGXJ59S55+yCjRiX1mZdq1cuQCf QmV3
vv4PL1SXR772DZUquAGIfT8=
=gfLn
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-21679-1147172537-0004--

Re: Q: Why is "X-Originating-IP"being abused by ISPs?

am 09.05.2006 13:02:21 von Sam

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--=_mimegpg-commodore.email-scan.com-21679-1147172541-0005
Content-Type: text/plain; format=flowed; charset="US-ASCII"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Usenet Beavis writes:

> On comp.mail.misc, in , "Mark Crispin" wrote:
>
>

>
> I killscored this person a long time ago because he refuses to
> use a proper delimiter on his sig, forcing people who don't
> want to see sigs to see his.

Beavis FAQ item #7.

> This is a straightforward violation of the Netiquette, and I
> gathered that he felt that because he was an academic that
> he was above the Netiquette.

As opposed to you, who reached the same conclusion, but on an assumption
that he's a Beavis, instead.

> That means I don't download his articles, nor those of any
> responses to his posts, unto the Nth generation.

Beavis FAQ item #7, again.

> And this really upsets him. He doesn't think I have a right
> to killscore him for forcing his egotistical sig on me.

Amazing deduction, Dr. Freud.

> He's wrong. I do have that right and I enforce it.

Good, Beavis. Now, stick your tongue out, and go home.

> [Note: it's not my fault that I'm a complete dumbass. I was dropped on my
> head as a child. See http://www.pearlgates.net/nanae/kooks/ac/ for
> more information]
>
> Beavis

--=_mimegpg-commodore.email-scan.com-21679-1147172541-0005
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQBEYHa9x9p3GYHlUOIRAg0DAJ0XTfMfgv5VRU6smg9S0K4U9SBLfQCe LtEV
bioaIMmiE82zqoQmpQ2Omt8=
=FD1M
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-21679-1147172541-0005--

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 09.05.2006 17:28:02 von Mark Crispin

On Tue, 9 May 2006, D. Stussy wrote:
> Let a domainkeys signature include the "Received:" header in its list of
> dependent headers. That is a guarenteed failure of the DK signature for any
> message transported between hosts (whether real or virtual). The only case it
> might not fail is where sender and recipient are on the same host - and failure
> is then dependent on whether the initial "Received:" header is the only such
> header and was also added to the message before the DK signature was computed.

In situations such as this, you need to refer to the specification.

> So, my question/objection/issue: Should we blame earthlink.net for including
> the header in their DK signature, the other ISPs for "misuse" of the undefined
> header (to the extent that something undefined can be misused), or both (just
> because we can)?

Sadly, the answer is "all, and none". Without recourse to a specification
which clearly states out the rules, or at least an authority who can
review the situation and issue a ruling (and then be given the task to
update the specification!), you can "blame" any of the above, or it could
be none of the above and instead something completely different.

This is the inevitable problem which occurs when specifications are
incomplete (or missing entirely); software is implemented ad-hoc without
referencing the specification; or when someone implements what he thinks
the specification "should" say rather than what it does say.

Is there a specification which lays out the precise semantics of
X-Originating-IP? Does the domainkeys specification lay out rules for the
handling of X-Originating-IP, or set out rules for headers which can be
modified in transit (such as Received and apparently X-Originating-IP)?

Without these answers, you can claim that either Earthlink or the other
ISPs are "right". Or "wrong". Someone, somewhere, needs to make a
decision (if necessary, flip a coin!) and carve that decision in stone.

A repeated request:

I agree that poking sticks at a caged lunatic is amusing, in an immature
way; but it's not a good thing to do. We all know that the individual
posting as "Alan Connor" is mentally ill. He probably has a family that
worries a lot about him; and he's obviously very, very, lonely. His bad
behavior is his way of getting attention.

He deserves our pity, not our scorn. His cure is beyond us; but as a just
and compassionate society we have a moral duty not to worsen his illness.
His behavior will presently stop once he ceases to get attention for it.
More importantly, if the only way that he gets attention is by good
behavior, he'll start behaving well.

By all means, correct his (many!) technical inaccuracies. It's also
alright to explain the situation to any newcomer who receives one of his
ludicrous flames.

But let's try ourselves to make this newsgroup higher-quality. Please?

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 10.05.2006 00:39:58 von unknown

Post removed (X-No-Archive: yes)

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 10.05.2006 01:24:29 von david

D. Stussy wrote:

> Point taken. However, are you saying that the problem is therefore
> Earthlink's - as they have their domainkeys signature dependent on this
> header, knowing that other ISPs are adding their own copy of the same
> named header before delivery thus invalidating the DK signature (i.e. a
> guaranteed failure)?

Ah. I see your point.

I guess in my opinion, DK should not include any X- header in the
headers it signs, because the signer can't possibly know what that
header means, nor if/when/how it will be mutilated.

I realize that this proposal breaks DK as it stands now, because my
understanding is that the DK header signs *all* subsequent headers.

So I put the blame not on Earthlink, nor on the other ISPs, but on
DK itself. :-)

Regards,

David.

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 10.05.2006 01:30:15 von david

D. Stussy wrote:

> "X-Originating-IP:" is meant to identify the incoming IP address from the
> ORIGINAL MESSAGE SUBMISSION and as such, it can only appear once in a
> message,

Yes, but let's take my network as an example: My desktop machine at
192.168.2.3 talks to my Sendmail box at 192.168.2.1, which then relays
mail out to my ISP's mail server.

I would argue my Sendmail box could legitimately add this header:

X-Originating-IP: 192.168.2.3

but I think most people would agree that if my ISP uses the header,
it probably should modify it to read:

X-Originating-IP: 209.217.122.117

which happens to be my public IP address.

So I really don't see the need for X-Originating-IP at all. Nor do I
think we can expect ISPs to use it "correctly" when there's still a
real argument over what "correct" use is.

Regards,

David.

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 10.05.2006 02:24:54 von unknown

Post removed (X-No-Archive: yes)

Re: Q: Why is "X-Originating-IP" being abused by ISPs?

am 10.05.2006 02:45:20 von unknown

Post removed (X-No-Archive: yes)