Subject: Re: ISSUE: 3.2.14 : <sender>

From: Russ Allbery <[email-masked]>
Date: Fri, 13 Jan 2006 23:01:14 -0800

John Stanley <[email-masked]> writes:

> "Modifying the headers" to claim that it knows "the true email address"
> for a user INCLUDES Injection-Info header fields. In fact, putting such
> info into that header is incorrect, since the posting is not being done
> from an email address. The posting is being done by a user logged into
> some system somewhere; a system at which he need not even necessarily
> HAVE an email address.

Sites should have some protocol-defined place to put a local identity into
the headers if they wish to do that for tracing or accountability purposes
under their local site policy.  Whether that be an e-mail address, a
username, a UID, or some encrypted, base64-encoded string should be
entirely up to the local site policy, its privacy policy, and so forth.

> No it is not. It is a basic reason why the injecting agent MUST NOT
> modify the information. It is unwise/insecure/unhelpful and patently
> absurd for it to claim it knows "the true email" address for someone who
> is posting an article, and "a true email address" is completely
> irrelevant.

News servers are permitted to add trace headers to locally originating
posts and have been for years.  Injection-Info is supposed to replace the
ton of unstandardized ones we have now.  That, on its face, is a fine
idea.

However, I agree with John that it has no business modifying information
that's already there.  Injection-Info should not be provided by the
posting agent, and if it is, the post should be rejected.  People who want
to reinject messages should remove Injection-Info from the post when they
do so, or rename it if we really want to keep trace information.  (In the
latter case, maybe it would be worthwhile to specify a separate header
name explicitly for that purpose that's allowed to occur multiple times in
the message, like Past-Injection-Info or something.)

> It makes no difference if the injecting agent is actually modifying the
> From or Sender header fields or inserting a header field that says
> "those other header fields are wrong, here's the correct data...". It is
> the same effect and has the same meaning.

The information in Injection-Info should not be the same information as
From or Sender semantically.  It should be site-specific poster identity
information in whatever form is convenient and useful for that site.  If
it happens to have the form of an e-mail address, well, that's an
interesting coincidence from the perspective of the standard, but not
something that software is allowed to draw automated conclusions from.
(For instance, nothing should expect to be able to mail that address just
because it looks like an e-mail address.)

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: John Stanley <[email-masked]>
Date: Fri, 13 Jan 2006 22:34:02 -0800 (PST)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>But for sure some injecting agents in some setups can
>determine the/a 'true' email address of the sender whatever the sender
>actually put in his "From:", and such injecting agents _can_ then insert
>that information in an Injection-Info header.

The injecting agent cannot determine the "true" email address. Period.
"An" email address for the user is irrelevant -- it cannot know that
the address is false and thus MUST NOT modify the headers to claim that
it knows the "true" address. You're using the word "true", so I assume
you mean to imply everything that "true" implies.

some system somewhere; a system at which he need not even necessarily HAVE 
an email address.

>Whether inserting such sender information in an Injection-Info header is
>wise/legal/helpful/whatever is a separate issue

No it is not. It is a basic reason why the injecting agent MUST NOT modify 
the information. It is unwise/insecure/unhelpful and patently absurd
for it to claim it knows "the true email" address for someone who is
posting an article, and "a true email address" is completely irrelevant.

>There is (and always has been, even in this group) a tension between those
>who want to hide the source of an article except by showing information
>that only the injecting ISP can associate with an individual poster/site,

I tire of your twisted interpretations of arguments you disagree with. 
I'm not saying anything should be hidden. I'm saying that the injecting
agent does not know the correct information to put in the headers and 
therefore MUST NOT put it there. Not only does it not know the correct
information, it doesn't know the information it sees in the article is 
incorrect.

>But, as I said, USEAGE is the place to discuss that tension and the pros
>and cons of both views.

No, it is not. We are discussing the jobs of different agents, and telling
an agent that it MUST NOT modify certain headers is well within the scope
of our discussion now. Stop trying to push it off until later, hoping that
it will simply go away as people tire of trying to explain to you the 
problem.

>USEPRO says (and has always said) that injecting agents MUST NOT modify
>headers that were placed there by the poster. But that is not the issue
>under discussion.

It makes no difference if the injecting agent is actually modifying
the From or Sender header fields or inserting a header field that says
"those other header fields are wrong, here's the correct data...". It
is the same effect and has the same meaning.

---

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 16 Jan 2006 11:42:45 GMT

>> for a user INCLUDES Injection-Info header fields.

But we are not proposing to "modify" any header. We are discussing what
should be in the Injection-Info at the time it is _created_.

> In fact, putting such

>entirely up to the local site policy, its privacy policy, and so forth.

Exactly so. If the entity that posted the article possesses an email
address (like what would have been put in the Sender header, if present)
AND if the injecting agent has the ability to determine that (or some
such) address, then it can go in the Injection-Info as a 'sender'
parameter. If neither of those prequisites applies, then the injecting
agent will have to use something else.

It is for the injecting agent's admin to decide (and pros, cons and
privacy implications are discussed in USEAGE).

>that's already there.

Indeed. Altering/deleting headers by the injecting agent has been a SHOULD
NOT in our drafts for many years (we fought long and hard over that
wording, and that is what we came to).

>  Injection-Info should not be provided by the
>posting agent, and if it is, the post should be rejected.

Except in the rare case of reinjection, when you just replace it with a
new one (maybe renaming the old one with an X-header).

>  People who want
>do so, or rename it if we really want to keep trace information.

Yes, but that operation might conceivably be performed by the injecting
agent rather than by the entity submitting the reinjection.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: "Forrest J. Cavalier III" <[email-masked]>
Date: Mon, 16 Jan 2006 11:35:22 -0500

> agent rather than by the entity submitting the reinjection.

Charles, which situation do you feel more likely to occur....

1. Someone knows what they are doing, knows how Usenet works, knows
    about loop avoidance, and knows the reasons to not re-inject but has good
    reason to re-inject, but is incapable of obtaining or writing software to
    remove the header.

OR

2. Someone does not know very well how Usenet works and INCORRECTLY
    thinks that re-injection is going to help propagation and be a service
    to everyone.

OR

3. Someone misconfigures some gatewaying tool and queues up a couple
    of days worth of messages to a newsgroup for re-injection.

OK.

Next up, a discussion of the "First, Do No Harm" portion of the
Hippocratic Oath and its application as an engineering principle
in protocol design.

---

From: Russ Allbery <[email-masked]>
Date: Mon, 16 Jan 2006 10:58:23 -0800

Charles Lindsey <[email-masked]> writes:
> Russ Allbery <[email-masked]> writes:

>> Injection-Info should not be provided by the posting agent, and if it
>> is, the post should be rejected.

>> People who want to reinject messages should remove Injection-Info from
>> the post when they do so, or rename it if we really want to keep trace
>> information.

> agent rather than by the entity submitting the reinjection.

Reinjection should never be done by the server unless the server is some
sort of special case that isn't implementing NNTP at all and is instead a
tightly coupled component of some larger system (in which case it's
outside the scope of our work).  In the case of NNTP, you cannot safely
determine when reinjection should be permitted on the server, and
therefore the decision must be made by the client.

---

From: "Charles Lindsey" <[email-masked]>
Date: Tue, 17 Jan 2006 12:18:52 GMT

>therefore the decision must be made by the client.

You may well be right there (though the injecting agent still needs to
determine somehow whether that preloaded Injection-Info is a genuine
reinjection by a guy who understands what he is doing, or the product of
some idjit or scammer. But that is a policy issue for that injector.

Currently, USEPRO is written on the basis that the injecting agent will
discard/replace any pre-existing Injection-Info, but there is no reason
why that should not be revisited at the proper time.

However, we are not supposed to be discussing USEPRO at the present time.

---

From: Russ Allbery <[email-masked]>
Date: Tue, 17 Jan 2006 10:03:41 -0800

> However, we are not supposed to be discussing USEPRO at the present

Fair point.  I'll queue the discussion of reinjection for that time.