Subject: Re: #1047

From: John Stanley <[email-masked]>
Date: Mon, 16 Jan 2006 13:58:53 -0800 (PST)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>But if you omit to inform your peers of the new name/alias, then you run
>the risk of having them insert MISMATCH into the Path.

I can neither prevent them nor force them to insert MISMATCH into the path 
header field. I can only determine what the "true" name of my own system
is. The point remains that _I_ am the one who determines that, not my
peers, and yet WE tell my peers that they are the ones who decide.

Harald Tveit Alvestrand <harald@xxxxxxxxxxxxx>:

>The point being that if you get an NNTP connection from 12.13.45.67, that 
>site claims to be bozo.example.org, and 12.13.45.67 has a DNS reverse 
>mapping that points to 12-13-45-67.dialup.example.net, the only thing you 
>can sensibly log is the IP address - you can't trust the claimed name, and 
>the reversemap has very limited value.

If you are a server admin who accepts articles from a dialup address, you
need to have some better authentication available than just the reverse 
DNS. If you don't, well, you have NO way of determining "true established 
<path-identity>".

>But an IP address is NOT a "true established identity". It's an IP 
>address.

In your example case, it is much more of a "true established identity"
than anything else.

>And then, both "true" and "established" become very slippery concepts.

Yes. Even when not thinking like an attacker.