Subject: Re: ISSUE: 3.2.14 : <sender>

From: John Stanley <[email-masked]>
Date: Tue, 17 Jan 2006 09:01:21 -0800 (PST)

Russ Allbery <rra@xxxxxxxxxxxx>:

>Ideally, all servers should be able to just use the message ID to look up
>information in logs, I agree.

Servers don't care. Admins care. If the admin cannot create a simple 
script to take a message id and return all of the data from a local 
database for that id, then he's in the wrong job.

>Within the framework that we're discussing, I'm happy about it in the
>sense that I think it's completely out of scope for us to care.

The "framework" of the question was concerning you as a user, who has
just had his news service username and password revealed to the world.
If you don't care, ok. I do.

>It's obviously a stupid thing to do from a security standpoint, but it is
>emphatically NOT the purpose of a standard to legislate against every
>stupid thing that anyone could possibly do.

You've lept from us saying MUST NOT for one thing all the way to "every 
stupid thing". Nobody is trying to legislate against "every stupid thing"
here.

It's not just "a stupid thing". It's not just an admin thing. It's an 
issue of releasing personal data about a system user in a manner that 
changes the meaning of two other headers that I assume we do care about.

>It is the business of a
>standard to define fields and their uses,

Yes, and implicit in that is defining what it is NOT to be used for.

>and when the use is "local
>information used at the discretion of the server admin," it means exactly
>that.

I would not call putting information into the header of an article that is 
distributed globally, available to anyone who wants to read it, "local", 
in any sense of the word. Perhaps that is the confusion. People think that 
defining a header field to be "local" means that it won't propogate with 
the rest of the article?

>>     ... so why you think
>> that spammers (and worse) won't jump on the Injection-Info header as a
>> source of verified information is beyond me.

> I don't think anything of the sort.

You seem to think that a simple statement that the information is not to 
be used as an email address even if it looks like one is sufficient to 
solve the problem, so apparently you think spammers (and worse) will 
listen to that statement and not jump on the data. If you don't think that
statement will solve the problem, ok, but then why bother saying it?

>If your news server is putting things into Injection-Info that you don't
>like, use a different news server.

Yes, in a perfect world, that's the perfect answer. Unfortunately, it's
an answer that closes the door after the horse has fled the barn. I hope
I don't charge you by the minute for your news connection, because there 
will be an awful lot of minutes being used by 'you' after I publish your
authentication data.

>Making rules in a standard about local
>site behavior isn't going to change the real world.

Then we shall just stop right here and disband this WG, shall we? After
all, at the most basic level, ALL "site behaviour" is local.

---

From: Russ Allbery <[email-masked]>
Date: Tue, 17 Jan 2006 09:59:55 -0800

> If you don't care, ok. I do.

I don't think there's any way that I can respond further to this or the
rest of John's message without simply reiterating my previous point.  I
think we just disagree on the proper role of a standard.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>