Subject: Re: #1047

From: John Stanley <[email-masked]>
Date: Fri, 13 Jan 2006 23:08:21 -0800 (PST)

Harald Tveit Alvestrand <harald@xxxxxxxxxxxxx>:

   1. It MUST establish the trusted identity of the source of the
      article ... firstly the true established <path-identity> of
      the source ...

I'm curious. What is "the true established <path-identity>" of a
source? The name? Well, sites can have any number of names. Which is the
"true established" one? If my server has one name but I change it and
my peers do not change their configs, then the "true established" name
is different than what those peers would insert as "the true established"
name. How can it be "true" if it isn't the correct name?

Is it an IP address? No, can't be that, even though that is more unique
than the name. (While a server passing an article over the net to a peer
can have any number of names for that link, it came out of the server on
one IP address, even if there are other addresses it will respond to.)

How do we tell an agent that it MUST do something that isn't well defined?

---

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 16 Jan 2006 11:18:11 GMT

>"true established" one?

Yes, that is a good point. A peering site may have several aliases, and it
should suffice that one of them MATCHes. I have made a note to review that
wording for the next version.

> If my server has one name but I change it and
>name.

But if you omit to inform your peers of the new name/alias, then you run
the risk of having them insert MISMATCH into the Path.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 16 Jan 2006 15:07:09 +0100

> the risk of having them insert MISMATCH into the Path.

The point being that if you get an NNTP connection from 12.13.45.67, that 
site claims to be bozo.example.org, and 12.13.45.67 has a DNS reverse 
mapping that points to 12-13-45-67.dialup.example.net, the only thing you 
can sensibly log is the IP address - you can't trust the claimed name, and 
the reversemap has very limited value.

But an IP address is NOT a "true established identity". It's an IP address.

If you want anything to be logged that is helpful when you're under attack, 
you HAVE to try to think like an attacker.

And then, both "true" and "established" become very slippery concepts.

                  Harald

---

From: Richard Clayton <[email-masked]>
Date: Mon, 16 Jan 2006 14:16:26 +0000

In message <[email-masked]>,
Harald Tveit Alvestrand <[email-masked]> writes

>the reversemap has very limited value.

without a timestamp, 12.13.45.67 may be less use than it appears (OK,
Usenet propagation speeds are high these days, but if some of the
machines on the path are congested (several hours of queues) then you
may be looking at a half dozen accounts...   and as soon as it is more
than one, chances are that abuse teams are going to move on to a simpler
problem :(

- -- 
richard                                                   Richard Clayton

Those who would give up essential Liberty, to purchase a little temporary 
Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755