Subject: #1159: USEFOR 3.2.14: Resolution of sender / posting-account

From: Harald Alvestrand <[email-masked]>
Date: Tue, 11 Apr 2006 15:03:58 +0200

Here is where I believe we stand at the moment.

I deleted the piece about authorized and authenticated identities; after 
reviewing discussion, I believe that's not appropriate to discuss here. 
Possibly in USEAGE.
I added words to say that different accounts should have different 
"posting-account" parameters too.

Are we done?

3.2.14.  Injection-Info

   The Injection-Info header field contains information provided by the
   injecting news server as to how an article entered the Netnews system
   and to assist in tracing its true origin.  It can also specify one or
   more addresses where complaints concerning the poster of the article
   may be sent.

   injection-info  =  "Injection-Info:" SP [CFWS] path-identity
                      [CFWS] *( ";" [CFWS] parameter ) [CFWS] CRLF

      NOTE: The syntax of <parameter> ([RFC2045] as amended by
      [RFC2231]), taken in conjunction with the folding rules of
      [RFC0822], effectively allows [CFWS] to occur on either side of
      the "=" inside a <parameter>.

   The following table gives the <attribute> and the format of the
   <value> for each <parameter> defined for use with this header field.
   At most one occurrence of each such <parameter> is allowed.

   <attribute>              format of <value>
   --------------------     -----------------
   "posting-host"           a <host-value>
   "posting-account"        any <value>
   "logging-data"           any <value>
   "mail-complaints-to"     an <address-list>

   where

   host-value      =  dot-atom-text / IPv4address / IPv6address /
                      (dot-atom-text ":" ( IPv4address / IPv6address ))

      NOTE: Since any such <host-value> or <address-
      list> has also to be a syntactically correct <value>, it will
      usually be necessary to encapsulate it as a <quoted-string>, for
      example:

   posting-host = "[email-masked]:192.168.0.1"

   Additionally, any other <parameter> whose <attribute> starts with
   "x-" MAY be used where the defined ones appear to be unsuitable, but
   other unlisted <parameter>s SHOULD NOT be used unless defined in
   extensions to this standard.

   Although comments and folding of white space are permitted throughout
   the Injection-Info header field, it is RECOMMENDED that folding is
   not used within any <parameter> (but only before or after the ";"
   separating those <parameter>s), and that comments are only used
   following the last <parameter>.

      NOTE: Some of this information has previously been sent in non-
      standardized header fields such as NNTP-Posting-Host, X-trace,
      X-Complaints-To, and others.  Once a news server uses Injection-
      Info, it should have no need to send these non-standard header
      fields.

   The "posting-host" <parameter> specifies the FQDN and/or IP address
   (IPv4address or IPv6address) of the host from which the news server
   received the article.

      NOTE: If the "posting-host" <parameter> identifies a dial-up
      point-of-presence, the "posting-account" or the "logging-data"
      <parameter> may provide additional information about the true
      origin of the article.

   The "posting-account" <parameter> identifies the source from which
   that news server received the article, in a notation that can be
   interpreted by the news server administrator.  This notation can
   include any information the administrator deems pertinent.  In order
   to limit the exposure of personal data, it SHOULD be given in a form
   that can't be interpreted by other sites, but two messages posted
   from the same account SHOULD have the same value of "posting-
   account", and two messages from different accounts SHOULD have
   differing values of "posting-account".

   The "logging-data" <parameter> contains information (typically a
   session number or other non-persistent means of identifying a posting
   account) which will enable the true origin of the article to be
   determined by reference to logging information kept by the news
   server.

   The "mail-complaints-to" <parameter> specifies mailbox(es) for
   sending complaints concerning the behavior of the poster of the
   article.

   It is a matter of local policy which <parameter>s to include.
   Some pieces of information have privacy implications; this is
   discussed in [USEAGE].

---

From: Russ Allbery <[email-masked]>
Date: Tue, 11 Apr 2006 16:47:52 -0700

> reviewing discussion, I believe that's not appropriate to discuss
> here. Possibly in USEAGE.

Here's my worry on this:

>   that can't be interpreted by other sites, but two messages posted from
>   the same account SHOULD have the same value of "posting-account", and
>   two messages from different accounts SHOULD have differing values of
>   "posting-account".

What does "account" mean in the last sentence?  We have a SHOULD here, so
this isn't just an idle terminology question.  In order to produce a fully
complying implementation, an implementer is going to have to know what
account means in order to do the right thing.

Now, in practice, NNTP is going to (hopefully) move with the rest of the
world towards SASL authentication.  That means that NNTP is going to hand
the underlying server two pieces of data, namely the authentication
identity and the authorization identity.  The authentication identity
corresponds to the credentials presented by the client.  The authorization
identity corresponds to the identity the client is acting as.  Often they
will be the same; sometimes they will be different.

An obvious Usenet-relevant example would be a posting account that's used
by the moderators of example.research.  example.research has five
different moderators, all of whom can approve articles.  Each moderator
authenticates with their own credentials, and all moderators have access
to a shared "example.research moderator" account on the server that's used
for all of the posting.

Should messages approved by these moderators all have the same
posting-account parameter (meaning that the posting-account represents the
authorization identity)?  Or should the posting-account parameter vary
depending on which moderator initiates the posting (meaning that the
posting-account represents the authentication identity)?

Both are useful in different circumstances.

>   determined by reference to logging information kept by the news

I remain sad to see this go into the document, but the redundancy with
message ID isn't sufficiently bad for me to raise a stink.  Consider me
part of the rough in rough consensus, I guess.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Harald Alvestrand <[email-masked]>
Date: Wed, 12 Apr 2006 19:20:20 +0200

> account means in order to do the right thing.
I think this may be a local matter - "whatever makes sense in the 
context of the sender"..... an university that uses authentication by IP 
address probably doesn't have something reasonable to use as "account", 
and so perhaps shouldn't use the field.... I find it hard to come up 
with a more precise definition. Suggestions?
> Both are useful in different circumstances.
in this particular use-case, I'd say that they are using different 
accounts - the only time I could think that the parameter would be 
useful is if someone is finding the moderation decisions inconsistent, 
and wants to check if one moderator is making the moderator approvals 
that he does not agree with (without caring who it actually is).
In a SASL context, that maps to the autentication identity. In other 
contexts, the item could have different names - would one represent this 
by a group name if authorizing in a pure UNIX context?
> part of the rough in rough consensus, I guess.
I don't have any great enthusiasm for reopening this issue either.

---

From: Russ Allbery <[email-masked]>
Date: Wed, 12 Apr 2006 17:02:16 -0700

>>>   from the same account SHOULD have the same value of
>>>   "posting-account", and two messages from different accounts SHOULD
>>>   have differing values of "posting-account".

>> What does "account" mean in the last sentence?  We have a SHOULD here,
>> so this isn't just an idle terminology question.  In order to produce a
>> fully complying implementation, an implementer is going to have to know
>> what account means in order to do the right thing.

> with a more precise definition. Suggestions?

How about this:

   The "posting-account" <parameter> identifies the source from which that
   news server received the article, in a notation that can be interpreted
   by the news server administrator.  This notation can include any
   information the administrator deems pertinent.  In order to limit the
   exposure of personal data, it SHOULD be given in a form that can't be
   interpreted by other sites.  However, to make it useful for rate
   limiting and abuse detection, two messages posted from the same source
   SHOULD have the same value of "posting-account", and two messages from
   different accounts SHOULD have differing values of "posting-account".
   The exact definition of source is left to the discretion of the news
   server administrator.

That also adds some explanation of why we care about matching up
posting-account between different messages.

---

From: Harald Alvestrand <[email-masked]>
Date: Thu, 13 Apr 2006 06:22:42 +0200

> posting-account between different messages.
This looks good to me - there's one remaining occurence of "account" in 
the text outside the parameter name; once we replace that with "source" 
too, it's consistent:

   different sources SHOULD have differing values of "posting-account".
   The exact definition of "source" is left to the discretion of the news
   server administrator.

I'll insert this version in the tracker.

Are we done?

---

From: Russ Allbery <[email-masked]>
Date: Wed, 12 Apr 2006 21:24:44 -0700

> Are we done?

Works for me.  Thanks for catching the account that I missed!

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 14 Apr 2006 19:19:58 GMT

>Are we done?

Bar minor niggles.

>   (IPv4address or IPv6address) of the host from which the news server
     ^^^^^^^^^^^^^^^^^^^^^^^^^^
    <IPv4address> or <IPv6address>

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 14 Apr 2006 19:35:50 GMT

>   The exact definition of "source" is left to the discretion of the news

Or you could say that it is a matter for negotiation between the
administrator and the poster (for example a group of moderators might
negotiate use of some authorization identity, but otherwise you get an
authentication identity of some sort).

I also prefer s/differing/different/, as a matter of style.

>Are we done?

Pretty much. That text will do if needs be.

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 14 Apr 2006 19:29:20 GMT

>to a shared "example.research moderator" account on the server that's used

I think it should normally be the authentication identity, but just
occasionally authorization might be appropriate, so the wording should be
slanted that way.

BTW, since SASL will become more and more used, there was a suggestion to
have a separate "authentication=" parameter, which we never really decided
on. It would make the matter entirely clear.

>part of the rough in rough consensus, I guess.

The essential diference is that the same parameter does not occur for each
article from the same source. Some ISPs, who cannot be bothered to keep
logs, include an encrypted log entry in the article. We all agree this is
a dumb idea (and USEAGE might well say so), but it happens.

The more useful use is as an index into the injectors logs, so that their
abuse desk can quickly locate the entry. But that usage should be
_in_addition_ to a posting-account (and/or posting-host). We might even say
that.

---

From: Harald Alvestrand <[email-masked]>
Date: Mon, 17 Apr 2006 10:34:52 +0200

> authentication identity of some sort).
I would not say that. This header is set by the administrator, and 
referring to negotiation with the poster is going to make life as an 
administrator look more complex (as well as being untrue in the majority 
of the cases).
> I also prefer s/differing/different/, as a matter of style.
For this instance, I'd actually prefer "differing", but that's a nit I'm 
happy to leave as editor's choice.