Subject: Use of message disposition notification

From: Julien ÉLIE <[email-masked]>
Date: Tue, 7 Apr 2009 19:21:07 +0200

Hi,

I read in 3.5 for an injected agent:

    It SHOULD reject any proto-article which contains a header field
    deprecated for Netnews (see, for example, [RFC3798] (Hansen, T. and
    G. Vaudreuil, "Message Disposition Notification," May 2004.)).

How is it supposed to be used?  I read in RFC 3798 that it is used
to "report the disposition of a message after it has been successfully
delivered".  In our case, the message is rejected and not delivered.

Is it really here that RFC 3798 is to be referenced?  (And not USEFOR
or another RFC?)
If yes, could it be better explained?

-- 
Julien ÉLIE

« Rien, ce n'est pas rien ! La preuve, c'est que l'on peut le soustraire.
  Exemple : rien moins rien = moins que rien ! » (Raymond Devos)

---

From: Russ Allbery <[email-masked]>
Date: Tue, 07 Apr 2009 10:51:05 -0700

Julien ÉLIE <[email-masked]> writes:

> How is it supposed to be used?  I read in RFC 3798 that it is used to
> "report the disposition of a message after it has been successfully
> Is it really here that RFC 3798 is to be referenced?  (And not USEFOR or
> another RFC?)  If yes, could it be better explained?

It's an example of a header that's deprecated for Netnews, in this case
precisely because it doesn't make any sense in Netnews.  The RFC says
somewhere in it that it's deprecated or not allowed in Netnews (I forget
where).

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 8 Apr 2009 12:58:53 GMT

>somewhere in it that it's deprecated or not allowed in Netnews (I forget

RFC 3798 end of section 2.1:

   Messages posted to newsgroups SHOULD NOT have a Disposition-
   Notification-To header.

The reason is that it could be used to send mail bombs. I suppose we could
mention that reason in our Security Considerations.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131            Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: Julien ÉLIE <[email-masked]>
Date: Wed, 8 Apr 2009 20:36:15 +0200

Hi Charles,

> mention that reason in our Security Considerations.

Oh, thanks!
It is not easy at all to find out such headers!!  I wonder how implementors
will manage to know the headers they should look at...

By the way, as you speak about security considerations, I see that USEPRO
references both pgpmoose and pgpverify.
Wouldn't a note on Cancel-Lock be added in 6.1?  ("Currently, many sites are
ignoring all cancel control messages and Supersedes header fields due to
the difficulty of authenticating them and their widespread abuse.")
It could be said that Cancel-Lock might be used (draft-ietf-usefor-cancel-lock-01)
and also NoCeM, which is more and more spread nowadays.

-- 
Julien ÉLIE

« Les légionnaires ont adopté pour attaquer la redoutable tactique
  dite de la tortue. Pour battre en retraite, les légionnaires
  adoptent l'efficace tactique dite du lièvre. » (Astérix)

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 9 Apr 2009 14:41:34 GMT

>and also NoCeM, which is more and more spread nowadays.

Cancel-Lock is not formally defined anywhere, hence I know of no
news-server that ever looks at it, although a few people add it in hope
:-).

Our original plan of work was that, when we were done with our present
drafts, the next jobs would be UTF-8 in newsgroup-names and a document
covering security matters - notably pgpmoose and pgpverify (which really
need to be unified) plus Cancel-Locks and, I would hope, NoCeM. But those
would  rechartering, and the probability of that happening is not,
shall we say, too promising :-( .

---

From: Julien ÉLIE <[email-masked]>
Date: Mon, 13 Apr 2009 18:14:57 +0200

Hi Charles,

> Cancel-Lock is not formally defined anywhere

Yet, this draft can be a good starting point:
    http://www.eyrie.org/~eagle/usefor/drafts/draft-ietf-usefor-cancel-lock-01.txt

> hence I know of no news-server that ever looks at it

news.individual.net does not honour cancels and supersedes
if there is no valid Cancel-Key: header.
    http://www.individual.net/faq.php#1.12
    http://groups.google.co.uk/group/alt.usenet.news-server-comparison/msg/7e6d4792819ad90f

news.albasani.net also added that:
    http://albasani.net/wiki/FAQ_(English)#Cancel-Lock_.26_Cancel-Key

And maybe other servers too.

They do in with a Perl hook in INN.

> although a few people add it in hope

More and more people are doing that.

> drafts, the next jobs would be UTF-8 in newsgroup-names

And also how to deal with UTF-8 Distribution: headers?  (they are currently
limited to ALPHA/DIGIT/+/-/_)
MIME is not allowed for them.
UTF-8 newsgroup names will also impact headers (Control:, Xref:, etc.).

-- 
Julien ÉLIE

« Lorsqu'un savant meurt, c'est une bibliothèque qui brûle. » (Sabatier)

---

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 15 Apr 2009 13:40:51 GMT

>    http://groups.google.co.uk/group/alt.usenet.news-server-comparison/msg/7e6d4792819ad90f

Ah! I am a NIN customer, but they never told me about it :-( .

But on looking at the FAQs that I regularly post, I see that they have
been adding Cancel-Locks and Cancel-Keys to them, and they seem to have
worked.

Is that draft-ietf-usefor-cancel-lock-01.txt still a correct description
of the algorithm as it is now implemented?

---

From: Julien ÉLIE <[email-masked]>
Date: Wed, 15 Apr 2009 23:30:20 +0200

Hi Charles,

> of the algorithm as it is now implemented?

It looks so.
The syntax is valid, as well as lock keys hashes.

Here is for instance the Perl implementation on news.albasani.net:

    http://albasani.net/viewvc.cgi/trunk/lib/Schnuerpel/INN/CancelLock.pm?view=markup&root=schnuerpel

It is exactly what the draft suggests to do.

-- 
Julien ÉLIE

« -- C'est joli cette avenue le long de la mer... Ça s'appelle comment ?
  -- La promenade des Bretons. » (Astérix)