Subject: Re: #1083 USEPRO 7.5: Rules for Generating message-ID

From: John Stanley <[email-masked]>
Date: Fri, 22 Jul 2005 16:07:12 -0700 (PDT)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

> Rather to everyone's surprise, Usenet as a whole hailed him as a hero.

Your memory of this differs from mine. 

   3. Other entities MAY be entitled to issue a cancel message for that
      article, in circumstances where established policy for any
      hierarchy or group in the Newsgroups header, or established custom
      within Usenet, so allows (such policies and customs are not
      defined by this document). ........

This is nothing more than a green flag to anyone who wants to cancel 
anything for any reason. "Established custom" is now "third party cancels 
are authorized", despite existing standard which says otherwise. Third 
party is third party. 

We should NOT authorize willy-nilly cancellation of articles by anyone who 
wants to at any time. We SHOULD limit cancellations to the poster and the 
admin of the site through which he posted. The latter can cancel spam just 
as easily as any other third party, and is already in a position of 
authority over the poster. 

>We are talking here of people who construct <msg-id>s which contain the
>names of other people's domains in their <id-right>. Assuming that they
>have taken care to choose an <id-left> such that the <msg-id> as a whole
>is still globally unique, they are not in breach of USEFOR; nothing will
>break as a result, hence they are not in breach of USEPRO.

Is there a requirement for globally permanently unique or not? 

If I see that you are using a certain newsreader that creates messages 
id's of the form <[email-masked]>, and I see that you've just 
posted <[email-masked]>, nothing breaks if I post with an id of 
<[email-masked]>? Would the owner of example.com feel the same way?

---

From: "Charles Lindsey" <[email-masked]>
Date: Mon, 25 Jul 2005 11:27:03 GMT

>are authorized", despite existing standard which says otherwise. Third 

"Established custom" is how Usenet works, and it is not our job to change
that. It exists; it works. The text I quoted in is USEAGE, and has no
normative effect.

>Is there a requirement for globally permanently unique or not? 

There is, but there is no *mandated* method of achieving it (there is a
REOMMENDED method).

><[email-masked]>? Would the owner of example.com feel the same way?

It is well known that generating <msg-id>s that can be predicted by the
Bad Guys is poor practice, for a variety of reasons. I have made a note to
include a warning about this in USEAGE.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5