Subject: Re: #1159 USEFOR 3.2.14 - (was POLL ...)

From: John Stanley <[email-masked]>
Date: Mon, 13 Mar 2006 10:22:40 -0800 (PST)

D) Remove both sender and posting-account from the spec

In <4408616E.8020905@xxxxxxxxxxxxx> Harald Alvestrand 
<harald@xxxxxxxxxxxxx> writes:

>After reviewing discussion again....

> a NEW proposed alternate text:

>  The "posting-account" <parameter> identifies the source from which
>  that news server received the article, in a notation that can be
>  interpreted by the news server admin. This notation can include any
>  info the admin deems pertinent, such as the authorized and/or
>  authenticated identity of the poster.

Distributing authenticated identities about the net is not a smart thing 
to do, and we ought not promote the idea. It is not just a privacy issue 
as some have claimed. A cracker holding a validated identity and the 
system upon which it is valid has two pieces of information out of the 
three he needs to break in.

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>It is, in any case, a matter for the poster and the admin to sort out
>between them,

What complete nonsense.

Where I "read news" (which has been broken for almost a month now), the 
"admin" has nothing to do with the news server. They outsource. The admin
at the outsource company basically says "bugger off" when the users 
contact him directly. Who is it that I'm supposed to "sort out" this 
problem with, again?

>>  It is a matter of local policy whether to include the "posting-account"
>>  <parameter>, the "sender" <parameter>, both, or neither.

It is both a privacy and a security issue and we should clearly state such
and prohibit it.

Forrest J. Cavalier III wrote:

> "I can't waste 100 bytes per message on my local logs
> so I'll waste 100 bytes of SPOOL ON EVERY SITE that stores
> articles injected here. Oh, if you want me to store your
> X-Trace headers for you, I guess so...."

Spot on.

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>The Path header in news serves a similar purpose to the Received header in
>email.

Wrong. The Received header field(s) in email document full information 
about the processing of an email message, including time of arrival and
agent data. It is not unusual for there to be more than one Received 
header field from one host.

The other obvious difference is that the Received header fields appear 
ONCE in ONE COPY of a message, while the Path header appears in each and 
every copy of the tens of thousands that appear on the net. Every byte 
added to a Path header field is duplicated untold numbers of times, while
a byte added to a Received header field is duplicated only in the one copy 
sent forward.

>What this shows is that the need for diagnostic information tends to grow,
>but that the syntax of the Received header was far too restrictive to
>accomodate what turned out to be needed.

Surly you cannot be serious.

>But it costs us nothing to allow for future extension should it be 
>needed.

"I cannot afford to store 100 bytes of logging info on my own system to 
keep track of my own users, so I will have everyone else store a copy of 
those 100 bytes on their systems for me."