Re: permitted cross-posting for genuine FAQs

---------

Chris Lewis (clewis@ferret.ocunix.on.ca)
Wed, 11 Mar 1998 20:26:18 -0500

On Mar 12, 8:58, Simon Lyall wrote:
} Subject: Re: permitted cross-posting for genuine FAQs
} On 11 Mar 1998, Andrew Gierth wrote:
} > Marty> 1) tighten up the meaning of "approved" so that the approval
} > Marty> header amounts to a crypto signature of the article by the
} > Marty> moderator. This would dramatically reduce the likelyhood of
} > Marty> forged approvals.
} >
} > This is already available (PGPMoose). Unfortunately, it doesn't fit
} > the *.answers pre-approval model; it works for conventional moderated
} > groups because the secret keys can be held at a central location by
} > the moderator, but *.answers posts are not injected by the *.answers
} > moderators.

} There could be ways to do this with an authentication header (you could
} have a signed token that covers only the headers that are "fixed" by the
} *.answers team, similar to the format of sign-control) , however then
} general consensis in the usefor group is that "Approved: " is pretty much
} going to be unfixable and any changes will have to be a new header rather
} than a straight change in Approved.

This sounds good, because it doesn't require the poster to use public
crypto. However, this isn't possible in a "fully secure" fashion,
because it's vulnerable to replay attacks. PGPMoose includes the
messageid in the signature simply because messageids are guaranteed
unique amongst all postings and prevent replay - obviously then,
the poster has to run the crypto and sign it themselves. You could fix
this by having the *.answers team include the body of your FAQ in the
signature (and hence replays are almost harm free because it's the same
contents), but, that would cause endless hassles for update. And god
help you if your mail or news system did any conversions...

} One other thing I should mention is that it is very easy and perfectly
} legit for a spammer to create their own *.answers group and even moderate
} it. Making anything that is crossposted to alt.spammers.answers exempt
} from removal isn't going to do much good..

Hell, Netzilla (one of top 5 mass spammers) has their own Usenet
hierarchy netzilla.*! ;-)

-- 
Rumours of my demise are greatly exaggerated.
Cold but happy, please pass the thermos!


For more information on spam, see http://spam.abuse.net/spam
Fight spam, support Rep. Chris Smith's TCPA extension: http://www.cauce.org