From: Russ Allbery (rra@stanford.edu)
Date: Wed Jan 17 2001 - 08:10:42 CST
Brad Templeton <brad@templetons.com> writes:
> Yes, sometimes you have to put up with some pain in order to have civil
> rights. That may sound trite to you, but it means a lot to some people.
> I'm not saying use tokens because it's easier. Do it because it's right.
Wow, that sure is going to persuade me that you're right, yes sir. What a
persuasive and well-defended technical argument that was.
>>> The code for
>>> hash( IP + secret string of the day)
>>> Is hardly rocket science.
>> Nonetheless, you just completely lost 80% of the people who run news
>> servers.
> There is no need to have them involved. It is something software
> authors would do. The time they would be lost would be when you call
> them up to say, "I want to complain about postings from the user coded
> xxxxxxx."
> If you are eager you can say, "I see you run Q News. Go to the web page
> at yyyy to find out how you can map the string xxxxxx to the user's real
> identity."
Okay, maybe I'm wrong. I know there are other people on this list, or at
least who were on this list, who have done way more work than I have on
cutting down on Usenet abuse. If Andrew or one of the other active spam
cancellers is still here, do you think the above would actually work?
I still don't think it makes any sense at all, but maybe I'm just being
unnecessarily pessimistic. You've increased the complexity of figuring
out what happened on the server by about an order of magnitude, plus I
really doubt that, say, IIS is going to implement the above in any way
that makes it easy to decode tokens (since that isn't going to be a common
operation). I can think of dozens of things that in practice are going to
go wrong with this.
> This is not trivial to do, but it's worth it.
That's a matter of opinion; I don't think it is.
> The question is, do we need a design weighted entirely to the
> convenience of the person tracking down the abuser or not?
That's a red herring, since the design isn't.
-- Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>