From: Russ Allbery (rra@stanford.edu)
Date: Wed Mar 14 2001 - 01:16:58 CST
Charles Lindsey <chl@clw.cs.man.ac.uk> writes:
> It is a violation of this standard to "forge" an email address, that
> is, to use a valid email address which the poster is not entitled to
> use. Even reply addresses with an invalid local-part but a valid
> domain can cause disruption to the administrators of such domains.
The order of phrasing of this paragraph makes it ambiguous whether reply
addresses with invalid local-parts but valid domains are a violation of
the standard. I think that could be resolved by instead saying:
It is a violation of this standard to use in From, Reply-To,
Mail-Copies-To, Approved, or Sender an email address the poster is not
entitled to use. Even addresses with an invalid local-part but a
valid domain can cause problems for the administrators of such
domains.
but I don't know if we want to go in the direction of such a list. That
wording does have the advantage of avoiding the much-debated and rather
controversial word "forge", though, which I think is a benefit.
> The use of addresses ending in the ".invalid" top-level-domain (see
> 5.2) by posters who wish to remain anonymous or to prevent automated
> harvesting of their addresses, but who do not care to take the
> additional precautions of using more sophisticated anonymity
> measures, will not solve these problems, but the absence of
> ".invalid" in an invalid address may provide some indication of
> malicious intent.
I'm confused by this paragraph. I think I disagree with what it's saying
both coming and going. Using .invalid and a munged address *does*
effectively prevent automated harvesting of the addresses, and not using
".invalid" seems unlikely to be evidence of *malicious* intent
necessarily.
> 9.2.2. Compromise of System Integrity
> The posting of unauthorized (as determined by the policies of the
> relevant hierarchy) control messages can cause unwanted newsgroups to
> be created, or wanted ones removed, from serving agents.
> Administrators of such agents SHOULD therefore take steps to verify
> the genuiness of such control messages, either by manual inspection
> (particularly of the Approved header) or by checking any digital
> signatures that may be provided. In addition, they SHOULD
> periodically compare the newsgroups carried against any regularly
> issued checkgroups messages, or against lists maintained by trusted
> servers and accessed by out-of-band protocols such as FTP or HTTP.
> More specifically, malicious cancel messages (7.5) can cause valid
> articles to be removed from serving agents.
"More specifically" isn't accurate, since the previous paragraph was
talking about a completely separate issue (newgroups and rmgroups). I
think that phrase can just be dropped.
> Improperly configured serving agents can allow articles posted to
> moderated groups onto the net without first being approved by the
> moderator. Injecting agents SHOULD verify that moderated articles
> were was received from one of the entities given in its Approved
> header and/or check any digital signatures that may be provided.
> [It does not actually say that in "Duties of an Injecting Agent". Should
> it? What we have said so far is pretty weak.]
I don't think we can really say much here without assuming that every site
has the same notions of what newsgroups are moderated, which I'm not sure
is a good assumption in the general case.
Note that the second sentence is unrelated to the first. The second
sentence is dealing with problems of forged approval, whereas the first
sentence is describing a problem generally caused by news servers which
are completely unaware that the newsgroup is moderated at all.
> 9.3. Liability
> There is a presumption that a poster who sends an article to Usenet
> intends it to be stored on a multitude of serving agents, and has
> therefore given permission for it to be copied to that extent.
> Nevertheless, Usenet is not exempt from the Copyright laws, and it
> should not be assumed that permission has been given for the article
> to be copied outside of Usenet, not for its permanent archiving
> contrary to any Archive header that may be present.
> Posters also need to be aware that they are responsible if they
> breach Copyright, Libel, Harrassment or other restrictions relating
> to material that they post, and that they may possibly find
> themselves liable for such breaches in jurisdictions far from their
> own. Serving agents may also be liable in some jurisdictions,
> especially if the breach has been explicitly drawn to their
> attention.
> Users who are concerned about such matters should seek advice from
> competent legal authorities.
I'm somewhat uncomfortable with including this sort of thing in a
technical standard, since none of us (to my knowledge) are lawyers and the
above is essentially "legal advice," not of the sort that one can be sued
for, but still of the sort that flies around a lot and doesn't mean very
much. It's all advise to *posters* and *users* of news software, whereas
I think RFCs are primarily targetted to *implementors*.
If there was some obvious liability for *implementors* of news software, I
could see mentioning that, but none of the above applies to the people who
write the software.
-- Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>