From: Erland Sommarskog (sommar@algonet.se)
Date: Sat Jan 12 2002 - 14:02:43 CST
John Stanley <stanley@peak.org> writes:
> Charles Lindsey (chl@clw.cs.man.ac.uk):
>
> >OK, it now say, in the duties of an injecting agent:
>
> > 10.The injecting agent MAY add other headers not already provided by
> > the poster,
>
> Unacceptable. It MUST NOT insert what it cannot know. This is especially
> true in the case of Sender, where inserting this header changes the
> meaning of the From header.
I simply don't care to follow to your long rant, but I can't escape
to point out an error here. A server can very well know that you are
authenticated as nisse@bigbizcorp.com. Then whether the address
myprivatemail@hotmail.com that you have specified is real or fake,
the server just simply don't give a damn about. Because at Big Biz
Corp you are supposed to use your real address, and your real address
with Big Biz Corp. If you don't like that, take the discussion with
Big Biz Corp, and not with us.
A slighly different case where such a policy could be in force is a
server which harbours some private newsgroups, and the owner of the
groups want people to state their logins somewhere. For instance,
this could be a newsgroup for beta evaluation, and you login with
your beta ID, which then turns up in, say, Sender.
> > NOTE: Care needs to be exercised, when adding any non-mandatory
> > header in this way, to ensure that the intentions of the poster
> > are preserved. In particular, the addition of a Sender header
> > would have privacy implications similar to those set out in
> > 6.19.1 regarding the Injector-Info header.
>
> Unacceptable. This implies that it is correct behaviour for an injector to
> insert a Sender header, when it simply is not.
I haven't followed current pratice very closely, but many many years
ago, this was certainly a common behaviour.
-- Erland Sommarskog, Stockholm, sommar@algonet.se