Re: Injection-Date and reinjection

["Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>]

In <45B628CD.8080706@xxxxxxxxxxxxxxx> "Forrest J. Cavalier III" <mibsoft@xxxxxxxxxxxxxxx> writes:

>Charles Lindsey wrote:

>> Yes, my preference is to preserve all the Path header, even early parts of
>> it that recorded its progress through some private system before getting
>> injected into Usenet. It will do litle harm, and may help unravel some
>> complicated cases where things have gone wrong. That is why Usepro-06 said
>> SHOULD preserve the old Path during reinjection. Then you get to see the
>> full story of exactly where it has been.
>> 

>You are comingling two points of argument, I think.  I do not consider
>the Path header as trace information.

Eh? I regard Path very much as trace information, our equivalent to the
email Received header (but much less verbose). It is certinaly widely used
for that purpose, for trying to find out where spam and other malpractice
originated - which requires some estimate of which parts of the Path are
bogus, which is the primary reason we have added diagnostic information to
it.

>I don't see any way to preserve Path except by renaming before reinjection. 
>Reinjection is a POST through an injecting agent, after all.

So, injection inserts a "POSTED" and reinjection inserts a second "POSTED"
which, if the article then appears "iffy" or otherwise spamish, directs
your attention immediately to the point to which your suspicions should be
directed.

>Either injecting agents are responsible for adding trustable headers to the 
>proto articles (after removing any that are present) or they are not.

Destruction of evidence can only hinder forensics.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: chl@xxxxxxxxxxxxxxxx      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5