From: Mark <mark@blackplague.gmu.edu>
Date: Tue, 21 Dec 93 03:29:24 PST
To: MERCURY@lcc.edu (Michael E. Marotta)
Subject: Re: Regarding "Free Willy"
In-Reply-To: <455B48CD008002F1@sleepy.egr.msu.edu>
Message-ID: <9312211128.AA24720@blackplague.gmu.edu>
MIME-Version: 1.0
Content-Type: text


>I'm sorry to have to confess this, but I don't understand how I as 
>a mere user receiving mail am supposed to know that the Free Willy 
>message did not come from the President. 

You just have to learn to read mail headers to get the gist of what
they are saying.

>> Return-Path: <President@whitehouse.gov>
>> Received: from [144.92.136.35] by toad.com id AA13485; 
>>   Sun, 19 Dec 93 14:16:03 PST

This says toad.com was connected to by telgate.adp.wisc.edu[144.92.104.20]


>Then charliemerritt offers another solution.
> 
>> Return-path: President@whitehouse.gov
>> Received: from delphi.com by bix.com (CoSy3.31.1.45) id
>>  <9312191740.memo.19248@BIX.com>; Sun, 19 Dec 1993 17:40:07 -0500 (EST)
>> Received: from relay2.UU.NET by delphi.com (PMDF V4.2-11 #4520) id
>> <01H6O7JJ9BJK94H43Q@delphi.com>; Sun, 19 Dec 1993 17:37:58 EDT
>> Received: from toad.com by relay2.UU.NET with SMTP
>>  (5.61/UUNET-internet-primary) id AA10179; Sun, 19 Dec 93 17:37:09 -0500
>> Received: by toad.com id AA13572; Sun, 19 Dec 93 14:19:04 PST
>> Received: by toad.com id AA13552; Sun, 19 Dec 93 14:17:31 PST
>> Received: from [144.92.136.35] by toad.com id AA13485; Sun,
>>  19 Dec 93 14:16:03 PST
>> From: President@whitehouse.gov
>> Date: Sun, 19 Dec 1993 14:13:02 -0800 (PST)
>> To: charliemerritt@bix.com
>> Message-id: <9312192216.AA13485@toad.com>
>> Content-transfer-encoding: 7BIT
>> X-Envelope-to: bix.com!charliemerritt
>> Apparently-To: Cypherpunks

Read from the bottom up, it's to charliemerrit@bix.com.

It *says* from president@whitehose.gov.

toad got it from good old telgate.adp.wisc.edu It looks like it tried
to deliver it a couple of times before succeeding.

then it went thru uunet, to delphi.com and then to bix.com...
obviously bix gets it's mailfeed via delphi. (they provide commercial
ip and usenet/mail feeds)

It was faked basically. A big clue is when it has "Apparently-To:" in
the header...

Mark