From: Richard Charles Graves <llurch@networking.stanford.edu>
Date: Sun, 15 Oct 95 23:29:26 PDT
To: postmaster@microsoft.com
Subject: Forged cancels of posts critical of Microsoft, *apparently* through internetmci.com or nasa.gov
Message-ID: <199510160629.XAA11766@Networking.Stanford.EDU>
MIME-Version: 1.0
Content-Type: text/plain


-----BEGIN PGP SIGNED MESSAGE-----

These are the forged cancels for my articles critical of Microsoft. *Many
Thanks* to the person who forwarded them to me; our server expires control
way too fast.

Somebody did an acceptable forge on the Message-ID, but the Path is quite
wrong. Can anybody help me catch this fool? I'm somewhat out of my element
here.

The most serious posts are available on the Web at
http://www-leland.stanford.edu/~llurch/win95netbugs/IP-Security-Bug.txt.asc,
and on the gopher archive at gopher://quixote.stanford.edu/1m/win95netbugs.

- -rich graves
 networking systems
 stanford university
 llurch@networking.stanford.edu


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMIH0IIND7LjhcPQ9AQFojQP/UrB/Us1PK8ne1GnsFxqXXVCJpanEKciH
p9wqVMfBJOTBdkYBHkuSHkdeaJfXz6QfEQYGZr6HIN/DD8A/VNOSB+dgCbBUYcOj
2/b+x+7CBfGvEsrbIVLxWl/Eua5pIcjWLLmfgYu3dCneDOqrXO9ehZSDg1JD9tTt
Av6lQIxTuVM=
=V+nf
-----END PGP SIGNATURE-----

[You always think of something after signing, don't you?]
Also emailed to postmaster@internetmci.com and  postmaster@news.msfc.nasa.gov. 
Was that right? Doesn't microsoft.com get its news feed from internetmci? 
OK, I'll Cc them, because I know they don't want anyone to believe that 
this was done by a Microsoft employee.

The cancel for 
<Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.EDU>, only,
is legitimate, and provides a very good comparison. I'm sure the forger 
studied it; so should we.

Path: rand.org!usc!howland.reston.ans.net!swrinde!elroy.jpl.nasa.gov!sdd.hp.com!
hplabs!unix.sri.com!news.Stanford.EDU!not-for-mail
From: llurch@Networking.Stanford.EDU (Richard Charles Graves)
Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo
ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin
g.tcp-ip,comp.protocols.tcp-ip.ibmpc
Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanfo
rd.EDU>
Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.ED
U>
Date: 13 Oct 1995 15:55:40 -0700
Organization: Stanford University
Lines: 1
Message-ID: <45mqpc$hn@Networking.Stanford.EDU>
NNTP-Posting-Host: networking.stanford.edu

<Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.EDU> was cancelled
 from within trn.

Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas
a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo
r-mail
From: llurch@Networking.Stanford.EDU (Richard Charles Graves)
Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo
ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin
g.tcp-ip,comp.protocols.tcp-ip.ibmpc
Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanfo
rd.EDU>
Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.ED
U>
Date: 13 Oct 1995 15:58:14 -0700
Organization: Stanford University
Lines: 1
Message-ID: <45mqu6$iu@Networking.Stanford.EDU>
NNTP-Posting-Host: networking.stanford.edu

<Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.EDU> was cancelled
 from within trn.

Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas
a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo
r-mail
From: llurch@Networking.Stanford.EDU (Richard Charles Graves)
Newsgroups: control,comp.protocols.tcp-ip.ibmpc,comp.os.ms-windows.networking.tc
p-ip
Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanfo
rd.EDU>
Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.ED
U>
Date: 13 Oct 1995 16:00:48 -0700
Organization: Stanford University, CA 94305, USA
Lines: 1
Message-ID: <45mr30$kh@Networking.Stanford.EDU>
NNTP-Posting-Host: networking.stanford.edu

cancel <Pine.ULT.3.91.951013145012.29858A-100000@Networking.Stanford.EDU>

Path: rand.org!usc!math.ohio-state.edu!uwm.edu!lll-winken.llnl.gov!fnnews.fnal.g
ov!unixhub!news.Stanford.EDU!not-for-mail
From: llurch@Networking.Stanford.EDU (Richard Charles Graves)
Newsgroups: comp.os.ms-windows.win95.misc,comp.os.ms-windows.win95.setup,comp.os
.ms-windows.apps.winsock.mail,comp.os.ms-windows.apps.winsock.misc,comp.os.ms-wi
ndows.apps.winsock.news
Subject: cmsg cancel <45nvip$ab6@nntp.Stanford.EDU>
Control: cancel <45nvip$ab6@nntp.Stanford.EDU>
Date: 14 Oct 1995 02:32:23 -0700
Organization: Stanford University
Lines: 1
Message-ID: <45o038$3ip@Networking.Stanford.EDU>
NNTP-Posting-Host: networking.stanford.edu

<45nvip$ab6@nntp.Stanford.EDU> was cancelled from within trn.