From: dlv@bwalk.dm.com (Dr. Dimitri Vulis)
Date: Mon, 2 Oct 95 04:41:22 PDT
Subject: Re: FORGED CANCELS of posts on n.a.n-a.m
In-Reply-To: <modemacDFr0qB.IyK@netcom.com>
Message-ID: <6FBccD15w165w@bwalk.dm.com>
MIME-Version: 1.0
Content-Type: text/plain


In article <modemacDFr0qB.IyK@netcom.com>, Rt. Rev. Modemac writes:
>Dr. Dimitri Vulis (dlv@bwalk.dm.com) wrote:
>: The National Alliance are not the first despicable racist net.abusers who forge
>: cancels for other people's articles critical of them on n.a.n-a.m. Ken Arromdee
>: has condemned one such forger, the graduate student Pyotr Vorobiev from Lehigh
>: University's Mechanical Engineering and Mechanics Department (+1 610 758 4100)
>
>When Scientology began cancelling posts by their critics on
>alt.religion.scientology, Homer Wilson Smith wrote a program called
>"Lazarus" to track for cancels.  The idea is simple: whenever a cancel
>message appears, Lazarus announces it on the newsgroup.
>
>Mayhap a Lazaraus-type program can be put into effect on
>news.admin.net-abuse.misc?

Many other newsgroups are affected by such net.abuse (Vorobiev-style forged
cancels based on contents); I just saw some messages on forged cancels in
soc.culture.jewish and soc.culture.german. I think running Lazarus-like
programs in _all_ newsgroups would be an extremely Good Idea.

Alas, the time when people used to contribute their time and equipment for
the public good of the net seems to be over. Peraps I'm just dreaming; or
perhaps Dave Hayes will like the following idea enough to implement it.

Also, I think it's a matter of time before some Cancelpoodle figures to put
'light' into the Path: of its Vorobiev-style forged cancels; then they will not
be seen by lighlink.com where Lazarus now runs. This needs to be addressed.

Anyway, here are my thoughts on this proposal:

There would be a collection (at least 5 or 6) of cancel-watchers (sort of like
the deamons that now watch misc.test) all over the world. They should be
well-connected (preferrably, one hop away from sites like uunet,
howland.reston.ans.net, etc).

Each watcher would look at incoming articles in "control", and whenever it sees
a cancel, it would replace its own uucp name in the path by something like
ellipsis (to keep it confidential) and forward the cancel to a central
cataloguer (singly or in batches). E.g., is a watcher at xyzz123.uucp saw a
cancel with the header

Path: xyz123!howland.reston.ans.net!someplace

it would send it to the cataloguer with the Path: replaced by

Path: ...!howland.reston.ans.net!someplace

The cataloguer would wake up every few hours (for example), group the collected
cancels by message-ids of the cancelled articles, and e-mail reports to the
(distinct) addresses (other than "usenet@*" or "news@*") mentioned in the
"From:", "Sender:", "Authorized:", and "X-Cancelled-By:" headers, and quoting
the entire cancel and the Path's as seen at different sites by the
cancel-watchers. This way, if the cancel is forged, its author will learn
within hours that it has been fraudulently cancelled and will automatically
receive enough Path: samples from all over the world to see where it was
posted, by comparing the Path headers in several copies of cancels.

A user or an entire site should be able to "opt out" of having its cancels
reported by sending a command to the cataloguer.

There should be a limit of, say, no more than 100 such notifications sent to a
site in one batch (to prevent too much traffic in the event of really massive
forged cancellation).

I don't have the resources to do this right now, but I would be happy if some
civic-minder netters took this proposal and ran with it.

---

Dr. Dimitri Vulis
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps