[news.admin] Suspectd forgery

vnend@phoenix.Princeton.EDU (D. W. James) (10/25/89)

In article <1989Oct20.174431.5665@ux1.cso.uiuc.edu> afw10544@uxa.cso.uiuc.edu (Tony Wang) supposedly writes:
)     You know, the more things change, the more they stay the same.
)When I left the net, there were massive discussions going on about fat,
)who you would date, and so on.

But the header looks like:
 
Path: phoenix!princeton!udel!wuarchive!uwm.edu!ux1.cso.uiuc.edu!uxa.cso.uiuc.edu!afw10544
>From: afw10544@uxa.cso.uiuc.edu (Tony Wang)
Newsgroups: soc.singles
Subject: Re: The Fat Topic Yet Again
Message-ID: <1989Oct20.174431.5665@ux1.cso.uiuc.edu>
Date: 20 Oct 89 17:44:31 GMT
References: <20843@gryphon.COM> <2330@cbnewsd.ATT.COM> <1031@upvax.UUCP> <PEL.89Oct16134455@unhd.UUCP> <1033@upvax.UUCP>
Sender: paul@ux1.cso.uiuc.edu (Paul Pomes)
Reply-To: afw10544@uxa.cso.uiuc.edu (Tony Wang)
Distribution: usa
Organization: University of Illinois at Urbana-Champaign
Lines: 33

	Not the posting looks like it originated from ux1, and that the
message ID backs this up.  So maybe someone named Paul Pomes posted it.

	But... I noticed a little while back that postings routed through
ux1 get a funny path, where ux1.cso.uiuc.edu is duplicated, and this one
is missing that error.  So it is suspect that it even came from UIUC.


-- 
Later Y'all,  Vnend                       Ignorance is the mother of adventure.   
SCA event list? Mail?  Send to:vnend@phoenix.princeton.edu or vnend@pucc.bitnet   
        Anonymous posting service (NO FLAMES!) at vnend@ms.uky.edu                    
       "People are beer's way of ensuring that there will be more beer."

coolidge@brutus.cs.uiuc.edu (John Coolidge) (10/25/89)

vnend@phoenix.Princeton.EDU (D. W. James) writes:
>In article <1989Oct20.174431.5665@ux1.cso.uiuc.edu> afw10544@uxa.cso.uiuc.edu (Tony Wang) supposedly writes:
>> [Text]

>But the header looks like:
>[Irrelevant bits deleted]
>Path: phoenix!princeton!udel!wuarchive!uwm.edu!ux1.cso.uiuc.edu!uxa.cso.uiuc.edu!afw10544
>From: afw10544@uxa.cso.uiuc.edu (Tony Wang)
>Message-ID: <1989Oct20.174431.5665@ux1.cso.uiuc.edu>
>Sender: paul@ux1.cso.uiuc.edu (Paul Pomes)

>	Not the posting looks like it originated from ux1, and that the
>message ID backs this up.  So maybe someone named Paul Pomes posted it.

ux1 is an nntp server, and thus the generated message id can differ from
the site where the user is 'From:'. uxa is the free student machine here,
so it's quite possible that Tony Wang posts from his account there -- I
just checked, and the last login was yesterday. Paul Pomes is the news
site admin for Computing Services, which runs ux1 and uxa, so the
Sender: field probably lists his name becuase of that (I just checked, and
a bunch of postings originating from uxa show ux1 in the message-id and
Paul Pomes' name in the Sender: field). This is actually fairly correct
use of Sender: (RFC1036: "It is intended to record the entity responsible
for submitting the message to the network. ... The primary purpose of this
field is to be able to track down messages to determine how they were
entered into the network"). A more correct usage would be to generate
Sender: news@ux1.cso.uiuc.edu, which ux1 used to produce (I'm not sure
why the switch was made).

Anyway, I doubt that this was a forgery --- and if it was, I suspect that
it originated on uxa.

--John

--------------------------------------------------------------------------
John L. Coolidge     Internet:coolidge@cs.uiuc.edu   UUCP:uiucdcs!coolidge
Of course I don't speak for the U of I (or anyone else except myself)
Copyright 1989 John L. Coolidge. Copying allowed if (and only if) attributed.
You may redistribute this article if and only if your recipients may as well.