[news.admin] Someone is editing headers

kurt@hi.unm.edu (Kurt Zeilenga) (01/04/88)

Someone along: hyubvwa!hplsla!tikal!uw-beaver!mit-eddie!husc6!cmcl2!beta
is editing the "From:" and "Message-ID:" headers.  Sites along this path
should check their news implementations for correctness.

I would suspect it is not a backbone site (otherwise we would see lots of
these) or posting site and their neighbors (otherwise we would see only
the bad ones).

Here are the two bad articles (headers only) I found in comp.lang.c and
the coressponding good articles (both arrived here, hi.uucp, and at
hc.uucp).

> Path: hi!hc!beta!cmcl2!husc6!mit-eddie!uw-beaver!tikal!hplsla!hpubvwa!codas!karthur
> From: karthur@codas
		^^^^^ stripped domain
> Newsgroups: comp.lang.c
> Subject: Turbo C--Current Version???
> Message-ID: <1464@codas>
		    ^^^^^ stripped domain
> Date: 30 Dec 87 13:42:00 GMT
> Lines: 15
 
> Path: hi!hc!beta!cmcl2!husc6!mit-eddie!uw-beaver!tikal!hplsla!hpubvwa!mimsy!chris
> From: chris@mimsy
	      ^^^^^ stripped domain
> Newsgroups: comp.lang.c
> Subject: pointer arithmatic error messages
> Message-ID: <9979@mimsy>
	            ^^^^^ stripped domain
> Date: 30 Dec 87 13:18:00 GMT
> Lines: 29
 

> Path: hi!hc!ames!hao!gatech!codas!karthur
> From: karthur@codas.att.com (Kurt_R_Arthur)
> Newsgroups: comp.lang.c
> Subject: Re: Turbo C--Current Version???
> Message-ID: <1464@codas.att.com>
> Date: 30 Dec 87 14:42:21 GMT
> References: <3195@ihlpf.ATT.COM>
> Organization: AT&T, Altamonte Springs, FL
> Lines: 15
 
> Path: hi!hc!ames!umd5!mimsy!chris
> From: chris@mimsy.UUCP (Chris Torek)
> Newsgroups: comp.lang.c
> Subject: Re: pointer arithmatic error messages
> Keywords: pointer aritmatic pcc
> Message-ID: <9979@mimsy.UUCP>
> Date: 30 Dec 87 14:18:52 GMT
> References: <3899@uw-june.UUCP>
> Organization: U of Maryland, Dept. of Computer Science, Coll. Pk., MD 20742
> Lines: 29
-- 
	Kurt (zeilenga@hc.dspo.gov)

fair@ucbarpa.Berkeley.EDU (Erik E. Fair) (01/04/88)

This is almost certainly one of the HP sites; they run notesfiles
almost exclusively which is known to exhibit this kind of poor
network behavior. Notesfiles sites should not be anything other
than leaf nodes.

	Erik E. Fair	ucbvax!fair	fair@ucbarpa.berkeley.edu

wunder@hpcea.CE.HP.COM (Walter Underwood) (01/05/88)

    This is almost certainly one of the HP sites; they run notesfiles
    almost exclusively which is known to exhibit this kind of poor
    network behavior.

This is caused by hplsla, and I'm going to go hammer on them.  They
are running software that has been obsolete for about a year and a
half.  I'm not sure why it just showed up in the last couple of weeks,
perhaps they changed their feeds.

    Notesfiles sites should not be anything other than leaf nodes.

Though this is true in general, the version of Notes in use inside HP
(except at hplsla!) is a good B News citizen, and does not have this
limitation.  Inside HP, we mix News and Notes sites indiscriminately.

	Erik E. Fair	ucbvax!fair	fair@ucbarpa.berkeley.edu

Walter Underwood
wunder@hplabs.hp.com

bobk@hplsla.HP.COM ( Bob Kunz) (01/08/88)

kurt@hi.unm.edu writes:

|Someone along: hyubvwa!hplsla!tikal!uw-beaver!mit-eddie!husc6!cmcl2!beta
|is editing the "From:" and "Message-ID:" headers.  Sites along this path
|should check their news implementations for correctness.

wunder@hplabs.hp.com writes:

|This is caused by hplsla, and I'm going to go hammer on them.  They
|are running software that has been obsolete for about a year and a
|half.  I'm not sure why it just showed up in the last couple of weeks,
|perhaps they changed their feeds.
|
	Since we were along the path that exhibited the original
	problem, we did investigate and solve this problem.  As it
	turns out, hpubvwa was delivering news to hplsla using an
	older protocol that did not support B News.  hplsla's software
	has been kept up to date and we have been exchanging news 
	with tikal since 1984.  The older protocol from hpubvwa to
	hplsla did not show up sooner because hpubvwa was the head of a 
	dead end list of machines and articles posted there (or down stream) 
	would have enough header information available for people not to 
	notice the missing information.  About two weeks ago, b-mrda decided
	the comp.* feed from hpubvwa was not fast enough, so they started
	exchanging comp.* with polari.  The two articles brought up as
	examples (there are numerous others) all beat our normal feed
	from tikal to hplsla.  That is, they arrived through polari
	and b-mrda through hpubvwa before through tikal.  The headers
	got stripped between hpubvwa and hplsla.  The real (un-stripped)
	version arrived from tikal and two distinct (but the same text)
	articles got propagated from us.

	I am sorry for being a part of this problem.  We did not
	intend for anything like this to happen and think we acted
	appropriately to repair the fault.

	Bob Kunz
	

wunder@hpcea.CE.HP.COM (Walter Underwood) (01/20/88)

An update on the duplicate articles earlier this month.  They were
caused by an old-style Notes feed inside HP (old-style Notes had no
way to store the domain on a message-ID).  So Erik Fair's analysis was
right:

    This is almost certainly one of the HP sites; they run notesfiles
    almost exclusively which is known to exhibit this kind of poor
    network behavior.

My first guess (posted to the net) was that it was caused by hplsla.
In fact it was a system that fed hplsla, and the folks at hplsla
helped track down the problem.  Lord knows how the old-style feed went
undetected for so long, but it was fixed a couple of days after we
noticed it.

These days we use news batches for transport, and only a serious
student of article headers can distinguish articles posted at a Notes
site from those posted at a News site.

Walter Underwood
wunder@hplabs.hp.com