karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) (02/25/88)
I'm a seriously confused individual. Quite out of the blue, I got the following message: ====================================================================== |Received: by tut.cis.ohio-state.edu (5.54/2.0) | id AA08417; Tue, 23 Feb 88 22:00:52 EST |Message-Id: <8802240300.AA08417@tut.cis.ohio-state.edu> |Received: from OREGON1.UOREGON.EDU by CUNYVM.CUNY.EDU ; Tue, 23 Feb 88 21:58:30 EST |Received: by OREGON1 (Mailer X1.25) id 7370; Tue, 23 Feb 88 18:56:35 PST |Date: Tue, 23 Feb 1988 18:56 PST |From: Revised List Processor (1.5m) <LISTSERV%OREGON1.BITNET@CUNYVM.CUNY.EDU> |Subject: Output of job "EMACS" from RSCS@UWAVM |To: KARL@TUT.CIS.OHIO-STATE.EDU | |Command replies from RSCS@UWAVM are being forwarded to you. |This server has been placed offline. Processing of |your DISTRIBUTE request has been postponed. ====================================================================== This is rather unusual. I know what RSCS is on IBM beasties (much to my chagrin), but I don't know the machine UWAVM, I haven't written any mail on Emacs-related things to anyone on the Internet in several weeks, and I don't know why it would be performing a DISTRIBUTE request for me. (But I can tell it's from the BITNET because IT BELIEVES IN UPPER CASE...) it was addressed very specifically to me, though not at the address from which I normally write mail; I "live" on Triceratops, not Tut. So I sent a request to the addresses that seemed logical, looking for some info about why I got it: ====================================================================== |From karl Wed Feb 24 10:02:36 1988 |To: postmaster@oregon1.bitnet, listserv@oregon1.bitnet |Subject: [LISTSERV%OREGON1.BITNET@CUNYVM.CUNY.EDU: Output of job "EMACS" from RSCS@UWAVM] | |Why have I received this, and what is it supposed to be telling me? | |--Karl Kleinpaste |Ohio State Computer Science | |[original message forwarded here] ====================================================================== I figured that a reply back to LISTSERV ought to do some good, and a request to postmaster *ought* to get something identifiable. Nope, I lose again. I just got this a couple of minutes ago: ====================================================================== |Received: from CUNYVM.CUNY.EDU by triceratops.cis.ohio-state.edu (3.2/2.0) | id AA00267; Wed, 24 Feb 88 11:28:57 EST |Message-Id: <8802241628.AA00267@triceratops.cis.ohio-state.edu> |Received: from OREGON1.UOREGON.EDU by CUNYVM.CUNY.EDU ; Wed, 24 Feb 88 10:45:10 EST |Received: by OREGON1 (Mailer X1.25) id 1839; Wed, 24 Feb 88 07:02:36 PST |Date: Wed, 24 Feb 1988 07:02 PST |From: Revised List Processor (1.5m) <LISTSERV%OREGON1.BITNET@CUNYVM.CUNY.EDU> |Subject: Output of your job "karl" |To: karl@triceratops.cis.ohio-state.edu | |> Why have I received this, and what is it supposed to be telling me? |Unknown command -- "WHY". Try HELP. | |All subsequent commands have been flushed. ====================================================================== OK, fine. The appropriate response now seems to be to ignore the issue entirely; asking questions is just generating more useless traffic in my mailbox. But I'd sure like to know what the original note was trying to tell me and, at least as important, what job about Emacs it is that's got my name on it at that machine. Dazed and confused, Karl
hirai@swatsun.uucp (Eiji "A.G." Hirai) (02/26/88)
In article <7136@tut.cis.ohio-state.edu< karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) writes:
< I'm a seriously confused individual. Quite out of the blue, I got the
< following message:
<
< |From: Revised List Processor (1.5m) <LISTSERV%OREGON1.BITNET@CUNYVM.CUNY.EDU<
< |Subject: Output of job "EMACS" from RSCS@UWAVM
< |
< |Command replies from RSCS@UWAVM are being forwarded to you.
< |This server has been placed offline. Processing of
< |your DISTRIBUTE request has been postponed.
We also got this for one of our users here at swatsun.uucp.
We're not even a Bitnet site - ours came through two uucp sites.
Boy, this brain-damaged software must really be desperate...
Here's what we got:
< Received: by OREGON1 (Mailer X1.25) id 8344; Tue, 23 Feb 88 21:21:22 PST
< Date: Tue, 23 Feb 1988 21:21 PST
< From: Revised List Processor (1.5m) <LISTSERV@OREGON1<
< Subject: Output of job "INFO-C" from RSCS@UWAVM
<
< Command replies from RSCS@UWAVM are being forwarded to you.
< This server has been placed offline. Processing of
< your DISTRIBUTE request has been postponed.
<
< Received: by OREGON1 (Mailer X1.25) id 8706; Tue, 23 Feb 88 22:00:38 PST
< Date: Tue, 23 Feb 1988 21:53 PST
< From: Revised List Processor (1.5m) <LISTSERV@OREGON1<
< Subject: Output of job "INFO-C" from RSCS@UWAVM
<
< Command replies from RSCS@UWAVM are being forwarded to you.
< RSCS@UWAVM has sent a DISTRIBUTE job to LISTSERV@OREGON1 with your userid as
< "from" origin. This job has been processed with the origin being forced back
< to "RSCS@UWAVM". Please contact the LISTSERV Coordination Board
< <LCOORD-L@FRECP11< if you think that "RSCS@UWAVM" should have been treated
< as a "trusted" userid.
< Invalid mail origin specification.
<
< |From: Revised List Processor (1.5m) <LISTSERV%OREGON1.BITNET@CUNYVM.CUNY.EDU<
< |Subject: Output of your job "karl"
< |To: karl@triceratops.cis.ohio-state.edu
< |
< |< Why have I received this, and what is it supposed to be telling me?
< |Unknown command -- "WHY". Try HELP.
< |
< |All subsequent commands have been flushed.
Wow, I love replies like this!! If someone finds out what
this is, please let us know. We're mighty interested in who's doing this
thing...
-a.g. hirai
--
Eiji "A.G." Hirai @ Swarthmore College, Swarthmore PA 19081 | Tel. 215-543-9855
UUCP: {rutgers, ihnp4, cbosgd}!bpa!swatsun!hirai | "All Cretans are liars."
Bitnet: vu-vlsi!swatsun!hirai@psuvax1.bitnet | -Epimenides
Internet: bpa!swatsun!hirai@rutgers.edu | of Cnossus, Cretescott@zorch.UU.NET (Scott Hazen Mueller) (02/28/88)
In article <7136@tut.cis.ohio-state.edu> karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) writes: < |From: Revised List Processor (1.5m) <LISTSERV%OREGON1.BITNET@CUNYVM.CUNY.EDU< < |Subject: Output of job "EMACS" from RSCS@UWAVM In article <1619@tulum.UUCP> hirai@swatsun.uucp (Eiji "A.G." Hirai) writes: < From: Revised List Processor (1.5m) <LISTSERV@OREGON1< < Subject: Output of job "INFO-C" from RSCS@UWAVM There was another one, Subject: line something like "Output of job "INFO-APP". Now, to me these things look like Internet/Bitnet style redistributions of Usenet newsgroups, possible with the names chopped of somewhere. Did either of you post stuff to comp.emacs (Karl) or comp.lang.c (Eiji) recently? Just my nickel's worth... \scott -- Scott Hazen Mueller scott@zorch.UU.NET (408) 245-9461 (pyramid|tolerant|uunet)!zorch!scott
rsalz@bbn.com (Rich Salz) (02/28/88)
I get lots of those stupid !@#$ BITNET failure messages, lately it seems
I'm guaranteed to get at least one for each comp.sources.unix article I
put out. I have found that the only thing that works is to send a sharp
message, full of lots of SHOUTING CAPITALS to {postmaster,listserv,rscs}@
{every-host-mentioned-in-a-header} with all the mail messages appended.
If anyone knows of a better place to complain about this kind of stuff,
I'd like to hear about it ASAP; isn't there a BITNET engineering task
meeting this week? (I wish I could avoid the tendency to claim that's
on oxymoron. :-)
/rich $alz, moderator of comp.sources.unix
--
For comp.sources.unix stuff, mail to sources@uunet.uu.net.dboyes@uoregon.UUCP (David Boyes) (02/28/88)
In article <1619@tulum.UUCP> hirai@swatsun.uucp (Eiji "A.G." Hirai) writes: >In article <7136@tut.cis.ohio-state.edu< karl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) writes: >[a lot of whining...] I sent the following letter to Karl a few days ago. These messages are legitimate and are caused by the software DOING THE RIGHT THING. The software compares the real origin of the file with the address inside the file -- if there is a difference AND the origin is not a trusted source, then the software should notify you that someone is trying to forge an article in your name. The message below explains the cause of the messages. ----------------------------Original message---------------------------- Sorry for the slow response -- your mail only arrived this morning. The reason for the error messages you have been receiving is due in some degree to the way mail and newsgroups are gatewayed into BITNET from Usenet and the Internet. Gateway points provide relay service, which is then formed into BITNET mail messages which are introduced into the store and forward network. Each store and forward file has an origin ID attached to it -- essentially who transmitted it. When your messages for several newsgroups were gatewayed into BITNET (about a week and a half after you wrote them -- thank the comp.os.vms and Info-VAX people for that) the link between University of Washington (UWAVM) and University of Oregon(OREGON1) was inoperative, causing RSCS (the network transmission control program) to hold files destined for OREGON1 until the link came back up. The link was down for about a day, causing a fair-sized buildup. The folks at UW transferred a lot ot the files to another userid, mainly to allow other traffic to live links to pass through. The OREGON1 link came back up and they began transferring some of the queued files back to RSCS for transmission. Unfortunately, in transferring them BACK to RSCS, the origin ID got munged, thus causing all of the mail daemons, mailing list servers, etc. to send out "possible bogus message" warnings to me (the postmaster -- ever want to deal with 2500 pieces of mail in a single day? The mind boggles....) and to YOU, the person that is ostensibly the one being impersonated. That's the whole story. Sorry for any inconvenience. ----------------------------------------------------------------------------- The situation has been corrected. *flame on* To those of you who think our software is brain-damaged, AT LEAST IT TRIES TO BE IMPOSTER-PROOF. RN certainly isn't. *flame off* -- David Boyes | ARPA: 556%OREGON1.BITNET@CUNYVM.CUNY.EDU Systems Division | BITNET: 556@OREGON1 UO Computing Center | UUCP: dboyes@uoregon.UUCP 'How long d'ya think it'll be before just us oldtimers remember WISCVM?'
rsalz@bbn.com (Rich Salz) (02/29/88)
In comp.mail.misc (<1615@uoregon.UUCP>), dboyes@drizzle.UUCP (David Boyes) writes: >I sent the following letter to Karl a few days ago. These messages are >legitimate and are caused by the software DOING THE RIGHT THING. No they're not. See below. >*flame on* >To those of you who think our software is brain-damaged, AT LEAST IT >TRIES TO BE IMPOSTER-PROOF. RN certainly isn't. >*flame off* Usenet is not electronic mail. RN does not try to be imposter-proof because the the underlying transport mechanism (UUCP or NNTP) are known to be insecure. We live with that. What does that have to do with mail, and why would a Usenet poster give a rat's ass? David explained the UOREGON failure messages tons of folks recently got came about because some local person moved queued mail files. The system later delivered the mail messages, but noticed they user-id's weren't kosher, so it sent mail to everyone saying "hey, I sent a mail message out under your name, but it might have been forged." Note the words "a mail message"; a prolific mail writer doesn't stand a snowball's chance of figuring out *which* mail message. **If the BITNET mailer thought the message was spoofed it should have sat **on it and told the postmaster! It should not have sent it! As I've said before, I get lots of messages from BITNET sites almost every time I put out something in comp.sources.unix. I'm tired of it, and I will continue to complain and gripe in public forums to drum up sympathy and support to get it stopped. /r$ -- For comp.sources.unix stuff, mail to rsalz@uunet.uu.net.
dboyes@uoregon.UUCP (David Boyes) (02/29/88)
In article <448@fig.bbn.com> rsalz@bbn.com (Rich Salz) writes: >I get lots of those stupid !@#$ BITNET failure messages, lately it seems >I'm guaranteed to get at least one for each comp.sources.unix article I >put out. I have found that the only thing that works is to send a sharp >message, full of lots of SHOUTING CAPITALS to {postmaster,listserv,rscs}@ >{every-host-mentioned-in-a-header} with all the mail messages appended. Gee, I never thought I'd have to flame Rich Salz, failthful moderator of far too many groups to count, but here goes: How about sending a message to POSTMAST@UWAVM.BITNET before complaining to the whole net, Rich? You'll notice that the messages you're complaining about all come from RSCS@UWAVM -- why not start with the source of the problem? >If anyone knows of a better place to complain about this kind of stuff, >I'd like to hear about it ASAP; isn't there a BITNET engineering task >meeting this week? (I wish I could avoid the tendency to claim that's >on oxymoron. :-) See above. > /rich $alz, moderator of comp.sources.unix -- David Boyes | ARPA: 556%OREGON1.BITNET@CUNYVM.CUNY.EDU Systems Division | BITNET: 556@OREGON1 UO Computing Center | UUCP: dboyes@uoregon.UUCP 'How long d'ya think it'll be before just us oldtimers remember WISCVM?'
karl@tut.cis.ohio-state.edu (Karl Kleinpaste) (02/29/88)
dboyes@uoregon.UUCP writes:
I sent the following letter to Karl a few days ago.
Interestingly enough, I haven't received a copy of David's note via
mail; this is the first I've seen of it. So I'm successfully getting
automated replies to mail (which I don't want), and I'm not getting
hand-mailed replies (which I need rather a bit more).
These messages are
legitimate and are caused by the software DOING THE RIGHT THING.
No, it's not. I, as a random user at a random site writing mail to a
random mailing list, should never see any sort of internal weirdness
of anyone else's network. If it's true that the automated message
originated from something I posted to comp.emacs (entirely possible,
as I show up there reasonably often), then that is explicitly a
broadcast medium and I don't want to hear what goes on in the
propagation of it across the countryside. Not ever.
(And as an aside, my note was not "lots of whining," as claimed. I
merely posted that I had gotten a strange note which I could not
correlate with anything I'd written, couldn't get any direct help when
I went through the standard procedure for asking for help, and hence
posted here looking for network wisdom. I can't think of a better
approach to the problem. I'm open to new suggestions, though.)
*flame on*
To those of you who think our software is brain-damaged, AT LEAST IT
TRIES TO BE IMPOSTER-PROOF.
*flames doused*
You have no hope whatever of making the system imposter-proof so long
as you maintain connections with networks that openly and freely
acknowledge that they are not secure, including but not limited to
UUCP and the Internet.
Jeesh, I wasn't trying to spawn a "my network is better than your
network" flame-fest. I just wanted to know where the weird mail came
from.
Karlkarl@triceratops.cis.ohio-state.edu (Karl Kleinpaste) (02/29/88)
karl@tut.cis.ohio-state.edu (that's me) writes: Interestingly enough, I haven't received a copy of David's note via mail; this is the first I've seen of it. Well, it figures. Last night, I wrote the preceding sentence. This morning, about 15 minutes ago, David's note got here: |Received: from CUNYVM.CUNY.EDU by triceratops.cis.ohio-state.edu (3.2/2.0) | id AA02555; Mon, 29 Feb 88 10:32:03 EST |Message-Id: <8802291532.AA02555@triceratops.cis.ohio-state.edu> |Received: from CUNYVM.BITNET by CUNYVM.CUNY.EDU ; Thu, 25 Feb 88 21:31:16 EST |Received: from CUNYVM by CUNYVM.BITNET (Mailer X1.25) with BSMTP id 3983; Thu, 25 Feb 88 21:31:11 EST |Received: from OREGON1.UOREGON.EDU by CUNYVM.CUNY.EDU ; Thu, 25 Feb 88 21:31:09 EST |Received: by OREGON1 (Mailer X1.25) id 4424; Thu, 25 Feb 88 16:48:50 PST |Date: Thu, 25 Feb 88 16:36:29 PST |From: "David Boyes (Network Postmaster)" | <556%OREGON1.BITNET@CUNYVM.CUNY.EDU> |Subject: Odd mail -- please repost to news groups. |To: Karl <karl@triceratops.cis.ohio-state.edu> |Cc: "David Boyes (Network Postmaster)" <556@oregon1> Observe that it sat at cunyvm.cuny.edu from last Thursday until this morning. Cunyvm has been up, as has Triceratops; my syslog shows that a good volume of BITNET-related mail has been bouncing back and forth between OSU and CUNY except for a couple of hours on Sunday, but nonetheless it took 4 days to get his note from there to here. Sigh...
henry@garp.mit.edu (Henry Mensch) (03/01/88)
In article <1618@uoregon.UUCP>, dboyes@uoregon (David Boyes) writes: >How about sending a message to POSTMAST@UWAVM.BITNET before >complaining to the whole net, Rich? You'll notice that the messages >you're complaining about all come from RSCS@UWAVM -- why not start >with the source of the problem? Because POSTMAST@anyhostname isn't an obvious place to complain to (postmaster, on the other hand, is). If you don't know about the 8-character limitation for usernames and mail addresses then you don't know that sending mail to "postmaster" may not work. -- # Henry Mensch / <henry@garp.mit.edu> / E40-379 MIT, Cambridge, MA # {ames,cca,rochester,harvard,mit-eddie}!garp!henry
bob@allosaur.cis.ohio-state.edu (Bob Sutterfield) (03/01/88)
(Jumping into the fray with both feet, he held his breath and said:) In article <1618@uoregon.UUCP> dboyes@drizzle.UUCP (David Boyes) writes: <In article <448@fig.bbn.com> rsalz@bbn.com (Rich Salz) writes: <>I... send a... message... to {postmaster,listserv,rscs}@ <>{every-host-mentioned-in-a-header} ... <... <How about sending a message to POSTMAST@UWAVM.BITNET before <complaining to the whole net, Rich? It seems he tried to, and Karl said he did the same, which is what touched off this whole discussion! How about supporting a standard mailing address for mail problems, David? At least, can your machine use a ten-character long mail delivery alias to turn "POSTMASTER" into "POSTMAST"? -=- Bob Sutterfield, Department of Computer and Information Science The Ohio State University; 2036 Neil Ave. Columbus OH USA 43210-1277 bob@cis.ohio-state.edu or ...!cbosgd!osu-cis!bob
dboyes@uoregon.UUCP (David Boyes) (03/01/88)
In article <7385@tut.cis.ohio-state.edu> karl@tut.cis.ohio-state.edu (Karl Kleinpaste) writes: >(And as an aside, my note was not "lots of whining," as claimed. I >merely posted that I had gotten a strange note which I could not >correlate with anything I'd written, couldn't get any direct help when >I went through the standard procedure for asking for help, and hence >posted here looking for network wisdom. I can't think of a better >approach to the problem. I'm open to new suggestions, though.) Sorry about that, Karl. I was in a filthy mood -- realize that for every one of those messages you got, I got THREE. One as postmaster, one as mailing list server maintainer, and one as mail daemon maintainer -- which adds up to 11,268 messages. All because someone at another site took the easy way out and used TRANSFER instead of SPTAPE... >You have no hope whatever of making the system imposter-proof so long >as you maintain connections with networks that openly and freely >acknowledge that they are not secure, including but not limited to >UUCP and the Internet. Good point. I was thinking primarily of mail originating within BITNET, but your comment is correct. >Karl -- David Boyes | ARPA: 556%OREGON1.BITNET@CUNYVM.CUNY.EDU Systems Division | BITNET: 556@OREGON1 UO Computing Center | UUCP: dboyes@uoregon.UUCP 'How long d'ya think it'll be before just us oldtimers remember WISCVM?'
dboyes@uoregon.UUCP (David Boyes) (03/02/88)
In article <7446@tut.cis.ohio-state.edu> bob@allosaur.cis.ohio-state.edu (Bob Sutterfield) writes: >(Jumping into the fray with both feet, he held his breath and said:) > >How about supporting a standard mailing address for mail problems, >David? At least, can your machine use a ten-character long mail >delivery alias to turn "POSTMASTER" into "POSTMAST"? It does. So does UW. So do all sites (that I've found) on BITNET supporting RFC 822 compatible mail. Sites supporting only IBM NOTE format are a different story, though -- but those sites don't do redistribution of mailing lists for exactly that reason. > Bob Sutterfield, Department of Computer and Information Science > bob@cis.ohio-state.edu or ...!cbosgd!osu-cis!bob Aargh. The last of the mangled files went through almost a week ago. Things should be quiet now -- I think the UW folks understand what happened now and (hopefully) won't do it again. We're keeping our fingers crossed. -- David Boyes | ARPA: 556%OREGON1.BITNET@CUNYVM.CUNY.EDU Systems Division | BITNET: 556@OREGON1 UO Computing Center | UUCP: dboyes@uoregon.UUCP 'How long d'ya think it'll be before just us oldtimers remember WISCVM?'