Forged messages (was: TC May advertises cypherpunks as keeping your taxes from going to 'people of colour')

"gtoal@gtoal.com" <gtoal@pizzabox.demon.co.uk> writes:

> Perhaps Detweiler was right after all about certain cypherpunks having
> a hidden agenda... seems TC May's rationale for running the cypherpunks
> list isn't to do with enhancing individual liberties but rather keeping
> all us WASPS safe from 'people of colour'...
> 
> I want nothing to do with a list run by racists.  Unsubscribe me now
> please (cypher@an-teallach.com).
> 
> G

A few headers from the message:

Received: by toad.com id AA16763; Sat, 15 Jan 94 05:13:04 PST
Received: by toad.com id AA16671; Sat, 15 Jan 94 05:09:48 PST
Received: from gate.demon.co.uk ([158.152.1.65]) by toad.com id AA16667;
Sat, 15 Jan 94 05:09:42 PST
Received: from pizzabox.demon.co.uk by gate.demon.co.uk id aa06847;
          15 Jan 94 13:04 GMT
Received: by pizzabox.demon.co.uk (AA25018); Sat, 15 Jan 94 13:01:35 GMT
Date: Sat, 15 Jan 94 13:01:35 GMT
Message-Id: <9401151301.AA25018@pizzabox.demon.co.uk>
From: "gtoal@gtoal.com" <gtoal@pizzabox.demon.co.uk>
Reply-To: Graham Toal <gtoal@pizzabox.demon.co.uk>
To: cypherpunks@toad.com
Subject: TC May advertises cypherpunks as keeping your taxes from going
to 'people of colour'


Note that pizzabox.demon.co.uk [158.152.8.236] doesn't tell where it got
the message from.  Could it have been longs.lance.colostate.edu?  I
liked Detweiler better when he just used anon.penet.fi.


P.S. I sent myself a test email by telnetting to pizzabox.demon.co.uk
25, but it identified the IP address I telnetted from... hopefully the
site administrators at demon.co.uk have recognized the problem and taken
steps to prevent further detweiling.  But be on your lookout, this will
only hold him off until he can find another SMTP port to spoof from.

Matthew J Ghio <mg5n+@andrew.cmu.edu>  writes:
>
> "gtoal@gtoal.com" <gtoal@pizzabox.demon.co.uk> writes:
> 
> Note that pizzabox.demon.co.uk [158.152.8.236] doesn't tell where it got
> the message from.  Could it have been longs.lance.colostate.edu?  I
> liked Detweiler better when he just used anon.penet.fi.

  Perhaps you just don't understand how headers work.

  Often times, the machine which originats a message puts a header 
  in that says it "recieved" it *despite* the fact that the message 
  was originated on that machine.  This happens (I believe) because
  the mail agent submits the message to sendmail for sending.  This
  causes sendmail to tag it as "recieved" despite its origin on that
  machine.

> P.S. I sent myself a test email by telnetting to pizzabox.demon.co.uk
> 25, but it identified the IP address I telnetted from... hopefully the
> site administrators at demon.co.uk have recognized the problem and taken
> steps to prevent further detweiling.  But be on your lookout, this will
> only hold him off until he can find another SMTP port to spoof from.

  Or, more likely, there was never a problem at pizzabox.demon.co.uk
  and the message is either not forged or the forger submitted it 
  through another mechanism.

 Jon Boone | PSC Networking | boone@psc.edu | (412) 268-6959
 finger boone@psc.edu for PGP public key block