Auto moderation

ecarp@netcom.com (Ed Carp):
> [ auto moderators ]
> > Sounds like a very easy scheme to break. Say I suddenly decide that I 
> > don't like your posts or Tim Mays posts. I can get you kicked off by 
> > using anonymous accounts to say that you're a nuisance. It seems to me 
> 
> It's not as easy as you might think.  How many anonymous accounts can you get?
> There are only so many anon servers, and for each anon account you have to have
> a different real account, all it buys you is your vote registers twice
 
Do you know how easy it is to fake an address? I occasionally telnet to port 25
and talk SMTP directly, to avoid spooling, but I have to type in the address
I want the mail to appear from. There's no way of ensuring that I type in 
my real address, or _any_ real address at all for that matter.

Digitally signed voting? Only works if you restrict yourself to 'known' voters.
Net identities are very easy to fake or create.
 
> Ed Carp, N7EKG/VE3              ecarp@netcom.com                519/824-3307
> Finger ecarp@netcom.com for PGP 2.3a public key         an88744@anon.penet.fi

That's an _anonymous_ address, right !? -----------------^^^^^^^^^^^^^^^^^^^^^^

-------------------------------------------------------------------------------
Rishab Aiyer Ghosh                                          rishab@dxm.ernet.in
Voicemail +91 11 3760335; Vox/Fax/Data 6853410
H-34C Saket New Delhi 110017 INDIA

The National Short-Sleeved Shirt Association says:
                                             Support your right to bare arms!
-------------------------------------------------------------------------------

>  
> Do you know how easy it is to fake an address? I occasionally telnet to port 25
> and talk SMTP directly, to avoid spooling, but I have to type in the address
> I want the mail to appear from. There's no way of ensuring that I type in 
> my real address, or _any_ real address at all for that matter.

	Actually, it's not quite that easy. You can mail from any 
username at your site, but if you put in a different site without using 
helo protocol, it gives an X-Authorization-Warning in the header, which 
contains your home site.
	Alternately, if you do use helo, someone can just have a look at 
the headers of the message, and work out wherethe message was posted 
from. Then, it's just a question of consulting SMTP and system logs, and 
the sysadmin has a fair chance of tracing you back. Perhaps you heard of 
some guy who sent a death threat to the president using this method? They 
traced him back REAL fast.

> 
> Digitally signed voting? Only works if you restrict yourself to 'known' voters.
> Net identities are very easy to fake or create.

	This i agree with. Any half competent cracker can create and 
remove hundreds of identities (or more, depending on when some sysadmin 
notices the suspicious batch job running in bground). There's lots of 
ways to fake this, so i agree, you'd have to work from a list of 
registered voters - and hope that no one person is represented on that 
list too many times.

*       *       Mikolaj J. Habryn
                dichro@tartarus.uwa.edu.au
    *           "Information wants to be free!"
                PGP Public key available by finger
    *           #include <standard-disclaimer.h>

Mikolaj Habryn <dichro@tartarus.uwa.edu.au> writes:

> 	Actually, it's not quite that easy. [to fake addresses through telnet 25]
> You can mail from any 
> username at your site, but if you put in a different site without using 
> helo protocol, it gives an X-Authorization-Warning in the header, which 
> contains your home site.

Many sites don't do put in an X-Authorization-Warning. At least one site
I know allows you to fake a sitename with helo.

> 	Alternately, if you do use helo, someone can just have a look at 
> the headers of the message, and work out wherethe message was posted 
> from. Then, it's just a question of consulting SMTP and system logs, and 
> the sysadmin has a fair chance of tracing you back. Perhaps you heard of 
> some guy who sent a death threat to the president using this method? They 
> traced him back REAL fast.

Right. But "they" were not an auto moderation script. Remember the context 
we're discussing this issue...

> > Digitally signed voting? Only works if you restrict yourself to 'known' vot
> > Net identities are very easy to fake or create.
> 
> 	This i agree with. Any half competent cracker can create and 
> remove hundreds of identities (or more, depending on when some sysadmin 
> notices the suspicious batch job running in bground). There's lots of 
> ways to fake this, so i agree, you'd have to work from a list of 
> registered voters - and hope that no one person is represented on that 
> list too many times.

Again, the context is auto-moderation of _open_ mailing lists (such as this 
one). I doubt that you'd want to restrict posts, approving or disapproving 
replies to "registered" members. The point is not to censor Nalbandian or
Detweiler. There may be some fans out there, and IAC the _reader_ should decide
what to look at. The point is to make this decision easier, with friendly 
advice from the poor souls who actually _read_ all the crap.
 
> *       *       Mikolaj J. Habryn
>                 dichro@tartarus.uwa.edu.au


-------------------------------------------------------------------------------

Rishab Aiyer Ghosh                                          rishab@dxm.ernet.in

Voicemail +91 11 3760335; Vox/Fax/Data 6853410
H-34C Saket New Delhi 110017 INDIA

The National Short-Sleeved Shirt Association says:
                                             Support your right to bare arms!