Subject: List Security/Integrity

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 06:55:34 -0500 (EST)

For those of you who don't know...
 the International Forum on the White
 Paper mailing list has been breeched
 with untraceable forgeries from it's
 WWW interface. We don't know how long
 this has been occuring. So the integrity
 of *all* correpsondences on this list
 is now drawn into question as are the
 indentities of *all* articles and senders.

 In seven years of pretty intensive net
 activity I have *never*  encountered such 
 extreme violations of a mailing list as
 these recent IFWP events. The WWW interface
 offered the public and IFWP participants
 is a gaping hole of potential fraud not
 to mention being damned difficult to
 access without this disasterous fault.

 The IFWP list is dead in regards to it's
 reliabiltity - which is to say the IFWP is
 itself on death's door. It is time to move
 to another host and forum that is capable
 of preserving the integrity and accessibility
 of these crucial procedings. We cannot
 say we speak for anyone if all of our
 messages are susceptable to invisible
 fraud. We cannot say we are communicating
 with anyone if all of our words are open
 to forgery.

 Action must be swift and decisive.

 Bob Allisat

 Free Community Network _ [email-masked] . http://fcn.net
 http://fcn.net/allisat _ http://fcn.net/draft

---

From: Eric Weisberg <[email-masked]>
Date: Fri, 20 Nov 1998 09:20:09 -0600

Bob's conclusions are utter non-sense, both in terms of the
alleged risk and the proposed cure.  The potential harm from Bob's
prescription far exceeds the treat he announces.  Indeed, his cure
is to kill the patient!

I don't think so.

>  indentities of *all* articles and senders.

We all get copies of the posts and recognize forgeries which
purport to come from US.  Bob does not deny being the author of
those with his name on them.  The forgeries have been few and
quickly identified.  There is no question of the authenticity of
the rest.

>  of these crucial procedings.

This may be the intended result.  In which case, Bob's suggestion
accomplishes the goal of the violator rather than the victims.
This is the problem with all responses to terrorism.  I would not
play into those hands.

> Action must be swift and decisive.

Where would you take us?

---

From: Eric Weisberg <[email-masked]>
Date: Fri, 20 Nov 1998 09:20:09 -0600

I don't think so.

Where would you take us?

---

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 10:34:04 -0500 (EST)

> Where would you take us?

 Minimum: to another mailing list
 Maximum: to a successive process.

 The rest of your comments do not
 address the seriousness of the
 problems recently uncovered. The
 company contracted or volunteering
 to maintain this list has allowed
 an error of great dimension to
 occur over a period of some days.
 Without comment or redress. Time
 to stop f*cking around and move
 this list elsewhere. Pronto.

 What solutions do you suggest Eric?

 Bob Allisat

---

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 10:34:04 -0500 (EST)

Bob Allisat

---

From: Mark Jeftovic <[email-masked]>
Date: Fri, 20 Nov 1998 10:48:49 -0500 (EST)

>  What solutions do you suggest Eric?

Mail forgery is a trivial matter (trivial to do, that is) which isn't solved
by running a mailing list from one server over another. More often than not,
among people who communicate frequently in a given forum, forgeries and
trickery are easily detected, discussed and dismissed.

Anyone who thinks it's a serious enough matter should be PGP signing their
posts. Let's not turn this into alt.genius.bill-palmer please.

-mark

---
Mark Jeftovic,  Chief Technology Officer, easyDNS Technologies Inc.
dns, web forwarding, domain regs, etc.  -> http://www.easyDNS.com/
obligatory personal home page, pgp key  -> http://www.shmOOze.net/~markjr/

---

From: Mark Jeftovic <[email-masked]>
Date: Fri, 20 Nov 1998 10:48:49 -0500 (EST)

-mark

---

---

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 11:04:09 -0500 (EST)

Mark comments:
> Mail forgery is a trivial matter (trivial to do, that is) which 
> isn't solved by running a mailing list from one server over 
> another. More often than not, among people who communicate 
> frequently in a given forum, forgeries and trickery are easily 
> detected, discussed and dismissed.

 The guy allowed anonymous
 articles to be contributed
 to a mailing list via the
 WWW. This is gross incompetance.
 Why are you all defending
 such gross incompetance?
 How can anyone allow such
 a situation to persist?

 Bob Allisat

---

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 11:04:09 -0500 (EST)

Bob Allisat

---

From: Eric Weisberg <[email-masked]>
Date: Fri, 20 Nov 1998 10:08:19 -0600

Bob asks us to move, but does not give us the address.

>  What solutions do you suggest Eric?

Lets start with the negative.  I do not suggest that we jump out
the window without first ascertaining the existence of a net.

If a problem has been identified, there may be a range of options
short of exterminating the herd.  This list administrator is as
competent as the next in dealing with forgeries.  Why shift the
problem instead of dealing with it here, where it has been
recognized?  Are you suggesting that the same risk would not exist
elsewhere?  Do you suggest that we stop using the Internet?   I
don't think so.

Here is my recommendation.  Take a deep breath.  Count to 10.
Contact the list administrator if you think you have something
constructive to add.  And, if you do not feel satisfied with the
result, announce the address where you will be setting up shop and
see who chooses to join you.   But, DO NOT tell the rest of us
that we are dead or should not continue to participate in this
discussion or otherwise facilitate the sabotage of which you
complain.

---

From: Eric Weisberg <[email-masked]>
Date: Fri, 20 Nov 1998 10:08:19 -0600

---

From: Mark Jeftovic <[email-masked]>
Date: Fri, 20 Nov 1998 11:18:15 -0500 (EST)

>  How can anyone allow such

I'm not defending "gross incompetence", all I'm saying is if somebody wants
to post forged messages to the list, they'll do it. It's a no brainer and
the list inhabitants will deal with it. Pointing fingers and calling a
list admin "incompetent" in public is going to earn about as many points
as posting forgeries. Ok, maybe it's a bit of hole to allow posts via
a WWW gate. If I felt that way, I'd post along the lines of "maybe we
should disallow posts from the WWW", I wouldn't be screaming for someone's
head. 

Can we get back to domain policy please?

-mark

---

---

From: Mark Jeftovic <[email-masked]>
Date: Fri, 20 Nov 1998 11:18:15 -0500 (EST)

-mark

---

---

From: Mark Jeftovic <[email-masked]>
Date: Fri, 20 Nov 1998 11:18:15 -0500 (EST)

-mark

---

---

From: Mark Jeftovic <[email-masked]>
Date: Fri, 20 Nov 1998 11:18:15 -0500 (EST)

-mark

---

---

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 11:35:06 -0500 (EST)

> Bob asks us to move, but does not give us the address.

 Eric asks us to stay at an
 address where we have no
 choice but to move from.
 Question: What does our
 landlord "Andy" have to
 say about this mess?

 Bob Allisat

---

From: Bob Allisat <[email-masked]>
Date: Fri, 20 Nov 1998 11:35:06 -0500 (EST)

Bob Allisat

---

From: "Roeland M.J. Meyer" <[email-masked]>
Date: Fri, 20 Nov 1998 11:16:38 -0800

> How can anyone allow such

Maybe because no one is paying for it?
___________________________________________________ 
Roeland M.J. Meyer, ISOC (InterNIC RM993) 
e-mail: <mailto:[email-masked]>[email-masked]
Internet phone: hawk.mhsc.com
Personal web pages: <http://www.mhsc.com/~rmeyer>www.mhsc.com/~rmeyer
Company web-site: <http://www.mhsc.com/>www.mhsc.com/
___________________________________________ 
 Who is John Galt?
 "Atlas Shrugged" - Ayn Rand

---

From: "Roeland M.J. Meyer" <[email-masked]>
Date: Fri, 20 Nov 1998 11:16:38 -0800

---

From: "Roeland M.J. Meyer" <[email-masked]>
Date: Fri, 20 Nov 1998 11:29:23 -0800

Hello all,

Because of recent developments with the IFWP list, MHSC has accelerated
development of its SecureList  and CertificateAuthority servces. Once we
have SecureMail in beta-test, we will work diligently to provide these
other services. We intend to make them available to the IFWP within 60
days. We do not intend to charge for them, provided that y'all can live
with a beta-level service. The essence of MHSC.NET is secured private
services delivered internationally. MHSC.NET is a vISP. The list will then
be housed on production MHSC servers. In the meanwhile, short of moving the
list, there is nothing much that we can do. Other than checking mailer
headers and PGP signing our documents. At the moment, we are getting our
production servers ready and initial set-up is always a lot of work.<sigh>

FYI, initial planed deployment, to beta, for SecureList and CertAuth, were
originally planned for 2Q99.

At 10:08 AM 11/20/98 -0600, Eric Weisberg wrote:
>__________________________________________________
>To view the archive of this list, go to:
>http://lists.interactivehq.org/scripts/lyris.pl?enter=ifwp
>
>To receive the digest version instead, send a
>blank email to [email-masked]
>
>To SUBSCRIBE forward this message to:
>[email-masked]
>
>To UNSUBSCRIBE, forward this message to:
>[email-masked]
>
>Problems/suggestions regarding this list? Email [email-masked].
>___END____________________________________________
>

_________________________________________________ 
Morgan Hill Software Company, Inc. 
Roeland M.J. Meyer, ISOC 
(RM993) 
President and CEO. 
e-mail:        <mailto:[email-masked]>mailto:[email-masked] 
Web-pages:    <http://www.mhsc.com/~rmeyer>http://www.mhsc.com/~rmeyer 
Web-site:        <http://www.mhsc.com>http://www.mhsc.com 
Colorado Springs, CO - Livermore, CA - Morgan Hill, CA 
-----------------------------------------(legal notice)-------- 
Note: Statements made in this message do not 
         necessarily reflect the  position of MHSC. All 
         forcasts and projections are to be considered 
         as forward-looking and presume conditions which 
         may not be referenced herein. 
-----------------------------------------(/legal notice)-------

---

From: "Roeland M.J. Meyer" <[email-masked]>
Date: Fri, 20 Nov 1998 11:29:23 -0800

Hello all,

---

From: "Roeland M.J. Meyer" <[email-masked]>
Date: Fri, 20 Nov 1998 12:48:55 -0800

My apologies to the list,

I inadvertantly hit the "Return reciept" button rather than the PGP
signature button.
Otherwise, this is the same message, with proper signatures.

>>___END____________________________________________

 ___________________________________________________  Roeland M.J. Meyer,
ISOC (InterNIC RM993)  e-mail: [email-masked] Internet phone:
hawk.mhsc.com Personal web pages: www.mhsc.com/~rmeyer Company web-site:
www.mhsc.com/ ___________________________________________   Who is John
Galt?   &quot;Atlas Shrugged&quot; - Ayn Rand

---

From: "Roeland M.J. Meyer" <[email-masked]>
Date: Fri, 20 Nov 1998 12:48:55 -0800