ftp.pasteur.org/FAQ//ftp-pasteur-org-FAQ.zip/FAQ/usenet/cancel-faq/part1

Internet Message Format | 2004-05-15 | 25.3 KB

Path: senator-bedfellow.mit.edu!bloom-beacon.mit.edu!newsfeed.stanford.edu!nntp.cs.ubc.ca!news.killfile.org!not-for-mail
From: [e-mail] (Tim Skirvin)
Newsgroups: news.admin.net-abuse.bulletins,news.admin.net-abuse.usenet,news.admin.net-abuse.sightings,news.admin.net-abuse.misc,news.answers
Subject: Cancel Messages: Frequently Asked Questions, Part 1/4 (v1.75)
Supersedes: <cancelfaq20030915050002$[e-mail]>
Followup-To: news.admin.net-abuse.usenet
Date: Sat, 15 May 2004 00:00:02 -0500
Organization: Killfiles, Unlimited
Lines: 559
Approved: [e-mail]
Expires: Sat, 26 Jun 2004 05:00:02 GMT
Message-ID: <cancelfaq20040515050002$[e-mail]>
Reply-To: [e-mail]
X-Trace: victor.killfile.org 1084597206 26768 216.43.25.138 (15 May 2004 05:00:06 GMT)
X-Complaints-To: [e-mail]
Summary: This is a list of Frequently Asked Question about cancel messages
     on Usenet.  It mainly discusses how cancels work, who issues
     them, their history, and what to do about them.  It is more of
     a general purpose FAQ than anything else; it's not required
     reading anywhere, just more of a reference.
X-Auth: PGPMoose V1.1 PGP news.admin.net-abuse.sightings
    iD8DBQFApaPTv1i8LqUfqQURAvhTAJ4zZT/zckluDzDC7lIo/DRefkwcOQCfS1If
    8dhZ1oBQMh6QIAtx50Tr4IE=
    =DCPo
Xref: senator-bedfellow.mit.edu news.admin.net-abuse.bulletins:34809 news.admin.net-abuse.usenet:610100 news.admin.net-abuse.sightings:1406501 news.admin.net-abuse.misc:222756 news.answers:271287

Archive-name: usenet/cancel-faq/part1
Posting-Frequency: monthly
Last-modified: 1999/09/30
Version: 1.75
URL: <URL:http://www.killfile.org/faqs/cancel.html>

Cancel Messages
Frequently Asked Questions
Part 1/4

This document contains information about cancel messages on Usenet, such
as who is allowed to use them, how they operate, what to do if your
message is cancelled, and the like.  It does not contain detailed
instructions on how to cancel a third party's posts.  It is not intended
to be a fully technical document; its audience is the average Usenet user,
up to a mid-level administrator.

This document is not meant to be a comprehensive explanation of Usenet
protocols, or of Usenet itself, but a basic knowledge of these concepts
is assumed.  Please refer to news.announce.newusers, RFC1036, and/or
RFC1036bis if you wish to learn them.

Disclaimers: The information contained within is potentially hazardous;
applying it without the permission of your news administrator may cause
the revocation of your account, civil action against you, and even the
possibility of criminal lawsuits.  The author of this document is in no
way liable for misuse of the information contained within, nor is he in
any way responsible for damages related to the use or accuracy of the
information.  Proceed at your own risk.


Table of Contents        > = In other parts of the FAQ
=================        * = Changed since last update
I. What are cancel messages?
   A. What are cancel messages?
 * B. Are cancel messages the only way to delete a message?
   C. Where can I find cancel messages?
   D. Who is generally allowed to issue cancels?
 * E. When and why are cancel messages allowed?
   F. How are they issued?
   G. How do I cancel my own post?
 * H. Who decided on these rules?
II. How do cancels work?
   A. What is control?  control.cancel?  How do I receive them?
   B. What standards are there for cancelling posts?
   C. What is the format of a cancel message?
   D. Do all news sites accept all forms of cancels?
   E. How do I alias out a pseudosite?
III. So your post was cancelled...
   A. Why was my post cancelled?
   B. I have the cancel message right in front of me.  Why was it cancelled?
   C. But I wasn't doing anything wrong!  Why was it cancelled?
   D. Look, pal, I said I wasn't doing anything wrong, and I meant it.  I
    didn't break any rules that I can see.  *Why was my post cancelled?*
   E. *sigh* Then what do I do about it?
>IV. What does it take to cancel messages?
>V. That idiot forge-cancelled my posts!
>VI. What moral issues are involved with cancel messages?
>VII. What's going to happen to cancels in the future?
>VIII. What about these other things?
>IX. What are the current cancel issues?

>Changes
>To Do
>Contributors
>Pointers

>Appendix A: Dave the Resurrector
>Appendix B: Retromoderation


I. What are cancel messages?
============================
 A. What are cancel messages?

    Cancel messages are a specialized form of message to Usenet
that, when they arrive at a server, request that the post bearing the
Message-ID contained within be deleted.  In essence, a cancel message,
if heeded, cancels another post.  Hence the name.


 B. Are cancel messages the only way to delete a message?

    No.  Usenet is transitory; not every message will be on all news
servers at all times.  In fact, cancels are fairly rare; the cause of a
missing message is very rarely a cancel.

    First of all, it takes some period of time for a message to
propagate to all news servers that wish to carry the message.  This is
inherent in the Usenet system; messages take time to arrive.  In some
cases, they do not arrive at all.

    More commonly, messages are deleted after a certain period of time
so that more messages can take their place - this process is known as
expiration.  The amount of time that a post exists varies from server to
server, and is usually based on the size and content-type of the article
and the newsgroups to which it was posted; servers typically save posts
for anywhere from a day to several weeks.  As this happens on all news
servers and is not consistent, expiration is the number one cause of
"missing" messages.

    As time goes on, the software itself has begun to change.  Messages
posted in HTML, messages containing picture attachments, anything posted
more than a few times, even messages with more than about five newsgroups
in their headers, all of these are subject to automatic filtering by newer
news software; ask your news administrators for details about what is done
at your site.

    Finally, there are more specific causes for missing messages.
Your message may have been replaced by another post using a Supersedes:
header; your news administrators may be running NoCeM, which selectively
deletes posts when used on a server level; your message could have been
filtered before it was even posted.  Ask your administrators for more
information about your system's policies, expiration times, and so forth.

    In summary: if your post is missing, do not instantly assume that
your message was cancelled.  A good rule of thumb is "no cancel message,
no cancel".  If you can find the cancel, then your post was cancelled; if
you can't, it probably wasn't.


 C. Where can I find cancel messages?

    As you must have a cancel message to show that your message was
cancelled, it is a good idea to know where to look for them.  The best
answer, in the short term, is to search control for the cancel (see
section II.A. for details).  If you are unable to find them there, the
Usenet search engines may be able to help - using Dejanews (<URL:http://
www.dejanews.com>) or AltaVista (<URL:http://www.altavista.com>), search
for your email address and the string 'cancel', and you may be able to
find any cancels issued for your posts.

    It should be noted that, for various reasons, the above methods
of finding cancel messages are becoming increasingly ineffective.  Any
suggestions or technical help in solving this problem would be greatly
appreciated by the Usenet community.


 D. Who is generally allowed to issue cancels?

    In general terms, the only people that are always authorized to
issue cancels for a message are the original author of the message and
the postmaster at the site the message was posted from.  However, there
are rules that allow third-party cancels in specific circumstances, such
as group moderation, spam and spew cancellations, article forgeries, and
a few other limited circumstances; those people in charge of these
duties are generally authorized to issue cancels directly relating to
the job.


 E. When and why are cancel messages allowed?

    When Usenet was created, cancels were meant to be only issued by
the original poster of a message.  They were implemented so that someone
could take back their words, remove information that was no longer
accurate, replace inaccurate information, and other, similar purposes.

    As time went on, more uses for cancel messages have been found.
Third party cancellations are now generally allowed if they are not
content-based; posting private mail is often more than frowned upon, and
newsgroup voting fraud may be stopped with a forged cancel; in the more
extreme cases, ads to inappropriate groups are cancelled, threads that
are crossposted to too many groups go away, and some even cancel in
order to just disrupt a newsgroup.  This is not to say that this is
accepted; on the contrary, cancelling based on a new criterion is usually
more than hotly contested.

    RFC1036bis, section 7.1, is the most "authoritative" list of valid
reasons for cancel messages; however, because it is not a formal RFC and
because Usenet changes so quickly, it should not be considered the final
word on such matters.  The following reasons are probably the most apt to
be considered valid by any random news administrator:

 1. First person cancels are performed by the original poster of a
    message.  They are explicitly allowed by the news system - a user
    is always authorized to cancel anything that he or she posts, for any
    reason, within the limits imposed by his or her administrators, the
    moderators or maintainers of those groups affected by the cancels, and
    the user's individual moral code.  This authority extends to messages
    written on another system.

 2. Second person cancels are performed by those people officially "in
    charge" of a user - the user's news administrator, the newsgroup
    moderators and hierarchy maintainers affected by the user's posts,
    or any party authorized to act on their behalf by said user or
    administrator.  These cancels, too, are officially authorized.

 3. Third person cancels are generally frowned upon, unless they are
    made based on one of the following criteria:

  a. Moderator cancels
    The moderator of a newsgroup has absolute authority over that group.
        This includes the right to issue cancels for posts that he or she
        did not authorize.  Retromoderation is a subset of this, in which
        the group is moderated only by the issuing of cancel messages;
        private hierarchies may generally be considered retromoderated by
        the hierarchy administrators, while in most most other hierarchies
        the legitimacy of retromoderation is still up for debate.  For more
        information on creating moderated groups, see news.groups and/or
        news.groups.questions.

  b. Spam/EMP cancels
    Spam or EMP, a message posted to Usenet separately multiple times,
        is generally accepted as a major threat to Usenet.  Therefore,
        anything posted too many times is automatically cancelled, with no
        regard to the content of the post.  The current spam cancellation
        threshold is 20 posts; for more information, see the Spam Thresholds
        FAQ.

  c. Spew cancels
    A spew is a long series of similar articles posted over and over
        again, due either to a malfunctioning program or malicious intent.
        They are almost universally considered to be a good use for cancels.
    However, there has yet to be an accepted broad definition of the
    term "spew" - right now, it mostly fits under "I know it when I
    see it".  For more discussion of spews, see news.admin.net-abuse.
    policy.

  d. ECP cancels
    ECP, or Excessive Cross-Posting, is when a message is posted to too
        many groups at the same time.  Much the same as spam cancellations,
        if a message is crossposted to too many groups, it will be cancelled
        without regard to content.  Currently, the cancellation threshold is
        a BI of 20 (the BI is "the sum of the square roots of the number of
        newsgroups in which each of the postings appears"); as with spam/
        EMP cancels, see the Spam Thresholds FAQ for details.

  e. Binaries in a non-binary group
    Much of Usenet does not want binary messages, usually for disk space
        and performance reasons.  To accommodate those sites that do want
        binaries, the alt.binaries.* and comp.binaries.* hierarchies were
        created.  However, there are still some binary messages posted to
        other Usenet groups; these are often cancelled without regard to
        content, based on the size of the binary.  For more information, see
        news.admin.net-abuse.policy, where the specifics are being debated.
        The bincancel FAQ concerns binary cancels in particular.

  f. Forgeries in the user's name
    It has become more and more common for people to post messages with
        false attribution lines.  If a message is attributed to a user, they
        may cancel it or authorize others to cancel it as if they had posted
        it themselves.


 F. How are they issued?

    Cancel messages are sent out as a standard Usenet post, except
they contain a "Control: cancel <message-ID>" header.  If a system that
accepts cancels receives the message, the post with the specified
message ID is deleted from that system.

    Most major newsreaders allow readers to cancel their own posts
with a key press.  Third-party cancels are more complicated, and must
follow several conventions; please refer to section II.B for details.


 G. How do I cancel my own post?

    Most major newsreaders allow you to cancel your message with a
few keypresses.  To cancel your own post, press the following key
(depending on your newsreader) while reading your message:

Unix
rn/trn:        'C'             tin:        'D'
gnus-emacs:    'C'             nn:        'C'
slrn:        Esc-^C             pine:        none

Unix/X
xrn:            'Cancel' button
knews:            Post/Cancel Article

OpenVMS
Anu News        'cancel'
newsrdr         'cancel'

PC/Windows
Free Agent - pre-v1.1:    Article/Cancel
       -    v1.1+:    Message/Cancel Usenet Message
Agent  -  v0.99g,v1.5:  Post/Cancel Usenet Message
       - 1.9 or newer:  Post/Cancel Usenet Message
       -        other:  Message/Cancel Usenet Message (other versions)
Waffle:            type CANCEL at the inter-message prompt
News Xpress:        Article/Cancel Post
Turnpike:           Article/Cancel Article
WinVN:            Article/Cancel
News Xpress (Win3.1):    Article/Cancel Post
Anawave Gravity:    Article/Cancel
Outlook Express:    Right Click on Message/Cancel
Internet News:        File/Cancel Message

PC/OS/2
NR/2:            Article/Cancel

Macintosh
Nuntius:        Articles/Cancel Article
NewsWatcher:        Special/Cancel Message
MacSOUP:        Message/Cancel
most browsers:        Special/Cancel Message

Amiga
Thor 2.6:        Event Commands/Cancel Message

Web Browsers
Netscape:        Edit/Cancel This Message (most versions 2.0+)
Mosaic:            none
Lynx:            none
Internet Explorer 4.0:     compose/cancel messages

Generic/Multi-System
Yarn:            'c'


    If you know of any other news readers that allow cancels, have
corrections for any of the above readers, or whatever, please mail
[e-mail] with the information.


 H. Who decided on these rules?

    Usenet is a cooperative venture of many thousands of sites world-
wide.  It was designed with the principle of mass communication in mind;
not much thought was put into security, because it didn't seem necessary
at the time.  As the need to control the system became evident, so too did
the potential for abuse; out of these two needs, these rules grew.

    As for who actually designed the rules: each site owns its own
machines, and can set set policy over its own systems and users.  Each
site can decide their own expiration policies, what other sites to accept
messages from, what control messages they will accept, and so forth;
however, it's generally much easier to have a standard set of rules to
work with, to improve efficiency and promote some level of consistency
across the network.  These rules were designed by the system administrators
in charge of the systems that Usenet runs on and the users that Usenet
serves, in order to give a framework under which to run Usenet as a whole.
In short: the rules were made by your administrators and those that they
choose to listen to.

    And if you have any problems with this, you should see if you can
make your administrators listen to you.


II. How do cancels work?
========================
 A. What is control?  control.cancel?  How do I receive them?

    control is a pseudo-newsgroup made up of all posts on a news
system containing the Control: header, which is used to create or delete
newsgroups, perform internal systems checks, cancel posts, and so forth.
It is mostly an administrative convenience.

    On many systems, control is broken up into several components
automatically by the software.  If this is true, there are several
newsgroups: control.newgroup (for the creation of new groups),
control.rmgroup (for the removal thereof), control.cancel (for cancel
messages), and so forth.  If the software is configured this way, cancel
messages will appear in control.cancel.

    All cancels are either recorded in control or control.cancel,
depending on the system type.  If a post was cancelled recently enough, a
record of the cancel *will* be here - if there is no cancel in the group,
then either there was no cancel or the cancel message itself has expired
(see section I.B.).

    Unfortunately, the latter situation has become more and more
common as time passes.  Most major news servers have begun to expire
control messages after extremely short time periods, ranging from a couple
of days to a couple of hours; even the major Usenet search engines have
begun to cut short their cancel message archives.  The rule of "no cancel
message, no cancel" still holds, but more burden for finding the cancel
message is being placed on the reader.

    If you cannot read control (or control.cancel), ask your news
administrator for help.


 B. What standards are there for cancelling posts?

    When cancelling your own post, the only standards are the
software requirements, which should be done automatically by whatever
software you are using.  Third-party cancels, however, have certain
standards that should be followed.

    There are three main reasons for following these standards when
using third-party cancels.  First is to identify the canceller, which
gives the practice accountability.  The second is to make sure that a
particular message is only cancelled once.  Finally, some news
administrators would rather not accept certain cancels, and a standard
will allow them to opt out of the system.

    The first standard is simple to fulfill; all legitimate third-
party cancels include an "X-Cancelled-By:" header, containing the email
address where the canceller can be contacted.  This also implies that the
canceller is willing to respond to comments and complaints; if the mail is
simply ignored, the canceller is violating this first standard.

    The second problem is solved much more creatively.  The $alz
convention (named after Richard Salz, the creator of INN), specifies
that the message ID for a cancel message prepend the message ID of the
original message with the string "cancel.".  For example:

Original Message ID:        <48u6e8$[e-mail]>
  Cancel Message ID:        <cancel.48u6e8$[e-mail]>

    The third problem, that of sites wanting to opt out certain
types of cancels, can be solved by adding certain "pseudo-sites" to the
path of the cancel; if a particular site wishes to not accept cancels
of that type, they can alias out that pseudo-site.  For information on
how to do this, see section II.E.

    The commonly accepted pseudo-sites are as follows:

cyberspam!usenet        Spam/EMP cancels (universal)
spewcancel!cyberspam!usenet    Spew cancels
mmfcancel!cyberspam!usenet     Make.Money.Fast cancels
bincancel!cyberspam!usenet    Binary (in a non-Binary group) cancels
adcancel!cyberspam!usenet    Ad cancels (for the biz.* hierarchy only)
retromod!cyberspam!usenet    Retro-Moderation cancels

    The `!usenet' part denotes that something must come after that
part of the path; it is not strictly necessary for it to be `usenet'.
Multiple pseudo-sites may be used in one message.

    For more information on cancel formatting, please refer to the
Newsgroup Care Cancel Cookbook by Rosalind Hengeveld <URL:http://www.
xs4all.nl/~rosalind/faq-care.html>.


 C. What is the format of a cancel message?

    Here's an example, a spam cancel by Chris Lewis, that follows
all of the standard conventions (plus a few extras), reformatted to fit
into 80 columns:
--
Date: 8 Jun 1997 15:43:37 GMT
Path: vixen.cso.uiuc.edu!ais.net!newsfeed.direct.ca!News1.Vancouver.iSTAR.net!
  news.istar.net!n1van.istar!hammer.uoregon.edu!nrchh45.rich.nt.com!bcarh8ac.
  bnr.ca!despams.ocunix.on.ca!cyberspam!not-for-mail
From: [e-mail] (Chris Lewis)
Approved: [e-mail]
X-Cancelled-by: [e-mail]
Sender: [e-mail]
Newsgroups: alt.recovery.aa
Subject: cmsg cancel <5ne625$f2b$[e-mail]>
Control: cancel <5ne625$f2b$[e-mail]>
X-No-Archive: Yes
X-Spam-Type: WOODSIDE
Lines: 7

WOODSIDE spam cancelled by [e-mail]
Original Subject: Sell YourPhotosNYC.Agency
Total spams this type to date: 1.758
Total this spam type for this user: 1041
Total this spam type for this user today: 503
Originating site: internetmci.com
Complaint addresses: [e-mail] [e-mail]
--

    Points to note: the 'Sender' line matches the original author of
the message, while the 'From' line points at the canceller, as does the
'X-Cancelled-By' header.  The Message-ID follows the $alz convention, and
the proper pseudo-site is present in the 'Path' header.  It should also be
noted that the 'X-Spam-Type' and 'X-No-Archive' headers are optional, as
is all information in the body of the cancel.


 D. Do all news sites accept cancels?

    No.  Many news sites have decided that, for whatever reason, they
do not want cancels; others merely do not want certain types of cancels.
Dave Hayes, for example, runs a "Site of Virtue", which not only ignores
cancels but drops them without distributing them; patches for INN to do this
are available from his Freedom Knights Homepage, at <URL:http://www.jetcafe.
org/~dave/usenet/>.  America Online, Dejanews, Zippo, and many other news
sites do not honor cancels of any sort.


 E. How do I alias out a pseudosite?

    INN v1.5 and beyond include shunning mechanisms out of the box;
just edit the 'newsfeeds' file and follow the instructions from the
comments.  Other, older news server software is less likely to include such
mechanisms.

    (If anyone's got information for other news servers, I'd love to
include it.)



III. So your post was cancelled...
==================================
 A. Why was my post cancelled?

    It probably wasn't.

    Unless you can find a copy of the cancel in control, it is very,
*very* unlikely that your post was actually cancelled.  Before you begin
to worry about a forged cancel, figure out the expiration times for
articles on your system and note whether or not your newsreader just
refuses to show you articles marked as 'read'; these are the most common
causes for "missing" articles.


 B. I have the cancel message right in front of me.  Why was it cancelled?

    Most cancels nowadays are for cleanup of various forms of net-abuse.
If you posted your message to too many places, or too many times, it will
generally be cancelled, regardless of the content of the post.

    For details about what is cancelled and why, read news.admin.
net-abuse.usenet, or check the news.admin.net-abuse FAQ.  Also, if you
received a mail on the subject from a spam cancellers, read it carefully;
it should probably explain why your message was cancelled.


 C. But I wasn't doing anything wrong!  Why was it cancelled?

    There's still legitimate reasons beyond official net-abuse to
cancel posts.

  o The moderator of a moderated newsgroup is permitted to cancel any
    messages in his newsgroup that he does not approve of.  There really
    isn't much recourse in this case; it's pretty much impossible to
    impeach a moderator, and the only thing you can really do about their
    actions is complain for a while or make a competing group.

  o Individual newsgroups and hierarchies, especially local hierarchies,
    may have rules permitting them to cancel messages posted there.  Again,
    there isn't much you can do about these cases, beyond reasoning with the
    administrators and/or not using the hierarchy.

  o Your post may have inadvertantly triggered the searching criteria for
    a continuing spam.  If you contact the spam-canceller in such a case,
    you can usually get your post re-posted and can be helped in making
    sure it won't happen again.

  o Your postmaster may have decided that they didn't like your post.  In
    this case, the only real recourse you have is to get a new service
    provider.


 D. Look, pal, I said I wasn't doing anything wrong, and I meant it.  I
  didn't break any rules that I can see.  *Why was my post cancelled?*

    I don't know.


 E. *sigh* Then what do I do about it?

    Post about it to news.admin.net-abuse.usenet.  Make sure to
include the full headers and text of the cancel, an explanation of what
the article was about, and any possible motives for the cancelling that
you can think of.  The administrators there will, if you're polite, try
to help.

    For more information, read section V.

--
Copyright 1998, Tim Skirvin.  All rights reserved.
<URL:http://www.killfile.org/faqs/cancel.html>