NetNews Usenet Archive 1992 #20/NN_1992_20.iso/spool/vmsnet/mail/pmdf/2214

Internet Message Format | 1992-09-07 | 5.5 KB

Path: sparky!uunet!haven.umd.edu!darwin.sura.net!wupost!usc!zaphod.mps.ohio-state.edu!news.acns.nwu.edu!uicvm.uic.edu!yang.earlham.edu!bsu-ucs.uucp!bsu-cs!news.cs.indiana.edu!
 rutgers!ub!csn!nc
   ar!elroy.jpl.nasa.gov!decwrl!decwrl!infopiz!mccall!ipmdf-newsgate!list
Newsgroups: vmsnet.mail.pmdf
Subject: Problems with NETFIND (cont).
Message-ID: <[e-mail]>
From: [e-mail] (Mike Sullenberger [phone])
Date: 27 Aug 92 19:17:00 GMT
Organization: The Internet
Return-Path: <[e-mail]>
Resent-Date: 27 Aug 1992 12:17 -0700 (PDT)
Resent-From: [e-mail]
CC: [e-mail], [e-mail],
Errors-To: [e-mail]
Resent-Message-ID: <[e-mail]>
X-Vms-To: in%"[e-mail]"
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-Transfer-Encoding: 7BIT
Lines: 98

>Date: Wed, 26 Aug 1992 03:32:31 -0600
>From: Mike Schwartz <[e-mail]>
>Subject: RE:  BIG complaint about NETFIND
>To: [e-mail]
>
>Mike,

>I added some code to Netfind to check for SMTP servers that report
>erroneous info.  So, even if you don't make the change to the server I
>suggested, people should no longer get invalid information about your site.
>Note that this change has not yet propogated to the Netfind server run by
>the Gopher folks - I told them about it, but for now they are still running
>an older version.
> - Mike

Is the fix that you have made global or did you just put in a flag for
SERV01.SLAC.STANFORD.EDU?  If it is not a global change then there are very
likely many site Postmasters that are wondering why mail is being addressed to
totally inappropriate hosts.

If your are going to try doing SMTP Mailer functions then you need to do ALL of
the things that an SMTP Mailer needs to do and one of the primary things is that
it OBEYS the Domain Nameservice MX records.  Under NO circumstances should you
send an SMTP EXPN command to any node except for the nodes that are  pointed to
by MX records (unless there are not any MX records), also remember to go through
your MX records in the correct order.

--------------------------------------------------------------------------------

>Date: Wed, 26 Aug 1992 11:24:38 -0600
>From: Mike Schwartz <[e-mail]>
>Subject: RE:  BIG complaint about NETFIND
>To: [e-mail]

>Ok, I'll fix the seed database entries.

> - Mike

--------------------------------------------------------------------------------

>Date: Wed, 26 Aug 1992 11:37:32 -0600
>From: Mike Schwartz <[e-mail]>
>Subject: RE:  BIG complaint about NETFIND
>To: [e-mail]

>This is also a consequence of the fact that the Gopher people don't keep
>their Netfind server up-to-date.  I fixed this problem a while ago on
>the University of Colorado server.
>
>I'd like to point out that Netfind is a purely voluntary effort.  I am
>not paid to do it - it is simply the outcome of a research prototype I
>built.  The tone of your messages imply that I am somehow obligated to fix
>things with respect to your domain.  I'm doing this out of a community
>spirit.  Perhaps in the future when you see things like this you can take
>the situation into account before you fire off an angry message.
> - Mike

You don't get the point.  I am not asking you to make changes to NETFIND so that
I can use it, but so that it does not cause problems to other people on the
network.  These are changes I certainly feel that you are obligated to fix and
to fix them quickly.  Anytime that a program such as NETFIND comes on the
network which provides mis-information and forces me to waste my time to clear
up the confusion, then I will certainly fire off angry messages.

--------------------------------------------------------------------------------

>Date: Thu, 27 Aug 1992 09:41:09 -0600
>From: Mike Schwartz <[e-mail]>
>Subject: RE:  A problem with NETFIND (fyi)
>To: [e-mail]

>Mike, I'm surprised at you.  This "problem with Netfind" was in reality a
>problem with the information your mailer gives out.  Moreover, one day
>after you told me about it, I changed Netfind to detect such problems,
>and not give out the invalid information.
> - Mike

Stop calling SERV01.SLAC.STANFORD.EDU a MAILER Node.  Just because it happens to
run an SMTP Deamon on it is NOT relevant.  If an outside SMTP mailer ignores the
MX records and sends SMTP commands to the node then that mailer is BROKEN (in
your case NETFIND is BROKEN) and it deserves whatever it might get.

I forwarded our communication to a wider list so that other Postmasters on the
network would not have to waste alot of their time figuring out why people from
all over the world were sending mail destined for people that were not even at
their site to a some host in their domain.

Actually you have done one service to the network.  You have pointed out very
dramatically how easy it is to envade someones privacy on the network.  It looks
like I will now have to look into shuting down access from offsite to all of the
services that NETFIND abuses, maybe I should have shutdown these services before
now.  There are a lot of government sites, ours included, that do not look
kindly on this type of probing.  If we want to allow general electronic access
to essentually private information (there are many privacy issues that need to
be resolved first) then we would do it the correct way by putting up, for
example, an OSI X.500 directory server or a WHOIS server.

Mike Sullenberger