Your Business	(Fi= nancial Svcs, Banking, Computer Hardware, Software, Professional Svcs, Chemicals, Apparel, Aerospace, Food, Government, Utility, etc=2E)
Type of Organization	(Mf= g, Dist/Wholesaler, Retailer, Law Firm, Investment Bank, Commercial Bank, University, Financial Consultants, Ad Agency, Contractor, Broker, etc=2E)
Your Business Expertise	(Co= rp=2EMgmt, Marketing, Civil Engineering, Tax Law, Nuclear Physics, Database Development, Operations, Pathologist, Mortg= age Banking, etc=2E)
Major Product Line	(In= tegrated Circuits, Commercial Aircraft, Adhesives, Cosmetics, Plastic Components, Snack Foods, etc=2E)

Click Here for XXX Galore From list@netscape.com Fri Jul 13 05:34:18 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id FAA07665 for ; Fri, 13 Jul 2001 05:34:17 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6D9Phv28115; Fri, 13 Jul 2001 02:25:43 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6D9Phk14312; Fri, 13 Jul 2001 02:25:43 -0700 (PDT) Resent-Date: Fri, 13 Jul 2001 02:25:43 -0700 (PDT) X-OpenMail-Authenticated-Sender: at 15.145.204.154 Sender: markd@pwd.hp.com Message-ID: <3B4EBE03.BE2E71B1@pwd.hp.com> Date: Fri, 13 Jul 2001 10:23:15 +0100 From: Mark Davidson Organization: Hewlett-Packard X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.4.2-2smp i686) X-Accept-Language: en MIME-Version: 1.0 To: robert byrne Cc: ietf-ldapext@netscape.com Subject: Re: too many permissions in the ACM References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"upqy2D.A.QeD.V6rT7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Hi, > To help a bit, I have included a previous mail where I outlined the > functionality each permission provides and includes a proposal to drop > two of the permissions ("t" and "p") with an explanation of why I think > that > would be acceptable. I agree with Robert about removing 't' and 'p' and would also remove a few others (although not as many as before). 'c' (compare) is a special case of 's' (search), so if I wanted to stop the compare operation with an ACI I would also have to stop search. Otherwise, if compare is denied, but not search, then I would just issue a baseObject search using an equality filter and get the same information. So I would drop 'c' and leave 's' to control compare. 'i' import and 'e' export seem to be related to 'a' add and 'd' delete. Does the list think that we need to tell the difference between adding and deleting entries and moving them? If not, then 'i' and 'e' can go and add can replace import and delete replace export in section 5.6 (Modify DN Operation). Mark From list@netscape.com Fri Jul 13 05:39:29 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id FAA08273 for ; Fri, 13 Jul 2001 05:39:28 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6D9cGv29418; Fri, 13 Jul 2001 02:38:17 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6D9cHI20323; Fri, 13 Jul 2001 02:38:17 -0700 (PDT) Resent-Date: Fri, 13 Jul 2001 02:38:17 -0700 (PDT) Date: Fri, 13 Jul 2001 02:36:30 -0700 (PDT) Message-Id: <200107130936.f6D9aTB04442@ywing.netscape.com> From: I Know How To: you.NGIV@netscape.com Subject: Interested in Making 25,000 a wk. THIS YEAR? X-Reply-To: I Know How Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Resent-Message-ID: <"FyHM9B.A.L9E.IGsT7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Hello, Listen, you don't have to tell me - I KNOW what your experiences have been marketing online. You've been in one of two places. EITHER you're fairly new on the Internet, and you KNOW that SOMEBODY makes money online - but you can't quite figure out HOW. OR MAYBE you can "sign people up" like gangbusters - and those people just SIT THERE. Those people don't just "sit there" because they are "lazy", "stupid" or "don't have the desire". The ONLY way for this to work is to do what is done in EVERY OTHER industry but ours - and that is, let the "marketers" do the "marketing" - and let the other people do what THEY do best! Some people just STINK at marketing. And they will NEVER make money online -no matter which "HOT! NEW!" thing they jump into again THIS week! But the thing is - you don't HAVE to! Want to find out why I market for OTHER PEOPLE all day? Then you need to see my open letter about HOW we do that. Just a word to the wise. LOTS of people do it our way. Want to FINALLY make money online? Want to NEVER have to "recruit" and "motivate" and "babysit" again? Then see how YOU can succeed online even if you HATE to market! WHY IN THE WORLD would you NOT want us to do the marketing FOR you? Are you having such GREAT success trying to do it on your own? Are your people? Let US set up a totally AUTOMATED system for you where WE do all the marketing for you – and we ALL make money!! . If YOU want to be able to make a lot of money, then you need to.. See ALL the details - and exactly WHAT I will do for you. See HOW and WHY,just email and I'll send the Info! Email now! Reply with "info" in subject to: imamllnair@financier.com Krissy This message is sent in compliance of the new e-mail bill: Senate bill 1618, Title 3, section 301, Paragraph (a)(2)(C) . ALL REMOVES TO THIS ADDRESS WILL BE HONORED pleaseremove2@netscape.net ?subject=Remove Please do not send removes to the interested address as you may end up receiving the information. From list@netscape.com Fri Jul 13 09:09:45 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id JAA03955 for ; Fri, 13 Jul 2001 09:09:44 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6DD8Tv14261; Fri, 13 Jul 2001 06:08:30 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6DD8Uk01881; Fri, 13 Jul 2001 06:08:30 -0700 (PDT) Resent-Date: Fri, 13 Jul 2001 06:08:30 -0700 (PDT) Date: Fri, 13 Jul 2001 06:09:04 -0700 (PDT) Message-Id: <200107131309.f6DD94c09630@xwing.aoltw.net> From: p1p9omfq5@msn.com To: oceg2mmml6@msn.com Reply-To: jolynkautzman3724@excite.com Subject: Got Debt? [nu2e2] Resent-Message-ID: <"aRq6qC.A.6c.NLvT7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Got debt? We can help using Debt Consolidation! If you owe $4,000 USD or more, consolidate your debt into just 1 payment and let us handle the rest! Wouldn't it be nice to have to worry about just 1 fee instead of half a dozen? We think so too. - You do not have to own a home - You do not need another mortgage - No credit checks required - Approval within 10 business days - Available to all US citizens For a FREE, no obligation, consultation, please fill out the form below and return it to us. Paying bills should not be a chore, and your life should be as easy and simple as possible. So take advantage of this great offer! Please note that we deal in unsecured debt, so mortgages and car loans etc. cannot apply. Please enter 'N/A' where appropriate. Work phone can be a secondary/cell number. -=-=-=-=-=-=-=-=-=-=- Full Name : Address : City : State : Zip Code : Home Phone : Work Phone : Best Time to Call : E-Mail Address : Estimated Debt Size : -=-=-=-=-=-=-=-=-=-=- Thank You To receive no further offers from our company regarding this matter or any other matter, please reply to this e-mail with the word 'Remove' in the subject line. From list@netscape.com Fri Jul 13 10:53:31 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA17994 for ; Fri, 13 Jul 2001 10:53:30 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6DEqFB18034; Fri, 13 Jul 2001 07:52:16 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6DEqFs02088; Fri, 13 Jul 2001 07:52:15 -0700 (PDT) Resent-Date: Fri, 13 Jul 2001 07:52:15 -0700 (PDT) Sender: Robert.Byrne@Sun.COM Message-ID: <3B4F0AC8.6ED2CA78@Sun.COM> Date: Fri, 13 Jul 2001 16:50:48 +0200 From: robert byrne Organization: Sun Microsystems X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: "ietf-ldapext@netscape.com" Subject: authentication levels in the ACM Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"pWdm4.A.jf.bswT7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Folks, The issue of authentication levels versus mechanisms has come up again. The history on this is that the model started with levels, went to mechanisms and now has moved back to levels. To help us try to reach concensus on this, here are three options and I try to list some pros and cos of each of the options. 1. Remove reference to authentication levels and mechanisms. This way, the model would not be capable of exressing anything concerning the authentication method or strength of a user. The policy of authentication requirements on users would be external to the model. Pro: 1. simplifies the ACM Con: 1. authentication is a basic notion for authorization and so it's natural to want to express it in the ACM. -- 2. Go back to a list of mechanisms with no "strength ordering" among the mechanisms. This way an aci subject would have to specify a list authentication mechanisms. There would be special keywords "none" and "authenticated" to mean "no authentication" and "some kind of authentication". Pro: 1. can force a given authzID to use a given mechanism. Con: 1. As no ordering is defined on mechanisms, the model cannot automatically give you behaviour you might expect: eg. if an aci authorizes me when I bind with DIGEST-MD5, I might be surprised to find that when I bound using SSL that it did not grant me that right. The implication is that at grant aci create time the admin needs to list _all_ the mecahanisms he wishes to grant rights. For deny, he needs to consider the possibility of the subject of his deny coming in using a different, "less strong", authentication mechanism with a potentially different authorizationId. -- 3. Stick with authentication levels and a "strength hierarchy" Pro: 1. The model can make use of the "strength hierarchy" in defining ACI semantics (e.g. a deny applies to ALL subjects at lower authnLevel). 2. Once the mechanisms are put in the buckets, the admin of acis is easier--just choose beteen the four levels rather than lots of mechanisms. Con: 1. Assignment of mechanisms to levels is on a per-server basis, but we could define a way for servers to advertise their assignments (for example to help with replication). 2. No way to associate a particular user with a particular mechanism. Cast your vote now! Otherwise we will default to 3, which is the current flavour. Rob. From list@netscape.com Fri Jul 13 11:02:20 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA19369 for ; Fri, 13 Jul 2001 11:02:19 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6DF16B19851; Fri, 13 Jul 2001 08:01:07 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6DF16o05609; Fri, 13 Jul 2001 08:01:06 -0700 (PDT) Resent-Date: Fri, 13 Jul 2001 08:01:06 -0700 (PDT) Date: Fri, 13 Jul 2001 10:59:54 -0500 From: Ryan Moats To: robert byrne Cc: "ietf-ldapext@netscape.com" Subject: Re: authentication levels in the ACM Message-ID: <20010713105954.B1162@armada.local.windrose.omaha.ne.us> References: <3B4F0AC8.6ED2CA78@Sun.COM> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <3B4F0AC8.6ED2CA78@Sun.COM>; from robert.byrne@Sun.COM on Fri, Jul 13, 2001 at 04:50:48PM +0200 Resent-Message-ID: <"Z1d6R.A.QXB.w0wT7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Doh! Lets try a mailing list response (sigh) Given the current state of #3, I'd prefer either 1 or 2. Ryan On Fri, Jul 13, 2001 at 04:50:48PM +0200, robert byrne wrote: | | Folks, | | The issue of authentication levels versus mechanisms has come up again. | | The history on this is that the model started with levels, went to | mechanisms and now has moved back to levels. | | To help us try to reach concensus on this, here are three options and I | try to list some pros and cos of each of the options. | | 1. Remove reference to authentication levels and mechanisms. | | This way, the model would not be capable of exressing anything | concerning the authentication method or strength of a user. The policy | of authentication requirements on users would be external to the model. | | Pro: | 1. simplifies the ACM | | Con: | 1. authentication is a basic notion for authorization and so it's | natural to want to express it in the ACM. | | -- | | 2. Go back to a list of mechanisms with no "strength ordering" among | the mechanisms. | | This way an aci subject would have to specify a list authentication | mechanisms. There would be special keywords "none" and "authenticated" | to mean "no authentication" and "some kind of authentication". | | Pro: | 1. can force a given authzID to use a given mechanism. | | Con: | 1. As no ordering is defined on mechanisms, the model cannot | automatically give you behaviour you might expect: eg. if an aci | authorizes me when I bind with DIGEST-MD5, I might be surprised to find | that when I bound using SSL that it did not grant me that right. The | implication is that at grant aci create time the admin needs to list | _all_ the mecahanisms he wishes to grant rights. For deny, he needs to | consider the possibility of the subject of his deny coming in using a | different, "less strong", authentication mechanism with a potentially | different authorizationId. | | -- | | 3. Stick with authentication levels and a "strength hierarchy" | | Pro: | 1. The model can make use of the "strength hierarchy" in defining | ACI semantics (e.g. a deny applies to ALL subjects at lower | authnLevel). | 2. Once the mechanisms are put in the buckets, the admin of acis is | easier--just choose beteen the four levels rather than lots of | mechanisms. | | Con: | 1. Assignment of mechanisms to levels is on a per-server basis, but | we could define a way for servers to advertise their assignments | (for example to help with replication). | 2. No way to associate a particular user with a particular mechanism. | | Cast your vote now! Otherwise we will default to 3, which is the | current flavour. | | Rob. | From list@netscape.com Fri Jul 13 21:30:32 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA12691 for ; Fri, 13 Jul 2001 21:30:31 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6E1TCv19379; Fri, 13 Jul 2001 18:29:12 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6E1TDk28789; Fri, 13 Jul 2001 18:29:13 -0700 (PDT) Resent-Date: Fri, 13 Jul 2001 18:29:13 -0700 (PDT) From: To: Subject: Welcome to directoryserviceinc.com Date: Fri, 13 Jul 2001 18:03:18 -0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_4F54_01C10BC6.18688E20" X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Message-ID: X-OriginalArrivalTime: 14 Jul 2001 01:20:33.0871 (UTC) FILETIME=[2DF76DF0:01C10C03] Resent-Message-ID: <"dmaYzD.A.cBH.nB6T7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a multi-part message in MIME format. ------=_NextPart_000_4F54_01C10BC6.18688E20 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Thank You for visiting http://www.directoryserviceinc.com, the web's most comprehensive database of addresses and phone numbers. In the future be sure to use http://www.directoryserviceinc.com for all your 411 needs. When you are away from computer you may access http://www.directoryserviceinc.com 's resources over the phone by dialing 1-888-554-1212, or if you are a sprint customer 10-10-3330. Thanks, Directoryserviceinc.com Team Note to the Recipients:- This is an automaticlly generated e-mail. If you do not want to receive this e-mail in the future, click Unsubscribe or reply to info@requested-info.com with "Remove" in the subject. You can also call customer service at 1-888-796-2488 Monday-Friday 8am-9pm EST ------=_NextPart_000_4F54_01C10BC6.18688E20 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Thank You for visiting http://www.directoryservicein= c.com, the=20 web's most comprehensive database of addresses and phone numbers. In the future be sure to use http://www.directoryservicein= c.com =20 =20 =20 =20 for all your 411=20 needs.

When you are away from computer you may access http://www.directoryservicein= c.com 's resources=20 over the phone

=20 by dialing 1-888-554-1212, or if you=20 are a sprint customer 10-10-3330.

Thanks,
Directoryserviceinc.com =20 Team
Note to the Recipients:- This is an automaticlly = generated e-mail. If you do not want to receive this e-mail in the = future, click Unsubscribe or reply to = info@requested-info.com = with "Remove" in the subject. You can also call customer service at = 1-888-796-2488 Monday-Friday 8am-9pm EST

------=_NextPart_000_4F54_01C10BC6.18688E20-- From list@netscape.com Sat Jul 14 03:50:54 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id DAA11081 for ; Sat, 14 Jul 2001 03:50:53 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6E7nAB23361; Sat, 14 Jul 2001 00:49:11 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6E7nBc03066; Sat, 14 Jul 2001 00:49:11 -0700 (PDT) Resent-Date: Sat, 14 Jul 2001 00:49:11 -0700 (PDT) From: Subject: why are you receiving this email?? Date: Sat, 14 Jul 2001 01:50:43 Message-Id: <851.254146.229281@server02> Resent-Message-ID: <"yaJx1B.A.Lv.1l_T7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com I received your e-mail address from a list of people searching for online business opportunities. If I made a mistake, please send me a "remove" message to the address at the bottom of the page. What you want is a money making program that's proven to work and costs little to nothing to get started? Many of us have been through a lot of MLM companies and have put in a lot of time, money and effort only to find out that you have been scammed? Even companies that seemed to be a sure thing! I have been through it many times myself, and what I have learned is that you should do your research and listen to the advice of the people who have truly made money from those programs. Would you like to know more about the programs that really bring you money? After many times of being scammed, $50 here and $50 there I finally found a program that worked and has been developed in such a way that it would make anyone successful. The system is very simple; I give you the ad copy I use and detailed instructions explaining exactly how to market it. The nurturing and development of your down line is the key that makes any MLM opportunity work. So what better way to help them become successful than to give them the exact method that is successful for you. If you would like me to send you the information about the program I am currently involved in, please send a message to the link below, with "interested" in the subject line. Mail to:kubox2@yahoo.ca ------------------------------------------------------------------ ---------- If you would like to be removed from the list, please write "remove" in the subject line. Mail to:kubalaka@yahoo.ca From list@netscape.com Sat Jul 14 23:22:10 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id XAA15020 for ; Sat, 14 Jul 2001 23:22:09 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6F3KtB07066; Sat, 14 Jul 2001 20:20:56 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6F3Kus23521; Sat, 14 Jul 2001 20:20:56 -0700 (PDT) Resent-Date: Sat, 14 Jul 2001 20:20:56 -0700 (PDT) Message-Id: <200107150319.f6F3JDI27448@ywing.netscape.com> From: "Ben West" Subject: Have One # 909 To: iop45c@ywing.aoltw.net X-Mailer: Microsoft Outlook Express 4.72.1712.3 X-MimeOLE: Produced By Microsoft MimeOLE VÐßD.1712.3 Mime-Version: 1.0 Date: Sat, 14 Jul 2001 22:39:34 -0500 Content-Type: multipart/mixed; boundary="----=_NextPart_000_007F_01BDF6C7.FABAC1B0" Resent-Message-ID: <"VUwpv.A.BvF.UwQU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a MIME Message ------=_NextPart_000_007F_01BDF6C7.FABAC1B0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0080_01BDF6C7.FABAC1B0" ------=_NextPart_001_0080_01BDF6C7.FABAC1B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable ***** This is an HTML Message ! ***** ------=_NextPart_001_0080_01BDF6C7.FABAC1B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FREE Computer With Merchant Account Setup
COMPLETE CREDIT CARD PROCESSING SYSTEMS FOR YOUR BUSINESS=2E INTERNE= T - HOME BASED - MAIL ORDER - PHONE ORDER

Do you accept credit cards? Your competition does!

Everyone Approved - Credit Problems OK!
Approval in less than 24 hours!
Increase your sales by 300%
Start Accepting Credit Cards on your website!
Free Information, No Risk, 100% confidential=2E
Your name and information will not be sold to thrid parties!
Home Businesses OK! Phone/Mail Order OK!
No Application Fee, No Setup Fee!
Close More Impulse Sales!

Everyone Approved!

Good Credit or Bad! To= apply today, please fill out the express form below=2E It contains all the information we need to get your account approved=2E For a= rea's that do not apply to you please put "n/a" in the box=2E

Upon receipt, we'll fax you with all of the all Bank Card Application documents necessary to establish your Merchant Account=2E Once returned we= can have your account approved within 24 hours=2E

Service Industry Standard
US

Site Inspection $50 - $75 FREE

Shipping $50 - $75 FREE

Warranty $10 Per Month= FREE

Sales Receipts $10 - $50&nbs= p; FREE

Fraud Screening
$=2E50 - $1=2E00
Per Transaction
FREE

Amex Set Up $50 - $75 FREE

24 Hour Help Line $10 Month FREE

Security Bond $5000- $10,00= 0
Or More NONE

This is a No Obligation Qualification Form and is your first step to accepting credit cards=2E By filling out this form you will= "not enter" in to any obligations o= r contracts with us=2E We will use it to determine the best p= rogram to offer you based on the information you provide=2E You will be c= ontacted by one of our representatives within 1-2 business days to go over = the rest of your account set up=2E
<= font color=3D"#cc0000">Note: All Information Provided To Us Will Remain= 100% Confidential !!

Apply Free With No Risk!

Pleas= e fill out the express application form completely=2E
Incomplete information m= ay prevent us from properly processing your application=2E

Your Full Emai= l Address:
be sure to use your full address (i= =2Ee=2E user@domain=2Ecom)

Your Name:

Business Name:=

Business Phone= Number:

Home Phone Num= ber:

Type of Busine= ss:

	Retail Business
	Mail Order Business
	Internet Based Busines= s

Personal Credi= t Rating:

	Excellent
	Good
	Fair
	Poor

How Soon Would= You Like a Merchant Account?

Your info= rmation is confidential, it will not be sold or used for any other purpose,= and you are under no obligation=2E Your information will be used solely for the purpose of evaluating= your business or website for a merchant account so that you may begin acce= pting credit card payments=2E

List Removal/OPT-OUT Option
Click Herem ------=_NextPart_001_0080_01BDF6C7.FABAC1B0-- ------=_NextPart_000_007F_01BDF6C7.FABAC1B0-- From list@netscape.com Sun Jul 15 03:38:27 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id DAA07903 for ; Sun, 15 Jul 2001 03:38:26 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6F7bAv02359; Sun, 15 Jul 2001 00:37:10 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6F7bCQ02609; Sun, 15 Jul 2001 00:37:12 -0700 (PDT) Resent-Date: Sun, 15 Jul 2001 00:37:12 -0700 (PDT) Message-Id: <200107150737.f6F7bNd29625@xwing.aoltw.net> From: "BARR. SAMSON OBOH" To: Subject: Thanks Mime-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Date: Sun, 15 Jul 2001 09:38:46 Resent-Message-ID: <"pE-yH.A.Vo.mgUU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com SAMSON OBOH ESQ. OKEAYA INNEH LAW CHAMBER BOOK SHOP BUILDING, 11TH FLOOR 23 BROAD STREET, LAGOS - NIGERIA SIR, I AM SAMSON OBOH ESQ (SAN) SENIOR PARTNER OF AHMED & ASSOCIATES LAW CHAMBERS, A LAWYER/ATTORNEY TO HAMZA AL MUSTAPHA WHO WAS THE FORMER CHIEF SECURITY OFFICER TO THE MILITARY DICTATOR OF NIGERIA, GENERAL SANI ABACHA. THE LATE GENERAL SANI ABACHA DIED UNEXPECTEDLY ON THE 8TH OF JUNE 1998. HIS COLLEAGUES IN THE ARMY POISONED HIM IN THE PRESIDENTIAL VILLA (ASOROCK) BECAUSE HE RULED NIGERIA WITH AN IRON HAND AND HE DID NOT WANT DEMOCRACY IN THE COUNTRY. WITH THE DEATH OF THE DICTATOR, ELECTIONS WERE HELD IN THE COUNTRY AND A CIVILIAN ADMINISTRATION WAS SWORN INTO POWER. WITH THE ADVENT OF THE NEW CIVILIAN ADMINISTRATION, A DECISION WAS TAKEN BY THE PRESIDENT OF NIGERIA TO PROBE AND PROSECUTE ALL MILITARY OFFICERS THAT SERVED IN THE LAST MILITARY REGIME OF THE LATE GENERAL SANI ABACHA. MY CLIENT, MAJOR HAMZA AL MUSTAPHA WAS SINGLED OUT BY THE GOVERNMENT OF THE DAY AS AN ARMY OFFICER THAT MUST BE PUNISHED BECAUSE OF HIS CLOSENESS TO THE LATE DICTATOR AND GROSS HUMAN RIGHT ABUSES ON THE CITIZENS OF NIGERIA. MY CLIENT AND I WERE BEST OF FRIENDS AND HE SHARED HIS SECRETS WITH ME. THE FORMER CHIEF SECURITY OFFICER TO THE LATE HEAD OF STATE MAJOR HAMZA AL MUSTAPHA HAD PRIVATE ACCOUNTS THAT ARE WORTH 100 MILLION UNITED STATES DOLLARS AROUND THE WORLD. PRESENTLY HE HAS BEEN ARRESTED BY THE GOVERNMENT OF THE DAY AND IS PRESENTLY IN PRISON WAITING TO BE TAKEN TO COURT ON CHARGES OF GROSS HUMAN RIGHT ABUSES ON THE CITIZENS OF NIGERIA. I WAS DIRECTLY INFORMED BY MY CONTACTS AT THE PRESIDENTIAL VILLA, THAT HE WILL BE CONVICTED BECAUSE OF HIS POSITION AS THE FORMER CHIEF SECURITY OFFICER TO THE LATE DICTATOR. SHORTLY BEFORE THE PRESENT GOVERNMENT ARRESTED MY CLIENT, HE ENTRUSTED TO ME THE SUM OF TWENTY -SIX MILLION, FOUR HUNDRED THOUSAND UNITED STATES DOLLARS (us$26,400,000.00) FOR SAFEKEEPING. THIS AMOUNT WAS TO BE SENT TO HIS MISTRESS IN LEBANON TO LAUNDER FOR HIM. I HAVE SINCE HAD THIS AMOUNT WITH ME STASHED AWAY A PRIVATE SECURITY COMPANY IN NIGERIA. I CANNOT SEND THIS MONEY TO MY CLEINT'S MISTRESS ANY MORE BECAUSE OF THE SITUATION OF THINGS OVER HERE. AS A RESULT OF THIS I HAVE BEEN MANDATED BY MY CLIENT TO SOLICIT FOR A PARTNER ABROAD WHO IS WILLING AND READY TO ASSIST IN RECEIVING THE $26.4 MILLION. THEREFORE, I NEED YOUR ASSISTANCE IN MOVING AND SECURING THIS MONEY IN YOUR ACCOUNT ABROAD. YOU WILL BE ADEQUATELY COMPENSATED WITH 15% OF THE TOTAL SUM FOR YOUR ASSISTANCE AND CO-OPERATION WITH ME TO MOVE THIS FUNDS OUT OF THE COUNTRY. I INTEND TO SAFEGUARD AND INVEST THIS AMOUNT OF MONEY ABROAD WITH A RELIABLE FOREIGN BUSINESS PARTNER SO THAT WE CAN INVEST THE FUNDS IN REAL ESTATE BUSINESS OR ANY VIABLE BUSINESS IN YOUR COUNTRY. THAT IS WHY I AM SOLICITING YOUR ASSISTANCE AND COOPERATION AS REGARDS THIS BUSINESS. ARRANGEMENTS HAVE BEEN CONCLUDED WITH A SECURITY COMPANY IN EUROPE TO RECEIVE THE MONEY IN CASH DEPENDING ON WHERE IS CONVENIENT FOR YOU. PLEASE INDICATE YOUR WILLINGNESS TO ASSIST US. I AM WAITING TO HEAR FROM YOU VERY SOON. BEST REGARDS, SAMSON OBOH ESQ From list@netscape.com Sun Jul 15 04:15:29 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id EAA16227 for ; Sun, 15 Jul 2001 04:15:28 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6F8EFB18289; Sun, 15 Jul 2001 01:14:15 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6F8EGw08998; Sun, 15 Jul 2001 01:14:16 -0700 (PDT) Resent-Date: Sun, 15 Jul 2001 01:14:16 -0700 (PDT) Date: Sun, 15 Jul 2001 01:14:38 -0700 (PDT) Reply-To: From: "success85225@yahoo.com" To: "6342@aol.com" <6342@aol.com> Message-ID: <0995185023.0924507627@mx3.mail.yahoo.com> Subject: A Wise Man Once Said... ADV: 1719136 Content-Type: text/plain; charset="us-ascii";format=flowed Content-Transfer-Encoding: 7bit Resent-Message-ID: <"sZMHW.A.OMC.WDVU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Be Debt Free for 2002. Please read before you delete. This is not a spam. Truly you will become debt free. You have nothing to lose and everything to gain. All our mailings are sent complying to the proposed United States Federal requirements for commercial e-mail: Section 301 Paragraph (a)(2)(C) of S.618. Please see the bottom of this message for further information and removal instructions. Dear Friend, AS SEEN ON NATIONAL TV: Make over a half million dollars ($500,000+)every 4 to 5 months from your home for an investment of only $25 U.S. Dollars - one time! THANKS TO THE COMPUTER AGE AND THE INTERNET! ====================================================== BE A MILLIONAIRE LIKE OTHERS WITHIN A YEAR!! Before you say "Bull", please read the following. This is the letter you have been hearing about on the news lately. Due to the popularity of this letter on the internet, a national weekly news program recently devoted an entire show to the investigation of this program described below, to see if it really can make people money. Also... ***Does this Headline Look familiar??*** PARENTS OF 15 YEAR OLD FIND $71,000 CASH HIDDEN IN CLOSET! Of course it does. This is one of the stories they featured on that news report. This is also the same program that he was using. Moving On... This show also investigated whether or not the program was legal. Their findings proved once and for all that there are "absolutely no laws prohibiting the participation in the program and if people can follow the simple instructions, they are bound to make some mega bucks with only $25 out of pocket cost." DUE TO THE RECENT INCREASE OF POPULARITY THIS PROGRAM HAS ATTAINED, IT IS CURRENTLY WORKING BETTER THAN EVER !!! This is what one participant had to say: "I am thankful for this profitable opportunity. I had seen this program many times before, but each time I passed on it. I am so glad I finally joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received a total of $610,470.00 in 21 weeks, with money still coming in." Pam Hedland, Fort Lee, NJ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Here is another testimonial: "This program has been around for a long time and I never believed in it. But one day when I received this again in the mail, I decided to gamble my $25 on it. I followed the simple instructions and walaa. 3 weeks later the money started to come in. First month I only made a total of $240.00 but the next 2 months after that I made a total of $290,000.00. So far, in the past 8 months by re-entering the program, I have made over $710,000 and I am playing it again. The key to success in this program is to follow the simple steps and not change anything." More testimonials later but first, ****** PRINT THIS NOW FOR YOUR FUTURE REFERENCE ****** $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you would like to make at least $500,000 every 4 to 5 months easily and comfortably, please read the following. THEN READ IT AGAIN AND AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ FOLLOW THE SIMPLE INSTRUCTIONS BELOW AND YOUR FINANCIAL DREAMS WILL COME TRUE!!! INSTRUCTIONS: **** Order all 5 reports shown on the list below. **** For each report, send: 1. $5 CASH 2. THE NAME AND NUMBER OF THE REPORT YOU ARE ORDERING 3. YOUR E-MAIL ADDRESS to the person whose name appears ON THAT LIST next to the report. MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE TOP LEFT CORNER in case of any mail problems. **** When you place your order, make sure you order each of the 5 reports. You will need all 5 reports so that you can save them on your computer and resell them. YOUR TOTAL COST $5 X 5 = $25. **** Within a few days you will receive, via e-mail, each of the 5 reports from these 5 different individuals. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. Also make a floppy of these reports and keep it on your desk in case something happens to your computer. **** IMPORTANT - DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than what is instructed below in steps 1 through 6 or you will lose out on a majority of your profits. Once you understand the way this works, you will also see how it does not work if you change it. Remember, this method has been tested, and if you alter it, it will NOT work!!! So, DO NOT try to change anything other than what is instructed. Because if you do, it will not work for you. Remember, honesty reaps the reward!!! 1. After you have ordered all 5 reports, take this advertisement and REMOVE the name and address of the person in REPORT # 5. This person has made it through the cycle and is not doubt counting their fortune. 2. Move the name and address in REPORT # 4 to REPORT # 5. 3. Move the name and address in REPORT # 3 to REPORT # 4. 4. Move the name and address in REPORT # 2 to REPORT # 3.. 5. Move the name and address in REPORT # 1 to REPORT #2. 6. Insert YOUR name and address in the REPORT # 1 position. PLEASE MAKE SURE you copy every name and address ACCURATELY! ============================================================ Take this entire letter, with the modified list of names, and save it on your computer. DO NOT MAKE ANY OTHER CHANGES. Save this on a disk as well just in case you lose any data. To assist you with marketing your business on the internet, the 5 reports you purchase will provide you with invaluable marketing information which includes how to send bulk e-mails legally, where to find thousands of free classified ads and much more. There are 2 primary methods to get this venture going: METHOD # 1: BY SENDING BULK E-MAIL LEGALLY ============================================================ Let's say that you decide to start small, just to see how it goes, and we will assume you and those involved send out only 5,000 e-mails each. Let's also assume that the mailing receives only a 0.2% response (the response could be much better but let's just say it is only 0.2%. Also, many people will send out thousands of e-mails instead of only 5,000 each.) Continuing with this example, you send out only 5,000 e-mails. With a 0.2% response, that is only 10 orders for Report # 1. Those 10 people responded by sending out 5,000 e-mails each for a total of 50,000. Out of those 50,000 e-mails, only 0.2% responded with orders. That equals 100 people responding and ordering Report # 2. Those 100 people mail out 5,000 e-mails each for a total of 500,000 emails. The 0.2% response to that is 1,000 orders for Report # 3. Those 1,000 people send out 5,000 e-mails each for a total of 5 million e-mails sent out. The 0.2% response to that is 10,000 orders for Report # 4. Those 10,000 people send out 5,000 e-mails each for a total of 50,000,000 (50 million) e-mails. The 0.2% response to that is 100,000 orders for Report # 5. THAT'S 100,000 ORDERS TIME $5 EACH = $500,000.00 (One-half million dollars.) Your total income in this example is: 1. $50 + 2. $500 + 3. $5,000 + 4. $50,000 + 5. $500,000 + Grand Total + $555,550.00 NUMBERS DO NOT LIE. GET A PENCIL AND PAPER AND FIGURE OUT THE WORSE POSSIBLE RESPONSE. NO MATTER HOW YOU CALCULATE IT, YOU WILL STILL MAKE A LOT OF MONEY!!! ------------------------------------------------------------- REMEMBER FRIEND, THIS IS ASSUMING ONLY 10 PEOPLE ORDER OUT OF THE 5,000 YOU MAILED TO. Dare to think for a moment what would happen if everyone or half or even one fourth of those people who responded mailed 100,000 e-mails each or more. There are over 250 million people on the internet worldwide and counting. Believe me, many people will do just that, and more! METHOD # 2: BY PLACING FREE ADS ON THE INTERNET =========================================================== Advertising on the net is very inexpensive and there are hundreds of FREE places to advertise. Placing a lot of free ads on the internet will easily get a large response. We strongly suggest you start with METHOD # 1 and add METHOD # 2 as you go along. For every $5 you receive, all you must do is e-mail them the Report they ordered. That's it. Always provide same day service on all reports. This will guarantee that the e-mail they send out, with your name and address on it, will be prompt because they can not advertise until they receive the report. **********AVAILABLE REPORTS********** ORDER EACH REPORT BY ITS NUMBER AND NAME ONLY. Notes: Always send $5 cash (U.S. CURRENCY) for each Report. Checks NOT accepted. Make sure the cash is concealed by wrapping it in at least 2 sheets of paper. On one of those sheets of paper, write the NUMBER & NAME of the Report you are ordering along with YOUR E-MAIL ADDRESS and your name and postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW: ==================================================== REPORT # 1: "The Insider's Guide to Sending Bulk e-mail on the Internet." ORDER REPORT # 1 FROM: Shane Black PO Box 2240 Gilbert, Arizona 85299-2240 USA Don't forget to provide your e-mail address to receive the reports! ==================================================== REPORT # 2: "The Insider's Guide to Advertising for Free on the Internet" ORDER REPORT # 2 FROM: SMJ PO Box 8936 Mesa, AZ. 85213-8936 USA ==================================================== REPORT # 3: "The Secrets of Multi-Level Marketing on the Internet" ORDER REPORT # 3 FROM: M. Miller 3089-C Clairemont Drive #343 San Diego, CA. 92117 USA ==================================================== REPORT # 4: "How to Become a Millionaire Utilizing the Power of Multi-Level Marketing and the Internet" ORDER REPORT # 4 FROM: KC 3439 NE Sandy Blvd #379 Portland, Oregon 97232 USA ==================================================== REPORT # 5: "How to Send 1,000,000 E-mails for FREE" ORDER REPORT # 5 FROM: DJ 3100 S Sheridan Blvd 1C-510 Denver, CO. 80227 USA ====================================================== There are currently more than 250,000,000 people online worldwide! $$$$$$$$$$$$$$ YOUR SUCCESS GUIDELINES $$$$$$$$$$$$$$ Follow these guidelines to create your success: If you do not receive at least 10 orders for Report # 1 within 2 weeks, continue sending e-mails until you do. After you receive 10 orders, 2 to 3 weeks after that you should receive 100 orders or more for Report # 2. If you did not, continue advertising or sending e-mails until you do. Once you have receiving 100 or more orders for Report # 2, YOU CAN RELAX, because the system is already working for you, and the cash will continue to roll in! THIS IS IMPORTANT TO REMEMBER: Every time your name is moved down on the list, you are placed in front of a different report. You can KEEP TRACK of your PROGRESS by watching which report people are ordering from you. IF YOU WANT TO GENERATE MORE INCOME SEND ANOTHER BATCH OF E-MAILS AND START THE WHOLE PROCESS AGAIN. There is NO LIMIT to the income you can generate from this business!!! -------------------------------------------------------------- FOLLOWING IS A NOTE FROM THE ORIGINATOR OF THIS PROGRM: You have just received information that can give you financial freedom for the rest of your life, with NO RISK and JUST A LITTLE BIT OF EFFORT. You can make more money in the next few weeks and months than you have ever imagined. Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way. It works exceedingly well as it is now. Remember to e-mail a copy of this exciting report after you have put your name and address in Report # 1 and move others to # 2...# 5 as instructed above. One of the people you send this to may send out 100,000 or more e-mails and your name will be on every one of them. Remember though, the more you send out the more potential customers you will reach. So my friend, I have given you ideas, information, materials and opportunity to become financially independent. IT IS UP TO YOU NOW! *************** MORE TESTIMONIALS *************** My name it Mitchell. My wife, Jody and I live in Chicago. I am an accountant with a major U.S. Corporation and I make pretty good money. When I received this program I grumbled to Jody about receiving "junk mail". I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Jody totally ignored my supposed intelligence and a few days later she jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work. Well, the laugh was on me! Within 3 weeks she had received 50 responses. Within the next 45 days she had received a total of $147,200.00 all cash! I was shocked. I have joined Jody in her "hobby". Mitchell Wolf, Chicago, Illinois --------------------------------------------------------------------------------------------------------------- "Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way I wouldn't get enough orders to at least get my money back. I was surprised when I found my medium size post office box crammed with orders. I made $319,210.00 in the first 12 weeks. The nice thing about this deal is that it does not matter where people live. There simply isn't a better investment with a faster return." Dan Sondstrom, Alberta, Canada -------------------------------------------------------------------------------------------------------------- "I had received this program before. I deleted it, but later I wondered if I should have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed again by someone else... 11 months passed and then it luckily came again ... I did not delete is one! I made more than $490,000 on my first try and all the money came within 22 weeks." Susan De Suza, New York, NY ------------------------------------------------------------------------------------------------------------- "It really is a great opportunity to make relatively easy money with little cost to you. I followed the simple instructions carefully and within 10 days the money started to come in. My first month I made $20,560.00 and by the end of the third month my total cash count was $362,840.00. Life is beautiful, thanks to the Internet." Fred Dellaca, Westport, New Zealand -------------------------------------------------------------------------------------------------------------- ORDER YOUR REPORTS TODAY AND GET STARTED ON "YOUR" ROAD TO FINANCIAL FREEDOM!!! If you have any questions of the legality of this program, contact the Office of Associate Director for Marketing Practices, Federal Trade Commission, Bureau of Consumer protection, Washington, D.C. Under Bill s.1618 TITLE III passed by the 105th Congress, this letter cannot be considered spam as long as the sender includes contact information and a method of removal. Make over a half million dollars ($500,000+) every 4 to 5 months from your home for an invest of only $25 U.S. Dollars - one time! It's there for you - go for it! Good Luck! -=-=-=-=--=-=-=-=-=-=REMOVE Instructions=-=-=-=-=-=-=-=-=-=- ************************************************************** Do not reply to this message - To be removed from future mailings: mail to remove1549@xyz002.com ************************************************************** -=-=-=-=--=-=-=-=-=-=-=-=More Info=-=-=-=-=-=-=-=-=-=-=-=-=-=- ************************************************************** To receive more information or to subscribe to Periodic mailings with offers like this... mail to reply1549@xyz002.com ************************************************************** <-*->$d d8i8F3=,d|F0,szI$dA93=i8F3=,d|F0,szI$dAS[8 i8F3=,d|F0,szI$dAA[=s8i8F3=,d|F0,szI$d?@i8F3=,d|F0,szI$d?@[8=i8F3=,d|F0,szI$dRF=i8F3=,d|F0,szI$d-dA9i8F3=,d|F0,szI$OAdOAd89i8F3=,d|F0,szI$9O[SSi8F3=,d|F0,szI$F,@FAi8F3=,d|F0,szI$[SSi8F3=,d|F0,szI$zz6Wvi8F3=,d|F0,szI$sSSd89i8F3=,d|F0,szI$s8FR|s3i8F3=,d|F0,szI$s|@[8=dzRi8F3=,d|F0,szI$sA@nz%fQmi8F3=,d|F0,szI$s?F=i8F3=,d|F0,szI$33|YY???0@d3$Ri8F3=,d|F0,szI$Rd33i8F3=,d|F0,szI$Rzd83i8F3=,d|F0,szI[,Fz8F=3=i8F3=,d|F0,szI[F3_ZS9d|F*3i8F3=,d|F0,szI_Ad8@i8F3=,sAF0,sz<-*-> From list@netscape.com Sun Jul 15 10:53:29 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA28624 for ; Sun, 15 Jul 2001 10:53:29 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6FEqFB02159; Sun, 15 Jul 2001 07:52:16 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6FEqFA04378; Sun, 15 Jul 2001 07:52:15 -0700 (PDT) Resent-Date: Sun, 15 Jul 2001 07:52:15 -0700 (PDT) Message-Id: <5.1.0.14.0.20010715072808.0292aae8@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Sun, 15 Jul 2001 07:48:03 -0700 To: helm@fionn.es.net From: "Kurt D. Zeilenga" Subject: Re: alternate "dc" naming conventions Cc: ietf-ldapext@netscape.com In-Reply-To: <200107110404.VAA11187@fionn.es.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"fqgXsB.A.CEB.e4aU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com At 09:04 PM 7/10/2001, Michael Helm wrote: >"Kurt D. Zeilenga" writes: >> In this setup, which is quite common BTW, the superior service >> needs to hold a subordinate reference and the subordinate >> service needs to hold a superior reference. Then the client > >I think what are you saying is, anything that is registered >in dns as >_ldap._tcp.es.net > like > w2kdomain.es.net > whitepages.es.net > grid-yellowpages.es.net > >must be prepared to provide service or referrals for anything >with dc=es,dc=net as the (appropriate) part of its base name, >is that right? Yes. The _ldap._tcp.es.net hold SRV location information for "dc=es,dc=net". There may objects subordinate to "dc=es,dc=net" which are locatable using same SRV information or locatable via LDAP referrals provided by the services referenced in the SRV information. >(If not) please straighten me out! > >(If so) >I didn't realize this level of coherence was required ... I don't > think it's that explicit in the locator draft. Should it be? Yes. >(Same applies to forbidding chasing dns search upwards) Any locate approach which requires the DNS tree to be walked (in either direction) will negatively impact the operation of DNS root, TLD, SLD, and ... servers and should be avoided. >Something about this level of coherence makes me nervous, but I'm >not exactly sure what. I don't think I expect it to work perfectly >(suppose one of the _ldap._tcp.es.net rr's points to a >stupid server that gives out bad or incomplete information). No solution works well with inappropriately configured or in poor implementations... just like DNS NS RRs and LDAP "ref" values. >I would be >inclined to code an ldap client to look up all the servers >it gets from the dns lookup and exhaust the list of servers in case the >previous ones didn't have the base name it was looking for. Exhausting a long list of RRs would be expensive. Each of the listed services should be "equally capable". >But maybe that's undesirable behavior in some other context. Yes, this would require a lot of work in deployments who want to use multiple RRs to list available replicas. >Leaving aside the dangling o=grid rdn, it seems like one >appropriate way to use dns srv for grid directory servers >is to register a referral server that could deal with the >restriction above & that clients could find by the usual >_ldap._tcp.my.domain query. That is, this is approach is for locating entries named using RFC 2047 (and entries subordinate to these). Yes, this approach has limited applicability. Other approaches (such as those described by Skip and myself) can be used for other applications. >How or whether the other servers >would be registered in dns is tbd. They probably should be >registered, if at all, as some other service or services. I'd guess that would likely depends on the approach. From list@netscape.com Sun Jul 15 19:07:05 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id TAA13135 for ; Sun, 15 Jul 2001 19:07:05 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6FN5rB20559; Sun, 15 Jul 2001 16:05:54 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6FN5rc18110; Sun, 15 Jul 2001 16:05:53 -0700 (PDT) Resent-Date: Sun, 15 Jul 2001 16:05:53 -0700 (PDT) X400-Received: by mta BAWMTA in /c=gb/admd=attmail/prmd=ba/; Relayed; 15 Jul 2001 23:03:54 Z X400-Received: by /c=gb/admd=attmail/prmd=ba/; Relayed; 15 Jul 2001 23:03:54 Z X400-MTS-Identifier: [/c=gb/admd=attmail/prmd=ba/; 01BA23B52215A006-BAWMTA] Content-Identifier: 01BA23B52215A006 Content-Return: Allowed X400-Content-Type: P2-1988 ( 22 ) Conversion: Allowed Original-Encoded-Information-Types: IA5-Text Priority: normal Disclose-Recipients: Prohibited Alternate-Recipient: Allowed X400-Originator: Dominic.J.Steinitz@BritishAirways.com X400-Recipients: non-disclosure; Message-Id: <"01BA23B52215A006*/c=GB/admd=ATTMAIL/prmd=BA/o=British Airways PLC/ou=CORPLN1/s=Steinitz/g=Dominic/i=J/"@MHS> Date: 15 Jul 2001 23:03:54 Z From: "Steinitz, Dominic J" To: "robert.byrne" cc: "Taylor, Martin S" , ietf-ldapext Subject: Re: authentication levels in the ACM Resent-Message-ID: <"Ya3s_.A.jaE.PHiU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Our view is definitely for option 2 as this leaves organisations free to choose what they consider strong enough for a given application. Methods are not necessarily a totally ordered set. Option 3 forces you to compare methods for strength which will vary depending on your view on threats, vulnerabilities and business impact. Dominic. robert.byrne@Sun.COM on 13/07/2001 15:53:00 To: ietf-ldapext cc: bcc: Dominic Steinitz Subject: authentication levels in the ACM Folks, The issue of authentication levels versus mechanisms has come up again. The history on this is that the model started with levels, went to mechanisms and now has moved back to levels. To help us try to reach concensus on this, here are three options and I try to list some pros and cos of each of the options. 1. Remove reference to authentication levels and mechanisms. This way, the model would not be capable of exressing anything concerning the authentication method or strength of a user. The policy of authentication requirements on users would be external to the model. Pro: 1. simplifies the ACM Con: 1. authentication is a basic notion for authorization and so it's natural to want to express it in the ACM. -- 2. Go back to a list of mechanisms with no "strength ordering" among the mechanisms. This way an aci subject would have to specify a list authentication mechanisms. There would be special keywords "none" and "authenticated" to mean "no authentication" and "some kind of authentication". Pro: 1. can force a given authzID to use a given mechanism. Con: 1. As no ordering is defined on mechanisms, the model cannot automatically give you behaviour you might expect: eg. if an aci authorizes me when I bind with DIGEST-MD5, I might be surprised to find that when I bound using SSL that it did not grant me that right. The implication is that at grant aci create time the admin needs to list _all_ the mecahanisms he wishes to grant rights. For deny, he needs to consider the possibility of the subject of his deny coming in using a different, "less strong", authentication mechanism with a potentially different authorizationId. -- 3. Stick with authentication levels and a "strength hierarchy" Pro: 1. The model can make use of the "strength hierarchy" in defining ACI semantics (e.g. a deny applies to ALL subjects at lower authnLevel). 2. Once the mechanisms are put in the buckets, the admin of acis is easier--just choose beteen the four levels rather than lots of mechanisms. Con: 1. Assignment of mechanisms to levels is on a per-server basis, but we could define a way for servers to advertise their assignments (for example to help with replication). 2. No way to associate a particular user with a particular mechanism. Cast your vote now! Otherwise we will default to 3, which is the current flavour. Rob. ------------------------------------------------------------------------------------------------- 21st century air travel http://www.britishairways.com From list@netscape.com Sun Jul 15 19:48:07 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id TAA17790 for ; Sun, 15 Jul 2001 19:48:07 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6FNkrv10980; Sun, 15 Jul 2001 16:46:54 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6FNksc24771; Sun, 15 Jul 2001 16:46:54 -0700 (PDT) Resent-Date: Sun, 15 Jul 2001 16:46:54 -0700 (PDT) Mime-Version: 1.0 X-Sender: hoytkesterson@mail.earthlink.net (Unverified) Message-Id: Date: Sun, 15 Jul 2001 16:25:13 -0700 To: "X.509":;, IETF LDAP From: "Hoyt L. Kesterson II" Subject: announcement of X.500 meeting 24-28 September in Flagstaff Arizona Content-Type: text/plain; charset="us-ascii" ; format="flowed" Resent-Message-ID: <"qc8sDB.A.pCG.ttiU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com There will be a meeting on X500 in Flagstaff Arizona the week of 24 September. Details on the agenda and the venue can be found in both word and pdf at ftp://ftp.bull.com/pub/OSIdirectory/Flagstaff2001/announcement.doc ftp://ftp.bull.com/pub/OSIdirectory/Flagstaff2001/announcement.pdf hoyt From list@netscape.com Sun Jul 15 23:57:37 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id XAA19333 for ; Sun, 15 Jul 2001 23:57:36 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6G3sXv23178; Sun, 15 Jul 2001 20:54:34 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6G3sZc11137; Sun, 15 Jul 2001 20:54:35 -0700 (PDT) Resent-Date: Sun, 15 Jul 2001 20:54:35 -0700 (PDT) DATE: 15 Jul 01 9:56:47 PM FROM: 5UerUmmF1@yahoo.com Message-ID: SUBJECT: $100 Per Hour Blind Folded *Checks Paid Weekly* Resent-Message-ID: <"UN4mq.A.ptC.5VmU7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This email will NOT contain any hype, just facts. **Recent Announcement** An 8 Time MLM industry million dollar earner (Phil Piccolo) and I have recently joined forces. We are setting up our initial team In a 4 by 7 Forced matrix (YES this is MLM). We are NOT interested in you dealing with family and freinds..Because of that claim...We will back you up with lists of FREE qualified prospects to contact and YOU will earn the $100 weekly commission checks. To be considered for our team you must follow the steps below before we will consider you for a position: STEP 1: Call 212-990-6089 (Listen To Mr. Piccolo's 5min message) STEP 2: Contact Lawrence and let him know you have completed step 1. 208-979-6149 These are the benefits of succeeding on our team: -Car Bonus Up To $1500 Per Month -Weekly Checks -Mortgage Bonus Up To $10,000 Per Month (Does Your Employer Offer These Benefits?) We will email millions to find the right people. Good luck. I received your e-mail as someone interested in Internet Business Opportunities. If I received your e-mail in error, or you are no longer interested, Email below to be removed immediately. Be sure REMOVE is in the Subject Title and you will not be contacted again. alh941@verizonmail.com From list@netscape.com Mon Jul 16 09:41:55 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id JAA09656 for ; Mon, 16 Jul 2001 09:41:54 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6GDdPB11827; Mon, 16 Jul 2001 06:39:25 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6GDdPs23555; Mon, 16 Jul 2001 06:39:25 -0700 (PDT) Resent-Date: Mon, 16 Jul 2001 06:39:25 -0700 (PDT) Message-Id: <200107161337.f6GDbiI20954@ywing.netscape.com> From: "Martin Roy" Subject: Your Chance #7008 To: winner23d@ywing.aoltw.net X-Mailer: Microsoft Outlook Express 4..72.1712.3 X-MimeOLE: Produced By Microsoft MimeOLE V(null).1712.3 Mime-Version: 1.0 Date: Mon, 16 Jul 2001 07:59:07 -0500 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6GDdMv23525 Resent-Message-ID: <"CxIpSB.A.rvF.L6uU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit 2BD8 *Earn $2000 - $5000 weekly-starting within 3-12 weeks. Make what you deserve! *Own your own business. Control your destiny! *Money Freedom=Time Freedom *54% + Gross Profit Margins *No Selling *Work from home, No overhead, or employees. *Fabulous Training & Support *Not traditional MLM, many times more profitable *Multibillion Dollar Travel & Internet Industry The most incredible part of our business is that ALL MY CLIENTS ASK ME TO CALL THEM! DO YOU QUALIFY FOR OUR MENTOR PROGRAM? ACCEPTING ONLY A FEW NEW ASSOCIATES This is not a hobby! Serious Inquires Only!! Please reply with the following information NOW! FULL NAME: COMPLETE ADDRESS: EMAIL ADDRESS: PHONE: (Required; area code & number) BEST 2 TIMES TO CALL YOU: TO: mailto:btqq@lawyer.com?subject=tell_me_more This message is sent in compliance of the new email bill section 301. Per Section 301, Paragraph (a)(2)(C) of S. 1618, further transmissions to you by the sender of this email will be stopped at no cost to you. This message is not intended for residents in the State of WA, NV, CA & VA. Screening of addresses has been done to the best of our technical ability. If you are a Washington, Virginia, or California resident please remove yourself. We respect all removal requests. //////////////////////////////////////////////////// Please remove at: mailto:mortgagef5e@usa.com?subject=remove //////////////////////////////////////////////////// From list@netscape.com Mon Jul 16 15:26:15 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA22666 for ; Mon, 16 Jul 2001 15:26:13 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6GJOrB11878; Mon, 16 Jul 2001 12:24:53 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6GJOqw00757; Mon, 16 Jul 2001 12:24:52 -0700 (PDT) Resent-Date: Mon, 16 Jul 2001 12:24:52 -0700 (PDT) Message-Id: X-Mailer: Novell GroupWise Internet Agent 5.5.2.1 Date: Mon, 16 Jul 2001 13:24:50 -0600 From: "Ed Reed" To: , , , Cc: , , "Ed Reed" Subject: LDAPSubentries comments review and request for last call by LDAPEXT and LDUP working groups Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6GJOnv00714 Resent-Message-ID: <"jlW9IB.A.ZL.C-zU7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit First version was published as an ldup working group document on 15 August 1999 with agreement of both the LDAPEXT and LDUP working group chairs that the document would be subject to a joint working group last call, but would be "worked" in the LDUP working group, due to LDAPEXT wg work load. 1) David Chadwick commented, on 25 Oct 1999 that the two attributes, "cn" and "subtreeSpec", serve different purposes. In particular, that because the LDAPSubentry definition is a subset of the X.500 subentries, "cn" used to name the subentry and "subtreeSpec" used to refine the scope of the subentry to possibly include fewer than all entries than the full subtree in which it's defined. Response: True. That is the intent of defining the LDAPSubentry - to make explicit that the scope is as though an empy subtreeSpec is defined for the LDAPSubentry. Arguably, we could say that LDAP will use the X.501 subentry definition, but then implementations would all have to "grok" the subtreeSpec attribute syntax and semantics, and the goal of creating the LDAPSubentry is to eliminate that requirement. 2) Kurt Zeilenga commented on 18 Nov 1999 that he didn't want to be required to name LDAPSubentries with cn, but wanted to be able to use other naming attributes instead that wouldn't introduce conflicts with non-subentries named with "cn". He suggested making LDAPSubentry be an abstract class with no naming attribute defined, and then subclassing another class that used "cn" as its naming attribute. Response: Naming rules are funny things in LDAP...following more discussion, Kurt suggested on 25 April 2000 that we make "cn" MUST, but state that naming with attributes other than CN is allowed. Agreed. 3) Steven Legg, on 30 March 2000 asked that we not leave naming up to developers, but clearly define what's to be expected. Response: Each application developer that defines a use of the LDAPsubentry class with a derived class (by which alternative naming attributes could be added - I presume that alternative naming attributes may NOT be added via adding Auxilliary classes) will be so defining the semantics of the new class (including the naming rules for the new class) that applications will need to know those semantics to make sense of the new subentry type, anyway. Browsers and applications will need to either know the semantics of the new class, or be schema aware enough to read and interpret naming rules that apply to the new class. The definition sets the expectation that "cn" will be used, but that other attributes MAY be used instead or as well (subject to the naming rules defined for the new class). My heart's with Steven, but I'm trying to accomodate Kurt, too. Came down on Kurt's side on this one. 4) David Chadwick on 15 March 2000 opined that if, in the future, LDAP wants to limit the portion of a naming context to which a subentry applies, we can simply re-invent subtreeSpecification at that time. Response - agreed, or even simply use the X.500 definition of subentry, if that will work for the application (ie, if the application doesn't need subentries to contain other subentries in a tree of subentries, and if X.500's family of entries won't work to reproduce the LDAPSubentry containment rules allowing subentries to contain other subentries). 5) Kurt Zeilenga on 3 July 2000 opined that LDAPSubentry should be abandoned in favor of just doing X.500 subentries, including subtreeSpecification, and be visible on the basis of a control. He made these suggestions so they'd be more useful within LDAP and for the Access Control Model, in particular. Response: After considerable discussion, we agreed on the list to use a control to make LDAPSubentries visible instead of the search filter mechanism, because the filter mechanism adds significant logic predicate complexity to developers whose applications already use complex search filters. The filter makes things simple and more importantly provides equivalent functionality to the X.500 subentries visibility mechanism. With regard to "just doing X.500", Mark Smith wrote on 7 July 2000 that "The X.500 subtree specifier is rich and therefore fairly complex to implement. That doesn't mean we shouldn't adopt it, but id does mean we should consider the impact." Kurt replied that we also need to consider the impact of making changes, possibly incompatible ones, to X.500 elements, like making them hierarchical instead of flat, and limiting their utility by dropping the subtreeSpecification. The author (me, Ed Reed) replied to Kurt's proposal to "just do X.500" with the following reasons for omitting the subtree specifier: a) it introduces what seems to be a lot of complexity to determining which entries a subentry would refer to, b) it introduces what seems to be a lot of complexity to determining which subentries apply to a particular entry, c) it introduces what seems to be a lot of complex thinking for administrators who want to understand how to tell their system to do something, and to understand what their system is trying to do d) the author (me) has not been exposed to many (any) real-world problems solved by the subtree specifier which are not or can not be as well handled in some other fashion. 6) There followed a discussion between Alan Lloyd, Albert Langer, Rob Byrne and Ron Ramsay about the relative merits of using subentries to hold access control information, particularly in distributed environments. 7) Last Call attempted on 14 July 2000, but Kurt immediately objected...to inadequate clarity of scoping specification and semantics, and to continued use of search filter to control visibility. Response: following additional remarks by others about semantics and administrative models, a section describing the X.501 administrative model and a proposed LDAP subset using LDAPsubentries was added. Additional language was added to try to pin down the semantics relating to containment/structure rules governing LDAPsubentries and their scope. The search filter visibility mechanism was eliminated in favor of a control. 8) Once the decision was made to use a control, the question of what kind of control was discussed: one corresponding to the subentries bit of the ServiceControls argument in X.511, or one corresponding to the whole ServiceControls argument (including the subentries bit). Response: concensus of the group appears to support the simpler control - representing just the subentries bit of the ServiceControl argument. It's simpler and doesn't introduce a lot of unresolved design issues that having the whole ServiceControls argument would create. 9) Compatibility issues for clients using RFC2215 to read LDAP subschema subentries (via search filter instead of a control) was raised, and Kurt offered to address them in LDAPbis. Response: Kurt to address in LDAPbis. 10) A discussion ensued over the behavior of the LDAPSubentriesControl to searches with scope of base entries (not an issue for X.500, since X.500 has READ as well as SEARCH). Respons: visibility was specified to be implicitly TRUE when a base entry search or a subtree search is made where the base of the search is an LDAPSubentry. So, even if the control is absent, if you base a search on an LDAPSubEntry it's obvious that you DO want the LDAPSubentry, so pretend the control is present even if it's not. 11) On 4 November 2000 I recounted the discussion from the working group about administrative areas and subentries. Issues raised in the discussion had to do with problems of partitioning administrative areas, dealing with various inheritance models of policy across multiple partitions of an administrative area, and so on. Response: Following that discussion, and the one at the spring IETF, I published a "light weight" administrative model designed as a subset of the X.500 model for comments, and then added them to the latest (-08.txt) draft. 12) On 6 Nov 2000 Rick Huber submitted several editorial corrections to the draft -04.txt, which were incorporated into later drafts. Ditto the -06 draft. 13) In the -07.txt draft published 1 March 2001 I removed the whole discussion of inheritance and the inheritableLdapSubentry object class specification and its attributes from the text. At bar boff convened to discuss the issue, we found that no "down-tree" inheritance replication mechanism was needed if servers hold sparse/fractional replicas of superior administrative areas that have LDAPsubentries relevant to the replication areas they hold. A separate internet draft, due to expire shortly, was written to describe that scheme. 14) The -08.txt draft published 6 April 2001 includes the candidate administration model originally circulated for comment on 22 March 2001. There have been two comments - one saying "it looks reasonable at first glance", and the other opposing the adoption of an administration model subsetted from X.500 without careful analysis and consideration. The comment in opposition also expressed the desire to see both LDAPEXT and LDUP involved in the decision, which both are (this being an output of both working groups and subject to last call in both groups). Response: The need for subentries to be understood within the context of an administrative model seems to be generally agreed to across the working group participants who have commented. The need to understand how administrative areas will work in a multi-master environment, and how policy is projected from an administrative point through a subtree needs to be understood. I've chosen in the model to leave some of the thornier issues of how administrative areas span specific administration areas, and in particular replication areas until more work is done on LDAP distributed operations. I'm generally in agreement that the X.500 model of Directory Specific Entries, distributed chaining operations, and even the use of subtreeSpecifications (for defining sparse and fractional replicas) probably do make sense - but that they need to be adapted to deal with the kind of multi-master, loosely consistent replication provided by LDUP. I think the administrative model subset I've ! proposed keeps us moving in the right direction - towards accreting more and more of X.500 into LDAP - without forcing us to lunge all the way into the pool at once. So - I'd like more comments on the administrative model. Does it work for ACI as LDAPEXT is defining it? Other applications than just LDUP? I think it DOES work for LDUP (ie, managing replication areas). With that, said, I'd like to ask the working group chairs of LDAPEXT and LDUP to jointly or severally issue last call on draft-ietf-ldup-subentry-08.txt. Regards, Ed Reed ================= Ed Reed Reed-Matthews, Inc. +1 801 796 7065 http://www.Reed-Matthews.COM From list@netscape.com Mon Jul 16 19:42:28 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id TAA06721 for ; Mon, 16 Jul 2001 19:42:28 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6GNdnv24373; Mon, 16 Jul 2001 16:39:49 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6GNdoc04263; Mon, 16 Jul 2001 16:39:50 -0700 (PDT) Resent-Date: Mon, 16 Jul 2001 16:39:50 -0700 (PDT) From: achanel36@bugjuise.net Message-ID: <00000b9a3382$000036c7$000004e5@mail4.bugjuise.net> To: Cc: <106444.1341@compuserve.com>, , , <107257.1302@compuserve.com>, , , , , , , , , , Subject: Congratulations! Order# 4156 1253 Date: Mon, 16 Jul 2001 05:15:14 -0500 MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal Reply-To: bill6547@Flashmail.com X-MIMETrack: Itemize by SMTP Server on agcmweb/agcmweb/it(Release 5.0.6a |January 17, 2001) at 16/07/2001 01:02:32 PM, Serialize by Router on agcmweb/agcmweb/it(Release 5.0.6a |January 17, 2001) at 17/07/2001 01:29:20 AM, Serialize complete at 17/07/2001 01:29:20 AM Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="iso-8859-1" Resent-Message-ID: <"OStP4C.A.-BB.Bt3U7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable

You Have Won The First Round!

Claim Your Entry Now!

Collect The Prize Of The Week!<= /b>

Click Here To Collect!

to be removed reply to this message w= ith "REMOVE" in the subject line
From list@netscape.com Mon Jul 16 21:24:22 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA28407 for ; Mon, 16 Jul 2001 21:24:22 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6H1HGB08573; Mon, 16 Jul 2001 18:17:17 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6H1HGQ13522; Mon, 16 Jul 2001 18:17:16 -0700 (PDT) Resent-Date: Mon, 16 Jul 2001 18:17:16 -0700 (PDT) Message-ID: <000030366926$000015cc$00000928@mail2.wuzzlenorple.com> To: From: achandos@wuzzlenorple.com Subject: If you need to lose 10,20,30 pounds or more, Please READ THIS!! 2344 Date: Mon, 16 Jul 2001 20:17:22 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: mark7853@runbox.com Resent-Message-ID: <"geSQuB.A.TSD.aI5U7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable
"I would like to share something with you. First let me say, I'm not tr= ying
to sell you anything (I don't like it when people do that). But, I do like=
it when people share with me what "works" in their life. Well,..

I have found something that "WORKS".

Young and old, male and female, if you think success was achieved through<= br> strict diets and hours upon hours of aerobic exercise...
IT IS NOT.
I've Lost So Many Inches I'm Almost Embarrassed To Say!
I'm wearing clothes I haven't touched since high school! I've dropped a tremendous amount of fat and "toned up REAL nice"... says my husband
George!" I personally didn't think it was possible. Especially after tryin= g
just about every kind of diet plan and exercise program invented. I gave u= p
all hope of ever being thin again. Depressed and angry, I began to throw o= ut
the many boxes, bottles, and books of failed diets that promised me I woul= d
lose the weight that was destroying my life.
That's when I noticed an unopened bottle of a product called BerryTrim Plu= s
I had purchased a few months prior. Just like that voice said in that
baseball movie, "If you build it , they will come" something told me to "T= ry
It, and it will work" sounds crazy, but I did, and..
I was amazed at what my scale told me!
Not only did it work but,
I Swear I Woke Up One Week Later and I Was A Dress Size Smaller!
following the simple directions that fit into everyday lifestyles.
I've Lost 60 pounds of fat
All in my first 6 months!
I'm kicking myself in the butt for it. I've had the answer to my prayers i= n
my cabinet for months and I waited much too long to do this.
I have dropped nearly a half a foot off my waistline. I eat what I want an= d
only work out twice a week. (Sometimes, less than that). I've become sold = on
this miracle product called BerryTrim Plus.
I Feel Absolutely Terrific!
My energy is through the roof! But even better than that, the intimacy in = my
marriage has improved tremendously. (I wasn't feeling very Sexy before I started BerrryTrim Plus.) Now, after losing several inches of blubber, we'= re
just like Newlyweds!
I love BerryTrim Plus!

Finally! I feel comfortable when I go out about the way I look in clothes.= I
used to run from the mirror after getting out of the shower, Now, I dance<= br> around naked in the bathroom mirror. And I feel tough too. Nothing like having strength!
My pants are fitting loosely, my stomach's flatter, my arms and legs look<= br> leaner. Seems like Overnight. "Poof!" They told me exactly what to expect=
and day by day, like clockwork, They were right on the money!
To top it all off, I seem to be literally repelling body fat as I get lean= er
and leaner by the moment!
I weigh the same at my second reunion as I did when I was in High School!<= br> Not bad? Right? My friends didn't recognize me from the last time they saw=
me! They said, "You look marvelous!"
BerryTrim Plus works because it allows your body to do what it does best.<= br> It's like tossing wood on a fire.
Solid logs keep the metabolism going.
Just check it out for yourself. You have nothing to lose but the weight. I=
can assure you, I would not put my reputation on the line by telling you a=
lie. BerryTrim Plus really worked for me, I believe it can work for you. Just click on the link below and read for yourself

CLICK HERE

Thank you for letting me tell you about my incredible happiness.

God Bless,
Mary Kennedy

This message is brought to you by BerryTrim Affiliate.=
We apologize for any email you may have inadvertently received.
Please CLICK HERE to b= e removed from future mailings.
From list@netscape.com Mon Jul 16 23:06:30 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id XAA12433 for ; Mon, 16 Jul 2001 23:06:30 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6H32xB17472; Mon, 16 Jul 2001 20:03:00 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6H330s13278; Mon, 16 Jul 2001 20:03:00 -0700 (PDT) Resent-Date: Mon, 16 Jul 2001 20:03:00 -0700 (PDT) Message-ID: <000009275f81$00002a7a$00005a53@mail2.bugjuise.net> To: Cc: <106444.1341@compuserve.com>, , , <107257.1302@compuserve.com>, , , , , , , , , , From: philblunts@bugjuise.net Subject: Congratulations! Order# 9546 23123 Date: Mon, 16 Jul 2001 21:03:06 -0500 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: alex9739@Flashmail.com X-OriginalArrivalTime: 17 Jul 2001 02:45:54.0500 (UTC) FILETIME=[9956A840:01C10E6A] Resent-Message-ID: <"cSvmTC.A.tOD.hr6U7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable
You Have Won The First Round!

Claim Your Entry Now!

Collect The Prize Of The Week!<= /b>

Click Here To Collect!

to be removed reply to this message w= ith "REMOVE" in the subject line
From list@netscape.com Tue Jul 17 04:35:08 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id EAA24437 for ; Tue, 17 Jul 2001 04:35:07 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6H8XoB10841; Tue, 17 Jul 2001 01:33:50 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6H8XoU29332; Tue, 17 Jul 2001 01:33:50 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 01:33:50 -0700 (PDT) From: Joachim Gjesdal Reply-To: Joachim Gjesdal To: ietf-ldapext@netscape.com Message-ID: <3B53FAA3.4DA7CD7A@ecomda.com> Date: Tue, 17 Jul 2001 10:43:15 +0200 Organization: ecomda X-Mailer: Mozilla 4.76 [en] (Windows NT 5.0; U) X-Accept-Language: en MIME-Version: 1.0 Subject: Re: ACM permission References: <5.1.0.14.0.20010709130810.02eeee98@127.0.0.1> Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"i6s5iD.A.4JH.sh_U7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit +1
Authorization and authentication are different things.
I hope not that old buggy applications will limit the level of security defined by the ldap acl model.
joachim
"Kurt D. Zeilenga" wrote:
At 09:25 AM 7/9/2001, Skovgaard, Erik wrote:
>That would be a problem. A lot of us still use the userPassword for
>authentication. It must be possible to protect the password (including
>performing filter matching) yet be able to use the compare operation on the
>attribute.
I'm not sure how permissions for compare relate to authentication.
The only operation which performs LDAP authentication is the
bind and its not controlled, per the I-D, by any permissions.
This said, I support having separate "assert" (compare/search
filter) permissions from read permissions as it is often useful
to allow one to assert a value but not allow them to read all
values. The example (which I believe someone else gave) is
that there may a group where one is allowed to assert that
an entity is a member but not allowed to see the member list.
Kurt
From list@netscape.com Tue Jul 17 09:25:24 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id JAA03730 for ; Tue, 17 Jul 2001 09:25:23 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6HDM3v06891; Tue, 17 Jul 2001 06:22:03 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6HDM4I04333; Tue, 17 Jul 2001 06:22:04 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 06:22:04 -0700 (PDT) Message-Id: <200107171323.VAA21617@mail.lansing.com.tw> From: "Roy Baker" Subject: Your Chance (Please disregard first email, it had the wrong reply address) #7601 To: winner23d@mail.lansing.com.tw X-Mailer: Microsoft Outlook Express 4..72.1712.3 X-MimeOLE: Produced By Microsoft MimeOLE V(null).1712.3 Mime-Version: 1.0 Date: Tue, 17 Jul 2001 08:04:39 -0500 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6HDM1v04303 Resent-Message-ID: <"C9KRmD.A.VDB.6vDV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit 7A3F *Earn $2000 - $5000 weekly-starting within 3-12 weeks. Make what you deserve! *Own your own business. Control your destiny! *Money Freedom=Time Freedom *54% + Gross Profit Margins *No Selling *Work from home, No overhead, or employees. *Fabulous Training & Support *Not traditional MLM, many times more profitable *Multibillion Dollar Travel & Internet Industry The most incredible part of our business is that ALL MY CLIENTS ASK ME TO CALL THEM! DO YOU QUALIFY FOR OUR MENTOR PROGRAM? ACCEPTING ONLY A FEW NEW ASSOCIATES This is not a hobby! Serious Inquires Only!! Please reply with the following information NOW! FULL NAME: COMPLETE ADDRESS: EMAIL ADDRESS: PHONE: (Required; area code & number) BEST 2 TIMES TO CALL YOU: TO: mailto:55btr@verizonmail.com?subject=tell_me_more This message is sent in compliance of the new email bill section 301. Per Section 301, Paragraph (a)(2)(C) of S. 1618, further transmissions to you by the sender of this email will be stopped at no cost to you. This message is not intended for residents in the State of WA, NV, CA & VA. Screening of addresses has been done to the best of our technical ability. If you are a Washington, Virginia, or California resident please remove yourself. We respect all removal requests. //////////////////////////////////////////////////// Please remove at: mailto:mortgagef5e@usa.com?subject=remove //////////////////////////////////////////////////// From list@netscape.com Tue Jul 17 13:37:38 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA29091 for ; Tue, 17 Jul 2001 13:37:37 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6HHYlv20929; Tue, 17 Jul 2001 10:34:47 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6HHYmk20585; Tue, 17 Jul 2001 10:34:48 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 10:34:48 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Rsent-To: eos@ops.ietf.org Approved: snmp From: The IESG To: AAA Working Group , ACAP Working Group , ADSLMIB Working Group , AFT Working Group , AGENTX Working Group , APEX Working Group , ATOMMIB Working Group , AVT Working Group , BEEP Working Group , BGMP Working Group , BMWG Working Group , BRIDGE Working Group , CALSCH Working Group , CAT Working Group , CCAMP Working Group , CNRP Working Group , DELTAV Working Group , DHC Working Group , DIFFSERV Working Group , DISMAN Working Group , DNSEXT Working Group , DNSOP Working Group , ECM Working Group , EDIINT Working Group , ENTMIB Working Group , ENUM Working Group , EOS Working Group , FAX Working Group , FRNETMIB Working Group , FTPEXT Working Group , GEOPRIV Working Group , GRIP Working Group , GSMP Working Group , HUBMIB Working Group , IDMR Working Group , IDN Working Group , IDR Working Group , IDWG Working Group , IFMIB Working Group , IMAPEXT Working Group , IMPP Working Group , IPCDN Working Group , IPFC Working Group , IPNGWG Working Group , IPO Working Group , IPORPR Working Group , IPP Working Group , IPPM Working Group , IPS Working Group , IPSEC Working Group , IPSP Working Group , IPSRA Working Group , IPTEL Working Group , ISIS Working Group , ISSLL Working Group , ITRACE Working Group , KINK Working Group , KRB-WG Working Group , L2TPEXT Working Group , LDAPBIS Working Group , LDAPEXT Working Group , LDUP Working Group , MALLOC Working Group , MANET Working Group , MBONED Working Group , MEGACO Working Group , MIDCOM Working Group , MMUSIC Working Group , MOBILEIP Working Group , MPLS Working Group , MSDP Working Group , MSEC Working Group , MSGTRK Working Group , MULTI6 Working Group , NASREQ Working Group , NAT Working Group , NFSV4 Working Group , NGTRANS Working Group , NNTPEXT Working Group , OPENPGP Working Group , OSPF Working Group , OTP Working Group , PILC Working Group , PIM Working Group , PKIX Working Group , POISSON Working Group , POLICY Working Group , PPPEXT Working Group , PPVPN Working Group , PROVREG Working Group , PWE3 Working Group , RAP Working Group , RESCAP Working Group , RIP Working Group , RMONMIB Working Group , RMT Working Group , ROHC Working Group , RSERPOOL Working Group , RUN Working Group , SACRED Working Group , SEAMOBY Working Group , SECSH Working Group , SIGTRAN Working Group , SIMPLE Working Group , SIP Working Group , SMIME Working Group , SMING Working Group , SNMPCONF Working Group , SNMPV3 Working Group , SPIRITS Working Group , SSM Working Group , STIME Working Group , SYSLOG Working Group , TEWG Working Group , TLS Working Group , TN3270E Working Group , TRADE Working Group , TSVWG Working Group , UDLR Working Group , URN Working Group , USEFOR Working Group , USWG Working Group , VPIM Working Group , VRRP Working Group , WEBDAV Working Group , WEBI Working Group , WTS Working Group , XMLDSIG Working Group , ZEROCONF Working Group cc: iesg@ietf.org Subject: Note Well Message-Id: Sender: Randy Bush Date: Tue, 17 Jul 2001 13:25:25 -0400 Resent-Message-ID: <"fvrPC.A.EBF.2cHV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Greetings, This is the revised text of the NOTE WELL statement. ------------------------------------------------------ NOTE WELL All statements related to the activities of the IETF and addressed to the IETF are subject to all provisions of Section 10 of RFC 2026, which grants to the IETF and its participants certain licenses and rights in such statements. Such statements include verbal statements in IETF meetings, as well as written and electronic communications made at any time or place, which are addressed to: - the IETF plenary session, - any IETF working group or portion thereof, - the IESG, or any member thereof on behalf of the IESG, - the IAB or any member thereof on behalf of the IAB, - any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices, - the RFC Editor or the Internet-Drafts function Statements made outside of an IETF meeting, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not subject to these provisions. From list@netscape.com Tue Jul 17 13:42:50 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA00429 for ; Tue, 17 Jul 2001 13:42:49 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6HHdav22510; Tue, 17 Jul 2001 10:39:36 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6HHdb224651; Tue, 17 Jul 2001 10:39:37 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 10:39:37 -0700 (PDT) Message-Id: <200107171716.NAA23758@ietf.org> From: The IESG To: AAA Working Group , ACAP Working Group , ADSLMIB Working Group , AFT Working Group , AGENTX Working Group , APEX Working Group , ATOMMIB Working Group , AVT Working Group , BEEP Working Group , BGMP Working Group , BMWG Working Group , BRIDGE Working Group , CALSCH Working Group , CAT Working Group , CCAMP Working Group , CNRP Working Group , DELTAV Working Group , DHC Working Group , DIFFSERV Working Group , DISMAN Working Group , DNSEXT Working Group , DNSOP Working Group , ECM Working Group , EDIINT Working Group , ENTMIB Working Group , ENUM Working Group , EOS Working Group , FAX Working Group , FRNETMIB Working Group , FTPEXT Working Group , GEOPRIV Working Group , GRIP Working Group , GSMP Working Group , HUBMIB Working Group , IDMR Working Group , IDN Working Group , IDR Working Group , IDWG Working Group , IFMIB Working Group , IMAPEXT Working Group , IMPP Working Group , IPCDN Working Group , IPFC Working Group , IPNGWG Working Group , IPO Working Group , IPORPR Working Group , IPP Working Group , IPPM Working Group , IPS Working Group , IPSEC Working Group , IPSP Working Group , IPSRA Working Group , IPTEL Working Group , ISIS Working Group , ISSLL Working Group , ITRACE Working Group , KINK Working Group , KRB-WG Working Group , L2TPEXT Working Group , LDAPBIS Working Group , LDAPEXT Working Group , LDUP Working Group , MALLOC Working Group , MANET Working Group , MBONED Working Group , MEGACO Working Group , MIDCOM Working Group , MMUSIC Working Group , MOBILEIP Working Group , MPLS Working Group , MSDP Working Group , MSEC Working Group , MSGTRK Working Group , MULTI6 Working Group , NASREQ Working Group , NAT Working Group , NFSV4 Working Group , NGTRANS Working Group , NNTPEXT Working Group , OPENPGP Working Group , OSPF Working Group , OTP Working Group , PILC Working Group , PIM Working Group , PKIX Working Group , POISSON Working Group , POLICY Working Group , PPPEXT Working Group , PPVPN Working Group , PROVREG Working Group , PWE3 Working Group , RAP Working Group , RESCAP Working Group , RIP Working Group , RMONMIB Working Group , RMT Working Group , ROHC Working Group , RSERPOOL Working Group , RUN Working Group , SACRED Working Group , SEAMOBY Working Group , SECSH Working Group , SIGTRAN Working Group , SIMPLE Working Group , SIP Working Group , SMIME Working Group , SMING Working Group , SNMPCONF Working Group , SNMPV3 Working Group , SPIRITS Working Group , SSM Working Group , STIME Working Group , SYSLOG Working Group , TEWG Working Group , TLS Working Group , TN3270E Working Group , TRADE Working Group , TSVWG Working Group , UDLR Working Group , URN Working Group , USEFOR Working Group , USWG Working Group , VPIM Working Group , VRRP Working Group , WEBDAV Working Group , WEBI Working Group , WTS Working Group , XMLDSIG Working Group , ZEROCONF Working Group cc: iesg@ietf.org Subject: Note Well Date: Tue, 17 Jul 2001 13:16:53 -0400 Sender: scoya@cnri.reston.va.us Resent-Message-ID: <"EknOoD.A.LAG.VhHV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Greetings, This is the revised text of the NOTE WELL statement. ------------------------------------------------------ NOTE WELL All statements related to the activities of the IETF and addressed to the IETF are subject to all provisions of Section 10 of RFC 2026, which grants to the IETF and its participants certain licenses and rights in such statements. Such statements include verbal statements in IETF meetings, as well as written and electronic communications made at any time or place, which are addressed to: - the IETF plenary session, - any IETF working group or portion thereof, - the IESG, or any member thereof on behalf of the IESG, - the IAB or any member thereof on behalf of the IAB, - any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices, - the RFC Editor or the Internet-Drafts function Statements made outside of an IETF meeting, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not subject to these provisions. From list@netscape.com Tue Jul 17 17:24:29 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA17976 for ; Tue, 17 Jul 2001 17:24:27 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6HJt7B16150; Tue, 17 Jul 2001 12:55:07 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6HJt6A10441; Tue, 17 Jul 2001 12:55:06 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 12:55:06 -0700 (PDT) Message-Id: <200107171955.MAA18003@breakaway.Stanford.EDU> X-Mailer: exmh version 2.0.2 2/24/98 Subject: fyi: CERT Advisory CA-2001-18 - Vulnerabilities in LDAP implementations To: LDAP extensions From: Jeff.Hodges@kingsmountain.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Tue, 17 Jul 2001 12:55:02 -0700 Sender: hodges@breakaway.Stanford.EDU Resent-Message-ID: <"QdpveD.A.viC.YgJV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com [apologies for cross-posting] I'm glad to see this announcement. I've wondered for several years what all vulnerabilities might be lurking in LDAP implementations, and now we have some actual indication, and a toolset and example methodology for uncovering such. PROTOS Test-Suite: c06-ldapv3 http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ JeffH ------- Forwarded Message Date: Tue, 17 Jul 2001 00:43:12 -0400 (EDT) Message-Id: From: CERT Advisory To: cert-advisory@cert.org Organization: CERT(R) Coordination Center - +1 412-268-7090 List-Help: , List-Subscribe: List-Unsubscribe: List-Post: NO (posting not allowed on this list) List-Owner: List-Archive: Subject: CERT Advisory CA-2001-18 Content-Type: text Content-Length: 23378 - -----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2001-18 Multiple Vulnerabilities in Several Implementations of the Lightweight Directory Access Protocol (LDAP) Original release date: July 16, 2001 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected * iPlanet Directory Server, version 5.0 Beta and versions up to and including 4.13 * Certain versions of IBM SecureWay running under Solaris and Windows 2000 * Lotus Domino R5 Servers (Enterprise, Application, and Mail), prior to 5.0.7a * Teamware Office for Windows NT and Solaris, prior to version 5.3ed1 * Qualcomm Eudora WorldMail for Windows NT, version 2 * Microsoft Exchange 5.5 LDAP Service (Hotfix pending) * Network Associates PGP Keyserver 7.0, prior to Hotfix 2 * Oracle 8i Enterprise Edition * OpenLDAP, 1.x prior to 1.2.12 and 2.x prior to 2.0.8 Overview Several implementations of the Lightweight Directory Access Protocol (LDAP) protocol contain vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both. If your site uses any of the products listed in this advisory, the CERT/CC encourages you to follow the advice provided in the Solution section below. I. Description The LDAP protocol provides access to directories that support the X.500 directory semantics without requiring the additional resources of X.500. A directory is a collection of information such as names, addresses, access control lists, and cryptographic certificates. Because LDAP servers are widely used in maintaining corporate contact information and providing authentication services, any threats to their integrity or stability can jeopardize the security of an organization. To test the security of protocols like LDAP, the PROTOS project presents a server with a wide variety of sample packets containing unexpected values or illegally formatted data. This approach may reveal vulnerabilities that would not manifest themselves under normal conditions. As a member of the PROTOS project consortium, the Oulu University Secure Programming Group (OUSPG) co-developed and subsequently used the PROTOS LDAPv3 test suite to study several implementations of the LDAP protocol. The PROTOS LDAPv3 test suite is divided into two main sections: the "Encoding" section, which tests an LDAP server's response to packets that violate the Basic Encoding Rules (BER), and the "Application" section, which tests an LDAP server's response to packets that trigger LDAP-specific application anomalies. Each section is further divided into "groups" that collectively exercise a particular encoding or application feature. Finally, each group contains one or more "test cases," which represent the network packets that are used to test individual exceptional conditions. By applying the PROTOS LDAPv3 test suite to a variety of popular LDAP-enabled products, the OUSPG revealed the following vulnerabilities: VU#276944 - iPlanet Directory Server contains multiple vulnerabilities in LDAP handling code The iPlanet Directory Server contains multiple vulnerabilities in the code that processes LDAP requests. In the encoding section of the test suite, this product had an indeterminate number of failures in the group that tests invalid BER length of length fields. In the application section of the test suite, this product failed four groups and had inconclusive results for an additional five groups. The four failed groups indicate the presence of buffer overflow vulnerabilities. For the inconclusive groups, the product exhibited suspicious behavior while testing for format string vulnerabilities. VU#505564 - IBM SecureWay Directory is vulnerable to denial-of-service attacks via LDAP handling code The IBM SecureWay Directory server contains one or more vulnerabilities in the code that processes LDAP requests. These vulnerabilities were discovered independently by IBM using the PROTOS LDAPv3 test suite. The CERT/CC is not currently aware of the nature of these vulnerabilities. VU#583184 - Lotus Domino R5 Server Family contains multiple vulnerabilities in LDAP handling code The Lotus Domino R5 Server Family (including the Enterprise, Application, and Mail servers) contains multiple vulnerabilities in the code that processes LDAP requests. In the encoding section of the test suite, this product failed 1 of 77 groups. The failed group tests a server's response to miscellaneous packets with semi-valid BER encodings. In the application section of the test suite, this product failed 23 of 77 groups. These results suggest that both buffer overflow and format string vulnerabilities are likely to be present in a variety of application components. VU#688960 - Teamware Office contains multiple vulnerabilities in LDAP handling code The Teamware Office suite is packaged with a combination X.500/LDAP server that provides directory services. Multiple versions of the Office product contain vulnerabilities that cause the LDAP server to crash in response to traffic sent by the PROTOS LDAPv3 test suite. In the encoding section of the test suite, this product failed 9 of 16 groups involving invalid encodings for several BER object types. In the application section of the test suite, this product failed 4 of 32 groups. The remaining 45 groups were not exercised during the test runs. The four failed groups indicate the presence of buffer overflow vulnerabilities. VU#717380 - Potential vulnerabilities in Qualcomm Eudora WorldMail Server LDAP handling code While investigating the vulnerabilities reported by OUSPG, it was brought to our attention that the Eudora WorldMail Server may contain vulnerabilities that can be triggered via the PROTOS test suite. The CERT/CC has reported this possibility to Qualcomm and an investigation is pending. VU#763400 - Microsoft Exchange 5.5 LDAP Service is vulnerable to denial-of-service attacks The Microsoft Exchange 5.5 LDAP Service contains a vulnerability that causes the LDAP server to freeze in response to malformed LDAP requests generated by the PROTOS test suite. This only affects the LDAP service; all other Exchange services, including mail handling, continue normally. Although this product was not included in OUSPG's initial testing, subsequent informal testing revealed that the LDAP service of the Microsoft Exchange 5.5 became unresponsive while processing test cases containing exceptional BER encodings for the LDAP filter type field. VU#765256 - Network Associates PGP Keyserver contains multiple vulnerabilities in LDAP handling code The Network Associates PGP Keyserver 7.0 contains multiple vulnerabilities in the code that processes LDAP requests. In the encoding section of the test suite, this product failed 12 of 16 groups. In the application section of the test suite, this product failed 1 of 77 groups. The failed group focused on out-of-bounds integer values for the messageID parameter. Due to a peculiarity of this test group, this failure may actually represent an encoding failure. VU#869184 - Oracle 8i Enterprise Edition contains multiple vulnerabilities in LDAP handling code The Oracle 8i Enterprise Edition server contains multiple vulnerabilities in the code used to process LDAP requests. In the encoding section of the test suite, this product failed an indeterminate number of test cases in the group that tests a server's response to invalid encodings of BER OBJECT-IDENTIFIER values. In the application section of the test suite, this product failed 46 of 77 groups. These results suggest that both buffer overflow and format string vulnerabilities are likely to be present in a variety of application components. VU#935800 - Multiple versions of OpenLDAP are vulnerable to denial-of-service attacks There are multiple vulnerabilities in the OpenLDAP implementations of the LDAP protocol. These vulnerabilities exist in the code that translates network datagrams into application-specific information. In the encoding section of the test suite, this product failed the group that tests the handling of invalid BER length of length fields. In the application section of the test suite, this product passed all 6685 test cases. Additional Information For the most up-to-date information regarding these vulnerabilities, please visit the CERT/CC Vulnerability Notes Database at: http://www.kb.cert.org/vuls/ Please note that the test results summarized above should not be interpreted as a statement of overall software quality. However, the CERT/CC does believe that these results are useful in describing the characteristics of these vulnerabilities. For example, an application that fails multiple groups indicates that problems exist in different areas of the code, rather than in a specific code segment. II. Impact VU#276944 - iPlanet Directory Server contains multiple vulnerabilities in LDAP handling code One or more of these vulnerabilities allow a remote attacker to execute arbitrary code with the privileges of the Directory Server. The server typically runs with system privileges. At least one of these vulnerabilities has been successfully exploited in a laboratory environment under Windows NT 4.0, but they may affect other platforms as well. VU#505564 - IBM SecureWay Directory is vulnerable to denial-of-service attacks via LDAP handling code These vulnerabilities allow a remote attacker to crash affected SecureWay Directory servers, resulting in a denial-of-service condition. It is not known at this time whether these vulnerabilities will allow a remote attacker to execute arbitrary code. These vulnerabilities exist on the Solaris and Windows 2000 platforms but are not present under Windows NT, AIX, and AIX with SSL. VU#583184 - Lotus Domino R5 Server Family contains multiple vulnerabilities in LDAP handling code One or more of these vulnerabilities allow a remote attacker to execute arbitrary code with the privileges of the Domino server. The server typically runs with system privileges. At least one of these vulnerabilities has been successfully exploited in a laboratory environment. VU#688960 - Teamware Office contains multiple vulnerabilities in LDAP handling code These vulnerabilities allow a remote attacker to crash affected Teamware LDAP servers, resulting in a denial-of-service condition. They may also allow a remote attacker to execute arbitrary code with the privileges of the Teamware server. The server typically runs with system privileges. VU#717380 - Potential vulnerabilities in Qualcomm Eudora WorldMail Server LDAP handling code The CERT/CC has not yet determined the impact of this vulnerability. VU#763400 - Microsoft Exchange 5.5 LDAP Service is vulnerable to denial-of-service attacks This vulnerability allows a remote attacker to crash the LDAP component of vulnerable Exchange 5.5 servers, resulting in a denial-of-service condition within the LDAP component. VU#765256 - Network Associates PGP Keyserver contains multiple vulnerabilities in LDAP handling code One or more of these vulnerabilities allow a remote attacker to execute arbitrary code with the privileges of the Keyserver. The server typically runs with system privileges. At least one of these vulnerabilities has been successfully exploited in a laboratory environment. VU#869184 - Oracle 8i Enterprise Edition contains multiple vulnerabilities in LDAP handling code One or more of these vulnerabilities allow a remote attacker to execute arbitrary code with the privileges of the Oracle server. The server typically runs with system privileges. At least one of these vulnerabilities has been successfully exploited in a laboratory environment. VU#935800 - Multiple versions of OpenLDAP are vulnerable to denial-of-service attacks These vulnerabilities allow a remote attacker to crash affected OpenLDAP servers, resulting in a denial-of-service condition. III. Solution Apply a patch from your vendor Appendix A contains information provided by vendors for this advisory. Please consult this appendix to determine if you need to contact your vendor directly. Block access to directory services at network perimeter As a temporary measure, it is possible to limit the scope of these vulnerabilities by blocking access to directory services at the network perimeter. Please note that this workaround does not protect vulnerable products from internal attacks. ldap 389/tcp # Lightweight Directory Access Protocol ldap 389/udp # Lightweight Directory Access Protocol ldaps 636/tcp # ldap protocol over TLS/SSL (was sldap) ldaps 636/udp # ldap protocol over TLS/SSL (was sldap) Appendix A. - Vendor Information This appendix contains information provided by vendors for this advisory. As vendors report new information to the CERT/CC, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. IBM Corporation IBM and Tivoli are currently investigating the details of the vulnerabilities in the various versions of the SecureWay product family. Fixes are being implemented as these details become known. Fixes will be posted to the download sites (IBM or Tivoli) for the affected platform. See http://www-1.ibm.com/support under "Server Downloads" or "Software Downloads" for links to the fix distribution sites. iPlanet E-Commerce Solutions [CERT/CC Addendum: These vulnerabilities were originally discovered in Directory Server 5.0 Beta and were later found to exist in versions up to and including version 4.13. These vulnerabilities have been addressed in the released version of Directory Server 5.0.] Lotus Development Corporation Lotus reproduced the problem as reported by OUSPG and documented it in SPR#DWUU4W6NC8. Lotus considers security issues as top priority, so we acted quickly to resolve the problem in a maintenance update to Domino. It was addressed in Domino R5.0.7a, which was released on May 18th, 2001. This release can be downloaded from Notes.net at http://www.notes.net/qmrdown.nsf/qmrwelcome. The fix is documented in the fix list at http://www.notes.net/r5fixlist.nsf/Search!SearchView&Query=DWUU 4W6NC8 Microsoft Corporation Microsoft is developing a hotfix for this issue which will be available shortly. Customers can obtain this hotfix by contacting Product Support Services at no charge and asking for Q303448 and Q303450. Information on contacting Microsoft Product Support Services can be found at http://www.microsoft.com/support/ Network Associates, Inc. Network Associates has resolved these vulnerabilities in Hotfix 2 for both Solaris and Windows NT. All Network Associates Enterprise Support customers have been notified and have been provided access to the Hotfix. This Hotfix can be downloaded at http://www.pgp.com/downloads/default.asp The OpenLDAP Project [CERT/CC Addendum: To address these vulnerabilities, the OpenLDAP Project has released OpenLDAP 1.2.12 for use in LDAPv2 environments and OpenLDAP 2.0.8 for use in LDAPv3 environments. The CERT/CC recommends that users of OpenLDAP contact their software vendor or obtain the latest version, available at http://www.openLDAP.org/software/download/.] QUALCOMM Incorporated The LDAP service in WorldMail may be vulnerable to this exploit, but our tests so far have been inconclusive. At this time, we strongly urge all WorldMail customers to ensure that the LDAP service is not accessible from outside their organization nor by untrusted users. The Teamware Group An issue has been discovered with Teamware Office Enterprise Directory (LDAP server) that shows a abnormal termination or loop when the LDAP server encounters a maliciously or incorrectly created LDAP request data. If the maliciously formatted LDAP request data is requested, the LDAP server may excessively copy the LDAP request data to the stack area. This overflow is likely to cause execution of malicious code. In other case, the LDAP server may go into abnormal termination or infinite loop. [CERT/CC Addendum: Teamware has provided additional documentation of these issues in their "Teamware Solution Database," available at http://support.teamw.com/Online/s_database1.shtml. Registered users can find information on these vulnerabilities by searching for document #010703-0000 for Windows NT or document #010703-0001 for Solaris.] Appendix B. - Supplemental Information The PROTOS Project The PROTOS project is a research partnership between the University of Oulu and VTT Electronics, an independent research organization owned by the Finnish government. The project studies methods by which protocol implementations can be tested for information security defects. Although the vulnerabilities discussed in this advisory relate specifically to the LDAP protocol, the methodology used to research, develop, and deploy the PROTOS LDAPv3 test suite can be applied to any communications protocol. For more information on the PROTOS project and its collection of test suites, please visit http://www.ee.oulu.fi/research/ouspg/protos/ ASN.1 and the BER Abstract Syntax Notation One (ASN.1) is a flexible notation that allows one to define a variety data types. The Basic Encoding Rules (BER) describe how to represent or encode the values of each ASN.1 type as a string of octets. This allow programmers to encode and decode data for platform-independent transmission over a network. References The following is a list of URLs referenced in this advisory as well as other useful sources of information: http://www.cert.org/advisories/CA-2001-18.html http://www.ietf.org/rfc/rfc2116.txt http://www.ietf.org/rfc/rfc2251.txt http://www.ietf.org/rfc/rfc2252.txt http://www.ietf.org/rfc/rfc2253.txt http://www.ietf.org/rfc/rfc2254.txt http://www.ietf.org/rfc/rfc2255.txt http://www.ietf.org/rfc/rfc2256.txt http://www.ee.oulu.fi/research/ouspg/protos/ http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/ http://www.kb.cert.org/vuls/ http://www.kb.cert.org/vuls/id/276944 http://www.kb.cert.org/vuls/id/505564 http://www.kb.cert.org/vuls/id/583184 http://www.kb.cert.org/vuls/id/688960 http://www.kb.cert.org/vuls/id/717380 http://www.kb.cert.org/vuls/id/763400 http://www.kb.cert.org/vuls/id/765256 http://www.kb.cert.org/vuls/id/869184 http://www.kb.cert.org/vuls/id/935800 _________________________________________________________________ The CERT Coordination Center thanks the Oulu University Secure Programming Group for reporting these vulnerabilities to us, for their detailed technical analyses, and for their assistance in preparing this advisory. We also thank the many vendors who provided feedback regarding their respective vulnerabilities. _________________________________________________________________ Authors: Jeffrey P. Lanza and Cory F. Cohen. Feedback on this advisory is greatly appreciated. ______________________________________________________________________ This document is available from: http://www.cert.org/advisories/CA-2001-18.html ______________________________________________________________________ CERT/CC Contact Information Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To subscribe to the CERT mailing list for advisories and bulletins, send email to majordomo@cert.org. Please include in the body of your message subscribe cert-advisory * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. _________________________________________________________________ Conditions for use, disclaimers, and sponsorship information Copyright 2001 Carnegie Mellon University. Revision History Jul 16, 2001: Initial release - -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQCVAwUBO1O5eQYcfu8gsZJZAQGupwQAikpVVn5wK0o9Kzdl3wjFf2jEhbyr3Ngz ycfKTYp8GfaKvKf9HzM/861WBmAkRIkChM+t9mQZ2FuH6nNMzfYRputHb3MK5w18 8EOE/stQbV0kDgXxi078ELkvZy4tqrNhd7KXNtsFCPvwo7XTrJJFLTpCS5Nltheq PaynurnhNrw= =mEjW - -----END PGP SIGNATURE----- ------- End of Forwarded Message From list@netscape.com Tue Jul 17 19:56:56 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id TAA15621 for ; Tue, 17 Jul 2001 19:56:55 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6HNtav08130; Tue, 17 Jul 2001 16:55:37 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6HNtcs11254; Tue, 17 Jul 2001 16:55:38 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 16:55:38 -0700 (PDT) From: corn411@wuzzlenorple.com Message-ID: <000044ed6a30$00006987$00001c9c@mail2.wuzzlenorple.com> To: Subject: Congratulations! Order# 2001 7324 Date: Tue, 17 Jul 2001 19:00:33 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: jill4390@runbox.com Resent-Message-ID: <"pW2VKD.A.IvC.4BNV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable
You Have Won The= First Round!
Claim Your Entry Now!
Collect The Prize Of The Week!

Click Here To Collect!

We apologize for any email you may ha= ve inadvertently received.
Please CLICK HERE to b= e removed from future mailings.

From list@netscape.com Tue Jul 17 21:32:13 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA06525 for ; Tue, 17 Jul 2001 21:32:12 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6I1UxB13680; Tue, 17 Jul 2001 18:30:59 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6I1V0U22164; Tue, 17 Jul 2001 18:31:00 -0700 (PDT) Resent-Date: Tue, 17 Jul 2001 18:31:00 -0700 (PDT) Date: Tue, 17 Jul 2001 21:30:51 -0400 (EDT) Message-Id: <200107180130.VAA37431@www-u-027.9netave.com> To: ietf-ldapext@netscape.com, ietf-ldapext-request@netscape.com, ietfnir@csi.compuserve.com.netscape.com, ietf-nir@csi.compuserve.com.netscape.com, ietfnntp@academ.com From: EnlargeYourPenis@aol.com () Subject: Add Length to your Penis! Resent-Message-ID: <"0NECiB.A.6ZF.SbOV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Below is the result of your feedback form. It was submitted by (EnlargeYourPenis@aol.com) on Tuesday, July 17, 2001 at 21:30:51 --------------------------------------------------------------------------- : Add Up To 5 Inches Or More To Your Penis... In Just Weeks! 2Inches are 100% GUARANTEED! IMPROVE YOUR LOVE LIFE AND YOUR SELF CONFIDENCE BY ADDING SERIOUS LENGTH AND GIRTH TO YOUR PENIS! THE "FOR MEN ONLY!" PROGRAM IS THE BEST AND MOST COMPREHENSIVE PENIS ENLARGEMENT PROGRAM AVAILABLE! GET STARTED NOW, WITH GARAUNTEED RESULTS HOW CAN YOU GO WRONG?? http://www22.brinkster.com/pharmacy/index2.html << Click LINK NOW! --------------------------------------------------------------------------- From list@netscape.com Wed Jul 18 06:43:30 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id GAA22711 for ; Wed, 18 Jul 2001 06:43:30 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6IAfuB24318; Wed, 18 Jul 2001 03:41:56 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6IAfvo05982; Wed, 18 Jul 2001 03:41:57 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 03:41:57 -0700 (PDT) Message-Id: <200107181040.f6IAeAP24816@ywing.netscape.com> From: "kurtn" To: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Date: Wed, 18 Jul 2001 05:34:25 Resent-Message-ID: <"oiKYKB.A.8cB.zfWV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6IAfuB24318 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ietf.org id GAA22711 Hello Dear Friend, You may have looked at everything under the sun while trying to find God (I know I tried it too!!)but you still weren't satisfied? BUT - Did you know? Jesus said - “I am the way the truth and the life. No man cometh to the Father but by me.” - John 14:6 Let me ask you a question. Why are the Palestinians fighting over the Temple Mount and why does the PLO want all of Jerusalem not just part of it? ANSWER - Because this is where the Lord Jesus Christ will return in His Glory, to the Mount of Olives, and then to Jerusalem where He will set up His Millenial Kingdom where every tear shall be wiped away for believers who know Him and serve Him. Another Question - Why do so many people celebrate Easter and Christmas, but they really don't know Jesus' real birth date and more importantly really don't know Jesus as their personal Lord and Savior. ANSWER - Because they are being misled by serving false pagan idols set up for them in the tradition of men and not by God. What if I told you someone has found the Ark of the Covenant and has given very compelling evidence that Jesus Christ's blood fell upon it to redeem us to God when He died upon the Cross at Calvary for our sins? What if I told you a DNA trace was done on the blood and it proves that only his earthly mother's blood type was present after testing and not his earthly father's thus proving that Jesus is the Messiah? Many prophecies in the bible have already been fulfilled!! As a matter of fact about 80%. We know that many other prophecies are being fulfilled right before our very eyes!! I want you to know the TRUTH. These truths are being presented to you so that you may know the TRUTH and have eternal life through salvation by the shedding of the blood of Jesus Christ for us on the Cross at Calvary. PLEASE KNOW THAT Jesus (Yeshua(Yeshua is the Hebrew name for Jesus)) IS THE MESSIAH You can receive Jesus Christ right now by faith. "If you confess with your mouth the Lord Jesus and believe in your heart that God has raised Him from the dead, you will be saved. For with the heart, one believes unto righteousness, and with the mouth confession is made to salvation"(Romans 10:9) If you now believe on God and place your faith in His Son, congratulations - and welcome to His family. We, all being His children, share in a heavenly inheritance! We are heirs to heaven and are promised the eternal pleasure of glorifying God. As our life here on earth progresses, God will continue to work in our hearts. We are daily being conformed to the image of Christ, Himself. We will begin to live lives of righteousness. Obedience to God will not be a burden to us, but rather a joy. You may wonder, now that you are a Christian, "What now?" Our greatest recommendation for believers, new and old, is fourfold: 1) find a bible believing of full gospel (Old Testament and New Testament!!) teaching church so you might hear the preaching of the Word and rejoice in the fellowship of other Christians, 2) study the Bible for that is where we learn of God and His plans, 3) pray to Him to strengthen your faith and increase your love toward Him, and 4) enjoy the blessings given by God in the heavenly ordained sacraments: baptism and the Lord's Supper. All of these will work to encourage and build upon your faith. If you have any questions, prayerfully search the Scriptures asking the Holy Spirit to give you guidance. Bless you in Yeshua's Name! From list@netscape.com Wed Jul 18 15:34:35 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA12061 for ; Wed, 18 Jul 2001 15:34:34 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6IJXDv23943; Wed, 18 Jul 2001 12:33:13 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6IJXDw09458; Wed, 18 Jul 2001 12:33:13 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 12:33:13 -0700 (PDT) From: id9q@msn.com To: 77x54gke@hotmail.com Reply-To: henryrossetti2649@canada.com Subject: Visa ~ MasterCard ~ American Express ~ Etc. [z8fdo] Content-Type: text/plain; charset=us-ascii Message-Id: <200107181237390.SM00148@email.onchina.com> Date: Wed, 18 Jul 2001 12:38:13 +0100 Resent-Message-ID: <"Cz4uHC.A.MTC.3ReV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Increase your revenues by accepting Credit Cards and Checks! Visa ~ MasterCard ~ American Express ~ Check Guarantee ~ Electronic Internet checks Increase Sales w/4 Powerful Words !!! We Accept Credit Cards Today, the world of E-business is moving faster everyday. And your customers expect every payment option, or they may take their business elsewhere. And that means lost sales! IF YOU SELL A PRODUCT OR SERVICE YOU NEED A MERCHANT ACCOUNT! Some Internet merchants have seen sales increases as high as 1500%! Offering a wide variety of easy payment options for your customers increases impulse buying and helps sell expensive items. Complete E-COMMERCE solutions to accept VISA, MasterCard, American Express and Checks for your website, online store, traditional storefront or home based business. ======================== Submit Your Information Via Email NAME: PHONENUMBER: AND BEST TIME TO CALL: ======================== Thank you To be removed type remove in the subject line From list@netscape.com Wed Jul 18 22:43:38 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA12053 for ; Wed, 18 Jul 2001 22:43:37 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J2fQB15976; Wed, 18 Jul 2001 19:41:27 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J2fRc18395; Wed, 18 Jul 2001 19:41:27 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 19:41:27 -0700 (PDT) Date: Wed, 18 Jul 2001 19:55:11 -0500 From: vg2kyfzu6o@msn.com Message-Id: <200107190055.TAA26459@super.t3cyber.com> To: 94o2@msn.com Reply-To: xeniaoberley1151@excite.com Subject: Need Tax Help? [cff8z] Resent-Message-ID: <"s_moJB.A.WcE.OjkV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Have tax problems? Do you owe the IRS money? If your debt is $10,000 US or more, we can help! Our licensed agents can help you with both past and present tax debt. We have direct contacts with the IRS, so once your application is processed we can help you immediately without further delay. Also, as our client we can offer you other services and help with other problems such as: - Tax Preparation - Audits - Seizures - Bank Levies - Asset Protection - Audit Reconsideration - Trust Fund Penalty Defense - Penalty Appeals - Penalty Abatement - Wage Garnishments .. and more! To receive FREE information on tax help, please fill out the form below and return it to us. There are no obligations, and supplied information is kept strictly confidential. Please note that this offer only applies to US citizens. Application processing may take up to 10 business days. ********** Full Name: State: Phone Number: Time to Call: Estimated Tax Debt Size: ********** Thank you for your time. Note: If you wish to receive no further advertisements regarding this matter or any other, please reply to this e-mail with the word REMOVE in the subject. From list@netscape.com Wed Jul 18 22:49:45 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA13434 for ; Wed, 18 Jul 2001 22:49:45 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J2mVv03627; Wed, 18 Jul 2001 19:48:31 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J2mXM21310; Wed, 18 Jul 2001 19:48:33 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 19:48:33 -0700 (PDT) Message-ID: <001101c11005$ef320c40$709f6e40@0022409398> From: "Carmen Quinones" To: Subject: FREE Checkman Software Date: Wed, 18 Jul 2001 22:50:06 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01C10FDB.FD0FA540" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Resent-Message-ID: <"T1H4cB.A.kMF._pkV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C10FDB.FD0FA540 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable ------=_NextPart_000_000E_01C10FDB.FD0FA540 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

------=_NextPart_000_000E_01C10FDB.FD0FA540-- From list@netscape.com Wed Jul 18 22:51:09 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA13785 for ; Wed, 18 Jul 2001 22:51:08 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J2n7B17209; Wed, 18 Jul 2001 19:49:08 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J2n7621944; Wed, 18 Jul 2001 19:49:07 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 19:49:07 -0700 (PDT) Message-ID: <001501c11006$02ac9ec0$709f6e40@0022409398> From: "Carmen Quinones" To: Subject: FREE Checkman Software Date: Wed, 18 Jul 2001 22:50:34 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0012_01C10FDC.0DE333A0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Resent-Message-ID: <"RX-wsB.A.CWF.gqkV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a multi-part message in MIME format. ------=_NextPart_000_0012_01C10FDC.0DE333A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Send Free Software ------=_NextPart_000_0012_01C10FDC.0DE333A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Send Free = Software

------=_NextPart_000_0012_01C10FDC.0DE333A0-- From list@netscape.com Wed Jul 18 23:34:32 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id XAA21993 for ; Wed, 18 Jul 2001 23:34:31 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J3XLv07790; Wed, 18 Jul 2001 20:33:22 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J3XNE02798; Wed, 18 Jul 2001 20:33:23 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 20:33:23 -0700 (PDT) Message-Id: <200107190331.f6J3VZP13133@ywing.netscape.com> From: anne_071101 To: ietf-ldapext@netscape.com Subject: ¤ñ¤Ú¨½®qÁÙ¬ü - ªF¤è®L«Â¦i( ¸´¹F¶®), ¥un11500 !! X-Mailer: Mail Bomber Reply-To: anne_071101@pchome.com.tw Date: Thu, 19 Jul 2001 11:31:44 +0800 Mime-Version: 1.0 Content-Type: text/html; charset=big5 Resent-Message-ID: <"3Gwg3D.A.Wr.BUlV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6J3XLv07790 Content-Transfer-Encoding: quoted-printable EZiBon =AE=C8=B9C=BA=F4

EZiBon =AE=C8=B9C=BA=F4 - =B6= =A7=A5=FA=A1B=AE= =FC=ACv=A1B=AEq=C0=AC=A1B=BF=CB=A4l=A8t=A6C

=A4=A4=B5= =D8=A5=C1=B0=EA90=A6~6=A4=EB27 =A4=E9= ..

=B4=BB=B0=B2=A4=A3=BA=A6=BB=F9!!

=C5=FD=B1z=BB=B4=C3P=A1B=A8S=ADt=BE=E1=AA=BA=

=A8=C9=A8=FC=A4T=A4=AD=A6n=A4= =CD, =BF=CB=A4l=A9M=BC=D6=AA=BA=A7=D6=BC=D6=AE=C8=B9C=B0=B2=B4=C1

=A5=CE=A4=D6=A4=D6= =AA=BA=AA=E1=B6O, =AFd=A4U=A5=C3=AB=ED=AA=BA=AC=FC=A6n=A6^=BE=D0...

=A1@

EZiBon =AFS=A7O=B1=C0=C2=CB=A4=F1=A4=DA=A8=BD=AEq=C1=D9=AC=FC= =AA=BA=AE=C8=B9C=C2I..

=A1y=AA= F=A4=E8=AEL=AB=C2=A6i - =B8=B4=B9F=B6=AE=A1z=A5=F2=AEL=A4=A7=AE=C8<= /p>

=A1@

=BE=E3=AD=D3= =B4=BB=B0=B2, =A7=DA=AD=CC=A4=A3=BA=A6=BB=F9=A1= A=B6W=AD=C8=AFS=B4f !!

=BF=CB=A4=F4=A1B=BF=CB=A4s= =A8=C9=A8=FC=B6=A7=A5=FA=A1B=A8F=C5y=A1B=AE=FC=ACv=AA=BA=AC~=C2=A7

=A4=A3=A5=CE=A6A=AA= =E1=B1z~~17800~~ =A4=B8= , =B5L=BD=D7=B1z=AA=B1=B4X=A4=D1=B3q=B3q=A5u=ADn 11500 =A4=B8=A1A

( =A8=EA=A5d=A4=A3=A5[=BB=F9 , =A6=DC=A4=D6=B8`=AC=D9=B1z 5000 =A4= =B8=A5H=A4W=AA=BA=B9w=BA=E2=B3=E1!! )

=B4=BB=B0=B2=B3=CC= =B3=CC=B6W=AD=C8=A6=E6=B5{, =BF=F9=B9L=A4F=AFu=AA=BA=AB=DC=A5i=B1=A4...

=A1@=AAF=A4= =E8=AEL=AB=C2=A6i - =AA=DD=B9F=B6=AE

=A1@

=A4=F4=AA=BA=A9I=B3= =EA=B1z=C5=A5=A8=A3=A4F=B6=DC?=A1@

=A4j=AE=FC=BBP=C2=C5=A4=D1<= /font>... =A8=E4=B9=EA=A5i=A5H=AB=DC=AA=F1= ...

=A5=CD=AC=A1... =A8=E4=B9=EA=A4]=A5i=A5H=AB=DC=A7=D6=BC=D6...

=BB=B4=C3= P=A4=DF=B1=A1...= =AB=F6=B3o=B8=CC=B5=B9=A9p=A6n=A6h=AF=BA=B8=DC...

E ZiBon =A4= T=A4j=A8t=A6C=A6=E6=B5{=B1=C0=C2=CB	=AB=F6=A6=B3= =A9=B3=BDu=AA=BA=A6=E6=B5{=A6W=BA=D9, =A5i=B0=D1=BE\=B8=D4=B2=D3=A6=E6=B5{...
=B6=A7=A5= =FA=A1B=AE=FC=ACv=A8t=A6C
1. =AAF=A4=E8=AEL=AB=C2=A6i-=AA=DD= =B9F=B6=AE6=A4=E9=A5=F2=AEL=A4=A7=AE=C8, =A5u=ADn11500 =A4=B8 ... =AFS=A7O=B1=C0=C2=CB, =B5=B4=B9=EF=B5=B4=B9=EF=B6W=AD=C8...
2. =AAF=A4=E8=AEL=AB=C2=A6i-=AA=DD= =B9F=B6=AE5=A4=E9=A5=F2=AEL=A4=A7=AE=C8, =A5u=ADn11500 =A4=B8 ...
3. =AAF=A4=E8=AEL=AB=C2=A6i-=AA=DD= =B9F=B6=AE4=A4=E9=A5=F2=AEL=A4=A7=AE=C8, =A5u=ADn11500 =A4=B8 ...
4.=B4=B6=A6N=AEq=B9=DA=A4=DB5=A4= =E9 , 15800 =A4=B8
5. =C5=CA=B4=CC=A4=DA=A8=BD=AEq6=A4= =E9, 16000 =A4=B8
6.=C5=CA=B4=CC=A4=DA=A8=BD=AEq= 5=A4=E9, 17000 =A4=B8
=A8F=C5y<= font size=3D"3">=A1B=AEq=C0=AC=A8t=A6C
1. =AF[=B2y=BF=CB=B1K=A4=A7=AE=C84=A4=E9, 15500 =A4=B8
2. =B0=A8=A8=D3=A6=E8=A8= =C8=A8=B9=B3=D8=AEq=C0=AC=B0=B2=B4=C1=A4=AD=A4=E9, 16700= =A4=B8
3. =B0=A8=A8=D3=A6=E8=A8=C8 =C4=F5=A5d=AB=C2+=A8=A9=B0=D2=AEq=C0=AC=B0=B2=B4=C1=A4=AD=A4=E9, 19300 =A4=B8<= /font>
4. =B0=A8=A8=D3=A6=E8=A8=C8=BC=D6=AE=F6=AEq=C0=AC= =B0=B2=B4=C1=A4=AD=A4=E9, 20300 =A4=B8
5. =C3=F6=AEq=BF= =CB=A4l=BB=A8=B5=D8=B0=B2=B4=C1=A4=AD=A4=E9, 24000 =A4=B8
=BF=CB=A4= l=A8t=A6C
1. =A4=E9=A5=BB=A8=CA=A8=C1=AF=AB= +=C0=F4=B2y=BCv=AB=B0=BF=CB=A4l6=A4=E9, 23800= =A4=B8
2. =A4=E9=A5=BB =A4E=A6{=B7=C5=ACu=BF=CB=A4l6=A4=E9, 27800 =A4=B8
3. =A4=E9=A5=BB =A4T=A4j=A5D=C3D=BF=CB=A4l5=A4=E9=B9C, 29800 =A4=B8
4. =BFD=ACw<= /font> e =B7s=B6= Q=B3=B7=B1=F9=B5=BA=C4R6=A4=E9 19800 =A4= =B8
5.&nb= sp; =AC=FC=B0=EA=B4=BB=B0=B2=AC=FC=A6=E8=A5D=C3D=BC=D6= =B6=E98=A4=E9 29900 =A4=B8
6. =AC=FC=B0=EA=B8g=A8=E5=AC=FC=A6= =E8=B0=EA=AEa=A4=BD=B6=E99=A4=E9, 36800 =A4=B8
7. =AC=FC=B0=EA=A5=FE=C4=FD=AC=FC=A6=E8=B0=EA=AEa=A4=BD=B6=E910=A4=E9, 37800= =A4=B8
8. =AC=FC=A5[ =A5=FE=C4=FD=AC=FC=AAF+=A5[=AAF(=ABa=ADx=BDg)10=A4=E9, 43000 =A4=B8=
=A6]=AC=B0=A8t=A6C=A6=E6=B5{=AB=DC= =A6h, =A4=A3=A4=CE=B8=FC=A5=FE, =B1z=A5i=A5H=AB=F6=A4U=A6C=A6U=B6=B5... =A9= =CE=A8=D3=B9q=B8=DF=B0=DD 02-25183070
[ = =AFS=B4f=BE=F7=B2=BC ] [ =AC=FC=A5[=A6=E6=B5{ ] [ =AAF=ABn=A8=C8=A6=E6=B5{<= /a> ] [ =AAF=A5_=A8=C8=A6=E6=B5{ ] [ =B0=EA=A5~=A4j=BE=C7=B6i=AD=D7 ] [=A4j=B3=B0=A6=E6=B5{]

	EziBon =AE=C8=B9C=BA=F4	=AAA=B0=C8=B1M=BDu: 02-25183070
=A5x=A5_=A5=AB=ABn=A8=CA=AAF= =B8=F4=A4G=ACq206=B8=B914=BC=D3 =A5=E6=C6[=BA=EE=B2=C42063=B8= =B9 =AB~=ABO(=A6r)0769=B8=B9	http:// www.ezibon.com.tw e-mail: service@ezibon.com.tw

From list@netscape.com Wed Jul 18 23:34:44 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id XAA22032 for ; Wed, 18 Jul 2001 23:34:43 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J3XWB20931; Wed, 18 Jul 2001 20:33:33 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J3XXs02950; Wed, 18 Jul 2001 20:33:33 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 20:33:33 -0700 (PDT) Message-Id: <200107190331.f6J3VfP13224@ywing.netscape.com> From: anne_071101 To: ietf-ldapext@netscape.com Subject: ®È¹C¤£À³¸Ó¬Ot¾á...´»°²¥un10000¤¸, ´N¥i¥H¥X°ê... X-Mailer: Mail Bomber Reply-To: anne_071101@pchome.com.tw Date: Thu, 19 Jul 2001 11:31:45 +0800 Mime-Version: 1.0 Content-Type: text/html; charset=big5 Resent-Message-ID: <"XxHlNC.A.Bt.IUlV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6J3XWB20931 Content-Transfer-Encoding: quoted-printable EZiBon =AE=C8=B9C=BA=F4

=A1@

EZiBon =AE=C8=B9C=BA=F4 - = =B8g=C0=D9=AE=C8=B9C=A8t=A6C

=A4=A4=B5= =D8=A5=C1=B0=EA90=A6~7=A4=EB5 =A4=E9...

=B4=BA=AE=F0=A4=A3=A8=CE, =A5X=B0=EA=AE=C8=B9C=ACO=B9=DA=B7Q,

=ABo=ACO=B8g=C0=D9=AA=BA=AD= t=BE=E1 ?!=A1@

EZiBon =B1=C0=A5X=B8g=C0=D9=AE=C8=B9C= =A8t=A6C

=A9=D2=A6=B3=A8t=A6C=A6=E6=B5= {

=B4=BB=B0=B2=B4=C1=B6=A1, =B3=A3=A5u=ADn10000 =A4=B8=A5=AA=A5k,

=B4N=AF=E0=C5=FD=A7A=BB=B4=C3= P=A5X=B0=EA --=A1y=A6Y=A1B=A6=ED=A1B=AA=B1=A1B=BC=D6=A1z=A4@=ACP=B4=C1

=A1@

1. =C1=FA= =B0=EA=AA=FC=A9=D4=A4O=BC=DA=AEL=A4=A7=AE=C8=A4=AD=A4=E9, 10000 =A4=B8

2. =AE=F5= =B0=EA=A4j=AB=B0=A4=FD=B4=C2=A4=BB=A4=E9, 11000 =A4=B8

3. =AAF=A4=E8=AEL=AB=C2=A6i= -=AA=DD=B9F=B6=AE6=A4=E9, 11500 =A4=B8

=A1@

=AE=C8=B9C=A4=A3=C0=B3=B8=D3= =ACO=ADt=BE=E1...

=C5=FD=A9p=A5=CE=B3=CC=A4=D6= =AA=BA=B8g=B6O, =AFd=A8=FA=A4H=A5=CD=B3=CC=AC=FC=A6n=AA=BA=A6=A8=AA=F8=B0O=BE= =D0...

=A1@

=C1=FA=B0=EA=A4H= =B0=D1=AA=BA=AEa=B6m...

=A1@

=A5X=B0=EA=A8=E4=B9=EA=A5i=A5= H=AB=DC=C2=B2=B3=E6...

=C5w=AA=EF=A4U=B8=FC=A6w=B8=CB [ =AF=BA=B8=DC=BE=F7] =AE=C9=AE=C9=A8=E8=A8=E8=AC=DD=AF=BA=B8= =DC

EZiBo= n =B6=A7=A5= =FA=A1B=AEq=C0=AC=A1B=BF=CB=A4l=A8t=A6C=A6=E6=B5{	=AFS=B4f=BE=F7=B2=BC
=B6=A7=A5=FA=A1B=AE=FC=ACv=A8t=A6C	=B0=EA=AE= =F5=B9q=A4l=BE=F7=B2=BC (=A5=F8=B7~=BB=F9)
1. =AAF=A4=E8=AEL=AB=C2=A6i= -=AA=DD=B9F=B6=AE6=A4=E9, =AD=EC=BB=F9 ~~17800~~ ~~=A4=B8, =A5u=ADn11500 =A4=B8~~ ~~...~~	1. =A5x=A5= _=AD=BB=B4=E4 2-60=A4=D1=A6=B3=AE=C4=A8=D3=A6^ 5900 =A4=B8
2. =B4=B6=A6N=AEq=B9=DA=A4=DB5=A4=E9 , 1580= 0 =A4=B8	2. =A5= x=A5_=A6N=B6=A9=A9Y=A4@=A6~=A6=B3=AE=C4=A8=D3=A6^, 9600 =A4=B8
3. =C5=CA=B4=CC=A4=DA=A8=BD= =AEq6=A4=E9, 16000 =A4=B8	3. =A5x=A5_=B0=D2=A8=A6=A4@=A6~=A6=B3=AE= =C4=A8=D3=A6^, 9600 =A4=B8
4. =C5=CA=B4=CC=A4=DA= =A8=BD=AEq5=A4=E9, 17000 =A4=B8	4. =A5x=A5_=C2b=AB=B0=A4@=A6~=A6=B3= =AE=C4=A8=D3=A6^, 9600 =A4=B8

=A8F=C5= y=A1B=AEq=C0=AC=A8t=A6C	=A4=A4=B0= =EA=A4j=B3=B0=AFS=B4f=BE=F7=B2=BC
1. =AF[=B2y=BF=CB=B1K=A4=A7=AE=C84=A4=E9, 15500 =A4=B8	1. =BFD=AF=E8 =A5x=A5_=BFD=AA=F990=A4=D1=A8=D3=A6^, 8100 =A4=B8
2. =B0=A8=A8=D3=A6=E8=A8=C8= =A8=B9=B3=D8=AEq=C0=AC=B0=B2=B4=C1=A4=AD=A4=E9, 16700 =A4=B8	2. =BFD=AF=E8 =A5x=A5_-=BFD=AA=F9-=A4W=AE=FC90=A4=D1=A8=D3=A6^, = 17300 =A4=B8
3. =B0=A8=A8=D3=A6=E8=A8=C8 =C4=F5=A5d=AB=C2+=A8=A9=B0=D2=AEq=C0=AC=B0=B2=B4=C1=A4=AD=A4=E9= , 19300 =A4=B8	3. =AAF=AF=E8 =A5x=A5_-=AD=BB=B4=E4-=A4W=AE=FC90=A4=D1=A8=D3=A6^= , 17300 =A4=B8
4. =B0=A8=A8=D3=A6=E8=A8=C8= =BC=D6=AE=F6=AEq=C0=AC=B0=B2=B4=C1=A4=AD=A4=E9, 20300 =A4=B8	4. =AAF=AF=E8 =A5x=A5_-=AD=BB=B4=E4-=ABn=A8=CA90=A4=D1=A8=D3=A6^= , 16600 =A4=B8
5. =C3=F6=AEq=BF=CB=A4l=BB=A8= =B5=D8=B0=B2=B4=C1=A4=AD=A4=E9, 24000 =A4=B8	5. =AAF=AF=E8 =A5x=A5_-=AD=BB=B4=E4-=AAC=A6{90=A4=D1=A8=D3=A6^, = 16600 =A4=B8
=BF=CB=A4= l=A8t=A6C	6. =A5=C1=AF=E8 =A5x=A5_-=AD=BB=B4=E4-=A5_=A8=CA90=A4=D1=A8=D3=A6= ^, 19000 =A4=B8
1. =A4=E9=A5=BB=A8=CA=A8=C1= =AF=AB+=C0=F4=B2y=BCv=AB=B0=BF=CB=A4l6=A4=E9, 23800 =A4=B8	=A8=E4=A5= L=AFS=B4f=BE=F7=B2=BC
2. =A4=E9=A5=BB =A4E=A6{=B7=C5=ACu=BF=CB=A4l6=A4=E9, 27800 =A4=B8	1. =B7s=AF=E8=AAF=A8=CA=A4@=A6~=A6=B3=AE=C4=A8=D3=A6^, 10900 =A4=B8<= /font>
3. =A4=E9= =A5=BB =B8g=A8=E5=AAF=A8=CA=A8f=B4=B5=A9`=BF=CB=A4l5=A4=E9, 28900 =A4=B8	2. =B7s=AF=E8=AAF=A8=CA=A4@=A6~=A6=B3=AE=C4=A8=D3=A6^, 10900 =A4=B8
4 . =A4=E9=A5=BB =A4T=A4j=A5D=C3D=BF=CB=A4l5=A4=E9=B9C, 29800 =A4=B8	3. =B7s=AF=E8=AC=A5=A7=FC=C1F=A4@=A6~=A6=B3=AE=C4=A8=D3=A6^, 28000 =A4=B8
5 . =BFD= =ACw e =B7s=B6Q=B3=B7=B1=F9=B5=BA=C4R6=A4=E9 19800 =A4=B8	=A1@
6 . =AC=FC=B0=EA=B4=BB=B0=B2=AC=FC=A6=E8= =A5D=C3D=BC=D6=B6=E98=A4=E9 29900 =A4=B8	=A1@
7 . =AC=FC=B0=EA=B8g=A8=E5=AC= =FC=A6=E8=B0=EA=AEa=A4=BD=B6=E99=A4=E9, 36800 =A4=B8	=A1@
8 . =AC=FC=B0=EA=A5=FE=C4=FD= =AC=FC=A6=E8=B0=EA=AEa=A4=BD=B6=E910=A4=E9, 37800 =A4=B8	=A1@
9 . =AC=FC=A5[ =A5=FE=C4=FD=AC=FC=AAF+=A5[=AAF(=ABa=ADx=BDg)10=A4=E9, 43000 =A4=B8	=A4=A3=A7= t=A8=E2=A6a=BE=F7=B3=F5=B5\|=A4=CE=A8=E4=A5L=AA=FE=A5[=B5\|(=BA=F4=A4W=B3=F8= =BB=F9=AC=B0=B7=C7)
=A6]=AC=B0=A8t=A6C=A6=E6=B5{= =AB=DC=A6h, =A4=A3=A4=CE=B8=FC=A5=FE, =B1z=A5i=A5H=AB=F6=A4U=A6C=A6U=B6=B5= ... =A9=CE=A8=D3=B9q=B8=DF=B0=DD 02-25183070
[ =AFS=B4f=BE=F7=B2=BC ] [ =AC=FC=A5[=A6=E6=B5{ ] [ =AAF=ABn=A8=C8=A6=E6= =B5{ ] [ =AAF=A5_=A8=C8=A6=E6=B5{<= /a> ] [ =B0=EA=A5~=A4j=BE=C7=B6= i=AD=D7 ] [=A4j=B3=B0=A6=E6=B5{]

=	EziBon =AE=C8=B9C=BA=F4	=AAA=B0=C8=B1M=BDu: 02-25183070
=A5x=A5_=A5=AB=ABn=A8=CA= =AAF=B8=F4=A4G=ACq206=B8=B914=BC=D3 =A5=E6=C6[=BA=EE=B2=C420= 63=B8=B9 =AB~=ABO(=A6r)0769=B8=B9	http:// www.ezibon.com.tw e-mail: service@ezibon.com.t= w

From list@netscape.com Thu Jul 19 01:18:38 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA13475 for ; Thu, 19 Jul 2001 01:18:36 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J5HBB28653; Wed, 18 Jul 2001 22:17:11 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J5HCg25637; Wed, 18 Jul 2001 22:17:12 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 22:17:12 -0700 (PDT) Message-Id: <5.1.0.14.0.20010718220231.02cf8900@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 18 Jul 2001 22:12:59 -0700 To: Ellen Stokes From: "Kurt D. Zeilenga" Subject: prescriptive and subentry ACIs: draft-ietf-ldapext-acl-model-08.txt Cc: ietf-ldapext@netscape.com In-Reply-To: <5.0.2.1.0.20010629105210.00a63688@popmail2.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"kTIMKC.A.HQG.V1mV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com The draft says: The following topics are deemed interesting and useful for future work, but are also beyond the scope of this model: - Use of prescriptive ACIs and scoping via use of a ldapACISubEntry and then goes on to describe ldapACISubentry. I suggest the above bullet be reworded: - Specification of prescriptive ACIs [X.501] and then to drop all mention of ldapACIsubentry, ldapSubentry, subentry, and references to the ldap subentry I-D. I also believe the document should note that subentry ACIs are beyond the scope of the document. Kurt From list@netscape.com Thu Jul 19 01:52:37 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA25473 for ; Thu, 19 Jul 2001 01:52:36 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J5pOv19359; Wed, 18 Jul 2001 22:51:24 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J5pP605275; Wed, 18 Jul 2001 22:51:25 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 22:51:25 -0700 (PDT) Message-Id: X-Mailer: Novell GroupWise Internet Agent 6.0 Date: Wed, 18 Jul 2001 23:48:47 -0600 From: "Jim Sermersheim" To: Cc: Subject: Submission of draft-ietf-ldapext-ldapv3-dupent-07.txt Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=_32685242.D7B61C59" Resent-Message-ID: <"tGcRsD.A.4RB.bVnV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a MIME message. If you are reading this text, you may want to consider changing to a mail reader or gateway that understands how to properly handle MIME multipart messages. --=_32685242.D7B61C59 Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: quoted-printable I-D Editor, Please publish the attached draft as an update to draft-ietf-ldapext-ldapv3= -dupent-06.txt LDAPExt Group, Here's the change log. This reflects comments made during the previous = last call. Changes to draft-ietf-ldapext-ldapv3-dupent-06.txt - Changed 'smallest' to 'smallest order' - Added "All controlValue data is represented as ASN.1 in this document, = and is to be BER encoded as stated in Section 5.1 of [RFC2251]." To = section 4, and modified text introducing ASN.1 def's - Added "Note that this may result in search result entries that no longer = match the search filter. Specifying an attribute supertype has the effect of treating all values of = that attribute's subtypes as if they were values of the specified = attribute supertype. See Section 5.2 for an example of this." To section = 4.1.1 - Modified the example in Section 5.2 to show how attribute supertypes are = handled - Minor editorials Thanks, Jim --=_32685242.D7B61C59 Content-Type: text/plain Content-Disposition: attachment; filename="draft-ietf-ldapext-ldapv3-dupent-07.txt" LDAPEXT Working Group J. Sermersheim Internet Draft Novell, Inc Document: draft-ietf-ldapext-ldapv3-dupent-07.txt July 2001 Intended Category: Standard Track LDAP Control for a Duplicate Entry Representation of Search Results 1. Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026 [1]. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet- Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. 2. Abstract This document describes a Duplicate Entry Representation control extension for the LDAP Search operation. By using the control with an LDAP search, a client requests that the server return separate entries for each value held in the specified attributes. For instance, if a specified attribute of an entry holds multiple values, the search operation will return multiple instances of that entry, each instance holding a separate single value in that attribute. 3. Overview The Server-Side Sorting control [RFC2891] allows the server to order search result entries based on attribute values (sort keys). It does not allow one to specify behavior when an attribute contains multiple values. The default behavior, as outlined in 7.9 of [X.511], is to use the smallest order value as the sort key. An application may need to produce an ordered list of entries, sorted by a multi-valued attribute, where each attribute value is represented in the list. In order to do this, a separate control is needed which causes the set of entries to be expanded sufficiently to represent each attribute value prior to sorting. Sermersheim Internet-Draft - Expires Jan 2002 Page 1 LDAP Control for a Duplicate Entry Representation of Search Results This document describes controls, which allow duplicate entries in the result set of search, where each entry represents a distinct value of a given multiple valued attribute. An example of this would be a sorted list of all telephone numbers in an organization. Because any entry may have multiple telephone numbers, and the list is to be sorted by telephone number, the list must be able to contain duplicate entries, each with its own unique telephone number. Another example would be an application that needs to display an ordered list of all members of a group. It would use this control to create a result set of duplicate groupOfNames entries, each with a single, unique value in its member attribute. The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", and "MAY" used in this document carry the meanings described in [RFC2119]. 4. The Controls Support for the controls is advertised by the presence of their OID in the supportedControl attribute of a server's root DSE. The OID for the request control is "2.16.840.1.113719.1.27.101.1" and the OIDs for the response controls are "2.16.840.1.113719.1.27.101.2" and "2.16.840.1.113719.1.27.101.3". All controlValue data is represented as ASN.1 in this document, and is to be BER encoded as stated in Section 5.1 of [RFC2251]. 4.1 Request Control This control is included in the searchRequest message as part of the controls field of the LDAPMessage, as defined in Section 4.1.12 of [RFC2251]. The controlType is set to "2.16.840.1.113719.1.27.101.1". The criticality MAY be set to either TRUE or FALSE. The controlValue is defined as the following DuplicateEntryRequest: DuplicateEntryRequest ::= SEQUENCE { AttributeDescriptionList, -- from [RFC2251] PartialApplicationAllowed BOOLEAN DEFAULT TRUE } 4.1.1 AttributeDescriptionList Semantics The AttributeDescriptionList data type is described in 4.1.5 of [RFC2251] and describes a list of zero or more AttributeDescription types as also described in 4.1.5 of [RFC2251]. Both definitions are repeated here for convenience: AttributeDescriptionList ::= SEQUENCE OF AttributeDescription Sermersheim Internet-Draft - Expires Jan 2002 Page 2 LDAP Control for a Duplicate Entry Representation of Search Results AttributeDescription ::= LDAPString A value of AttributeDescription is based on the following BNF: attributeDescription = AttributeType [ ";" ] While processing a search request, a server implementation examines this list. If a specified attribute or attribute subtype exists in an entry to be returned by the search operation, and that attribute holds multiple values, the server treats the entry as if it were multiple, duplicate entries -- the specified attributes each holding a single, unique value from the original set of values of that attribute. Note that this may result in search result entries that no longer match the search filter. Specifying an attribute supertype has the effect of treating all values of that attribute's subtypes as if they were values of the specified attribute supertype. See Section 5.2 for an example of this. Client implementations SHOULD NOT specify attribute type options that indicate transfer encoding (e.g. ;binary). When two or more attributes are specified by this control, the number of duplicate entries is the combination of all values in each attribute. Because of the potential complexity involved in servicing multiple attributes, server implementations MAY choose to support a limited number of attributes in the control. There is a special case where either no attributes are specified, or an attribute description value of "*" is specified. In this case, all attributes are used. (The "*" allows the client to request all user attributes in addition to specific operational attributes). If an attribute is unrecognized, that attribute is ignored when processing the control. 4.1.2 PartialApplicationAllowed Semantics The PartialApplicationAllowed field is used to specify whether the client will allow the server to apply this control to a subset of the search result set. If TRUE, the server is free to arbitrarily apply this control to no, any, or all search results. If FALSE, the server MUST either apply the control to all search results or fail to support the control at all. Client implementations use the DuplicateSearchResult control to discover which search results have been affected by this control. 4.2 Response Controls Sermersheim Internet-Draft - Expires Jan 2002 Page 3 LDAP Control for a Duplicate Entry Representation of Search Results Two response controls are defined to provide feedback while the search results are being processed; DuplicateSearchResult and DuplicateEntryResponseDone. The DuplicateSearchResult control is sent with all SearchResultEntry operations that contain search results which have been modified by the DuplicateEntryRequest control. The DuplicateEntryResponseDone control is sent with the SearchResultDone operation in order to convey completion information. 4.2.1 The DuplicateSearchResult control This control is included in the SearchResultEntry message of any search result that holds an entry that has been modified by the DuplicateEntryRequest control as part of the controls field of the LDAPMessage, as defined in Section 4.1.12 of [RFC2251]. This control is absent on search results that are unaffected by DuplicateEntryRequest control. The controlType is set to "2.16.840.1.113719.1.27.101.2". The criticality is ignored. The controlValue is not included. 4.2.2 The DuplicateEntryResponseDone control This control is included in the searchResultDone message as part of the controls field of the LDAPMessage, as defined in Section 4.1.12 of [RFC2251]. The controlType is set to "2.16.840.1.113719.1.27.101.3". The criticality is ignored. The controlValue is defined as the following DuplicateEntryResponseDone: DuplicateEntryResponseDone ::= SEQUENCE { resultCode, -- From [RFC2251] errorMessage [0] LDAPString OPTIONAL, attribute [1] AttributeDescription OPTIONAL } A result field is provided here to allow the server to convey to the client that an error resulted due to the control being serviced. For example, a search that would ordinarily complete successfully may fail with a sizeLimitExceeded error due to this control being processed. Though any result code that is defined in [RFC2251] MAY be returned the following list assigns special meanings to certain result codes when returned in this control: - success: The control was successful. - timeLimitExceeded Time limit reached before attribute values could be processed. - sizeLimitExceeded Size limit reached as a result of this Sermersheim Internet-Draft - Expires Jan 2002 Page 4 LDAP Control for a Duplicate Entry Representation of Search Results control. - adminLimitExceeded Result set too large for server to handle. - unwillingToPerform Server cannot process control. The errorMessage field MAY be populated with a human-readable string in the event of an erroneous result code. The attribute field MAY be set to the value of the first attribute specified by the DuplicateEntryRequest that was in error. The client MUST ignore the attribute field if the result is success. 5. Protocol Examples 5.1 Simple example This example will show this control being used to produce a list of all telephone numbers in the dc=example,dc=net container. Let's say the following three entries exist in this container; dn: cn=User1,dc=example,dc=net telephoneNumber: 555-0123 dn: cn=User2,dc=example,dc=net telephoneNumber: 555-8854 telephoneNumber: 555-4588 telephoneNumber: 555-5884 dn: cn=User3,dc=example,dc=net telephoneNumber: 555-9425 telephoneNumber: 555-7992 First an LDAP search is specified with a baseDN of "dc=example,dc=net", subtree scope, filter set to "(telephoneNumber=*)". A DuplicateEntryRequest control is attached to the search, specifying "telephoneNumber" as the attribute description, and the search request is sent to the server. The set of search results returned by the server would then consist of the following entries: dn: cn=User1,dc=example,dc=net telephoneNumber: 555-0123 dn: cn=User2,dc=example,dc=net telephoneNumber: 555-8854 control: 2.16.840.1.113719.1.27.101.2 dn: cn=User2,dc=example,dc=net telephoneNumber: 555-4588 control: 2.16.840.1.113719.1.27.101.2 dn: cn=User2,dc=example,dc=net Sermersheim Internet-Draft - Expires Jan 2002 Page 5 LDAP Control for a Duplicate Entry Representation of Search Results telephoneNumber: 555-5884 control: 2.16.840.1.113719.1.27.101.2 dn: cn=User3,dc=example,dc=net telephoneNumber: 555-9425 control: 2.16.840.1.113719.1.27.101.2 dn: cn=User3,dc=example,dc=net telephoneNumber: 555-7992 control: 2.16.840.1.113719.1.27.101.2 All but the first entry are accompanied by the DuplicateSearchResult control when sent from the server. Note that it is not necessary to use an attribute in this control that is specified in the search filter. This example only does so, because the result was to obtain a list of telephone numbers. 5.2 Specifying multiple attributes A more complicated example involving multiple attributes will result in more entries. If we assume these entries in the directory: dn: cn=User1,dc=example,dc=net cn: User1 givenName: User One mail: user1@example.net dn: cn=User2,dc=example,dc=net cn: User2 givenName: User Two mail: user2@example.net mail: usertwo@example.net In this example, we specify mail and name in the attribute list. By specifying name, all attribute subtypes of name will also be considered. Following is the resulting set of entries: dn: cn=User1,dc=example,dc=net cn: User1 mail: user1@example.net control: 2.16.840.1.113719.1.27.101.2 dn: cn=User1,dc=example,dc=net givenName: User One mail: user1@example.net control: 2.16.840.1.113719.1.27.101.2 dn: cn=User2,dc=example,dc=net cn: User2 mail: user2@example.net control: 2.16.840.1.113719.1.27.101.2 Sermersheim Internet-Draft - Expires Jan 2002 Page 6 LDAP Control for a Duplicate Entry Representation of Search Results dn: cn=User2,dc=example,dc=net cn: User2 mail: usertwo@example.net control: 2.16.840.1.113719.1.27.101.2 dn: cn=User2,dc=example,dc=net givenName: User Two mail: user2@example.net control: 2.16.840.1.113719.1.27.101.2 dn: cn=User2,dc=example,dc=net givenName: User Two mail: usertwo@example.net control: 2.16.840.1.113719.1.27.101.2 5.3 Listing the members of a groupOfNames This example shows how the controls can be used to turn a single groupOfNames entry into multiple duplicate entries. Let's say this is our groupOfNames entry: dn: cn=Administrators,dc=example,dc=net cn: Administrators member: cn=aBaker,dc=example,dc=net member: cn=cDavis,dc=example,dc=net member: cn=bChilds,dc=example,dc=net member: cn=dEvans,dc=example,dc=net We could set our search base to "cn=Administrators,dc=example,dc=net ", filter to "(objectClass=*)", use an object scope (to restrict it to this entry) and send the duplicateEntryRequest control with "member" as its attribute value. The resulting set would look like this: dn: cn=Administrators,dc=example,dc=net member: cn=aBaker,dc=example,dc=net control: 2.16.840.1.113719.1.27.101.2 dn: cn=Administrators,dc=example,dc=net member: cn=cDavis,dc=example,dc=net control: 2.16.840.1.113719.1.27.101.2 dn: cn=Administrators,dc=example,dc=net member: cn=bChilds,dc=example,dc=net control: 2.16.840.1.113719.1.27.101.2 dn: cn=Administrators,dc=example,dc=net member: cn=dEvans,dc=example,dc=net control: 2.16.840.1.113719.1.27.101.2 This list can then be sorted by member and displayed (also by member) in a list. Sermersheim Internet-Draft - Expires Jan 2002 Page 7 LDAP Control for a Duplicate Entry Representation of Search Results 6 Relationship to other controls This control is intended (but not limited) to be used with the Server Side Sorting control [RFC2891]. By pairing this control with the Server Side Sorting control, One can produce a set of entries, sorted by attribute values, where each attribute value is represented in the sorted set. Server implementations MUST ensure that this control is processed before sorting the result of a search, as this control alters the result set of search. This control MAY also be used with the Virtual List View [VLV] control (which has a dependency on the Server Side Sort control). The nature of the dependency between the VLV control and the Sort control is such that the Sorting takes place first. Because the sort happens first, and because this control is processed before the sort control, the impact of this control on the VLV control is minimal. Some server implementations may need to carefully consider how to handle the typedown functionality of the VLV control when paired with this control. The details of this are heavily implementation dependent and are beyond the scope of this document. 7. Notes for Implementers Both client and server implementations MUST be aware that using this control could potentially result in a very large set of search results. Servers MAY return an adminLimitExceeded result in the response control due to inordinate consumption of resources. This may be due to some a priori knowledge such as a server restriction of the number of attributes in the request control that it's willing to service, or it may be due to the server attempting to service the control and running out of resources. Client implementations MUST be aware that when using this control, search entries returned will contain a subset of the values of any specified attribute. If this control is used in a chained environment, servers SHOULD NOT pass this control to other servers. Instead they SHOULD gather results and apply this control themselves. 8. Security Considerations This control allows finer control of the result set returned by an LDAP search operation and as such may be used in a denial of service attack. See Section 7 for more information on how this is detected and handled. 9. Acknowledgments The author gratefully thanks the input and support of participants of the LDAP-EXT working group. 10. References Sermersheim Internet-Draft - Expires Jan 2002 Page 8 LDAP Control for a Duplicate Entry Representation of Search Results [RFC2251] Wahl, M, S. Kille and T. Howes, "Lightweight Directory Access Protocol (v3)", Internet RFC, December, 1997. Available as RFC 2251. [RFC2891] Wahl, M, A. Herron and T. Howes, "LDAP Control Extension for Server Side Sorting of Search Results", Internet RFC, August, 2000. Available as RFC 2891. [VLV] Boreham, D, Sermersheim, J, Anantha, A, Armijo, M, "LDAP Extensions for Scrolling View Browsing of Search Results", Internet Draft, April, 2000. Available as draft-ietf-ldapext-ldapv3-vlv-04.txt. [X.511] ITU-T Rec. X.511, "The Directory: Abstract Service Definition", 1993. [RFC2119] Bradner, Scott, "Key Words for use in RFCs to Indicate Requirement Levels", Internet Draft, March, 1997. Available as RFC 2119. 11. Author's Address Jim Sermersheim Novell, Inc. 1800 South Novell Place Provo, Utah 84606, USA jimse@novell.com +1 801 861-3088 Sermersheim Internet-Draft - Expires Jan 2002 Page 9 --=_32685242.D7B61C59-- From list@netscape.com Thu Jul 19 02:00:56 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAA29034 for ; Thu, 19 Jul 2001 02:00:56 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J4vYB26738; Wed, 18 Jul 2001 21:57:34 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J4vZM19803; Wed, 18 Jul 2001 21:57:35 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 21:57:35 -0700 (PDT) Message-Id: <5.1.0.14.0.20010718205248.00af8be8@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 18 Jul 2001 21:53:02 -0700 To: "Ed Reed" From: "Kurt D. Zeilenga" Subject: Re: LDAPSubentries comments review and request for last call by LDAPEXT and LDUP working groups Cc: , In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"lfaz2B.A.D1E.9imV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com At 12:24 PM 7/16/2001, Ed Reed wrote: >So - I'd like more comments on the administrative model. Does it work for ACI as LDAPEXT is defining it? Other applications than just LDUP? I think it DOES work for LDUP (ie, managing replication areas). I don't think it works for access controls, subschema, collective attributes, and likely not for LDUP (consider sparse replica). Of course, my definition of "works" may be quite different than yours. ldapSubentry can only hold information associated with a subtree. ldapSubentry, by design, cannot hold information associated with a subtree refinement [X.501]. Consider a case where the administrator wishes to hold a set of shared attributes for the collection of entries which are immediately subordinate to a particular entry (but not the particular entry). This cannot be done using LDAPsubentries as LDAPsubentries requires that each subordinate have a separate subentry to hold the attributes. As these attributes are held in different subentries, they are not shared. And further subentries need to be created to break the inheritance (as the information was to be shared between the immediate subordinates). And, of course, needed subordinates are not automatically created/deleted upon add, delete, and rename. I believe there is good operational experience from the X.500 community that a subentry subtree refinement mechanism is needed to allow for effective administration of the Directory. I recommend we adapt X.500 subentries, including the subtree specification mechanism, for use with LDAP. Kurt From list@netscape.com Thu Jul 19 02:40:34 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAA16863 for ; Thu, 19 Jul 2001 02:40:33 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J6deB05019; Wed, 18 Jul 2001 23:39:41 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J6dfE15148; Wed, 18 Jul 2001 23:39:41 -0700 (PDT) Resent-Date: Wed, 18 Jul 2001 23:39:41 -0700 (PDT) Message-ID: <00002ec938a5$000000c9$00001dcc@mail4.wuzzlenorple.com> To: From: philblusk@wuzzlenorple.com Subject: If you need to lose 10,20,30 pounds or more, Please READ THIS!! 7628 Date: Thu, 19 Jul 2001 01:41:33 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: wjilknmv@umailme.com Resent-Message-ID: <"6YEnZC.A.JsD.sCoV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable

"I would like to share something with you. First let me say, I'm not tr= ying
to sell you anything (I don't like it when people do that). But, I do like=
it when people share with me what "works" in their life. Well,..

I have found something that "WORKS".

Young and old, male and female, if you think success was achieved through<= br> strict diets and hours upon hours of aerobic exercise...
IT IS NOT.
I've Lost So Many Inches I'm Almost Embarrassed To Say!
I'm wearing clothes I haven't touched since high school! I've dropped a tremendous amount of fat and "toned up REAL nice"... says my husband
George!" I personally didn't think it was possible. Especially after tryin= g
just about every kind of diet plan and exercise program invented. I gave u= p
all hope of ever being thin again. Depressed and angry, I began to throw o= ut
the many boxes, bottles, and books of failed diets that promised me I woul= d
lose the weight that was destroying my life.
That's when I noticed an unopened bottle of a product called BerryTrim Plu= s
I had purchased a few months prior. Just like that voice said in that
baseball movie, "If you build it , they will come" something told me to "T= ry
It, and it will work" sounds crazy, but I did, and..
I was amazed at what my scale told me!
Not only did it work but,
I Swear I Woke Up One Week Later and I Was A Dress Size Smaller!
following the simple directions that fit into everyday lifestyles.
I've Lost 60 pounds of fat
All in my first 6 months!
I'm kicking myself in the butt for it. I've had the answer to my prayers i= n
my cabinet for months and I waited much too long to do this.
I have dropped nearly a half a foot off my waistline. I eat what I want an= d
only work out twice a week. (Sometimes, less than that). I've become sold = on
this miracle product called BerryTrim Plus.
I Feel Absolutely Terrific!
My energy is through the roof! But even better than that, the intimacy in = my
marriage has improved tremendously. (I wasn't feeling very Sexy before I started BerrryTrim Plus.) Now, after losing several inches of blubber, we'= re
just like Newlyweds!
I love BerryTrim Plus!

Finally! I feel comfortable when I go out about the way I look in clothes.= I
used to run from the mirror after getting out of the shower, Now, I dance<= br> around naked in the bathroom mirror. And I feel tough too. Nothing like having strength!
My pants are fitting loosely, my stomach's flatter, my arms and legs look<= br> leaner. Seems like Overnight. "Poof!" They told me exactly what to expect=
and day by day, like clockwork, They were right on the money!
To top it all off, I seem to be literally repelling body fat as I get lean= er
and leaner by the moment!
I weigh the same at my second reunion as I did when I was in High School!<= br> Not bad? Right? My friends didn't recognize me from the last time they saw=
me! They said, "You look marvelous!"
BerryTrim Plus works because it allows your body to do what it does best.<= br> It's like tossing wood on a fire.
Solid logs keep the metabolism going.
Just check it out for yourself. You have nothing to lose but the weight. I=
can assure you, I would not put my reputation on the line by telling you a=
lie. BerryTrim Plus really worked for me, I believe it can work for you. Just click on the link below and read for yourself

CLICK HERE

Thank you for letting me tell you about my incredible happiness.

God Bless,
Mary Kennedy

This message is brought to you by BerryTrim Affiliate.=
We apologize for any email you may have inadvertently received.
Please CLICK HERE to b= e removed from future mailings.

From list@netscape.com Thu Jul 19 03:25:06 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id DAA22548 for ; Thu, 19 Jul 2001 03:25:05 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J7MLB08492; Thu, 19 Jul 2001 00:22:21 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J7MLQ25827; Thu, 19 Jul 2001 00:22:21 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 00:22:21 -0700 (PDT) From: estoil0c0@wuzzlenorple.com Message-ID: <00003f0601fe$0000749e$00003936@mail3.wuzzlenorple.com> To: Subject: Boost Your Windows Reliability!!! 14646 Date: Thu, 19 Jul 2001 02:17:29 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: grebb664@arabia.com Resent-Message-ID: <"FlssFC.A.ITG.rqoV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable

Dear Windows User,

Now you can boost the reliability of ordinary Windows 95, 98 and ME to nea= rly the level of Windows NT or 2000, Microsoft's professional and industrial v= ersion of Windows.

The new WinFix is a very effective way to improve the reliability of Windo= ws, because it makes Windows fault-tolerant and self-repairing.

And WinFix is very safe, because it operates completely independent of Win= dows.

C= LICK HERE to find out more about WinFix, the safest, most e= ffective way to keep you working, by keeping your PC working non-stop.

Arlen Dixon, CEO
Pinewood Software Marketing

-------------------------------------------------------

This announcement is intended for PC users who asked to be kept
informed about new developments in Windows technology.

We apologize for any email you may have inadvertently received.
Please CLICK HERE to b= e removed from future mailings.

From list@netscape.com Thu Jul 19 04:06:43 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id EAA27254 for ; Thu, 19 Jul 2001 04:06:39 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6J85UB11746; Thu, 19 Jul 2001 01:05:30 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6J85UM09130; Thu, 19 Jul 2001 01:05:30 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 01:05:30 -0700 (PDT) Reply-To: From: "Steven Legg" To: Subject: Equality Matching of ACI Values Date: Thu, 19 Jul 2001 18:05:51 +1000 Message-ID: <008601c11029$a16db670$b05508cb@osmium.adacel.com.au> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2120.0 Resent-Message-ID: <"68HuxC.A.NOC.JTpV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit LDAPexters, The semantics of equality matching for attribute values of the ACI syntax has been little discussed. The current draft of the access control model simply uses the general purpose directoryComponentsMatch rule from draft-legg-ldapext-component-matching-03.txt as the equality matching rule for the entryACI and subtreeACI attributes. The directoryComponentsMatch rule returns true if and only if all the component parts of two ACI values being compared are the same. The precise meaning of "the same" depends on the ASN.1 definition for the ACI syntax and is determined by the provisions of the component matching draft. A reasonable target for the design of an equality matching rule for the ACI syntax is for the equality test to align with the semantic equivalence of the values being compared. That is, two ACIs are equal if they mean the same thing and are not equal if they mean different things. With such a rule redundant duplication of access control information is prevented and semantically distinct ACIs are never blocked from being added to the same entry. For most of the fields in an ACI the generic matching by directoryComponentsMatch aligns quite nicely with semantic equivalence within the access control model. If two values of a field mean the same thing directoryComponentsMatch says they are equal and if they mean different things directoryConmponentsMatch says they are not equal. However, there are two fields, and , where the generic matching is not well aligned and the discrepancy may not be to everyone's liking. When I defined directoryComponentsMatch I also described a way of extending it, so we can vary the meaning of "the same" for ACI matching in a straightforward way if that is what the group wants. Later in this message I show what that would look like for the access control model draft. The component matching framework also provides ways of partially matching ACI values. Some of the possible changes discussed below alter the ASN.1 definition for the ACI syntax and so have consequences on the partial matching of ACIs (which are also discussed). ---------------------------------------------------------------------------- --- (1) IP Addresses RFC 2373 allows leading zero digits in the number parts of the textual representations of IP addresses and also allows for compressed representations of addresses. A single IP address can therefore have multiple representations. The ABNF for ACIs allows these multiple representations and the IP addresses are copied verbatim into a UTF8String in the binary encoding. These multiple representations for IP addresses aren't considered equal by the generic matching semantics of directoryComponentsMatch since it just does a caseIgnoreMatch of the IP address character strings. Here are our options. (1.A) Leave things as they are. So two ACI values that have the same IP address for a machineSubject, but using different representations, will not be equal, even if all the other fields in the ACI are the same. For example, these three ACI values mean the same thing but are not equal as things are currently defined: grant:r#[all]#authnLevel:strong:ipAddress:::10.9.8.7 grant:r#[all]#authnLevel:strong:ipAddress:::10.09.08.07 grant:r#[all]#authnLevel:strong:ipAddress:0:0:0:0:0:0:10.9.8.7 If I wanted to use the componentFilterMatch matching rule to search for ACIs that contain a particular IP address, e.g. with this filter, (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.machineSubject.ipAddress.*.single", rule caseIgnoreMatch, value "::10.9.8.7" }) then I will only find the ACIs with exactly the representation of the IP address I've chosen to search on. Also, the lexicographic ordering of IP address textual representations doesn't conform to the natural ordering of IPv6 addresses, so I can't write a sensible filter to match ACIs with IP addresses less than or greater some presented value (according to the caseIgnoreOrderingMatch rule "::10.9.8.7" is greater than "::10.10.8.7" !). (1.B) Constrain the ABNF for so that each IP address can be represented in only one way. There are a number of ways this could be done. One solution is to disallow leading zero digits in all fields, require leading zero fields to be compressed, but otherwise mandate the x:x:x:x:x:x:d.d.d.d form be used, so for example, ::10.9.8.7 is okay but ::10.09.08.07 and 0:0:0:0:0:0:10.9.8.7 are not. This would clean up the equality matching, but the ordering relationship is still all wrong. Different constraints would enable sensible ordering matches but require less convenient representations of legacy IPv4 addresses. (1.C) Change the ASN.1 type corresponding to to IPAddress ::= OCTET STRING (SIZE(16)). The conceptual data type for IP addresses that directoryComponentsMatch operates on then becomes the address's 128 bit identifier. This implies a notional translation from the textual representation (the ABNF for an ACI doesn't change) into the 128 bit identifier before any comparison takes place. The default matching rule that directoryComponentsMatch applies to IPAddress component values will be octetStringMatch. These three ACI values will be equal because the corresponding 128 bit identifier is the same in each case according to octetStringMatch: grant:r#[all]#authnLevel:strong:ipAddress:::10.9.8.7 grant:r#[all]#authnLevel:strong:ipAddress:::10.09.08.07 grant:r#[all]#authnLevel:strong:ipAddress:0:0:0:0:0:0:10.9.8.7 Because of the change to the associated ASN.1, the binary representation of an ACI would contain IP addresses as their 128 bit identifiers regardless of the textual representation used in the LDAP string representation of the ACI value. It also means that if an ACI value is converted to the binary representation and then back into the LDAP string representation the textual representation of the IP addresses may change (e.g. the first ACI value above may come back looking like the third value). Also, component matching becomes more awkward because the textual representations cannot be used. To search for ACIs that contain a particular IP address I would have to use a filter like this: (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.machineSubject.ipAddress.*.single", rule octetStringMatch, value '0000000000000000000000000a090807'H }) It works but it isn't pretty. At least octetStringOrderingMatch conforms to the appropriate ordering relationship for IP addresses so componentFilterMatch can be used to find ACIs containing IP addresses greater than or less than an asserted value. (1.D) Derive a variant of directoryComponentsMatch that compares the textual representations of IP addresses in exactly the way we want. We can define an equality matching rule for IP address strings, let's call it ipAddressMatch, which simply evaluates to true if and only if the component value and assertion value represent the same 128 bit IPv6 address, regardless of the format in which they are presented. To make ipAddressMatch semantics apply when matching IP address fields of values of the entryACI and subtreeACI attributes the equality matching rule for these attributes has to be replaced with a variant of directoryComponentsMatch, let's call it aciMatch, which is just like directoryComponentsMatch except that it uses ipAddressMatch to compare IPAddress components. I've provided some text at the end of this message that shows how this would be written up in the ACM draft. These three ACI values will be equal according to aciMatch: grant:r#[all]#authnLevel:strong:ipAddress:::10.9.8.7 grant:r#[all]#authnLevel:strong:ipAddress:::10.09.08.07 grant:r#[all]#authnLevel:strong:ipAddress:0:0:0:0:0:0:10.9.8.7 If I want to search for ACIs that contain a particular IP address then this filter, (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.machineSubject.ipAddress.*.single", rule ipAddressMatch, value "::10.9.8.7" }) will find the ACIs with any valid representation of the IP address (e.g. ::10.9.8.7, ::10.09.08.07 and 0:0:0:0:0:0:10.9.8.7 will match each other). If we also define an ipAddressOrderingMatch that conforms to the necessary ordering relationship for IP addresses then componentFilterMatch can also be used to find ACIs containing IP addresses greater than or less than an asserted value. ---------------------------------------------------------------------------- --- 2) It isn't clear what sort of matching should apply to a in a subject. The ASN.1 type corresponding to in the ABNF for an ACI is UserID. UserID is defined to be a UTF8String in the -08 draft of the Access Control Model. A revised draft is expected to be submitted by Friday (20th) in which the corresponding ASN.1 type will have changed to OCTET STRING. There are pros and cons either way, but there is also an improved solution in the same style as (1.D). The is one form of authorization identity defined in RFC 2829 and is rendered as a UTF8 character string. RFC 2829 imposes no particular interpretation on the authorization identity strings. Whether, for example, "SMITH" and "smith" represent the same identity or different identities is a local implementation or deployment matter. Spaces in the identity strings may or may not be significant. If is mapped to an ASN.1 UTF8String directoryComponentsMatch will default to a caseIgnoreMatch of identities, possibly regarding two separate identities as the same identity. If is mapped to an ASN.1 OCTET STRING directoryComponentsMatch will default to an octet comparison of the identities, possibly failing to recognize two authorization identities as being the same. Here are the options. (2.A) Retain OCTET STRING as the ASN.1 type of UserID. This is the conservative approach. The disadvantage of having UserID defined as an OCTET STRING is that if I want to use componentFilterMatch to search for ACIs that contain a particular then I can only apply octetStringMatch to the UserID component, e.g. like so: (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.idBasedSubject.oneSubject.user", rule octetStringMatch, value '736D697468'H }) I can't use caseIgnore or caseExact equality, ordering or substrings rules. They are undefined on OCTET STRING components. (2.B) Change the ASN.1 type of UserID back to UTF8String. If a deployment uses case sensitive user IDs two ACIs that apply to completely different users can evaluate to equal. For example, these two ACIs would be equal: grant:r#[all]#authnLevel:strong:authzId-u:SMITH grant:r#[all]#authnLevel:strong:authzId-u:smith and so couldn't appear in the same entry. That presents a problem for managing ACIs if "SMITH" and "smith" are different users. The advantage of defining UserID as a UTF8String is that it is possible to use componentFilterMatch in a more convenient way to search for ACIs that contain a particular user ID, e.g. with a filter like this: (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.idBasedSubject.oneSubject.user", rule caseIgnoreMatch, value "smith" }) It is also possible to use ordering or substrings rules, and the caseExact counterparts of the caseIgnore rules. The client chooses between caseIgnore and caseExact matching to suit their deployment. (2.C) Derive a variant of directoryComponentsMatch that compares UTF8String UserID components character by character. UserID is defined to be a UTF8String again and we define an equality matching rule, let's call it characterStringMatch, which evaluates to true if and only if the attribute/component value and assertion value match exactly character by character. Letter case and all spaces are significant. If we aren't already doing so to implement (1.D), we define aciMatch as a variant of directoryComponentsMatch, to (additionally) compare UserID components using characterStringMatch. These two ACI values will not be equal according to aciMatch (the conservative approach): grant:r#[all]#authnLevel:strong:authzId-u:SMITH grant:r#[all]#authnLevel:strong:authzId-u:smith However, because UserID is a UTF8String it is possible to use filters like these: (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.idBasedSubject.oneSubject.user", rule caseIgnoreMatch, value "smith" }) (entryACI:componentFilterMatch:=item:{ component "subject.pureSubject.idBasedSubject.oneSubject.user", rule caseExactMatch, value "smith" }) ---------------------------------------------------------------------------- --- The easiest thing to do is just stay with the status quo, options (1.A) and (2.A), and accept their idiosyncracies. With regard to (1), IP address subjects should be discouraged anyway, so perhaps we shouldn't be too worried about how well they are matched. The solutions with the nicest all round properties are (1.D) and (2.C). What follows is the text that would be added to the Access Control Model draft to effect these changes. Then the only other changes that need to be made are to replace directoryComponentsMatch with aciMatch in the definitions for entryACI and subtreeACI, and to redefine the UserID ASN.1 type as a UTF8String. No changes to the ABNF would be required. ---------------------------------------------------------------------------- --- The LDAP definition for the aciMatch matching rule is: ( NAME 'aciMatch' SYNTAX 1.2.36.79672281.1.5.3 ) The aciMatch matching rule is derived from the directoryComponentsMatch matching rule in [DirCompMatch]. The derived matching semantics of aciMatch are defined by the following table, using the convention described in Section 7.2 of [DirCompMatch]. ASN.1 Type | Matching Rule ============+===================== UserID | characterStringMatch IPAddress | ipAddressMatch The LDAP definition for the characterStringMatch matching rule is: ( NAME 'characterStringMatch' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) The characterStringMatch rule evaluates to true if and only if the attribute or component value and the assertion value have the same number of characters and corresponding characters are the same. Letter case and whitespace characters are significant in the comparison. This matching rule may be applied to attribute or component values of the DirectoryString ASN.1 type, any of the ASN.1 restricted character string types, or their ASN.1 subtypes. The LDAP definition for the ipAddressMatch matching rule is: ( NAME 'ipAddressMatch' SYNTAX ) The ipAddressMatch rule evaluates to true if and only if the attribute or component value and the assertion value represent the same 128 bit IPv6 address identifier, regardless of the textual format in which they are presented. The LDAP definition for the IPAddress syntax is: ( DESC 'IPAddress' ) This syntax corresponds to the IPAddress ASN.1 type from Section 4.1.2. The LDAP string representation of attribute or assertion values in this syntax is described by the rule in Section 4.1.1. ---------------------------------------------------------------------------- --- Cast your votes ! Regards, Steven From list@netscape.com Thu Jul 19 11:17:34 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA20133 for ; Thu, 19 Jul 2001 11:17:32 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6JFGLB20161; Thu, 19 Jul 2001 08:16:21 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6JFGLk16618; Thu, 19 Jul 2001 08:16:21 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 08:16:21 -0700 (PDT) Message-Id: <5.0.2.1.0.20010719101356.00a63f18@popmail2.austin.ibm.com> X-Sender: stokes@popmail2.austin.ibm.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Thu, 19 Jul 2001 10:16:16 -0500 To: "Kurt D. Zeilenga" From: Ellen Stokes Subject: Re: prescriptive and subentry ACIs: draft-ietf-ldapext-acl-model-08.txt Cc: ietf-ldapext@netscape.com In-Reply-To: <5.1.0.14.0.20010718220231.02cf8900@127.0.0.1> References: <5.0.2.1.0.20010629105210.00a63688@popmail2.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"qSqmrD.A.3CE.DnvV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Kurt, The authors came to this conclusion last week (we just hadn't stated this on the mailing list yet) and in the next draft (09) all references and text to subentry (and its children) is being removed. We believe that this is beyond the scope of the document. Ellen At 10:12 PM 7/18/2001 -0700, Kurt D. Zeilenga wrote: >The draft says: > The following topics are deemed interesting and useful for > future work, but are also beyond the scope of this model: > - Use of prescriptive ACIs and scoping via use of a ldapACISubEntry > >and then goes on to describe ldapACISubentry. > >I suggest the above bullet be reworded: > - Specification of prescriptive ACIs [X.501] > >and then to drop all mention of ldapACIsubentry, ldapSubentry, >subentry, and references to the ldap subentry I-D. > >I also believe the document should note that subentry ACIs are >beyond the scope of the document. > >Kurt From list@netscape.com Thu Jul 19 11:30:57 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA24280 for ; Thu, 19 Jul 2001 11:30:56 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6JFT1B22491; Thu, 19 Jul 2001 08:29:01 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6JFT1I22110; Thu, 19 Jul 2001 08:29:01 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 08:29:01 -0700 (PDT) Message-Id: X-Mailer: Novell GroupWise Internet Agent 5.5.2.1 Date: Thu, 19 Jul 2001 09:29:02 -0600 From: "Ed Reed" To: Cc: , Subject: Re: LDAPSubentries comments review and request for last callby LDAPEXT and LDUP working groups Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6JFSxv22080 Resent-Message-ID: <"AfSofD.A.GZF.7yvV7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit Response: LDAP includes, by reference, X.500 subentries, including refinement. Just use them, if your applications require refinement. LDAPSubentries are intended to assist in representing policy information that doesn't require refinement as supported by X.500. Perhaps LDAPv3bis will clarify the LDAP representation of the X.500 subtreeSpecification, including the various chop semantics, and everyone will implement them as a result. Then the only obsticle will be getting test modules added to the Microsoft, Novell, Netscape, et al directory administrator certification test programs so there will be a prayer that they'll be used correctly by the 75,000 or so certified directory administrators out there in the real world. My personal view is that the subtreeSpecification is a neat piece of design that requires system administrators to view their application policy (ACI, Schema, whatever) as a collection of ropes created from multiple arbitrary threads connecting attributes and entries scattered throughout a tree (without intersecting or overlapping or leaving any attribute/entry unconnected). This multidimensional view is elegant, powerful, versitile, and pretty totally without the computational tools needed to inspect, modify, or test whether the refinements expressed actually relate in any interesting way to the policy the administrator had in mind when they started refining their policy. SubtreeSpecifications appear to be an interesting implementation mechanism for representing complex policy. Unfortunately, the current state of the market place is that developers, who can walk through the code in their minds to figure out what a thing will do, too often assume that everyone else can do that, too. Frankly, I've had enough trouble explaining (over and over and over again) to information technology consumers why "relational databases aren't just as good" as hierarchical tree structures for distributed management policy representation. Now you want to get them thinking multidimensionally, too? Crawl, walk, run - a lesson taught by real world experience, and addressed to developers of products, consumers of those products, and the executive managers of those consumers. Technologists who put forward elegant, powerful, versitile and uninspectable solutions find, in the mass market, that they're also unpredictable because they'll be used in the wildest, most amusing ways. I recommend we not go there. If the concensus of the group is that we must, then I think we need to seriously reconsider the advisability of taking LDAPv3bis forward, and realize that we all should just adopt X.500 in its entirity. Kurt and Albert have been correct in their assertions that LDAP isn't a distributed service, we're turning it into one by pieces, and the X.500 design (if we need the whole refinement thing, then we probably need the whole HOB thing as well, and if we do that, then what's left not to put into LDAPv3bis?) should be tried instead. If you can get Microsoft and Novell to go there, that is... I for one don't want to encourage LDAP customers to use refinement in ACI, nor to experiment with multimaster replication from sparse and fractional replicas. I think there's a world of applications (like non-global, in-the-tree schema management), in the distributed management world, that do not require that kind of power to be put into consumers hands to use to shoot themselves in the foot. But, if the number of customer support phone calls resulting from having hundreds of thousands of directory administrators trying to figure out why their highly refined policy doesn't behave "the way they thought it would" is a satisfactory definition of success, then go for it! I'll ask the chairs to decide the concensus of the working group. Ed ================= Ed Reed Reed-Matthews, Inc. +1 801 796 7065 http://www.Reed-Matthews.COM >>> "Kurt D. Zeilenga" 07/18/01 10:53PM >>> At 12:24 PM 7/16/2001, Ed Reed wrote: >So - I'd like more comments on the administrative model. Does it work for ACI as LDAPEXT is defining it? Other applications than just LDUP? I think it DOES work for LDUP (ie, managing replication areas). I don't think it works for access controls, subschema, collective attributes, and likely not for LDUP (consider sparse replica). Of course, my definition of "works" may be quite different than yours. ldapSubentry can only hold information associated with a subtree. ldapSubentry, by design, cannot hold information associated with a subtree refinement [X.501]. Consider a case where the administrator wishes to hold a set of shared attributes for the collection of entries which are immediately subordinate to a particular entry (but not the particular entry). This cannot be done using LDAPsubentries as LDAPsubentries requires that each subordinate have a separate subentry to hold the attributes. As these attributes are held in different subentries, they are not shared. And further subentries need to be created to break the inheritance (as the information was to be shared between the immediate subordinates). And, of course, needed subordinates are not automatically created/deleted upon add, delete, and rename. I believe there is good operational experience from the X.500 community that a subentry subtree refinement mechanism is needed to allow for effective administration of the Directory. I recommend we adapt X.500 subentries, including the subtree specification mechanism, for use with LDAP. Kurt From list@netscape.com Thu Jul 19 20:47:33 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA11562 for ; Thu, 19 Jul 2001 20:47:33 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6K0k0B12685; Thu, 19 Jul 2001 17:46:00 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6K0k0g06832; Thu, 19 Jul 2001 17:46:00 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 17:46:00 -0700 (PDT) Message-Id: <5.1.0.14.0.20010719091823.0293c000@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Thu, 19 Jul 2001 17:40:52 -0700 To: "Ed Reed" From: "Kurt D. Zeilenga" Subject: Re: LDAPSubentries comments review and request for last callby LDAPEXT and LDUP working groups Cc: , In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"nOUS1C.A.YqB.H93V7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com At 08:29 AM 7/19/2001, Ed Reed wrote: >LDAP includes, by reference, X.500 subentries, including refinement Then why are we wasting our time with LDAPsubentries? X.500 subentries provides a sound approach, an approach proven to work for holding subschema, ACIs, and collective attributes. We certainly don't need an second approach, especially one which is inconsistent with the X.500 data model which implementations "MUST act in accordance with." Kurt From list@netscape.com Thu Jul 19 21:54:06 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA04445 for ; Thu, 19 Jul 2001 21:54:05 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6K1pKv17254; Thu, 19 Jul 2001 18:51:20 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6K1pLg29153; Thu, 19 Jul 2001 18:51:21 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 18:51:21 -0700 (PDT) From: <9vUQS25B9@home.com> Subject: Money Making Package Date: Thu, 19 Jul 2001 17:14:52 Message-Id: <69.33377.320539@server> Resent-Message-ID: <"NYuhPB.A.HHH.X64V7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Dear Friends & Future Millionaire: AS SEEN ON NATIONAL TV: Making over half million dollars every 4 to 5 months from your home for an investment of only $25 U.S. Dollars expense one time THANK'S TO THE COMPUTER AGE AND THE INTERNET ! ================================================== BE A MILLIONAIRE LIKE OTHERS WITHIN A YEAR!!! Before you say ''Bull'', please read the following. This is the letter you have been hearing about on the news lately. Due to the popularity of this letter on the Internet, a national weekly news program recently devoted an entire show to the investigation of this program described below, to see if it really can make people money. The show also investigated whether or not the program was legal. Their findings proved once and for all that there are ''absolutely NO Laws prohibiting the participation in the program and if people can -follow the simple instructions, they are bound to make some mega bucks with only $25 out of pocket cost''. DUE TO THE RECENT INCREASE OF POPULARITY & RESPECT THIS PROGRAM HAS ATTAINED, IT IS CURRENTLY WORKING BETTER THAN EVER. This is what one had to say: ''Thanks to this profitable opportunity. I was approached many times before but each time I passed on it. I am so glad I finally joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received total $610,470.00 in 21 weeks, with money still coming in." Pam Hedland, Fort Lee, New Jersey. ================================================== Here is another testimonial: "This program has been around for a long time but I never believed in it. But one day when I received this again in the mail I decided to gamble my $25 on it. I followed the simple instructions and walaa ..... 3 weeks later the money started to come in. First month I only made $240.00 but the next 2 months after that I made a total of $290,000.00. So far, in the past 8 months by re-entering the program, I have made over $710,000.00 and I am playing it again. The key to success in this program is to follow the simple steps and NOT change anything.'' More testimonials later but first, ===== PRINT THIS NOW FOR YOUR FUTUREREFERENCE ====== $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you would like to make at least $500,000 every 4 to 5 months easily and comfortably, please read the following...THEN READ IT AGAIN and AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ FOLLOW THE SIMPLE INSTRUCTION BELOW AND YOUR FINANCIAL DREAMS WILL COME TRUE, GUARANTEED! INSTRUCTIONS: =====Order all 5 reports shown on the list below ===== For each report, send $5 CASH, THE NAME & NUMBER OF THE REPORT YOU ARE ORDERING and YOUR E-MAIL ADDRESS to the person whose name appears ON THAT LIST next to the report. MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE TOP LEFT CORNER in case of any mail problems. === When you place your order, make sure you order each of the 5 reports. You will need all 5 reports so that you can save them on your computer and resell them. YOUR TOTAL COST $5 X 5=$25.00. Within a few days you will receive, via e-mail, each of the 5 reports from these 5 different individuals. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. Also make a floppy of these reports and keep it on your desk in case something happen to your computer. IMPORTANT - DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than what is instructed below in step '' 1 through 6 '' or you will loose out on majority of your profits. Once you understand the way this works, you will also see how it does not work if you change it. Remember, this method has been tested, and if you alter, it will NOT work !!! People have tried to put their friends/relatives names on all five thinking they could get all the money. But it does not work this way. Believe us, we all have tried to be greedy and then nothing happened. So Do Not try to change anything other than what is instructed. Because if you do, it will not work for you. Remember, honesty reaps the reward!!! 1.... After you have ordered all 5 reports, take this advertisement and REMOVE the name & address of the person in REPORT # 5. This person has made it through the cycle and is no doubt counting their fortune. 2.... Move the name & address in REPORT # 4 down TO REPORT # 5. 3.... Move the name & address in REPORT # 3 down TO REPORT # 4. 4.... Move the name & address in REPORT # 2 down TO REPORT # 3. 5.... Move the name & address in REPORT # 1 down TO REPORT # 2 6.... Insert YOUR name & address in the REPORT # 1 Position. PLEASE MAKE SURE you copy every name & address ACCURATELY! ========================================================== **** Take this entire letter, with the modified list of names, and save it on your computer. DO NOT MAKE ANY OTHER CHANGES. Save this on a disk as well just in case if you loose any data. To assist you with marketing your business on the internet, the 5 reports you purchase will provide you with invaluable marketing information which includes how to send bulk e-mails legally, where to find thousands of free classified ads and much more. There are 2 Primary methods to get this venture going: METHOD # 1: BY SENDING BULK E-MAIL LEGALLY ========================================================== Let's say that you decide to start small, just to see how it goes, and we will assume You and those involved send out only 5,000 e-mails each. Let's also assume that the mailing receive only a 0.2% response (the response could be much better but lets just say it is only 0.2%. Also many people will send out hundreds of thousands e-mails instead of only 5,000 each). Continuing with this example, you send out only 5,000 e-mails. With a 0.2% response, that is only 10 orders for report # 1. Those 10 people responded by sending out 5,000 e-mail each for a total of 50,000. Out of those 50,000 e-mails only 0.2% responded with orders. That's=100 people responded and ordered Report # 2 . Those 100 people mail out 5,000 e-mails each for a total of 500,000 e-mails. The 0.2% response to that is 1000 orders for Report # 3. Those 1000 people send out 5,000 e-mails each for a total of 5 million e-mails sent out. The 0.2% response to that is 10,000 orders for Report # 4. Those 10,000 people send out 5,000 e-mails each for a total of 50,000,000 (50 million) e-mails. The 0.2% response to that is 100,000 orders for Report # 5 THAT'S 100,000 ORDERS TIMES $5 EACH=$500,000.00 (half million). Your total income in this example is: 1..... $50 + 2..... $500 + 3..... $5,000 + 4 ... $50,000 + 5..... $500,000 ........ Grand Total=$555,550.00 NUMBERS DO NOT LIE. GET A PENCIL & PAPER AND FIGUREOUT THE WORST POSSIBLE RESPONSES AND NO MATTER HOW YOU CALCULATE IT, YOU WILL STILL MAKE A LOT OF MONEY ========================================================= REMEMBER FRIEND, THIS IS ASSUMING ONLY 10 PEOPLE ORDERING OUT OF 5,000 YOU MAILED TO. Dare to think for a moment what would happen if everyone or half or even one 4th of those people mailed 100,000 e-mails each or more? There are over 150 million people on the Internet worldwide and counting. Believe me, many people will do just that, and more! METHOD # 2 : BY PLACING FREE ADS ON THE INTERNET Advertising on the net is very very inexpensive and there are hundreds of FREE places to advertise. Placing a lot of free ads on the Internet will easily get a larger response. We strongly suggest you start with Method # 1 and METHOD # 2 as you go along. For every $5 you receive, all you must do is e-mail them the Report they ordered. That's it. Always provide same day service on all orders. This will guarantee that the e-mail they send out, with your name and address on it, will be prompt because they can not advertise until they receive the report. =========== AVAILABLE REPORTS ==================== ORDER EACH REPORT BY ITS NUMBER & NAME ONLY. Notes: Always send $5 cash (U.S. CURRENCY) for each Report. Checks NOT accepted. Make sure the cash is concealed by wrapping it in at least 2 sheets of paper. On one of those sheets of paper, Write the NUMBER & the NAME of the Report you are ordering, YOUR E-MAIL ADDRESS and your name and postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW : REPORT # 1: "The Insider's Guide to Advertising for Free on the Net" Order Report #1 from: Kris Kamenz 248 Forrest Avenue Winnipeg, MB R2V 1K1 Canada REPORT # 2: "The Insider's Guide to Sending Bulk e-mail on the Net" Order Report # 2 from: Anthony J. Ciervo 3340 Emerald Blvd Long Pond, PA 18334 USA ____________________________________________________________ REPORT # 3: "Secret to Multilevel Marketing on the Net" Order Report # 3 from : Michael P. 2508 Robin Altus, OK 73521 USA __________________________________________________________ REPORT # 4: "How to Become a Millionaire Utilizing MLM & the Net" Order Report # 4 from: D. J. 16 Northcrest Dr. London, ONTARIO, CANADA N5X 3V8 ____________________________________________________________ REPORT #5: "How to Send Out 0ne Million e-mails for Free" Order Report # 5 from: E. Zurbrigg RR #1 St. Marys, ON, Canada N4X 1C4 ____________________________________________________________ $$$$$$$$$ YOUR SUCCESS GUIDELINES $$$$$$$$$$$ Follow these guidelines to guarantee your success: === If you do not receive at least 10 orders for Report #1 within 2 weeks, continue sending e-mails until you do. === After you have received 10 orders, 2 to 3 weeks after that you should receive 100 orders or more for REPORT # 2. If you did not, continue advertising or sending e-mails until you do. === Once you have received 100 or more orders for Report # 2, YOU CAN RELAX, because the system is already working for you, and the cash will continue to roll in ! THIS IS IMPORTANT TO REMEMBER: Every time your name is moved down on the list, you are placed in front of a Different report. > You can KEEP TRACK of your PROGRESS by watching which report people are ordering from you. IF YOU WANT TO GENERATE MORE INCOME SEND ANOTHER BATCH OF E-MAILS AND START THE WHOLE PROCESS AGAIN. There is NO LIMIT to the income you can generate from this business !!! ====================================================== FOLLOWING IS A NOTE FROM THE ORIGINATOR OF THIS PROGRAM: You have just received information that can give you financial freedom for the rest of your life, with NO RISK and JUST A LITTLE BIT OF EFFORT. You can make more money in the next few weeks and months than you have ever imagined. Follow the program EXACTLY AS INSTRUCTED. Do Not change it in any way. It works exceedingly well as it is now. Remember to e-mail a copy of this exciting report after you have put your name and address in Report #1 and moved others to #2 ...........# 5 as instructed above. One of the people you send this to may send out 100,000 or more e-mails and your name will be on every one of them. Remember though, the more you send out the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent. IT IS UP TO YOU NOW ! ============ MORE TESTIMONIALS ================ "My name is Mitchell. My wife, Jody and I live in Chicago. I am an accountant with a major U.S. Corporation and I make pretty good money. When I received this program I grumbled to Jody about receiving ''junk mail''. I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I ''knew'' it wouldn't work. Jody totally ignored my supposed intelligence and few days later she jumped in with both feet. I made merciless fun of her, and was ready to lay the old ''I told you so'' on her when the thing didn't work. Well, the laugh was on me! Within 3 weeks she had received 50 responses. Within the next 45 days she had received total $ 147,200.00 ........... all cash! I was shocked. I have joined Jody in her ''hobby''. Mitchell Wolf M.D., Chicago, Illinois ====================================================== ''Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back''. '' I was surprised when I found my medium size post office box crammed with orders. I made $319,210.00 in the first 12 weeks. The nice thing about this deal is that it does not matter where people live. There simply isn't a better investment with a faster return and so big." Dan Sondstrom, Alberta, Canada ''I had received this program before. I deleted it, but later I wondered if I should have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed again by someone else.........11 months passed then it luckily came again...... I did not delete this one! I made more than $490,000 on my first try and all the money came within 22 weeks." Susan De Suza, New York, N.Y. ''It really is a great opportunity to make relatively easy money with little cost to you. I followed the simple instructions carefully and within 10 days the money started to come in. My first month I made $20,560.00 and by the end of third month my total cash count was $362,840.00. Life is beautiful, Thanx to internet.". Fred Dellaca, Westport, New Zealand ======================================================= ORDER YOUR REPORTS TODAY AND GET STARTED ON 'YOUR' ROAD TO FINANCIAL FREEDOM ======================================================= If you have any questions of the legality of this program, contact the Office of Associate Director for Marketing Practices, Federal Trade Commission, Bureau of Consumer Protection, Washington, D.C. (Note: To avoid delays make sure appropriate postage to Canada is applied if mailing from the US) This is a one time mailing no need to be removed! From list@netscape.com Thu Jul 19 22:16:24 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA12237 for ; Thu, 19 Jul 2001 22:16:24 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6K2EoB26663; Thu, 19 Jul 2001 19:14:50 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6K2Epc06929; Thu, 19 Jul 2001 19:14:51 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 19:14:51 -0700 (PDT) Message-Id: X-Mailer: Novell GroupWise Internet Agent 5.5.2.1 Date: Thu, 19 Jul 2001 20:14:39 -0600 From: "Ed Reed" To: Cc: , Subject: Re: LDAPSubentries comments review and request for last callbyLDAPEXT and LDUP working groups Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6K2Emv06899 Resent-Message-ID: <"v4sOWD.A.5rB.YQ5V7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit I think I answered that - because the X.500 refinement mechanism is too complex to be easily understood, configured, or implemented, much less managed. A profile of a simpler thing is needed for many applications. ================= Ed Reed Reed-Matthews, Inc. +1 801 796 7065 http://www.Reed-Matthews.COM >>> "Kurt D. Zeilenga" 07/19/01 06:40PM >>> At 08:29 AM 7/19/2001, Ed Reed wrote: >LDAP includes, by reference, X.500 subentries, including refinement Then why are we wasting our time with LDAPsubentries? X.500 subentries provides a sound approach, an approach proven to work for holding subschema, ACIs, and collective attributes. We certainly don't need an second approach, especially one which is inconsistent with the X.500 data model which implementations "MUST act in accordance with." Kurt From list@netscape.com Thu Jul 19 22:48:04 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA25248 for ; Thu, 19 Jul 2001 22:48:03 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6K2kNB29387; Thu, 19 Jul 2001 19:46:27 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6K2kNY13985; Thu, 19 Jul 2001 19:46:23 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 19:46:23 -0700 (PDT) Message-Id: <200107201413.JAA04902@cocain.cocain.org> From: "Judy" Subject: Accepting credit cards was never easier To: business@cocain.cocain.org Date: Thu, 19 Jul 2001 20:52:09 -0500 X-Mailer: Microsoft Outlook Express 4.72.1712.3 X-MimeOLE: Produced By Microsoft MimeOLE Vdiffondi.1712.3 Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_007F_01BDF6C7.FABAC1B0" Content-Transfer-Encoding: 7bit Resent-Message-ID: <"3FpgG.A.-ZD.9t5V7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a MIME Message ------=_NextPart_000_007F_01BDF6C7.FABAC1B0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0080_01BDF6C7.FABAC1B0" ------=_NextPart_001_0080_01BDF6C7.FABAC1B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FREE Computer With Merchant Account Setup COMPLETE CREDIT CARD PROCESSING SYSTEMS FOR YOUR BUSINESS=2E INTERNET - HOME BASED - MAIL ORDER - PHONE ORDER Do you accept credit cards? Your competition does! Everyone Approved - Credit Problems OK! Approval in less than 24 hours! Increase your sales by 300% Start Accepting Credit Cards on your website! Free Information, No Risk, 100% confidential=2E Your name and information will not be sold to thrid parties! Home Businesses OK! Phone/Mail Order OK! No Application Fee, No Setup Fee! Close More Impulse Sales! Everyone Approved! Good Credit or Bad! To apply today, please fill out the express form below=2E It contains all the information we need to get your account approved=2E For area's that do not apply to you please put "n/a" in the box=2E Upon receipt, we'll fax you with all of the all Bank Card Application documents necessary to establish your Merchant Account=2E Once returned we can have your account approved within 24 hours=2E Service Industry Standard US Site Inspection $50 - $75 FREE Shipping $50 - $75 FREE Warranty $10 Per Month FREE Sales Receipts $10 - $50 FREE Fraud Screening $=2E50 - $1=2E00 Per Transaction FREE Amex Set Up $50 - $75 FREE 24 Hour Help Line $10 Month FREE Security Bond $5000- $10,000 Or More NONE This is a No Obligation Qualification Form and is your first step to accepting credit cards=2E By filling out this form you will "not enter" in to any obligations or contracts with us=2E We will use it to determine the best program to offer you based on the information you provide=2E You will be contacted by one of our representatives within 1-2 business days to go over the rest of your account set up=2E Note: All Information Provided To Us Will Remain 100% Confidential !! Apply Free With No Risk! Please fill out the express application form completely=2EIncomplete information may prevent us from properly processing your application=2E Your Full Email Address: be sure to use your full address (i=2Ee=2E user@domain=2Ecom) Your Name: Business Name: Business Phone Number: Home Phone Number: Type of Business: Retail Business Mail Order Business Internet Based Business Personal Credit Rating: Excellent Good Fair Poor How Soon Would You Like a Merchant Account? Your information is confidential, it will not be sold or used for any other purpose, and you are under no obligation=2E Your information will be used solely for the purpose of evaluating your business or website for a merchant account so that you may begin accepting credit card payments=2E List Removal/OPT-OUT Option Click Here ------=_NextPart_001_0080_01BDF6C7.FABAC1B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable FREE Computer With Merchant Account Setup

COMPLETE CREDIT CARD PROCESSING SYSTEMS FOR YOUR BUSINESS=2E INTERNE= T - HOME BASED - MAIL ORDER - PHONE ORDER

Do you accept credit cards? Your competition does!

Everyone Approved - Credit Problems OK!
Approval in less than 24 hours!
Increase your sales by 300%
Start Accepting Credit Cards on your website!
Free Information, No Risk, 100% confidential=2E
Your name and information will not be sold to thrid parties!
Home Businesses OK! Phone/Mail Order OK!
No Application Fee, No Setup Fee!
Close More Impulse Sales!

Everyone Approved!

Good Credit or Bad! To= apply today, please fill out the express form below=2E It contains all the information we need to get your account approved=2E For a= rea's that do not apply to you please put "n/a" in the box=2E

Upon receipt, we'll fax you with all of the all Bank Card Application documents necessary to establish your Merchant Account=2E Once returned we= can have your account approved within 24 hours=2E

Service	Industry Standard	US
Site Inspection	$50 - $75	FREE
Shipping	$50 - $75	FREE
Warranty	$10 Per Month=	FREE
Sales Receipts	$10 - $50&nbs= p;	FREE
Fraud Screening	$=2E50 - $1=2E00 Per Transaction	FREE
Amex Set Up	$50 - $75	FREE
24 Hour Help Line	$10 Month	FREE
Security Bond	$5000- $10,00= 0 Or More	NONE

This is a No Obligation Qualification Form and is your first step to accepting credit cards=2E By filling out this form you will= "not enter" in to any obligations o= r contracts with us=2E We will use it to determine the best p= rogram to offer you based on the information you provide=2E You will be c= ontacted by one of our representatives within 1-2 business days to go over = the rest of your account set up=2E

<= font color=3D"#cc0000">Note: All Information Provided To Us Will Remain= 100% Confidential !!

Apply Free With No Risk!

Pleas= e fill out the express application form completely=2E
Incomplete information m= ay prevent us from properly processing your application=2E

Your Full Emai= l Address:
be sure to use your full address (i= =2Ee=2E user@domain=2Ecom)

Your Name:

Business Name:=

Business Phone= Number:

Home Phone Num= ber:

Type of Busine= ss:

	Retail Business
	Mail Order Business
	Internet Based Busines= s

Personal Credi= t Rating:

	Excellent
	Good
	Fair
	Poor

How Soon Would= You Like a Merchant Account?

List Removal/OPT-OUT Option
Click Here ------=_NextPart_001_0080_01BDF6C7.FABAC1B0-- ------=_NextPart_000_007F_01BDF6C7.FABAC1B0-- From list@netscape.com Fri Jul 20 00:12:39 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id AAA21937 for ; Fri, 20 Jul 2001 00:12:38 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6K4BAB05710; Thu, 19 Jul 2001 21:11:11 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6K4BBg03192; Thu, 19 Jul 2001 21:11:11 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 21:11:11 -0700 (PDT) Reply-To: From: "Steven Legg" To: "'Kurt D. Zeilenga'" , "'Ed Reed'" Cc: , Subject: RE: LDAPSubentries comments review and request for last callby LDAPEXT and LDUP working groups Date: Fri, 20 Jul 2001 14:11:19 +1000 Message-ID: <007c01c110d2$07dee7f0$b05508cb@osmium.adacel.com.au> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2120.0 In-Reply-To: <5.1.0.14.0.20010719091823.0293c000@127.0.0.1> Resent-Message-ID: <"Si4OZC.A.gx.d96V7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Kurt D. Zeilenga wrote: > At 08:29 AM 7/19/2001, Ed Reed wrote: > >LDAP includes, by reference, X.500 subentries, including refinement > > Then why are we wasting our time with LDAPsubentries? > X.500 subentries provides a sound approach, an approach > proven to work for holding subschema, ACIs, and collective > attributes. We certainly don't need an second approach, > especially one which is inconsistent with the X.500 data > model which implementations "MUST act in accordance with." I agree. I would be very happy for the LDAP subentry model to be a proper subset of the X.500 administrative model since I already support the X.500 model through LDAP. Having to duplicate that functionality in a slightly different way for LDAP would be irksome, and the prospect of having to support two subschema subentries in each subschema area in the DIT, one conforming to X.500 and one conforming to LDAP, does not fill me with joy. The X.500 working group has a current work item for X.500 - LDAP alignment. If we ask them nicely I'm sure they will modify the subentry definitions to be more amenable to some of the uses being proposed for LDAP. For example, the requirement in X.501 that subentries "shall not have subordinates" could be relaxed to "may only have subentries as subordinates". Adding a requirement that subentries with the subschema, collectiveAttributeSubentry, accessControlSubentry, etc, auxiliary object classes must be immediately subordinate to an administration point entry assures backward compatibility with current uses of subentries while enabling subentry hierarchies for new subentry auxiliary classes defined for LDAP. Regards, Steven > > Kurt > > > From list@netscape.com Fri Jul 20 01:35:11 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA20107 for ; Fri, 20 Jul 2001 01:35:10 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6K5XiB11824; Thu, 19 Jul 2001 22:33:44 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6K5Xj622391; Thu, 19 Jul 2001 22:33:45 -0700 (PDT) Resent-Date: Thu, 19 Jul 2001 22:33:45 -0700 (PDT) Reply-To: From: "Steven Legg" To: "'Ed Reed'" , Cc: , Subject: RE: LDAPSubentries comments review and request for lastcallbyLDAPEXT and LDUP working groups Date: Fri, 20 Jul 2001 15:33:59 +1000 Message-ID: <007d01c110dd$94ab0fa0$b05508cb@osmium.adacel.com.au> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2120.0 In-Reply-To: Resent-Message-ID: <"Ur4-fC.A.ddF.2K8V7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Ed, Ed Reed wrote: > I think I answered that - because the X.500 refinement mechanism > is too complex to be easily understood, configured, or implemented, > much less managed. A profile of a simpler thing is needed for many > applications. Complexity is a relative thing. I find the subtree refinement mechanism much easier to get my head around than the LDAP access control model. Anyway, what's the problem with writing a profile for the use of subtree specifications in LDAP that restricts the possible forms (to one even!) ? The only proposal I've ever been able to find for an LDAP string representation of subtree specifications is the long expired draft-ietf-asid-ldapv3-attributes-03.txt. With this proposal, the simplest specification is "(####)", which means "the whole subtree". Can't new subentry classes for LDAP simply require the subtree specification to be exactly this ? Since there isn't a normative reference for the LDAP string representation of subtree specifications I would rather that the string encoding be defined algorithmically from the ASN.1, i.e. using the generic string encoding rules from my component matching draft. With those rules the whole subtree specification is just "{}". An overt description of the LDAP string representation of subtree specifications could just mention this form for the unwashed masses, while for those who need to use it for X.500 interworking, or want to experiment with it in LDAP, there is a deduceable ABNF for more refined subtree specifications. Regards, Steven > > ================= > Ed Reed > Reed-Matthews, Inc. > +1 801 796 7065 > http://www.Reed-Matthews.COM > > >>> "Kurt D. Zeilenga" 07/19/01 06:40PM >>> > > At 08:29 AM 7/19/2001, Ed Reed wrote: > >LDAP includes, by reference, X.500 subentries, including refinement > > Then why are we wasting our time with LDAPsubentries? > X.500 subentries provides a sound approach, an approach > proven to work for holding subschema, ACIs, and collective > attributes. We certainly don't need an second approach, > especially one which is inconsistent with the X.500 data > model which implementations "MUST act in accordance with." > > Kurt > > > > From list@netscape.com Fri Jul 20 06:03:59 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id GAA15073 for ; Fri, 20 Jul 2001 06:03:59 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6KA2Xv25864; Fri, 20 Jul 2001 03:02:33 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6KA2X619780; Fri, 20 Jul 2001 03:02:33 -0700 (PDT) Resent-Date: Fri, 20 Jul 2001 03:02:33 -0700 (PDT) Sender: Ludovic.Poitou@Sun.com Message-ID: <3B5801B2.D3F463CD@Sun.com> Date: Fri, 20 Jul 2001 12:02:26 +0200 From: Ludovic Poitou Organization: Sun Microsystems Inc. X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: internet-drafts@ietf.org CC: ggood@loudcloud.com, ietf-ldapext@netscape.com, mcs@netscape.com, ietf-ldup@imc.org Subject: update to draft-good-ldap-changelog-01.txt Content-Type: multipart/mixed; boundary="------------454482E795D1A8680588F9A5" Resent-Message-ID: <"s-UijC.A.q0E.3GAW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a multi-part message in MIME format. --------------454482E795D1A8680588F9A5 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Internet-Drafts Editors, Please publish draft-good-ldap-changelog-02.txt as an update to draft-good-ldap-changelog-01.txt LDAPExt and LDUP working groups, This is a re-publication of the now expired "draft-good-ldap-changelog-01.txt", with no updates in the content. The goal is to have the document moved to Informational status. I look forward to any input & insight the WGs can provide. Thank you and best regards, Ludovic. -- Ludovic Poitou Sun Microsystems Inc. iPlanet E-Commerce Solutions - Directory Group - Grenoble - France --------------454482E795D1A8680588F9A5 Content-Type: text/plain; charset=iso-8859-1; name="draft-good-ldap-changelog-02.txt" Content-Disposition: inline; filename="draft-good-ldap-changelog-02.txt" Content-Transfer-Encoding: quoted-printable INTERNET-DRAFT Gordon Good draft-good-ldap-changelog-02.txt Loudcloud Intended Category: Informational Ludovic Poitou Sun Microsystems 19 July 2001 Definition of an Object Class to Hold LDAP Change Records Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet- Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet Draft expires 19 January 2002. Abstract In order to support more flexible replication methods, it is desirable to specify some manner in which an LDAP client may retrieve a set of changes which have been applied to an LDAP server's database. The client, which may be another LDAP server, may then choose to update its own replicated copy of the data. This document specifies an object class which may be used to represent changes applied to an LDAP server. It also specifies a method for discovering the location of the container object which holds these change records, so that clients and servers have a common rendezvous point for this information. Background and Intended Usage This document describes an objectclass which can be used to represent changes which have been applied to a directory server. It also suggests a common location for a container which holds these objects. Good Expires 19 January 2002 [Page 1] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 A client may update its local copy of directory information by reading the entries within this container, and applying the changes to its local database. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119 [3]. New Attribute Types Used in the changeLogEntry Object Class ( 2.16.840.1.113730.3.1.5 NAME 'changeNumber' DESC 'a number which uniquely identifies a change made to a directory entry' SYNTAX 'INTEGER' EQUALITY 'integerMatch' ORDERING 'integerOrderingMatch' ) ( 2.16.840.1.113730.3.1.6 NAME 'targetDN' DESC 'the DN of the entry which was modified' EQUALITY distinguishedNameMatch SYNTAX 'DN' ) ( 2.16.840.1.113730.3.1.7 NAME 'changeType' DESC 'the type of change made to an entry' EQUALITY caseIgnoreMatch SYNTAX 'DirectoryString' ) ( 2.16.840.1.113730.3.1.8 NAME 'changes' DESC 'a set of changes to apply to an entry' SYNTAX 'OctetString' ) ( 2.16.840.1.113730.3.1.9 NAME 'newRDN' DESC 'the new RDN of an entry which is the target of a modrdn operation' EQUALITY distinguishedNameMatch SYNTAX 'DN' ) ( 2.16.840.1.113730.3.1.10 NAME 'deleteOldRDN' DESC 'a flag which indicates if the old RDN should be retained as an attribute of the entry' EQUALITY booleanMatch SYNTAX 'BOOLEAN' ) Good Expires 19 January 2002 [Page 2] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 ( 2.16.840.1.113730.3.1.11 NAME 'newSuperior' DESC 'the new parent of an entry which is the target of a moddn operation' EQUALITY distinguishedNameMatch SYNTAX 'DN' ) Schema Definition of the changeLogEntry Object Class ( 2.16.840.1.113730.3.2.1 NAME 'changeLogEntry' SUP top STRUCTURAL MUST ( changeNumber $ targetDN $ changeType ) MAY ( changes $ newRDN $ deleteOldRDN $ newSuperior ) ) Discussion of changeLogEntry Attributes: changeNumber: the change number, as assigned by the supplier. This integer MUST strictly increase as new entries are added, and must always be unique within a given server. Syntax: INTEGER targetdn: the distinguished name of the entry which was added, modified or deleted. In the case of a modrdn operation, the targetdn gives the DN of the entry before it was modified. Syntax: DN changeType: the type of change. One of: "add", "delete", "modify", "modrdn". Later RFCs may define additional values for changeType. Syntax: DirectoryString changes: the changes which were made to the directory server. These changes are in LDIF format, which is described in [1]. Syntax: OctetString newRDN: the new RDN (Relative Distinguished Name) of the entry, if the= changeType is "modrdn". If the changeType attribute does not have the= value "modrdn", then there should be no values contained in the newRDN= attribute. Syntax: DN Good Expires 19 January 2002 [Page 3] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 deleteOldRDN: a flag which tells whether the old RDN of the entry should be retained as a distinguished attribute of the entry, or should be deleted. A value of "FALSE" indicates that the RDN should b= e retained as a distinguished attribute, and a value of "TRUE" indicates= that it should not be retained as a distinguished attribute of the entry. If any value other than "TRUE" or "FALSE" is contained in the deleteOldRDN attribute, or if the deleteOldRDN contains multiple values, the RDN should be retained as a distinguished attribute (that is, "FALSE" is the default if no values are present, or if illegal values are present). Syntax: BOOLEAN newSuperior: if present, gives the name of the entry which becomes the immediate superior of the existing entry. This optional attribute reflects LDAPv3 functionality, and MUST NOT be generated by LDAPv2 servers [2]. Syntax: DN Discussion of the changeLogEntry object class The changeLogEntry object class is used to represent changes made to a= directory server. The set of changes made to a directory server, then= , is given by the ordered set of all entries within the changelog container, ordered by changeNumber. A client may synchronize its local copy of a remote directory server's= contents by searching the remote server's changelog container for any entries where the changenumber is greater than or equal to the last change previously retrieved from that server. If the entry with the changenumber matching the last change retrieved is not returned in the= search results, then the server's changelog has been trimmed. The client must then fall back to reading the entire directory to bring it= s copy in sync with the server's. Assuming that the client has successfully retrieved one or more change= log entries from the server, it can then use the information contained in = each entry to update the corresponding entry (named by the targetDN attribu= te) in its local copy of the database. Note that, due to access control restrictions, the client is not guara= nteed read access to the "changes" attribute. If the client discovers that = the "changes" attribute has no values, then it must read the entry given b= y the targetDN attribute, possibly only retrieving attributes it deems "interesting". However, in the case of delete and modrdn operations, = there is never a "changes" attribute, so it is never necessary to read the t= arget entry in these cases. Good Expires 19 January 2002 [Page 4] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 Examples of the changeLogEntry object class In each example below, the "changes" attribute is shown in plain text,= with embedded newlines. This is done for clarity. It is intended tha= t newlines be stored in the entry literally, not encoded in any way. If a "changes" attribute value is stored in an LDIF file, it must base-64 encoded. Example 1: A changeLogEntry representing the addition of a new entry to the directory dn: changenumber=3D1923, cn=3Dchangelog changenumber: 1923 targetdn: cn=3DBarbara Jensen, ou=3DAccounting, o=3DAce Industry, c=3D= US changetype: add changes: cn: Barbara Jensen\ncn: Babs Jensen\nsn: Jensen\n givenname: Barbara\ntelephonenumber: +1 212 555-1212\nmail: babs@ace.= com\n objectclass: top\nobjectclass: person\nobjectclass: organizationalPer= son\n objectclass: inetOrgPerson Example 2: A changeLogEntry representing the deletion of an entry from the directory dn: changenumber=3D2933, cn=3Dchangelog changenumber: 2933 targetdn: cn=3DGern Jensen, ou=3DProduct Testing, o=3DAce Industry, c=3D= US changetype: delete Example 3: A changeLogEntry representing the modification of an entry in the directory dn: changenumber=3D5883, cn=3Dchangelog changenumber: 5883 targetdn: cn=3DBjorn Jensen, ou=3DProduct Development, o=3DAce Industr= y, c=3DUS changetype: modify changes: delete: telephonenumber\ntelephonenumber: 1212\n-\n add: telephonenumber\ntelephonenumber: +1 212 555 1212\n- Example 4: A changeLogEntry representing a modrdn operation performed on an entry in the directory dn: changenumber=3D10042, cn=3Dchangelog changenumber: 10042 targetdn: cn=3DBjorn Jensen, ou=3DProduct Development, o=3DAce Industr= y, c=3DUS changetype: modrdn newrdn: cn=3DBjorn J Jensen deleteoldrdn: FALSE Good Expires 19 January 2002 [Page 5] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 Location of the container containing changeLogEntry objects For LDAPv3 servers, the location of the container which holds changeLogEntry objects is obtained by reading the "changeLog" attribut= e of a server's root DSE. For example, if the container's root is "cn=3Dchangelog", then the root DSE must have an attribute named "changeLog" with the value "cn=3Dchangelog". The "changelog" attribute is defined as follows: ( 2.16.840.1.113730.3.1.35 NAME 'changelog' DESC 'the distinguished name of the entry which contains the set of entries comprising this server's changelog' EQUALITY distinguishedNameMatch SYNTAX 'DN' ) For LDAPv2 servers, the name of the changelog container must be "cn=3Dchangelog". Interoperability between LDAPv2 and LDAPv3 implementations Implementors are discouraged from developing implementations in which an LDAPv2 server is synchronized from an LDAPv3 server using the changelog method described in this document. Problems can arise when a= n LDAPv2 server reads a "moddn" changelog entry which gives a new superior. Since LDAPv2 does not support such an operation, there is no= t way for the v2 server to perform the moddn operation atomically. It could, of course, delete all the entries under the old superior and ad= d them under the new superior entry, but such an operation would either not be atomic, or require extensive server-side support on the LDAPv2 server to make the operation appear as if it were atomic. It is recommended that servers which only implement LDAPv2 should refuse to synchronize from LDAPv3 servers. Before beginning synchronization, the LDAPv2 server should attempt to read the root DSE= of the supplier server. If the root DSE is present, and the supportedldapversion attribute contained in the root DSE contains the value "3", then the LDAPv2 server should immediately disconnect and proceed no further with synchronization. Security Considerations Servers implementing this scheme MUST NOT allow the "changes" attribute to be generally readable. The "changes" attribute contains all modifications made to an entry, and some changes may contain sensitive data, e.g. passwords. Good Expires 19 January 2002 [Page 6] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 If a server does allow read access on the "changes: attribute to a particular bound DN, then that DN should be trusted. For example, two= cooperating servers may exchange the password for some DN which is granted read access to the "changes" attribute of the changeLog. This= would allow one server to retrieve changes and apply them directly to its database. In situations where the "changes" attribute is not readable by a clien= t, that client may still use the entries in the changeLog to construct a list of entry DNs which are known to have changed since the last time the client synchronized. The client may then read each of those entri= es, subject to whatever access control is in effect on the server, and update its local copy of each entry. Servers implementing this scheme should disallow write access to the changelog container object and all entries contained within. Acknowledgements This material is based in part upon work supported by the National Science Foundation under Grant No. NCR-9416667. References [1] Good, G., "The LDAP Data Interchange Format (LDIF) - Technical Specification", RFC 2849 iPlanet e-commerce Solutions, June 2000, [2] Wahl, M., Howes, T., Kille, S., "Lightweight Directory Access Protocol (v3)", RFC 2251 Critical Angle, Inc., Netscape Communications= Corp., ISODE Consortium, July, 1997, [3] S. Bradner, "Key Words for use in RFCs to Indicate Requirement Levels", Harvard University, RFC 2119, March 1997, Authors' Addresses Gordon Good Loudcloud, Inc. 599 N. Mathilda Avenue Sunnyvale, CA 94085 Good Expires 19 January 2002 [Page 7] =0C INTERNET-DRAFT Change Record Object Class 19 July 2001 USA Phone: +1 408 744-7300 EMail: ggood@loudcloud.com Ludovic Poitou Sun Microsystems Inc. 32 Chemin du vieux chene 38920 Meylan France Phone: +33 476 188 212 Email: ludovic.poitou@sun.com Good Expires 19 January 2002 [Page 8] =0C --------------454482E795D1A8680588F9A5-- From list@netscape.com Fri Jul 20 10:47:54 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA24408 for ; Fri, 20 Jul 2001 10:47:53 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6KEkhv13998; Fri, 20 Jul 2001 07:46:44 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6KEkhA16416; Fri, 20 Jul 2001 07:46:43 -0700 (PDT) Resent-Date: Fri, 20 Jul 2001 07:46:43 -0700 (PDT) Subject: const-correct ldap_err2string To: ietf-ldapext@netscape.com X-Mailer: Lotus Notes Build M10_07152001 Beta 3 July 15, 2001 Message-ID: From: Ken_Lin@iris.com Date: Fri, 20 Jul 2001 10:47:05 -0400 X-MIMETrack: Serialize by Router on Arista/Iris(Release 5.0.8 |June 18, 2001) at 07/20/2001 10:50:06 AM MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Resent-Message-ID: <"4iCaDB.A.IAE.SREW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com I'd like to propose we change the definition of char *ldap_err2string( int err ); as described in ftp://ftp.ietf.org/internet-drafts/draft-ietf-ldapext-ldap-c-api-05.txt to return a const char* like so: const char *ldap_err2string( int err ); From list@netscape.com Fri Jul 20 13:59:06 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA12430 for ; Fri, 20 Jul 2001 13:58:59 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6KHpmB19352; Fri, 20 Jul 2001 10:51:49 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6KHplU03177; Fri, 20 Jul 2001 10:51:47 -0700 (PDT) Resent-Date: Fri, 20 Jul 2001 10:51:47 -0700 (PDT) Sender: Ludovic.Poitou@sun.com Message-ID: <3B5807CD.B5FE0AC0@Sun.com> Date: Fri, 20 Jul 2001 12:28:30 +0200 From: Ludovic Poitou Organization: Sun Microsystems Inc. X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: ietf-ldapext@netscape.com CC: ludovic.poitou@sun.com, prasanta@netscape.com, jimse@novell.com Subject: LDAP Password Policy draft... Content-Type: multipart/mixed; boundary="------------E69301B427178D1F0EAABBA3" Resent-Message-ID: <"ZwLvPD.A.Px.x-GW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com This is a multi-part message in MIME format. --------------E69301B427178D1F0EAABBA3 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi LDAP-Ext members, A update to the LDAP Password Policy draft has been submited (and attached here by). We did a general editing pass and modified the section 6 and 7 for conformance to rfc 2119 and the section 8 for clarification. The document is now complete and we would like to make it progress to Proposed Standard. We solicit your comments on the document. Thank you and best regards, Ludovic. -- Ludovic Poitou Sun Microsystems Inc. iPlanet E-Commerce Solutions - Directory Group - Grenoble - France --------------E69301B427178D1F0EAABBA3 Content-Type: text/plain; charset=iso-8859-1; name="draft-behera-ldap-password-policy-04.txt" Content-Disposition: inline; filename="draft-behera-ldap-password-policy-04.txt" Content-Transfer-Encoding: quoted-printable Internet Draft P.Behera draft-behera-ldap-password-policy-04.txt V. Chu Intended Category: Proposed Standard Netscape Expires: January 2002 L. Poitou Sun Microsystems J. Sermersheim Novell July 2001 Password Policy for LDAP Directories Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC 2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet- Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Copyright 2001, The Internet Society. All rights Reserved. Please see the Copyright Section near the end of this document for more information. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119 [RFC-2119]. 1. Abstract Password policy as described in this document is a set of rules that controls how passwords are used and administered in LDAP directories. In order to improve the security of LDAP directories Behera, et. al. Expires January 18, 2002 Page 1=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 and make it difficult for password cracking programs to break into directories, it is desirable to enforce a set of rules on password usage. These rules are made to ensure that users change their passwords periodically, passwords meet construction requirements, the re-use of old password is restricted, and users are locked out after a certain number of failed attempts. 2. Overview LDAP-based directory services are currently accepted by many organizations as the access protocol for directories. The ability to ensure the secure read and update access to directory information throughout the network is essential to the successful deployment. Most LDAP implementations support many authentication schemes - the most basic and widely used is the simple authentication i.e., user DN and password. In this case, many LDAP servers have implemented some kind of policy related to the password used to authenticate. Among other things, this policy includes: - Whether and when passwords expire. - Whether failed bind attempts cause the account to be locked. - If and how users are able to change their passwords. In order to achieve greater security protection and ensure interoperability in a heterogeneous environment, LDAP needs to standardize on a common password policy model. This is critical to the successful deployment of LDAP directories. 2.1 Application of password policy The password policy defined in this document can be applied to any attribute holding users' passwords which are used for authentication by the use of the bind operation. Typically, it is applied to the userPassword attribute in the case of the LDAP simple authentication method [RFC-2251] or the case of password based SASL [RFC-2222] authentication such as CRAM-MD5 [RFC- 2195] and HTTP-Digest [RFC-Digest]. The policy described in this document assumes that the password attribute holds a single value. No considerations are made for directories or systems that allow a user to maintain multiple passwords. The password policy also defines some constraints to be checked during add or modify operations on these attributes. In this document, the term "user" represents any application which is an LDAP client using the directory to retrieve or store information. Behera, et. al. Expires January 18, 2002 Page 2=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 Server implementations MAY institute internal policy whereby certain identities (such as directory administrators) are not forced to comply with any of password policy. In this case, the password for a directory administrator never expires; the account is never locked, etc. 3. Articles of password policy The following sections explain in general terms each aspect of the password policy defined in this document as well as the need for each. These policies are subdivided into the general groups of password usage and password modification. Implementation details are presented in Sections 6 and 7. 3.1. Password Usage Policy This section describes policy enforced while users are using passwords to authenticate. The general focus of this policy is to minimize the threat of intruders once a password is in use. 3.1.1. Password Guessing limit In order to prevent intruders from guessing a user's password, a mechanism exists to track the number of failed authentication attempts, and take action when a limit is reached. This policy consists of five parts: - A configurable limit. - A counter to track the number of failed authentication attempts. - A timeframe in which the limit of consecutive failed authentication attempts must happen before action is taken. - The action to be taken when the limit is reached. The action will either be nothing, or the account will be locked. - An amount of time the account is locked (if it is to be locked). This can be indefinite. 3.2. Password Modification Policy This section describes policy enforced while users are modifying passwords. The general focus of this policy is to ensure that when users add or change their passwords, the security and effectiveness of their passwords is maximized. Behera, et. al. Expires January 18, 2002 Page 3=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 3.2.1. Password Expiration, Expiration Warning, and Grace binds One of the key properties of a password is the fact that it is not well known. If a password is frequently changed, the chances of that user's account being broken into are minimized. Directory administrators may deploy a password policy that causes passwords to expire after a given amount of time - thus forcing users to change their passwords periodically. As a side effect, there needs to be a way in which users are made aware of this need to change their password before actually being locked out of their accounts. One or both of the following methods handle this: - The user is sent a warning sometime before his password is due to expire. If the user fails to heed this warning before the expiration time, his account will be locked. - The user may bind to the directory a preset number of times after her password has expired. If she fails to change her password during one of her 'grace' binds, her account will be locked. 3.2.2. Password History When the Password Expiration policy is used, an additional mechanism may be employed in order to prevent users from simply re-using a previous password (as this would effectively circumvent the expiration policy). In order to do this; a history of used passwords is kept. The directory administrator sets the number of passwords to be stored at any given time. Passwords are stored in this history whenever the password is changed. Users aren't allowed to specify any passwords that are in the history list while changing passwords. 3.2.3. Password Minimum Age Users may circumvent the Password History mechanism by quickly performing a series of password changes. If they change their password enough times, their 'favorite' password will be pushed out of the history list. This process may be made less attractive to users by employing a minimum age for passwords. If users are forced to wait 24 hours Behera, et. al. Expires January 18, 2002 Page 4=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 between password changes, they may be less likely to cycle through a history of 10 passwords. 3.2.4. Password Syntax and Minimum length In order to prevent users from creating or updating passwords that are easy to guess, a password syntax policy may be employed. This policy consists of two general mechanisms - ensuring that passwords conform to a defined syntax and ensuring that they are of a minimum length. Forcing a password to comply with a syntax may imply a variety of things including: - Disallowing trivial or well-known words make up the password. - Forcing a certain number of digits be used. - Disallowing anagrams of the user's name. The implementation of this policy meets with the following problems: - If the password to be added or updated is encrypted by the client before being sent, the server has no way of enforcing this policy. Therefore, the onus of enforcing this policy falls upon client implementations. - There are no specific definitions of what 'syntax checking' means. This can lead to unexpected behavior in a heterogeneous environment. 3.2.5. User Defined Passwords In some cases, it is desirable to disallow users from adding and updating their own passwords. This policy makes this functionality possible. This implies that certain other policy, such as password expiration is not enforced. 3.2.6. Password Change After Reset This policy forces the user to update her password after it has been set for the first time, or has been reset by the directory administrator. Behera, et. al. Expires January 18, 2002 Page 5=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 This is needed in scenarios where a directory administrator set or reset the password to a well-known value. 3.2.7 Safe modification As directories become more commonly used, it will not be unusual for clients to connect to a directory and leave the connection open for an extended period. This opens up the possibility for an intruder to make modifications to a user's password while that user's computer is connected but unattended. This policy forces the user to prove his identity by specifying the old password before modifying it. 3.3 Restriction of the Password Policy The password policy has defined in this document can apply to any attribute containing a password. Because the state information in the user's entry is on a per attribute basis and not per password attribute value, the server should enforce that the password attribute subject to the password, contains one and only one password value. 4. Schema used for Password Policy The schema elements defined here fall into two general categories. A password policy object class is defined which contains a set of administrative password policy attributes, and a set of operational attributes are defined which hold general password policy state information for each user. 4.1. The pwdPolicy Object Class This object class contains the attributes defining a password policy in effect for a set of users. See Section 8subtrees of the DIT. ( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' AUXILIARY SUP top MUST ( pwdAttribute ) MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckSyntax $ pwdMinLength $ pwdExpireWarning $ pwdGraceLoginLimit $ pwdLockout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) ) Behera, et. al. Expires January 18, 2002 Page 6=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 4.2. Attribute Types used in the pwdPolicy ObjectClass Following are the attribute types used by the pwdPolicy object class. 4.2.1 pwdAttribute This holds the name of the attribute to which the password policy is applied. For example, the password policy may be applied to the userPassword attribute. ( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 4.2.2 pwdMinAge This attribute holds the number of seconds that must elapse between modifications to the password. If this attribute is not present, 0 seconds is assumed. ( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.3 pwdMaxAge This attribute holds the number of seconds after which a modified password will expire. If this attribute is not present, or if the value is 0 the password does not expire. ( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.4 pwdInHistory This attribute specifies the maximum number of used passwords stored in the pwdHistory attribute. Behera, et. al. Expires January 18, 2002 Page 7=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 If this attribute is not present, or if the value is 0, used passwords are not stored in the pwdHistory attribute and thus may be reused. ( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.5 pwdCheckSyntax This attribute indicates how the password syntax will be checked while being modified or added. If this attribute is not present, or if the value is '0', syntax checking will not be enforced. A value of '1' indicates that the server will check the syntax, and if the server is unable to check the syntax (due to a hashed password or other reasons) it will be accepted. A value of '2' indicates that the server will check the syntax, and if the server is unable to check the syntax it will return an error refusing the password. ( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckSyntax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.6 pwdMinLength This attribute holds the minimum number of characters that must be used in a password, if syntax checking is enabled. If this attribute is not present, no minimum password length will be enforced. If the server is unable to check the length (due to a hashed password or otherwise), the server will, depending on the value of the pwdCheckSyntax attribute, either accept the password without checking it ('0' or '1') or refuse it ('2') . ( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.7 pwdExpireWarning Behera, et. al. Expires January 18, 2002 Page 8=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 This attribute specifies the maximum number of seconds before a password is due to expire that expiration warning messages will be returned to an authenticating user. If this attribute is not present, or if the value is 0 no warnings will be sent. ( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.8 pwdGraceLoginLimit This attribute specifies the number of times an expired password can be used to access an account. If this attribute is not present or if the value is 0, the account cannot be accessed once the password has expired. ( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceLoginLimit' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.9 pwdLockout This attribute indicates, when its value is "TRUE", that users will be locked out of the directory after a specified number of consecutive failed bind attempts. The maximum number of consecutive failed bind attempts is specified in pwdMaxFailure. If this attribute is not present, or if the value is "FALSE", the account will not be locked when the number of failed bind attempts has been reached. ( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) 4.2.10 pwdLockoutDuration This attribute holds the number of seconds that an account will remain locked due to too many failed bind attempts. If this attribute is not present, or if the value is 0 the account will be locked until reset by an administrator. Behera, et. al. Expires January 18, 2002 Page 9=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 ( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.11 pwdMaxFailure This attribute specifies the number of consecutive failed bind attempts after which a users account will be locked. If this attribute is not present, or if the value is 0, the account will not be locked due to failed bind attempts and the value of pwdLockout will be ignored. ( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.12 pwdFailureCountInterval This attribute holds the number of seconds after which the password failures are purged from the failure counter, even though no successful authentication occurred. If this attribute is not present, or if its value is 0, the failure counter is only reset by a successful authentication. ( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInterval' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) 4.2.13 pwdMustChange This attribute specifies with a value of "TRUE" that users must change their passwords when they first bind to the directory after a password is set or reset by the administrator. If this attribute is not present, or if the value is "FALSE", users are not required to change their password upon binding after the administrator sets or resets the password. ( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' Behera, et. al. Expires January 18, 2002 Page 10=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) 4.2.14 pwdAllowUserChange This attribute indicates whether users can change their own passwords. If this attribute is not present, a value of "TRUE" is assumed. ( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) 4.2.15 pwdSafeModify This attribute specifies whether or not the existing password must be sent when changing a password. If this attribute is not present, a "FALSE" value is assumed. ( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) 4.3. Attribute Types for Password Policy State Information Password policy state information must be maintained for each user. The information is located in each user entry as a set of operational attributes. These operational attributes are: pwdChangedTime, pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime, pwdHistory, pwdGraceUseTime, pwdReset. Since the password policy could apply to several attributes used to store passwords, each of the above operational attributes must have an option to tell which attribute is applies to. The password policy option is defined as the following: pwd- For example, if the pwdPolicy object has for pwdAttribute "userPassword" then the pwdChangedTime operational attribute, in a user entry, will be like this: pwdChangedTime;pwd-userPassword: 20000103121520Z Behera, et. al. Expires January 18, 2002 Page 11=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 4.3.1 pwdChangedTime This attribute specifies the time the entry's password was last changed. This is used by the password expiration policy. If this attribute does not exist, the password will never expire. ( 1.3.6.1.4.1.42.2.27.8.1.16 NAME 'pwdChangedTime' DESC 'The time the password was last changed' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE USAGE directoryOperation) 4.3.2 pwdAccountLockedTime This attribute holds the time that the user's account was locked. A 0 value means that the account has been locked permanently, and that only an administrator can unlock the account. ( 1.3.6.1.4.1.42.2.27.8.1.17 NAME 'pwdAccountLockedTime' DESC 'The time an user account was locked' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE USAGE directoryOperation) 4.3.3 pwdExpirationWarned This attribute contains the time when the password expiration warning was first sent to the client. The password will expire in the pwdExpireWarning time. ( 1.3.6.1.4.1.42.2.27.8.1.18 NAME 'pwdExpirationWarned' DESC 'The time the user was first warned about the coming expiration of the password' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE USAGE directoryOperation ) 4.3.4 pwdFailureTime Behera, et. al. Expires January 18, 2002 Page 12=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 This attribute holds the timestamps of the consecutive authentication failures. ( 1.3.6.1.4.1.42.2.27.8.1.19 NAME 'pwdFailureTime' DESC 'The timestamps of the last consecutive authentication failures' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch USAGE directoryOperation ) 4.3.5 pwdHistory This attribute holds a history of previously used passwords. Values of this attribute are transmitted in string format as given by the following ABNF: pwdHistory =3D time "#" syntaxOID "#" length "#" data time =3D syntaxOID =3D numericoid ; the string representation of the ; dotted-decimal OID that defines the ; syntax used to store the password. ; numericoid is described in 4.1 of ; [RFC2252]. length =3D numericstring ; the number of octets in data. ; numericstring is described in 4.1 of ; [RFC2252]. data =3D . This format allows the server to store, and transmit a history of passwords that have been used. In order for equality matching to function properly, the time field needs to adhere to a consistent format. For this purpose, the time field MUST be in GMT format. ( 1.3.6.1.4.1.42.2.27.8.1.20 NAME 'pwdHistory' DESC 'The history of user's passwords' Behera, et. al. Expires January 18, 2002 Page 13=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 EQUALITY octetStringMatch USAGE directoryOperation) 4.3.6 pwdGraceUseTime This attribute holds the timestamps of grace login once a password has expired. ( 1.3.6.1.4.1.42.2.27.8.1.21 NAME 'pwdGraceUseTime' DESC 'The timestamps of the grace login once the password has expired' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch SINGLE-VALUE USAGE directoryOperation) 4.3.7 pwdReset This attribute holds a flag to indicate if the password has been reset and therefore must be changed by the user on first authentication. ( 1.3.6.1.4.1.42.2.27.8.1.22 NAME 'pwdReset' DESC 'The indication that the password has been reset' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE directoryOperation) 5. Controls used for Password Policy This section details the controls used while enforcing password policy. A request control is defined that is sent by a client with a request operation in order to elicit a response control. The response control contains various warnings and errors associated with password policy 5.1 Request Control This control MAY be sent with any LDAP request message in order to convey to the server that this client is aware of, and can process the response control described in this document. When a server receives this control, it will return the response control when appropriate and with the proper data. Behera, et. al. Expires January 18, 2002 Page 14=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 The controlType is 1.3.6.1.4.1.42.2.27.8.5.1 and the criticality MUST be FALSE. There is no controlValue. passwordPolicyRequest controlType: 1.3.6.1.4.1.42.2.27.8.5.1 criticality: FALSE controlValue:None 5.2 Response Control If the client has sent a passwordPolicyRequest control, the server sends this control with the following operation responses: bindResponse, modifyResponse, addResponse, compareResponse and possibly extendedResponse, to inform of various conditions and MAY be sent with other operations (in the case of the changeAfterReset error). passwordPolicyResponse controlType: 1.3.6.1.4.1.42.2.27.8.5.1 criticality: FALSE controlValue:an OCTET STRING, whose value is the BER encoding of the following type: PasswordPolicyResponseValue ::=3D SEQUENCE { warning [0] CHOICE OPTIONAL { timeBeforeExpiration [0] INTEGER (0 .. maxInt), graceLoginsRemaining [1] INTEGER (0 .. maxInt) } error [1] ENUMERATED OPTIONAL { passwordExpired (0), accountLocked (1), changeAfterReset (2), passwordModNotAllowed (3), mustSupplyOldPassword (4), invalidPasswordSyntax (5), passwordTooShort (6), passwordTooYoung (7), passwordInHistory (8) } The timeBeforeExpiration warning specifies the number of seconds before a password will expire. The graceLoginsRemaining warning specifies the remaining number of time a user will be allowed to authenticate with an expired password. The passwordExpired error signifies that the password has expired and must be reset. The changeAfterReset error signifies that the password must be changed Behera, et. al. Expires January 18, 2002 Page 15=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 before the user will be allowed to perform any operation other than bind and modify. The passwordModNotAllowed is set when a user is restricted from changing her password. The invalidPasswordSyntax error is set when a password doesn't pass syntax checking. The passwordTooYoung is set if the age of the password to be modified is not yet old enough. Typically, only either a warning or an error will be encoded though there may be exceptions. For example, if the user is required to change a password after the administrator set it, and the password will expire in a short amount of time, the control may include the timeBeforeExpiration warning and the changeAfterReset error. 6. Server Implementation by LDAP operation The following sections contain detailed instructions that refer to attributes of the pwdPolicy object class. When doing so, the attribute of the pwdPolicy object that governs the entry being discussed is implied. The server SHOULD enforce that the password attribute subject to a password policy as defined in this document, contains one and only one password value. The scenarios in the following operations assume that the client has attached a passwordPolicyRequest control to the request message of the operation. In the event that the passwordPolicyRequest control was not sent, no passwordPolicyRequest control is returned. All other instructions remain the same. 6.1 Bind Operation When processing a bind request, the server MUST perform the following steps: 1. Check for a locked account: If the value of the pwdAccountLockedTime attribute is 0, or if the current time is less than the value of the pwdAccountLockedTime attribute added to the value of the pwdLockoutDuration, the account is locked. If the account is locked, the server MUST send a bindResponse to the client with the resultCode: unwillingToPerform (53), and MUST Behera, et. al. Expires January 18, 2002 Page 16=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 include the passwordPolicyResponse in the controls field of the bindResponse message with the error: accountLocked (1). If the account is not locked, the server MUST proceed with the bind operation. 2. Check the result of the bind operation: If the bind operation succeeds with authentication, the server MUST do the following: A. Delete the pwdFailureTime attribute. B. Check whether the password must be changed now. If the pwdMustChange attribute is set to TRUE, and if the pwdReset attribute is set to TRUE, the password must be changed now. If the password must be changed now, the server MUST send a bindResponse to the client with the resultCode: success (0), and MUST include the passwordPolicyResponse in the controls field of the bindResponse message with the warning: changeAfterReset specified. The server MUST then disallow all operations issued by this user except modify password, bind, unbind, abandon and StartTLS extended operation. If the password does not need to be changed now, the operation proceeds. C. Check for password expiration The password has expired when either of the following conditions is met: - If the value of the pwdExpireWarning attribute is 0, the server subtracts the current time from the time stored in pwdChangedTime to arrive at the password's age. If the age is greater than the value in the pwdMaxAge attribute, the password has expired. - If the value of the pwdExpireWarning attribute is non- zero, and the pwdExpirationWarned attribute is present and has a time value, the server subtracts the current time from the time stored in the pwdExpirationWarned to arrive at the first warning age. If the age is greater than the Behera, et. al. Expires January 18, 2002 Page 17=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 value in the pwdExpireWarning attribute, the password has expired. If the password has expired, the server MUST check for remaining grace logins. If the pwdGraceUseTime attribute is present, the server MUST count the number of values in that attribute and subtract it from the pwdGraceLoginLimit. A positive result specifies the number of remaining grace logins. If there are remaining grace logins, the server MUST add a new value with the current time in pwdGraceUseTime. Then it MUST send a bindResponse with the resultCode: success (0), and MUST include the passwordPolicyResponse in the controls field of the bindResponse message with the warning: graceLoginsRemaining choice set to the number of grace logins left. If there are no remaining grace logins, the server MUST send a bindResponse with the resultCode: invalidCredentials (49), and MUST include the passwordPolicyResponse in the controls field of the bindResponse message with the error: passwordExpired (0) set. If the password has not expired, execution continues. D. Calculates whether the time before expiration warning should be sent. If the pwdExpireWarning attribute is present and contains a value, the server MUST perform the following steps. If the pwdExpirationWarned attribute is present and has a time value, the warning time is the value of the pwdExpirationWarned attribute plus the value of the pwdExpireWarning attribute minus the current time. If the pwdExpirationWarned attribute is not present, the server MUST subtract the current time from the time stored in pwdChangedTime to arrive at the password's age. If the age is greater than the value of the pwdMaxAge attribute minus the value of the pwdExpireWarning attribute, the server MUST set the current time as the value of the pwdExpirationWarned attribute, and the warning time is the value of pwdMaxAge minus the password's age. Behera, et. al. Expires January 18, 2002 Page 18=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 If the warning time is a positive number, the server MUST send a bindResponse with the resultCode: success (0), and MUST include the passwordPolicyResponse in the controls field of the bindResponse message with the warning: timeBeforeExiration set to the value as described above. If the warning time is zero, or wasn't calculated, the server MUST send a bindResponse with the resultCode: success (0), and MUST include the passwordPolicyResponse with nothing in the SEQUENCE. If the pwdExpireWarning attribute is not present, the server MUST send a bindResponse with the resultCode: success (0), and MUST include the passwordPolicyResponse with nothing in the SEQUENCE. If the bind operation fails authentication due to invalid credentials, the server MUST do the following: A. Add the current time as a value of the pwdFailureTime attribute. B. If the pwdLockout attribute is TRUE, the server MUST also do the following: Count the number of values in the pwdFailureTime attribute that are younger than pwdFailureCountInterval. If the number of these failures is greater or equal to the pwdMaxFailure attribute, the server MUST lock the account by setting the value of the pwdAccountLockedTime attribute to the current time. After locking the account, the server MUST send a bindResponse to the client with the resultCode: unwillingToPerform (53), and MUST include the passwordPolicyResponse in the controls field of the bindResponse message with the error: accountLocked (1). If the number of failures is less than the pwdMaxFailure attribute, operation proceeds. If the pwdLockout attribute is FALSE, operation continues. C. Failure times that are old by more than pwdFailureCountInterval, are purged from the pwdFailureTime attribute. Behera, et. al. Expires January 18, 2002 Page 19=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 D. If no errors were returned, the server MUST send a bindResponse with the resultCode: success (0), and MUST include the passwordPolicyResponse with nothing in the SEQUENCE. 6.2. Modify Operation Because the password is stored in an attribute, the modify operation may be used to create or update a password. But some alternate mechanisms have been defined or may be defined, such as the LDAP Password Modify Extended Operation [RFC-3062]. The following instructions are to be followed when processing any request that includes changes to a subject to a policy as defined in this document. The instructions assume that the request is a Modify operation, they SHOULD be adapted to the actual request (for example replace modifyResponse by extendedResponse and PasswdModifyResponseValue in the case of the Password Modify Extended Request). While processing a password modification, the server MUST perform the following steps: 1. Check the pwdSafeModify attribute. If set to TRUE, the server MUST ensure that the modify operation contains a delete action before the add or replace action, and that the delete action specifies the existing password. If the delete action is not specified, the server MUST abort the modification and then MUST send a modifyResponse to the client with the resultCode: unwillingToPerform (53), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: mustSupplyOldPassword (4). If the Password Modify Extended Request is used, the server MUST ensure that the old password was specified in the PasswdModifyRequestValue. If the old password is absent, the server MUST abort the modification and MUST return an error as described above. 2. Check the value of the pwdMustChange attribute. If TRUE, the server MUST check the pwdReset attribute in the user's entry, to see if a Directory Administrator has reset the password. If so, it MUST ensure that the modify operation contains no Behera, et. al. Expires January 18, 2002 Page 20=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 modifications other than the modification of the password attribute. If other modifications exist, the server MUST send a modifyResponse to the client with the resultCode: unwillingToPerform (53), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: changeAfterReset (2). 3. Check to see whether the bound identity has sufficient rights to modify the password. If the bound identity is a user changing her own password, this MAY be done by either the use of an access control mechanism, or by checking the pwdAllowUserChange attribute. Otherwise an access control mechanism MUST be used. The determination of this is implementation specific. If the user is not allowed to change her password, the server MUST send a modifyResponse to the client with the resultCode: unwillingToPerform (53), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: passwordModNotAllowed (3). 4. Check the value of the pwdMinAge attribute. If it is set to a non-zero value, the server MUST subtract the current time from the value of the pwdChangedTime attribute to arrive at the password's age. If the password's age is less than the value of the pwdMinAge attribute, the password is too young to modify. In this case, the server MUST send a modifyResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: passwordTooYoung (7). 5. Check the value of the pwdCheckSyntax attribute. If the value is non-zero, The server: A. MUST ensure that the password meets the syntax restrictions enforced by the server. This enforcement is implementation specific. If the server is unable to check the syntax (due to a hashed password or otherwise), the value of pwdCheckSyntax is evaluated. If the value is 1, operation MUST continue. If the value is 2, the server MUST send a modifyResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: invalidPasswordSyntax (5). Behera, et. al. Expires January 18, 2002 Page 21=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 If the server is able to check the password syntax, and the check fails, the server MUST send a modifyResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: invalidPasswordSyntax (5). B. MUST Check the value of the pwdMinLength attribute. If the value is non-zero, it MUST ensure that the new password is of at least the minimum length. If the server is unable to check the length (due to a hashed password or otherwise), the value of pwdCheckSyntax is evaluated. If the value is 1, operation MUST continue. If the value is 2, the server MUST send a modifyResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: passwordTooShort (5). If the server is able to check the password length, and the check fails, the server MUST send a modifyResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: passwordTooShort (5). 6. Check the value of the pwdInHistory attribute. If the value is non-zero, the server MUST check whether this password exists in the entry's pwdHistory attribute or in the current password attribute. If the password does exist in the pwdHistory attribute or in the current password attribute, the server MUST send a modifyResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the modifyResponse message with the error: passwordInHistory (8). If the steps have completed without causing an error condition, the server MUST follow the following steps in order to update the necessary password policy state attributes: 7. Check the value of the pwdMaxAge attribute. If the value is non- zero, or if the value of the pwdMinAge attribute is non-zero, the server MUST update the pwdChangedTime attribute on the entry to the current time. Behera, et. al. Expires January 18, 2002 Page 22=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 8. If the value of the pwdInHistory attribute is non-zero, the server MUST add the previous password to the pwdHistory attribute. If the number of attributes held in the pwdHistory attribute exceeds the value of pwdInHistory, the server MUST remove the oldest excess passwords. 9. Remove the pwdFailureTime, pwdReset, pwdGraceUseTime and pwdExpirationWarned attributes from the user's entry if they exist. The server MUST then apply the modify operation. 6.3 Add Operation The password MAY be set during an Add operation. If it is, the server MUST perform the following steps while processing the add operation. Note that these are essentially duplicates of steps 3, 5 and 7 from Section 6.2 with the exception that pwdAllowUserChange is not checked. 1. Check to see whether the bound identity has sufficient rights to modify the password. This MAY be done by the use of an access control mechanism. If the user is not allowed to add this password, the server MUST send an addResponse to the client with the resultCode: unwillingToPerform (53), and MUST include the passwordPolicyResponse in the controls field of the addResponse message with the error: passwordModNotAllowed (3). 2. Check the value of the pwdCheckSyntax attribute. If the value is non-zero, The server: A. MUST ensure that the password meets the syntax restrictions enforced by the server. This enforcement is implementation specific. If the server is unable to check the syntax (due to a hashed password or otherwise), the value of pwdCheckSyntax MUST be evaluated. If the value is 1, operation MUST continue. If the value is 2, the server MUST send an addResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the addResponse message with the error: invalidPasswordSyntax (5). If the server is able to check the password syntax, and the check fails, the server MUST send an addResponse to the client Behera, et. al. Expires January 18, 2002 Page 23=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the addResponse message with the error: invalidPasswordSyntax (5). B. MUST check the value of the pwdMinLength attribute. If the value is non-zero, it MUST ensure that the new password is of at least the minimum length. If the server is unable to check the length (due to a hashed password or otherwise), the value of pwdCheckSyntax MUST be evaluated. If the value is 1, operation MUST continue. If the value is 2, the server MUST send an addResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the addResponse message with the error: passwordTooShort (5). If the server is able to check the password length, and the check fails, the server MUST send an addResponse to the client with the resultCode: constraintViolation (19), and MUST include the passwordPolicyResponse in the controls field of the addResponse message with the error: passwordTooShort (5). If the steps above have completed without causing an error condition, the server MUST follow the steps below in order to update the necessary password policy state attributes. 3. Check the value of the pwdMaxAge attribute. If the value is non- zero, or if the value of the pwdMinAge attribute is non-zero, the server MUST update the pwdChangedTime attribute on the entry to the current time. 6.4 Compare Operation The compare operation MAY be used to compare a password. This might be performed when a client wishes to verify that user's supplied password is correct. An example of this is an LDAP HTTP authentication redirector. It may be desirable to use this rather than performing a bind operation in order to reduce possible overhead involved in performing a bind. Access Controls SHOULD be used to restrict this comparison from being made. If a server supports this behavior, it MUST comply with the following. Otherwise the password policy described in this document may be circumvented. Behera, et. al. Expires January 18, 2002 Page 24=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 While comparing password attributes, the server MUST perform the following steps: 1. Check for a locked account: If the value of the pwdAccountLockedTime attribute is 0, or if the current time is less than the value of the pwdAccountLockedTime attribute added to the value of the pwdLockoutDuration, the account is locked. If the account is locked, the server MUST send a compareResponse to the client with the resultCode: compareFalse (5), and MUST include the passwordPolicyResponse in the controls field of the compareResponse message with the error: accountLocked (1). If the account is not locked, the server MUST proceed with the compare operation. 2. If Access Controls permit, the server MUST proceed with compare operation and MUST check the result. If the result of the compare operation is true, the server MUST do the following: A. Delete the pwdFailureTime attribute. B. Check for password expiration The password has expired when either of the following conditions is met: - If the value of the pwdExpireWarning attribute is 0, the server MUST subtract the current time from the time stored in pwdChangedTime to arrive at the password's age. If the age is greater than the value in the pwdMaxAge attribute, the password has expired. - If the value of the pwdExpireWarning attribute is non- zero, and the pwdExpirationWarned attribute is present and has a time value, the server MUST subtract the current time from the time stored in the pwdExpirationWarned to arrive at the first warning age. If the age is greater than the value in the pwdExpireWarning attribute, the password has expired. If the password has expired, the server MUST check for remaining grace logins. Behera, et. al. Expires January 18, 2002 Page 25=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 If the pwdGraceUseTime attribute is present, the server MUST count the number of values in that attribute and MUST subtract it from the pwdGraceLoginLimit. A positive result specifies the number of remaining grace logins. If there are remaining grace logins, the server MUST add a new value with the current time in pwdGraceUseTime. Then it MUST send a compareResponse with the resultCode: compareTrue (6), and MUST include the passwordPolicyResponse in the controls field of the compareResponse message with the warning: graceLoginsRemaining choice set to the number of grace logins left. If there are no remaining grace logins, the server MUST send a compareResponse with the resultCode: compareFalse (5), and MUST include the passwordPolicyResponse in the controls field of the compareResponse message with the error: passwordExpired (0) set. If the password has not expired, execution MUST continue. C. Calculate whether the time before expiration warning should be sent. If the pwdExpireWarning attribute is present and contains a value, the server MUST perform the following steps. If the pwdExpirationWarned attribute is present and has a time value, the warning time is the value of the pwdExpirationWarned attribute plus the value of the pwdExpireWarning attribute minus the current time. If the pwdExpirationWarned attribute is not present, the server MUST subtract the current time from the time stored in pwdChangedTime to arrive at the password's age. If the age is greater than the value of the pwdMaxAge attribute minus the value of the pwdExpireWarning attribute, the server MUST set the current time as the value of the pwdExpirationWarned attribute, and the warning time is the value of pwdMaxAge minus the password's age. If the warning time is a positive number, the server MUST send a compareResponse with the resultCode: compareTrue (6), and MUST include the passwordPolicyResponse in the controls field of the compareResponse message with the Behera, et. al. Expires January 18, 2002 Page 26=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 warning: timeBeforeExiration set to the value as described above. If the warning time is zero, or wasn't calculated, the server MUST send a compareResponse with the resultCode: compareTrue (6), and MUST include the passwordPolicyResponse with nothing in the SEQUENCE. If the pwdExpireWarning attribute is not present, the server MUST send a compareResponse with the resultCode: compareTrue (6), and MUST include the passwordPolicyResponse with nothing in the SEQUENCE. If the result of the compare operation is false, the server MUST do the following: A. Add the current time as a value of the pwdFailureTime attribute. B. If the pwdLockout attribute is TRUE, the server MUST do the following: Count the number of values in the pwdFailureTime attribute that are younger than pwdFailureCountInterval. If the number of these failures is greater or equal to the pwdMaxFailure attribute, the server MUST lock the account by setting the value of the pwdAccountLockedTime attribute to the current time. After locking the account, the server MUST send a compareResponse to the client with the resultCode: compareFalse (5), and MUST include the passwordPolicyResponse in the controls field of the compareResponse message with the error: accountLocked (1). If the number of failures is less than the pwdMaxFailure attribute, operation MUST proceed. If the pwdLockout attribute is FALSE, operation MUST continue. C. Failure times that are old by more than pwdFailureCountInterval, MUST be purged from the pwdFailureTime attribute. Behera, et. al. Expires January 18, 2002 Page 27=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 D. If no errors were returned, the server MUST send a compareResponse with the resultCode: compareTrue (6), and MUST include the passwordPolicyResponse with nothing in the SEQUENCE. 7. Client Implementation by LDAP operation These sections illustrate possible scenarios for each LDAP operation and define the types of responses that identify those scenarios. The scenarios in the following operations assume that the client attached a passwordPolicyRequest control to the request message of the operation, and thus MAY receive a passwordPolicyResponse control in the response message. In the event that the passwordPolicyRequest control was not sent, no passwordPolicyRequest control is returned. All other instructions remain the same. 7.1. Bind Operation For every bind response received, the client MUST check the resultCode of the bindResponse and MUST check for a passwordPolicyResponse to determine if any of the following conditions are true and MAY prompt the user accordingly. 1. The password failure limit has been reached and the account is locked. The user needs to retry later or contact the directory administrator to reset the password. resultCode: unwillingToPerform (53) passwordPolicyResponse: error: accountLocked (1) 2. The user is binding for the first time after the directory administrator set the password. In this scenario, the client SHOULD prompt the user to change his password immediately. resultCode: success (0) passwordPolicyResponse: error: changeAfterReset (2) 3. The password has expired but there are remaining grace logins. The user needs to change it. resultCode: success (0) passwordPolicyResponse: warning: graceLoginsRemaining 4. The password has expired and there are no more grace logins. The user MUST contact the directory administrator in order to have its password reset. Behera, et. al. Expires January 18, 2002 Page 28=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 resultCode: invalidCredentials (49) passwordPolicyResponse: error: passwordExpired (0) 5. The user's password will expire in n number of seconds. resultCode: success (0) passwordPolicyResponse: warning: timeBeforeExpiration 7.2 Modify Operations 7.2.1 Modify Request If the application or client encrypts the password prior to sending it in a password modification operation (whether done through modifyRequest or another password modification mechanism), it SHOULD check the values of the pwdMinLength, and pwdCheckSyntax attributes and SHOULD enforce these policies. 7.2.2 Modify Response If the modifyRequest operation was used to change the password, or if another mechanism is used --such as an extendedRequest-- the modifyResponse or other appropriate response MAY contain information pertinent to password policy. The client MUST check the resultCode of the response and MUST check for a passwordPolicyResponse to determine if any of the following conditions are true and optionally notify the user of the condition. 1. The user attempted to change her password without specifying the old password but the password policy requires this. resultCode: unwillingToPerform (53) passwordPolicyResponse: error: mustSupplyOldPassword (4) 2. The user MUST change her password before submitting any other LDAP requests. resultCode: unwillingToPerform (53) passwordPolicyResponse: error: changeAfterReset (2) 3. The user doesn't have sufficient rights to change his password. resultCode: unwillingToPerform (53) passwordPolicyResponse: error: passwordModNotAllowed (3) Behera, et. al. Expires January 18, 2002 Page 29=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 4. It is too soon after the last password modification to change the password. resultCode: constraintViolation (19) passwordPolicyResponse: error: passwordTooYoung (7) 5. The password failed syntax checking. resultCode: constraintViolation (19) passwordPolicyResponse: error: invalidPasswordSyntax (5) 6. The length of the password is too short. resultCode: constraintViolation (19) passwordPolicyResponse: error: passwordTooShort (6) 7. The password has already been used; the user MUST choose a different one. resultCode: constraintViolation (19) passwordPolicyResponse: error: passwordInHistory (8) 7.3 Add Operation If a password is specified in an addRequest, the client MUST check the resultCode of the addResponse and MUST check for a passwordPolicyResponse to determine if any of the following conditions are true and may prompt the user accordingly. 1. The user doesn't have sufficient rights to add this password. resultCode: unwillingToPerform (53) passwordPolicyResponse: error: passwordModNotAllowed (3) 2. The password failed syntax checking. resultCode: constraintViolation (19) passwordPolicyResponse: error: invalidPasswordSyntax (5) 3. The length of the password is too short. resultCode: constraintViolation (19) passwordPolicyResponse: error: passwordTooShort (6) 7.4. Compare Operation Behera, et. al. Expires January 18, 2002 Page 30=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 When a compare operation is used to compare a password, the client MUST check the resultCode of the compareResponse and MUST check for a passwordPolicyResponse to determine if any of the following conditions are true and MAY prompt the user accordingly. These conditions assume that the result of the comparison was true. 1. The password failure limit has been reached and the account is locked. The user needs to retry later or contact the directory administrator to reset the password. resultCode: compareFalse (5) passwordPolicyResponse: error: accountLocked (1) 2. The password has expired but there are remaining grace logins. The user needs to change it. resultCode: compareTrue (6) passwordPolicyResponse: warning: graceLoginsRemaining 3. The password has expired and there are no more grace logins. The user MUST contact the directory administrator to reset the password. resultCode: compareFalse (5) passwordPolicyResponse: error: passwordExpired (0) 4. The user's password will expire in n number of seconds. resultCode: compareTrue (6) passwordPolicyResponse: warning: timeBeforeExpiration 7.4 Other Operations For operations other than bind, unbind, abandon, search or StartTLS, the client MUST check the following result code and control to determine if the user needs to change the password immediately. 1. The user needs to change password. The user SHOULD be prompted to change the password immediately. resultCode: unwillingToPerform (53) passwordPolicyResponse: error: changeAfterReset (2) 8. Administration of a Password Policy Behera, et. al. Expires January 18, 2002 Page 31=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 A password policy MUST be defined for a particular subtree of the DIT by adding to an LDAP subentry whose immediate superior is the root of the subtree, the pwdPolicy auxiliary object class. The scope of the password policy is the same as the default scope of an LDAP subentry as defined in section 5.1.2 of [SubEntry]. It is possible to define password policies for different password attributes within the same pwdPolicy entry, by specifying multiple values of the pwdAttribute. But password policies could also be in separate sub entries as long as they are contained under the same LDAP subentry. Modifying the password policy MUST not result in any change in users' entries to which the policy applies. It SHOULD be possible to overwrite the password policy for one user by defining a new policy in a subentry of the user entry. 9. Password Policy and Replication The pwdPolicy object defines the password policy for a portion of the DIT and MUST be replicated on all the replicas of this subtree, as any subentry would be, in order to have a consistent policy among all replicated servers. The elements of the password policy that are related to the users are stored in the entry themselves as operational attributes. As these attributes are subject to modifications even on a read-only replica, replicating them must be carefully considered. The pwdChangedTime attribute MUST be replicated on all replicas, to allow expiration of the password. The pwdReset attribute MUST be replicated on all replicas, to deny access to operations other than bind and modify password. The pwdHistory attribute MUST be replicated to writable replicas. It doesn't have to be replicated to a read-only replica, since the password will never be directly modified on this server. The pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime and pwdGraceUseTime attributes MUST be replicated to writable replicas, making the password policy global for all servers. When the user entry is replicated to a read-only replica, these attributes SHOULD NOT be replicated. This means that the number of failures, of grace logins and the locking will take place on each replicated server. For example, the effective number of failed Behera, et. al. Expires January 18, 2002 Page 32=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 attempts on a user password will be N x M (where N is the number of servers and M the value of pwdMaxFailure attribute). Replicating these attributes to a read-only replica MAY reduce the number of tries globally but MAY also introduce some inconstancies in the way the password policy is applied. 10. Security Considerations This document defines a set of rules to implement in an LDAP server, in order to improve the security of LDAP directories and make it difficult for password cracking programs to break into directories. Access controls SHOULD be used to restrict access to the password policy attributes. Especially all the attributes defined to maintain the Password Policy state information SHOULD not be modifiable by anyone but the Administrator of the directory server. As it is possible to define a password policy for one specific user by adding an subentry immediately under the user's entry, Access Controls SHOULD be used to restrict the use of the pwdPolicy object class or the LDAP subentry object class. When a password policy is put in place, the LDAP directory is subject to a denial of service attack. A malicious user could deliberately lock out one specific user's account (or all of them) by sending bind requests with wrong passwords. There is no way to protect against this kind of attack. The LDAP directory server SHOULD log as much information as it can (such as client IP address) whenever an account is locked, in order to be able to identify the origin of the attack. Denying anonymous access to the LDAP directory is also a way to restrict this kind of attacks. 11. References [RFC-2119] S. Bradner, "Key Words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997. [RFC-2195] J. Klensin, R. Catoe, P. Krumviede, "IMAP/POP AUTHorize Extension for Simple Challenge/Response", RFC 2195, September 1997. [RFC-2222] J. Myers, "Simple Authentication and Security Layer (SASL)", RFC 2222, October 1997. [RFC-2251] Wahl, M., Howes, T., Kille, S., "Lightweight Directory Access Protocol (v3)", RFC 2251, August 1997. Behera, et. al. Expires January 18, 2002 Page 33=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 [RFC-2252] Wahl, M., Coulbeck, A., Howes, T., Kille, S., "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997. [RFC-2307] L. Howard, "An Approach for Using LDAP as a Network Information Service", RFC 2307, March 1998. [RFC-Digest] Paul J. Leach, Chris Newman, "Using Digest Authentication as a SASL Mechanism", RFC 2831, May 2000. [SubEntry] Ed Reed, "LDAP Subentry schema", draft-ietf-ldup- subentry-08.txt, April 2001. [RFC-3062] K. Zeilenga, "LDAP Password Modify Extended Operation", RFC 3062, February 2001. 12. Copyright Notice Copyright (C) The Internet Society (2001). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." 13. Authors' Addresses Behera, et. al. Expires January 18, 2002 Page 34=0C= INTERNET DRAFT LDAP Password Policy 18 July 2001 Prasanta Behera Netscape Communications Corp. 4170 Network circle. Santa Clara, CA 95054 USA +1 408 276-3960 prasanta@netscape.com Valerie Chu Netscape Communications Corp. 501 E. Middlefield Rd. Mountain View, CA 94043 USA +1 650 937-3443 vchu@netscape.com Ludovic Poitou Sun Microsystems Inc. 32 Chemin du vieux ch=EAne 38240 Meylan France +33 476 188 212 ludovic.poitou@sun.com Jim Sermersheim Novell, Inc. 1800 South Novell Place Provo, Utah 84606, USA +1 801 861-3088 jimse@novell.com Behera, et. al. Expires January 18, 2002 Page 35=0C= --------------E69301B427178D1F0EAABBA3-- From list@netscape.com Fri Jul 20 19:24:46 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id TAA03912 for ; Fri, 20 Jul 2001 19:24:45 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6KNMlv17673; Fri, 20 Jul 2001 16:22:47 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6KNMmA17578; Fri, 20 Jul 2001 16:22:48 -0700 (PDT) Resent-Date: Fri, 20 Jul 2001 16:22:48 -0700 (PDT) Message-ID: <00007e4a4132$00003fa0$0000759b@mail3.wuzzlenorple.com> To: From: estoi42@wuzzlenorple.com.netscape.com Subject: Win a Palm Pilot!!!! 30107 Date: Thu, 12 Jul 2001 04:22:03 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: grebb664@yahoo.com Resent-Message-ID: <"8bdYAD.A.-RE.G1LW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable

From list@netscape.com Fri Jul 20 20:57:58 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA06618 for ; Fri, 20 Jul 2001 20:57:58 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6L0umv00909; Fri, 20 Jul 2001 17:56:48 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6L0unc27951; Fri, 20 Jul 2001 17:56:49 -0700 (PDT) Resent-Date: Fri, 20 Jul 2001 17:56:49 -0700 (PDT) Message-ID: <17376200176210575880@EAGLE> X-EM-Version: 5, 0, 0, 19 X-EM-Registration: #01B0530810E603002D00 X-Priority: 3 Reply-To: res02mg1@gte.net X-MSMail-Priority: Normal From: "David C. Dickson" To: IETF-LDAPEXT@netscape.com Subject: 21st Century Commerce Int'l EXPO 2001 - Training Conference - Phoenix, AZ Date: Fri, 20 Jul 2001 20:57:05 -0400 MIME-Version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6L0ukv27921 Resent-Message-ID: <"spz0v.A.X0G.PNNW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit To: IETF-LDAPEXT@NETSCAPE.COM TRAINING CONFERENCE: 21st Century Commerce International EXPO 2001 E-Business://Building Integrated Solutions September 10-13, 2001 Phoenix Civic Plaza Phoenix, Arizona Main Program: Registration: 7:30 a.m., September 11 Program Begins: 8:30 a.m., September 11 Wrap-up: 3:30 p.m., September 13 Continental Breakfast, Refreshments and Lunches included. About the Conference: The 21st Century Commerce International EXPO 2001 will be held in Phoenix, Arizona, September 10-13, 2001. The conference was created in 1987 as a conference and trade exhibition focused on IT solutions for the government marketplace and the Department of Defense. The EXPO has expanded to encompass commercial marketplace best business practices. EXPO offers you an opportunity to hear from some of the nations top business leaders who will discuss and examine all aspects of e-business, from infrastructure to enterprise architecture, to hardware and software, to security issues. On the trade show floor, you will see successful e-business in action: from government agencies to Fortune 500 companies to small- and medium-size enterprises making a difference for tomorrow's wired world. Who should attend: * Senior Managers (government and Industry) * Chief Information Officers * Knowledge Officers * International Business Leaders * eBusiness Architects * Information Technology Officers * Program Managers * Product Data Managers * Customer Relations Managers * Technology Providers * Small-Medium-Large Enterprises * Data Conversion Managers and Providers * Application Service Providers Among those areas that will be discussed in the tracks are: * Defining Requirements for Integrated Solutions * Strategy Focused Execution * Exploiting Value Chain Management * Electronic Enterprises-Broadening Your Space * Integrated Technologies * Electronic Government Enterprise-Governing Beyond Borders Key Presentations: * Mr. Robert D. Johnson, Executive Vice President and COO, Honeywell International and President and CEO, Honeywell Aerospace * Ms. Mary J. Mitchell, Program Executive for Electronic Government Policy, General Services Administration * Mr. Jack Garrison, Director of Integrated Logistics, Lockheed Martin * LTG Daniel G. Brown, Deputy Commander in Chief, US Transportation Command * LTG Charles S. Mahan, Jr., Deputy Chief of Staff for Logistics, US Army * RADM Ray Archer, Defense Logistics Agency * Ms. Ariane Whittemore, Assistant Deputy Chief of Naval Operations, (Fleet Readiness and Logistics) * Dr. Palmer Smith, Director of Government Solutions, Sabre, Inc. * Mr. John F. Phillips, Vice President of Aftermarket Growth, Honeywell * Mr. Barry Lerner, Vice President of Government Sales, Exostar, LLC * Mr. Walt Kozak, PricewaterhouseCoopers * Mr. Pat Holcomb, CommerceOne * Mr. Craig York, Honeywell International Three ways to register: * On-line at www.21cc.org * By fax at 703-522-3192 * By mail: AFEI, 2111 Wilson Boulevard, Suite 400, Arlington, VA 22201 Register prior to August 31 for Early Bird rates! AFEI Members: $750 Government Employees: $825 Non-Member: $900 Tutorials: $100 (September 10) GSA (MOBIS/LOGWORLD Training): $75 (September 10) Tutorials Sessions Include: * Introduction to Supply Chain Management including practical steps in planning for implementation * How to conduct auctions on the Internet. Reverse auctions - how they work - how DoD is using reverse auctions to save money * Strategy Focused Execution including an introduction to Enterprise Resource Planning (ERP) and Customer Relationship Management (CRM) * XML with examples of the practical application of XML within Industry and Government * Introduction to Enterprise Application Integration (EAI) * Configuration Management (The transition to an Industry-wide standard) We are pleased to announce that GSA will be holding a LOGWORLD/ MOBIS training session during the EXPO this year. This year the General Services Administration's (GSA) procurement innovations will be presented at the 21st Century Commerce International EXPO 2001 on September 10. GSA will provide training at EXPO 2001 for contractors and Federal agencies interested in the Logistics Worldwide (LOGWORLD) and Management, Organizational and Business Improvement Services (MOBIS) schedule contracts. LOGWORLD enables Federal agencies to procure comprehensive logistics solutions to enhance or replace existing operations and capabilities. Examples of the type of services provided under this schedule include Supply and Value Chain Management; Acquisition Logistics; Distribution and Transportation Logistics; Deployment Logistics; Logistics training services, support products and new services. MOBIS provides Federal agencies with a tool to seek expert advice for improving management and organizational effectiveness. Examples of the type of services provided under the MOBIS schedule are consulting services; facilitation services; survey services; Alternative Dispute Resolution (ADR) services; A76 study support; project management services; training services and support products. www.northwest.gsa.gov/fss/msc Executive Roundtable: This years Executive Roundtable (ERT) theme is Returns on Business Investments in the New Reality. The ERT is a special session for senior management (CEO, COO, CIO, CTO, Sr. Vice Presidents, Presidents, Executive Directors) and is offered by invitation only. If you would like to request an invitation, please contact Michelle Bourke at mbourke@afei.org. Exhibit: Booth space will be reserved on a first-come, first-served basis. Reserve your preferred location as soon as possible. The floorplan has been configured to maximize traffic throughout the display area, and the program schedule will be designed to encourage attendee participation. For more information on available booth space and prices, go to http://www.21cc.org/01exhibits.htm. We have already sold 50% of our booth spaces! Sign up soon! Conference Sponsors: * EXOSTAR * Sprint E Solutions * CSC * Phoenix Business Journal * Government Computer News * National Defense Industrial Association * National Defense Magazine * Thomas Group * BidSource * The Greater Phoenix Chamber of Commerce To view sponsorship opportunities, please visit the website at www.21cc.org Contact: Michelle Beckner Bourke, EXPO Conference Manager, at (703) 247-9473, mbourke@afei.org; If you wish to be REMOVED from this list, please REPLY by placing REMOVE in the subject line. Thank you From list@netscape.com Sat Jul 21 04:22:02 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id EAA29773 for ; Sat, 21 Jul 2001 04:22:02 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6L8KqB24736; Sat, 21 Jul 2001 01:20:52 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6L8Kqo02607; Sat, 21 Jul 2001 01:20:52 -0700 (PDT) Resent-Date: Sat, 21 Jul 2001 01:20:52 -0700 (PDT) X400-Received: by mta BAWMTA in /c=gb/admd=attmail/prmd=ba/; Relayed; 21 Jul 2001 08:20:44 Z X400-Received: by /c=gb/admd=attmail/prmd=ba/; Relayed; 21 Jul 2001 08:20:44 Z X400-MTS-Identifier: [/c=gb/admd=attmail/prmd=ba/; 009623B593B5C004-BAWMTA] Content-Identifier: 009623B593B5C004 Content-Return: Allowed X400-Content-Type: P2-1988 ( 22 ) Conversion: Allowed Original-Encoded-Information-Types: IA5-Text Priority: normal Disclose-Recipients: Prohibited Alternate-Recipient: Allowed X400-Originator: Dominic.J.Steinitz@BritishAirways.com X400-Recipients: non-disclosure; Message-Id: <"009623B593B5C004*/c=GB/admd=ATTMAIL/prmd=BA/o=British Airways PLC/ou=CORPLN1/s=Steinitz/g=Dominic/i=J/"@MHS> Date: 21 Jul 2001 08:20:44 Z From: "Steinitz, Dominic J" To: "ludovic.poitou" cc: "Taylor, Martin S" , ietf-ldapext , "ludovic.poitou" , prasanta , jimse Subject: Re: LDAP Password Policy draft... Resent-Message-ID: <"GStRqC.A.Vo.itTW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com 1. In Section 6.1 "Bind Operation", 2, B, paragraph 3: what is the StartTLS operation? It doesn't appear in RFC2251 and no reference is given. 2. In Section 7 "Client Implementation by LDAP operation", the following is specified: The scenarios in the following operations assume that the client attached a passwordPolicyRequest control to the request message of the operation, and thus MAY receive a passwordPolicyResponse control in the response message. In the event that the passwordPolicyRequest control was not sent, no passwordPolicyRequest control is returned. All other instructions remain the same. I couldn't find anything that specified what happens if the client doesn't attach a passwordPolicyRequest control and the password has expired, for example. Clearly the server can't return a passwordPolicyResponse control because Section 6 "Server Implementation by LDAP Operation" specifies: The scenarios in the following operations assume that the client has attached a passwordPolicyRequest control to the request message of the operation. In the event that the passwordPolicyRequest control was not sent, no passwordPolicyRequest control is returned. All other instructions remain the same. 3. In Section 8 "Administration of a Password Policy", the following is specified: A password policy MUST be defined for a particular subtree of the DIT by adding to an LDAP subentry whose immediate superior is the root of the subtree, the pwdPolicy auxiliary object class. The scope of the password policy is the same as the default scope of an LDAP subentry as defined in section 5.1.2 of [SubEntry]. It is possible to define password policies for different password attributes within the same pwdPolicy entry, by specifying multiple values of the pwdAttribute. But password policies could also be in separate sub entries as long as they are contained under the same LDAP subentry. I think the first sentece of the second paragraph says that the same policy can apply to two attributes, for example, objectClass: pwdPolicy pwdAttribute: userPassword pwdAttribute: sn It's not clear why the second sentence begins with "But" as it refers to two different password policies not two password attributes. Does it mean that an entry could have two sub entries each with an objectClass of pwdPolicy but one with a pwdAttribute of userPassword, say, and the other with a pwdAttribute of sn, say? I suggest something like: "It is also possible to define password policies for different password attributes by using separate sub entries as long as they are contained under the same LDAP subentry" 4. Is this draft generally implemented? Perhaps this isn't a question for this mailing list. I'm curious to know because if I modify my client would I have anything to test against? Dominic. ------------------------------------------------------------------------------------------------- 21st century air travel http://www.britishairways.com From list@netscape.com Sat Jul 21 20:14:41 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA22621 for ; Sat, 21 Jul 2001 20:14:40 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6M0DUv02091; Sat, 21 Jul 2001 17:13:30 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6M0DVg00200; Sat, 21 Jul 2001 17:13:31 -0700 (PDT) Resent-Date: Sat, 21 Jul 2001 17:13:31 -0700 (PDT) Date: Sun, 22 Jul 2001 10:12:58 +1000 Reply-To: From: "nmkiuytre445@arabia.com" To: "9868@ecuamail.com" <9868@ecuamail.com> Message-ID: <0995761022.0800142204@mail.arabia.com> Subject: ADV: Re: Make Unlimited Calls for Only $69.95/Month 37377 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Resent-Message-ID: <"bizzMC.A.iC.pqhW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable <=21-- Graphic Tag -->

We're offering new flat rate local and long distance unlimit= ed
calling plans for 0-cents per minute, from just =2469.95 per month. =

See details below or click here.

With our choice of 0-cents per minute calling plans= , you can now:

Make unlimited calls for a fixed flat monthly fee.

No longer have to pay =22per minute=22 charges.

Enjoy savings, whether you're a family, a college student,
a = small-to-medium-sized business, or have a home office.

And it's all backed by ITT Unlimited's Risk-Free Guarantee. <= /FONT><=21-- Horizontal Line Tag -->

SPECIAL INTRO OFFER

Sign up now and get FREE Internet Access.
Hurry=21 Offer expires July 24, 2001. See our Web site fo= r details.

TO SIGN UP FOR OUR SERVICE TODAY, Click Here.
Or more information call ITT Unlimited toll-free at: 1-866-328-0417

=

We at ITT Un= limited are very enthusiastic about our flat rate service, and sincerely hope t= hat you will consider giving us a shot as your long distance provider. We're sure you'll be thrilled at the quality of service, as w= ell as the savings=21
However, we do not want you receiving e-mails that you are not inter= ested in, so to have us permanently remove you from our list, email osas1963=40atozasia.com = ;with the word =22remove=22 in the subject line. We guarantee you will not receive any future e-mails from us.
Thanks for your time and consideration=21
< ** From list@netscape.com Sun Jul 22 00:22:40 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id AAA20553 for ; Sun, 22 Jul 2001 00:22:39 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6M4LNv10589; Sat, 21 Jul 2001 21:21:23 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6M4LPM04743; Sat, 21 Jul 2001 21:21:25 -0700 (PDT) Resent-Date: Sat, 21 Jul 2001 21:21:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: Sugarpine.Sierra.West@greatbasin.net, LLC To: ietf-ldapext@netscape.com Subject: Press Release Message-ID: <200172176865ietf-ldapext@netscape.com> Date: Sat, 21 Jul 2001 21:21:05 -0600 Resent-Message-ID: <"k_VNPB.A.rJB.CTlW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6M4LNv10589 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ietf.org id AAA20553 For Immediate Release Incline Village, Nevada Contact Corporate Communications www.sugarpinellc.com Sugarpine Sierra West, LLC is proud to announce 4 additional services, Sports Memorabilia, Hair Raisers, Financial Services and Worlds-Best-4 the worlds largest virtual shopping mall featuring over 2.2 million products! Save time! Save money! Make money!!! These services and products are now available to everyone. To view these tremendous opportunities, please visit our website. Sports Memorabilia may be viewed simply by clicking on its front-page banner. Hair Raisers may be viewed by visiting our web site, www.sugarpinellc.com, and select our associates’ link. Our Financial Services is linked and bannered on our home page. As you all may already know, Sugarpine Sierra West, LLC is at its heart an asset hosting company. Please don’t forget to look at our Asset Gallery to see some outstanding business and investment opportunities, as well as collectables and real estate. Sugarpine Sierra West, LLC would like to extend its sincere thanks and appreciation to all! Please visit us at our web site at: www.sugarpinellc.com. Corporate Communications: Sugarpine Sierra West, LLC Mr. Charles J. Armstrong II or Ms. Denise Pavlo Phone: 775-832-2552 E-Mail: info@sugarpinellc.com To be removed from our e-mail list, reply to this e-mail with "REMOVE" in the subject line of your reply. From list@netscape.com Sun Jul 22 10:27:51 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA11520 for ; Sun, 22 Jul 2001 10:27:50 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6MEPrB25684; Sun, 22 Jul 2001 07:25:54 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6MEPsY25303; Sun, 22 Jul 2001 07:25:54 -0700 (PDT) Resent-Date: Sun, 22 Jul 2001 07:25:54 -0700 (PDT) From: Friends@hotmail.com To: abgez@NetFriends.netscape.com Reply-To: r4sm@bigfoot.com Subject: A Personal Invitation To Financial Freedom! [dwrtb] Message-Id: <01Jul22.102547edt.119156@lacutus.wesbell.com> Date: Sun, 22 Jul 2001 10:25:46 -0400 Resent-Message-ID: <"RKE7lD.A.9KG.wJuW7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Dear Friend, Mortgages, car payments, and credit cards have become a way of life. Stop for a moment and think, how would you feel if your paycheck was yours to keep? 100% of it! I would like to introduce you to some information that will provide you with financial freedom and show you how to create true wealth. True wealth is having your money work for you instead of you working for money. This information is available to anyone who desires to be free from the bondage of debt. This is NOT a MLM program or get rich quick scheme. To request your free information, please send an email with “Send Financial Freedom Info” in the subject line to: mailto:tim48me2@n2mail.com?subject=Send_Financial_Freedom_Info Prosperously Yours, Carol Note: If you wish to be removed from further mailings, click REPLY with the word REMOVE in the subject area. All requests to be removed are immediately honored. From list@netscape.com Sun Jul 22 18:14:49 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id SAA11746 for ; Sun, 22 Jul 2001 18:14:48 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6MMDdB11225; Sun, 22 Jul 2001 15:13:39 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6MMDdk01619; Sun, 22 Jul 2001 15:13:39 -0700 (PDT) Resent-Date: Sun, 22 Jul 2001 15:13:39 -0700 (PDT) Message-ID: From: Subject: Fwd: Marketing over Net should be... Mime-Version: 1.0 Content-Type: text/html; charset="us-ascii" Date: Sun, 22 Jul 2001 15:13:27 Resent-Message-ID: <"hDM-lD.A.vY.RA1W7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com

You are receiving this e-mail because you opted-in by requesting information or requested to receive
special offers from an online purchase, in the last 6 months. To unsubscribe, please click HERE

We craft distinctive corporate identity with
unique images, animation and sound

New
Look

Our mission is to project your company in the best possible image, to the greatest number of your potential clients. Our goal is to create and implement the most sophisticated and successful ad campaign possible for your company.

We deliver the most dynamic e!mail
marketing campaign in the world

More
Clients

Our professional techniques of marketing and the quality of our ad copy, generates more quality potential customers per marketing dollar than any other form of marketing. With custom graphics, images and bullet descriptions, your potential client will not miss your message.

Direct e!mail marketing generates more
qualified leads which generate greater sales

More
Money

Conventional methods of marketing (i.e. snail mail) are 100 times more expensive, with only one tenth of the response. It is undisputable, that warm qualified leads generate greater sales. Without professional marketing, your product/service will never reach its potential growth or sales.

If you're serious about your
business then this is for you!

Fill out the following form and one
of our consultants will contact you.

Your Name:

Your Web Address:

Company Name:

State:

Business Phone:

Home Phone:

Email:

Type of Business:

From list@netscape.com Mon Jul 23 02:52:09 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAB06687 for ; Mon, 23 Jul 2001 02:52:08 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6N6otv12025; Sun, 22 Jul 2001 23:50:56 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6N6ov625614; Sun, 22 Jul 2001 23:50:57 -0700 (PDT) Resent-Date: Sun, 22 Jul 2001 23:50:57 -0700 (PDT) Message-Id: <200107230651.f6N6pUg12656@xwing.aoltw.net> From: msz To: ietf-ldapext@netscape.com Subject: ¤J¤fºô¯¸, µ¹±z¥þ¥@¬Éªº«K§Q, ¤£ª¾¹Dªº¸ê°T... X-Mailer: Mail Bomber Reply-To: jean070605@pchome.com.tw Date: Mon, 23 Jul 2001 14:47:39 +0800 Mime-Version: 1.0 Content-Type: text/html; charset=big5 Resent-Message-ID: <"6VbbfD.A.2PG.Pl8W7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6N6otv12025 Content-Transfer-Encoding: quoted-printable =AE=C8=B9C=B1M=B7~=A4J=A4f=BA=F4=AF=B8 www

=AE=C8=B9C=B1M=B7= ~=A4J=A4f=BA=F4=AF=B8 www.ET-Mall.com.tw =B5=B9=B1z=A5=FE=A5@=AC=C9...

=A5X=B0=EA=AE=C8=B9C, =A7A=AA=BE=B9D---

=AD=FE=AEa=AE=C8=A6=E6= =AA=C0=B3=CC=ABK=A9y ? =AD=FE=AE= a=AE=C8=A6=E6=AA=C0=B3=CC=BA=EB=BDo ? = =AD=FE=AEa=A6=E6=B5{=B3=CC=AE=F6=BA=A9 ? = =AD=FE=AEa=A6=E6=B5{=B3=CC=AFS=A7O ? =AD=FE=AE= a=A4j=B3=B0=AE=C8=B9C=BF=EC=AA=BA=B3=CC=A6n ?

=B0=EA=A4=BA=AE=C8=B9C, =A7A=AA=BE=B9D---

=AD=FE=AEa=AE=C8=A6=E6=AA=C0= =B3=CC=B6m=A4g ? =AD=FE=AEa=AE=C8=A6=E6=AA=C0=B3=CC=B9D=A6a ?

=A1@

=A5=FE=AEa=A5X=B9C=A1= B=BE=C7=A5=CD=B2=A6=AE=C8=A1B=B1=A1=ABQ=BBe=A4=EB=A1B=AD=FB=A4u=AE=C8=B9C= .... =A7A=AA=BE=B9D=A7=E4=AD=FE=AEa=BF=EC=B3=CC=BEA=A6X? =

=A7=E4=B3=F8=AF=C8? =A7=E4=C2=F8=BBx ? =B0=DD=AAB=A4=CD ? =A7=E4K= imo ? ...

=A4=B6=B2=D0=B1z, =A5x=C6W=B0=DF=A4@=A1y=AE=C8=B9C=B1M=B7~=A4J= =A4f=BA=F4=AF=B8=A1z www.ET-MALL.com.tw , =A5=FE=B3=A1=B3=A3=B7d=A9w=A4F !!

=A6]=AC=B0, ET-MALL =AA=BA=AE=C8=A6=E6=AA=C0=A6=A8=AD=FB, =B3=A3=ACO<= span style=3D"FONT-FAMILY: =B7s=B2=D3=A9=FA=C5=E9; FONT-SIZE: 12pt; mso-a= scii-font-family: 'Times New Roman'; mso-hansi-font-family: 'Times New Ro= man'; mso-bidi-font-family: 'Times New Roman'; mso-font-kerning: 1.0pt; m= so-ansi-language: EN-US; mso-fareast-language: ZH-TW; mso-bidi-language: = AR-SA">=A1y=A4=A4=B5=D8=A5=C1=B0=EA=AE=C8=A6=E6=B7~=AB~=BD=E8=ABO=BB= =D9=A8=F3=B7|=B7|=AD=FB=A1z, =AB~=BD=E8=A6=B3=ABO=BB=D9=A1C

=A6]=AC=B0, ET-MALL =AC=B0=ACF=A9=B2=A1y=B2=A3=B7~=B9q=A4l=A4=C6=ADp=B9=BA=A1z=BB= =B2=BE=C9=B1=C0=BCs=A8t=B2=CE, =A5[=A4J=AA=BA=AE=C8=A6=E6=AA=C0=AAA=B0=C8=AB~=BD=E8=B3z=A9= =FA=A4=C6=A1C

=A6]=AC=B0, ET-MALL =A5]=A7t=B0=EA=A4=BA=A9=D2=A6=B3=A1y=A4=A4=A4j=AB= =AC=AE=C8=A6=E6=AA=C0=A1z, =AD= n=B3=CC=ABK=A9y=AA=BA=A1B=B3=CC=BA=EB=BDo=AA= =BA=A1B=B3=CC=AFS=A7O=AA=BA=A1B=B3=CC=A6n=AA=BA....=B2=CE=B2=CE=A6=B3=A1C<= /font>

=A6]=AC=B0, ET-MALL =AA=BA=A1y =AE=F8=B6O=AA=CC=AAA=B0=C8= =A4=A4=A4=DF=A1z, =A5i=A5H=B1N=A9=D2=A6=B3=AA=BA=BB=DD=A8D, =A5=E6=B5=B9=B3=CC=B1M=B7~=A1B=B3=CC=A6X=BEA=AA=BA=AE=C8=A6= =E6=AA=C0=B4=A3=A8=D1=AAA=B0=C8...

=A1@

=B1z=B7Q=A4F=B8= =D1=A5=D8=ABe=A5x=C6W =B3=CC=ABK=A9y=A1B=B3=CC=BA=EB=BDo=A1B=B3=CC=BC= =DA=AD=B7=A1B=B3=CC=AFS=A7O...=AA=BA=A6=E6= =B5{=A6=B3=AD=FE=A8=C7=B6=DC?  &= nbsp;     &n= bsp; =B3o=A8=C7=A6=E6=B5{=A4=A3=AC=DD= =A5i=B1=A4

=B1z=A6=B3=A4=A3=AA=BE= =B9D=ADn=A7=E4=AD=FE=AEa=AE=C8=A6=E6=AA=C0=AA=BA=A7x=C2Z?   =A5u=ADn=B5=B9=A7=DA=AD=CC=B1z=AA=BA=BB=DD=A8D, E= T-MALL =AE=F8=B6O=AA=CC=AAA=B0=C8=A4=A4=A4=DF=B1N=B7|=AC=B0=B1= z
&nbs= p;        =A5=E6=A5=D1=B3=CC=B1M=B7~=AA=BA=AE=C8=A6=E6=AA=C0=B3B=B2= z...=A1@       =AE=F8=B6O=AA=CC=AAA=B0=C8=A4=A4=A4=DF -=B6q=A8=AD=BBs=A7@
=A1@

=A8=EC eT-Mall =AD=BA=AD=B6=ADq=BE\=B9q=A4l=B3=F8, X'Mas =B1= z=B4N=A6=B3=BE=F7=B7|=BAZ=B9C=A8f=B4=B5= =A9`=BC=D6=B6=E9(=A4=AD=A6W) ,

=A2x123=AEa=C1p=B7=F9=AAA=B0=C8=AE=C8= =A6=E6=AA=C0=A2x ET-MALL =AD=BA=AD=B6=A2x
CopyRightR by= LifeJet Technology Co., Ltd. All Rights Reserved. =AB=D8=C4=B3=B3=CC=A8=CE=C2s=C4=FD=BC=D2=A6=A1=AC=B0 80= 0x600=A1BIE4.0 =A5H=A4W=AA=A9=A5=BB

From list@netscape.com Mon Jul 23 02:52:48 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAA06722 for ; Mon, 23 Jul 2001 02:52:48 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6N6pev12412; Sun, 22 Jul 2001 23:51:40 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6N6pgo26348; Sun, 22 Jul 2001 23:51:42 -0700 (PDT) Resent-Date: Sun, 22 Jul 2001 23:51:42 -0700 (PDT) Message-ID: <000020c91111$000044f6$00000d42@mail3.bestbrightest.net> To: From: mikeee1028@bestbrightest.net Subject: New Internet Casino $100 Free Play!!! 3394 Date: Mon, 23 Jul 2001 02:53:20 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: myra8837@polbox.com X-OriginalArrivalTime: 23 Jul 2001 06:51:27.0699 (UTC) FILETIME=[E57CEA30:01C11343] Resent-Message-ID: <"wDPyKB.A.iaG.7l8W7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable
Come and play at the world's premiere online Casino! We are happy to offer you, in an elegant atmosphere, a 20% BONUS for your first deposit as a New Player.
Sign up now! Don't wait!
We'll automatically credit your account with a = 20% BONUS of extra chips, to wager in our casino.
Don't hesitate and try your luck!
CLICK HERE

We apologize for any email you may have inadvertently received.
Please CLICK HERE to be r= emoved from future mailings.
From list@netscape.com Mon Jul 23 06:57:05 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id GAA09944 for ; Mon, 23 Jul 2001 06:57:05 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6NAttv29433; Mon, 23 Jul 2001 03:55:55 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6NAttw15455; Mon, 23 Jul 2001 03:55:55 -0700 (PDT) Resent-Date: Mon, 23 Jul 2001 03:55:55 -0700 (PDT) Message-Id: <200107231054.GAA09795@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: ietf-ldapext@netscape.com From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-ldapext-ldapv3-dupent-07.txt Date: Mon, 23 Jul 2001 06:54:51 -0400 Sender: nsyracus@cnri.reston.va.us Resent-Message-ID: <"s9MMND.A.FxD.5KAX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the LDAP Extension Working Group of the IETF. Title : LDAP Control for a Duplicate Entry Representation of Search Results Author(s) : J. Sermersheim Filename : draft-ietf-ldapext-ldapv3-dupent-07.txt Pages : 9 Date : 20-Jul-01 This document describes a Duplicate Entry Representation control extension for the LDAP Search operation. By using the control with an LDAP search, a client requests that the server return separate entries for each value held in the specified attributes. For instance, if a specified attribute of an entry holds multiple values, the search operation will return multiple instances of that entry, each instance holding a separate single value in that attribute. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldapv3-dupent-07.txt Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-ldapext-ldapv3-dupent-07.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-ldapext-ldapv3-dupent-07.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <20010720083101.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-ldapext-ldapv3-dupent-07.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-ldapext-ldapv3-dupent-07.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <20010720083101.I-D@ietf.org> --OtherAccess-- --NextPart-- From list@netscape.com Mon Jul 23 07:24:44 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id HAA11255 for ; Mon, 23 Jul 2001 07:24:43 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6NBNcv01451; Mon, 23 Jul 2001 04:23:38 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6NBNck21173; Mon, 23 Jul 2001 04:23:38 -0700 (PDT) Resent-Date: Mon, 23 Jul 2001 04:23:38 -0700 (PDT) To: manager@pnn.com.tw From: dima@seed.net.tw Subject: The new invention products for your company (REF No. E-0723) Date: Mon, 23 Jul 2001 17:54:11 +0800 Message-Id: <37095.745963773151700.11145@localhost> MIME-Version: 1.0 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Resent-Message-ID: <"FLBAP.A.LKF.3kAX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit

This message is for Buyer's searching for new innovative productg, if this information is irrelevant for you, we apologize. Or perhaps,would you please kindly pass this information to the right person?

ATTN: Marketing Manager

Are you looking for an outstanding invention and innovative product of the 21st century?

Summer is coming, are you looking for a hi-tech technology product that will rejuvenate you? Are you searching for interactive and delightful fitness equipment to keep you fit with pleasure? And facing the global low economy, are you seeking for a popular product which would bring your company's revenue to the top?

In late 20th century, the foldable scooter has been the most popular sports item. But now in new millennium, what would be the new favorite in sports and fitness field? e-Body Rejuvenator^® is the answer. It is a high-tech intelligent innovation which has obtained patents and copyrights in 47 countries, and won major international invention awards as follows:

- Gold Medal from London International Invention Competition 2000

- Silver Medal from The 28th International Invention Competition of Geneva 2000

- The Supreme Prize of Golden Brain Award from Taiwan International Competition 2000

e-Body Rejuvenator^® is suitable for both gender and all age group to practice indoor or outdoor, either for leisure exercise or fitness purposes and that is a much wider acceptance than the foldable scooter. Besides, e-Body Rejuvenator^® is ideal and safe for long-term and regular practice, compare to foldable scooter which may have higher chance of causing injury.

Our outstanding interactive fitness equipment, e-Body Rejuvenator^® would be the most popular item this 21st century. Moreover, it is the most creative and unique item of giftware or promotion of new era. This high-tech body shaper will lead to other popular activities among new generations who are enthusiastic for high technology in both fitness and leisure fields.

Products photo : English, Japanese, French, German.< /SPAN>

" High-Tech" article : English, Japan ese, French, Germa n.

Catalogue : English-1, English-2, Japanese-1, Japanese-2, French-1, French-2 , German-1, German-2

Toptell Technology is a well-known manufacturer and exporter of electronic innovations in Taiwan. We specialize in integrating high technology into daily essentials for new millennium. We announce an innovative or patented product every year since 1998. These innovative products have won major international invention awards and we received praises from the President of Taiwan and superior government officers for our creative spirit.

The hula hoop exercise is well known for its amazing easy waist slimming result among other fitness sports. Our brand new body shaper, e-Body Rejuvenator^® , is designed and structured as fitness equipment with the concepts of high technology and ergonomic principles. This creative idea has improved the old conception, which an ordinary toy hula hoop was unable to achieve since 1958., e-Body Rejuvenator^® is specially developed to interact during entertainment, exercise and users attempt to lose weight. An electronic microprocessor provides various functions with human touch, such as voice report on turn counting and timing and crowd's cheerful or disappointed exclamations.

e-Body Rejuvenator ^® is like being with your own personal trainer who cheers and reminds the time, preventing you from overdoing the exercise. Simply enter your weight and waistline measurements, the body shaper's built-in microprocessor will then automatically calculate and accumulate the burnt out calories. In addition, this body shaper will also count and accumulate each number of turns achieved and time of use achieved, and then display all the figures on LCD screen and store in memory. A unique electronic voice reporter will speak and report the counting and timing simultaneously, as well as interact with you to encourage you to keep going and challenge your own record. There are exclamations on new record achieved or quit halfway. In addition, there is a "beep" sound effect that is similar to heartbeat sound corresponding with each turn. When the user turns the body shaper faster, the beeping speed goes faster and vice versa. User will enjoy several lifelike surrounding songs to play along while this body shaper is in use. With this interaction and interesting design, there's no more excuse for giving up using the most convenient and efficient body shaper.

e-Body Rejuvenator^® is available in other specific languages upon customers' request.

Meanwhile, we keep on inventing new products and another brand new invention and patent product with 48 countries patent will relase soon. This new invention product shall be popular for all seasons no matter is indoor or outdoor. People will surely have fun using this new fitness equipment whether summer,autumn, winter or spring. It is also suitable for all ages; the old ages will enjoy it as much as kids. This new invention and patented product is expected will released about Oct. 2001. Please visit our website www.toptell.com.tw frequently for more product details and other innovations.

Best regards,

Sharon Chu (Sales Executive)

Tina Huang (Marketing Manageress)

Toptell Technology Int'l Co. Ltd.
Suite 1203, No. 142, Sec.3, Min Chuan E. Rd.,
Taipei 105, Taiwan R.O.C.
tel: +886-2-25450089
fax:+886-2-25451637
e-mail: toptell@tpts7.seed.net.tw
www.toptell.com.tw

From list@netscape.com Tue Jul 24 10:53:41 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA22228 for ; Tue, 24 Jul 2001 10:53:39 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OEppB06950; Tue, 24 Jul 2001 07:51:52 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OEn2g29867; Tue, 24 Jul 2001 07:49:02 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 07:49:02 -0700 (PDT) Message-Id: <200107241029.GAA05924@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; CC: ietf-ldapext@netscape.com, ietf-ldup@imc.org From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-good-ldap-changelog-02.txt Date: Tue, 24 Jul 2001 06:29:39 -0400 Sender: nsyracus@cnri.reston.va.us Resent-Message-ID: <"-mxDh.A.SOH.SrYX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Definition of an Object Class to Hold LDAP Change Records Author(s) : G. Good, L. Poitou Filename : draft-good-ldap-changelog-02.txt Pages : 8 Date : 23-Jul-01 In order to support more flexible replication methods, it is desirable to specify some manner in which an LDAP client may retrieve a set of changes which have been applied to an LDAP server's database. The client, which may be another LDAP server, may then choose to update its own replicated copy of the data. This document specifies an object class which may be used to represent changes applied to an LDAP server. It also specifies a method for discovering the location of the container object which holds these change records, so that clients and servers have a common rendezvous point for this information. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-good-ldap-changelog-02.txt Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-good-ldap-changelog-02.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-good-ldap-changelog-02.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <20010723140452.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-good-ldap-changelog-02.txt --OtherAccess Content-Type: Message/External-body; name="draft-good-ldap-changelog-02.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <20010723140452.I-D@ietf.org> --OtherAccess-- --NextPart-- From list@netscape.com Tue Jul 24 13:21:45 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA03841 for ; Tue, 24 Jul 2001 13:21:44 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OHKLB11851; Tue, 24 Jul 2001 10:20:22 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OFXa224805; Tue, 24 Jul 2001 08:33:36 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 08:33:36 -0700 (PDT) From: Date: Tue, 24 Jul 01 00:17:14 EST To: yourbank@five.com Subject: FUN MAKING MONEY Message-ID: <> Resent-Message-ID: <"pz0wOC.A.F1F.9TZX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Subject: Real Money Dear Friends & Future Millionaire: AS SEEN ON NATIONAL TV: Making over half million dollars every 4 to 5 months from your home for an investment of only $25 U.S. Dollars expense one time THANK'S TO THE COMPUTER AGE AND THE INTERNET ! ================================================== BE A MILLIONAIRE LIKE OTHERS WITHIN A YEAR!!! Before you say ''Bull'', please read the following. This is the letter you have been hearing about on the news lately. Due to the popularity of this letter on the Internet, a national weekly news program recently devoted an entire show to the investigation of this program described below, to see if it really can make people money. The show also investigated whether or not the program was legal. Their findings proved once and for all that there are ''absolutely NO Laws prohibiting the participation in the program and if people can -follow the simple instructions, they are bound to make some mega bucks with only $25 out of pocket cost''. DUE TO THE RECENT INCREASE OF POPULARITY & RESPECT THIS PROGRAM HAS ATTAINED, IT IS CURRENTLY WORKING BETTER THAN EVER. This is what one had to say: ''Thanks to this profitable opportunity. I was approached many times before but each time I passed on it. I am so gladI finally joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received total $ 610,470.00 in 21 weeks, with money still coming in." Pam Hedland, Fort Lee, New Jersey. =================================================== Here is another testimonial: "This program has been around for a long time but I never believed in it. But one day when I received this again in the mail I decided to gamble my $25 on it. I followed the simple instructions and walaa ..... 3 weeks later the money started to come in. First month I only made $240.00 but the next 2 months after that I made a total of $290,000.00. So far, in the past 8 months by re-entering the program, I have made over $710,000.00 and I am playing it again. The key to success in this program is to follow the simple steps and NOT change anything.'' More testimonials later but first, ===== PRINT THIS NOW FOR YOUR FUTUREREFERENCE ====== $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you would like to make at least $500,000 every 4 to 5 months easily and comfortably, please read the following...THEN READ IT AGAIN and AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ FOLLOW THE SIMPLE INSTRUCTION BELOW AND YOUR FINANCIAL DREAMS WILL COME TRUE, GUARANTEED! INSTRUCTIONS: =====Order all 5 reports shown on the list below ===== For each report, send $5 CASH, THE NAME & NUMBER OF THE REPORT YOU ARE ORDERING and YOUR E-MAIL ADDRESS to the person whose name appears ON THAT LIST next to the report. MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE TOP LEFT CORNER in case of any mail problems. === When you place your order, make sure you order each of the 5 reports. You will need all 5 reports so that you can save them on your computer and resell them. YOUR TOTAL COST $5 X 5=$25.00. Within a few days you will receive, vie e-mail, each of the 5 reports from these 5 different individuals. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. Also make a floppy of these reports and keep it on your desk in case something happen to your computer. IMPORTANT - DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than what is instructed below in step '' 1 through 6 '' or you will loose out on majority of your profits. Once you understand the way this works, you will also see how it does not work if you change it. Remember, this method has been tested, and if you alter, it will NOT work !!! People have tried to put their friends/relatives names on all five thinking they could get all the money. But it does not work this way. Believe us, we all have tried to be greedy and then nothing happened. So Do Not try to change anything other than what is instructed. Because if you do, it will not work for you. Remember, honesty reaps the reward!!! 1.... After you have ordered all 5 reports, take this advertisement and REMOVE the name & address of the person in REPORT # 5. This person has made it through the cycle and is no doubt counting their fortune. 2.... Move the name & address in REPORT # 4 down TO REPORT # 5. 3.... Move the name & address in REPORT # 3 down TO REPORT # 4. 4.... Move the name & address in REPORT # 2 down TO REPORT # 3. 5.... Move the name & address in REPORT # 1 down TO REPORT # 2 6.... Insert YOUR name & address in the REPORT # 1 Position. PLEASE MAKE SURE you copy every name & address ACCURATELY! ========================================================== **** Take this entire letter, with the modified list of names, and save it on your computer. DO NOT MAKE ANY OTHER CHANGES. Save this on a disk as well just in case if you loose any data. To assist you with marketing your business on the internet, the 5 reports you purchase will provide you with invaluable marketing information which includes how to send bulk e-mails legally, where to find thousands of free classified ads and much more. There are 2 Primary methods to get this venture going: METHOD # 1: BY SENDING BULK E-MAIL LEGALLY ========================================================== Let's say that you decide to start small, just to see how it goes, and we will assume You and those involved send out only 5,000 e-mails each. Let's also assume that the mailing receive only a 0.2% response (the response could be much better but lets just say it is only 0.2%. Also many people will send out hundreds of thousands e-mails instead of only 5,000 each). Continuing with this example, you send out only 5,000 e-mails. With a 0.2% response, that is only 10 orders for report # 1. Those 10 people responded by sending out 5,000 e-mail each for a total of 50,000. Out of those 50,000 e-mails only 0.2% responded with orders. That's=100 people responded and ordered Report # 2 . Those 100 people mail out 5,000 e-mails each for a total of 500,000 e-mails. The 0.2% response to that is 1000 orders for Report # 3. Those 1000 people send out 5,000 e-mails each for a total of 5 million e-mails sent out. The 0.2% response to that is 10,000 orders for Report # 4. Those 10,000 people send out 5,000 e-mails each for a total of 50,000,000 (50 million) e-mails. The 0.2% response to that is 100,000 orders for Report # 5 THAT'S 100,000 ORDERS TIMES $5 EACH=$500,000.00 (half million). Your total income in this example is: 1..... $50 + 2..... $500 + 3..... $5,000 + 4 .. $50,000 + 5..... $500,000 ........ Grand Total=$555,550.00 NUMBERS DO NOT LIE. GET A PENCIL & PAPER AND FIGUREOUT THE WORST POSSIBLE RESPONSES AND NO MATTER HOW YOU CALCULATE IT, YOU WILL STILL MAKE A LOT OF MONEY ! ========================================================= REMEMBER FRIEND, THIS IS ASSUMING ONLY 10 PEOPLE ORDERING OUT OF 5,000 YOU MAILED TO. Dare to think for a moment what would happen if everyone or half or even one 4th of those people mailed 100,000e-mails each or more? There are over 150 million people on the Internet worldwide and counting. Believe me, many people will do just that, and more! METHOD # 2 : BY PLACING FREE ADS ON THE INTERNET ======================================================= Advertising on the net is very very inexpensive and there are hundreds of FREE places to advertise. Placing a lot of free ads on the Internet will easily get a larger response. We strongly suggest you start with Method # 1 and dd METHOD # 2 as you go along. For every $5 you receive, all you must do is e-mail them the Report they ordered. That's it. Always provide same day service on all orders. This will guarantee that the e-mail they send out, with your name and address on it, will be prompt because they can not advertise until they receivethe report. =========== AVAILABLE REPORTS ==================== ORDER EACH REPORT BY ITS NUMBER & NAME ONLY. Notes: Always send $5 cash (U.S. CURRENCY) for each Report. Checks NOT accepted. Make sure the cash is concealed by wrapping it in at least 2 sheets of paper. On one of those sheets of paper, Write the NUMBER & the NAME of the Report you are ordering, YOUR E-MAIL ADDRESS and your name and postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW : ==================================================== REPORT # 1: "The Insider's Guide to Advertising for Free on the Net" Order Report #1 from: M.G. 7143 Hillside Dr. W. Bloomfield, MI 48322-2847, USA __________________________________________________________ REPORT # 2: "The Insider's Guide to Sending Bulk e-mail on the Net" Order Report # 2 from: K.C. 7143 Hillside Dr. W. Bloomfield, MI 48322-2847, USA ___________________________________________________________ REPORT # 3: "Secret to Multilevel Marketing on the Net" Order Report # 3 from : B. M. 4510 Meadow Way White Lake, Mi 48383-1816, USA ________________________________________________________ REPORT # 4: "How to Become a Millionaire Utilizing MLM & the Net" Order Report # 4 from: D. J. 16 Northcrest Dr. London, Ontario, Canada N5X-3V8 ___________________________________________________________ REPORT #5: "How to Send Out 0ne Million e-mails for Free" Order Report # 5 from: E. Zurbrigg RR # 1 St. Marys, Ontario, Canada N4X-1C4 ___________________________________________________________ $$$$$$$$$ YOUR SUCCESS GUIDELINES $$$$$$$$$$$ Follow these guidelines to guarantee your success: === If you do not receive at least 10 orders for Report #1 within 2 weeks, continue sending e-mails until you do. === After you have received 10 orders, 2 to 3 weeks after that you should receive 100 orders or more for REPORT # 2. If you did not, continue advertising or sending e-mails until you do. === Once you have received 100 or more orders for Report # 2, YOU CAN RELAX, because the system is already working for you, and the cash will continue to roll in ! THIS IS IMPORTANT TO REMEMBER: Every time your name is moved down on the list, you are placed in front of a Different report. You can KEEP TRACK of your PROGRESS by watching which report people are ordering from you. IF YOU WANT TO GENERATE MORE INCOME SEND ANOTHER BATCH OF E-MAILS AND START THE WHOLE PROCESS AGAIN. There is NO LIMIT to the income you can generate from this business !!! ====================================================== FOLLOWING IS A NOTE FROM THE ORIGINATOR OF THIS PROGRAM: You have just received information that can give you financial freedom for the rest of your life, with NO RISK and JUST A LITTLE BIT OF EFFORT. You can make more money in the next few weeks and months than you have ever imagined. Follow the program EXACTLY AS INSTRUCTED. Do Not change it in any way. It works exceedingly well as it is now. Remember to e-mail a copy of this exciting report after you have put your name and address in Report #1 and moved others to #2 ...........# 5 as instructed above. One of the people you send this to may send out 100,000 or more e-mails and your name will be on every one of them. Remember though, the more you send out the more potential customers you will reach. So my friend, I have given you the ideas, information, materials and opportunity to become financially independent. IT IS UP TO YOU NOW ! ============ MORE TESTIMONIALS ================ "My name is Mitchell. My wife, Jody and I live in Chicago. I am an accountant with a major U.S. Corporation and I make pretty good money. When I received this program I grumbled to Jodyaboutreceiving ''junk mail''. I made fun of the whole thing,spoutingmy knowledge of the population and percentages involved. I ''knew'' it wouldn't work. Jody totally ignored my supposed intelligence and few days later she jumped in with both feet. I made merciless fun of her, and was ready to lay the old ''I told you so'' on her when the thing didn't work. Well, the laugh was on me! Within 3 weeks she had received 50 responses. Within the next 45 days she had received total $ 147,200.00 ........... all cash! I was shocked. I have joined Jody in her ''hobby''. Mitchell Wolf M.D., Chicago, Illinois ====================================================== ''Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back''. '' I was surprised when I found my medium size post office box crammed with orders. I made $319,210.00in the first 12 weeks. The nice thing about this deal is that it does not matter where people live. There simply isn't a better investment with a faster return and so big." Dan Sondstrom, Alberta, Canada ======================================================= ''I had received this program before. I deleted it, but later I wondered if I should have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed again by someone else.........11 months passed then it luckily came again...... I did not delete this one! I made more than $490,000 on my first try and all the money came within 22 weeks." Susan De Suza, New York, N.Y. ======================================================= ''It really is a great opportunity to make relatively easy money with little cost to you. I followed the simple instructions carefully and within 10 days the money started to come in. My first month I made $20,560.00 and by the end of third month my total cash count was $362,840.00. Life is beautiful, Thanx to internet.". Fred Dellaca, Westport, New Zealand ======================================================= ORDER YOUR REPORTS TODAY AND GET STARTED ON 'YOUR' ROAD TO FINANCIAL FREEDOM ! ======================================================= If you have any questions of the legality of this program, contact the Office of Associate Director for Marketing Practices, Federal Trade Commission, Bureau of Consumer Protection, Washington, D.C. (Note: To avoid delays make sure appropriate postage to Canada is applied if mailing from the US) -=-=-=-=--=-=-=-=-=-=-=Remove Instructions=-=-=-=-=-=-=-=-=-=-=-= ************************************************************** Do not reply to this message - To be removed from future mailings: mailto:housetips@hotmail.com?Subject=Remove ************************************************************** From list@netscape.com Tue Jul 24 14:11:04 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id OAA07988 for ; Tue, 24 Jul 2001 14:11:04 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OIA6B06515; Tue, 24 Jul 2001 11:10:06 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OI0rk25262; Tue, 24 Jul 2001 11:00:53 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 11:00:53 -0700 (PDT) Date: Tue, 24 Jul 2001 01:49:50 -0700 (PDT) Message-Id: <200107240849.f6O8nn803731@xwing.aoltw.net> To: From: Subject: Optin Leads for only $1 Resent-Message-ID: <"dP79m.A.CBG.3ebX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com ============================================================ Opt In Club Opportunities Help stamp out spam by going Opt In. ============================================================ ============================================ Optin Leads for only $1 ============================================ Now you can order your own Business Opportunity Seeker 100% Optin Leads for $1 each. Your leads are loaded into your own secured autoresponder and with the initial sales message going to them. Send them without risk - spam-free with this approved company. To learn more about this opportunity, Send Email To Mailto:optinleads1@yahoo.com ============================================================= To be unsubscribe from future mailings, click the link mailto:optout720@yahoo.com ============================================================= From list@netscape.com Tue Jul 24 15:34:44 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA14170 for ; Tue, 24 Jul 2001 15:34:43 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OJUUv27814; Tue, 24 Jul 2001 12:30:31 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OJUVQ04819; Tue, 24 Jul 2001 12:30:31 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 12:30:31 -0700 (PDT) Date: Tue, 24 Jul 2001 12:30:01 -0700 (PDT) Message-Id: <200107241930.f6OJU1g06289@ywing.netscape.com> To: From: Subject: Opt-In Leads for only $1 Resent-Message-ID: <"AYqDvD.A.AJB.UzcX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com ============================================================ Opt In Club Opportunities Help stamp out spam by going Opt In. ============================================================ ============================================ Opt-In Leads for only $1 ============================================ Now you can order your own Business Opportunity Seeker 100% Opt-In Leads for $1 each. Your leads are loaded into your own secured autoresponder and with the initial sales message going to them. Send them without risk - spam-free with this approved company. To learn more about this opportunity, Send Email To Mailto:optinleads1@yahoo.com ============================================================= To be unsubscribe from future mailings, click the link mailto:optout720@yahoo.com ============================================================= From list@netscape.com Tue Jul 24 16:17:30 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA17707 for ; Tue, 24 Jul 2001 16:17:29 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OKGEv22432; Tue, 24 Jul 2001 13:16:14 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OK8dk26521; Tue, 24 Jul 2001 13:08:39 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 13:08:39 -0700 (PDT) Message-Id: <5.0.2.1.0.20010724135101.00ad7e30@popmail2.austin.ibm.com> X-Sender: stokes@popmail2.austin.ibm.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Tue, 24 Jul 2001 15:03:22 -0500 To: ietf-ldapext@netscape.com From: Ellen Stokes Subject: ldap ACI draft status (from version 08) Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"8Jar4B.A.gdG.DXdX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Folks, Since the release of version 8 of the ldap access control model draft, we've been attempting to close the open items. This note reflects the state of those open items. You will also see separate additional notes on each remaining open item. The plan is to resolve in the next 2 weeks so the draft can be updated and a last call issued right after the IETF meeting in August. Resolved items: 1. expansion of groups/roles... reference Rob Byrne's note of July 10 that sketches the resolution. 2. authnLevel: From discussion on the mailing list after the issuance of draft 07, consensus was reached to change authnLevel to reflect hierarchical levels and not authn mechanisms. After issuance of draft 08, the number of comments solicited on this topic per Rob Byrne's July 13 note on authnLevels did not produce a statistically compelling reason to change the draft (3 (different) responses. So authnLevel as defined in draft 08 will not change. 3. Use of subentries will be removed from new draft...reference note from Kurt Z. and Ellen S. on prescriptive and subentry ACI of July 18/19. Open items: 1. generalization of permission for controls: (Mark Davidson of July 6 on ACM permission) 2. too many permissions: proposal from author Rob Byrne to remove some permission, reference note July 13 on too many permissions 3. equality matching of ACI: proposal from Steven Legg, reference note July 19/20 on Equality Matching of ACI Values Separate notes on these items will be emailed shortly. Ellen From list@netscape.com Tue Jul 24 16:18:54 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA17861 for ; Tue, 24 Jul 2001 16:18:53 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OKHeB26583; Tue, 24 Jul 2001 13:17:41 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OK9QI27615; Tue, 24 Jul 2001 13:09:26 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 13:09:26 -0700 (PDT) Message-Id: <5.0.2.1.0.20010724150226.00b1dec8@popmail2.austin.ibm.com> X-Sender: stokes@popmail2.austin.ibm.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Tue, 24 Jul 2001 15:09:07 -0500 To: ietf-ldapext@netscape.com From: Ellen Stokes Subject: Fwd: Equality Matching of ACI Values Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"8gf7b.A._sG.tXdX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Folks, Since Steven Legg put out the options and proposed resolutions, there has been no comment on the mailing list. The authors plan to change the draft to reflect 1A and 2A. Speak your comments now... Ellen >From: "Steven Legg" >To: >Subject: Equality Matching of ACI Values >Date: Thu, 19 Jul 2001 18:05:51 +1000 >Message-ID: <008601c11029$a16db670$b05508cb@osmium.adacel.com.au> >MIME-Version: 1.0 >Content-Type: text/plain; > charset="iso-8859-1" >Content-Transfer-Encoding: 7bit >X-Priority: 3 (Normal) >X-MSMail-Priority: Normal >X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 >Importance: Normal >X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2120.0 >Resent-Message-ID: <"68HuxC.A.NOC.JTpV7"@glacier> >Resent-From: ietf-ldapext@netscape.com >X-Mailing-List: >X-Loop: ietf-ldapext@netscape.com >Precedence: list >Resent-Sender: ietf-ldapext-request@netscape.com > > >LDAPexters, > >The semantics of equality matching for attribute values of the ACI syntax >has been little discussed. The current draft of the access control model >simply uses the general purpose directoryComponentsMatch rule from >draft-legg-ldapext-component-matching-03.txt as the equality matching >rule for the entryACI and subtreeACI attributes. The >directoryComponentsMatch >rule returns true if and only if all the component parts of two ACI values >being compared are the same. The precise meaning of "the same" depends on >the ASN.1 definition for the ACI syntax and is determined by the provisions >of the component matching draft. > >A reasonable target for the design of an equality matching rule for the ACI >syntax is for the equality test to align with the semantic equivalence of >the values being compared. That is, two ACIs are equal if they mean the >same thing and are not equal if they mean different things. With such a >rule redundant duplication of access control information is prevented and >semantically distinct ACIs are never blocked from being added to the same >entry. > >For most of the fields in an ACI the generic matching by >directoryComponentsMatch aligns quite nicely with semantic equivalence >within >the access control model. If two values of a field mean the same thing >directoryComponentsMatch says they are equal and if they mean different >things directoryConmponentsMatch says they are not equal. However, there >are two fields, and , where the generic matching is >not well aligned and the discrepancy may not be to everyone's liking. > >When I defined directoryComponentsMatch I also described a way of extending >it, so we can vary the meaning of "the same" for ACI matching in a >straightforward way if that is what the group wants. Later in this message >I show what that would look like for the access control model draft. > >The component matching framework also provides ways of partially matching >ACI values. Some of the possible changes discussed below alter the ASN.1 >definition for the ACI syntax and so have consequences on the partial >matching of ACIs (which are also discussed). > >---------------------------------------------------------------------------- >--- > >(1) IP Addresses > >RFC 2373 allows leading zero digits in the number parts of the textual >representations of IP addresses and also allows for compressed >representations >of addresses. A single IP address can therefore have multiple >representations. >The ABNF for ACIs allows these multiple representations and the IP addresses >are copied verbatim into a UTF8String in the binary encoding. These multiple >representations for IP addresses aren't considered equal by the generic >matching semantics of directoryComponentsMatch since it just does a >caseIgnoreMatch of the IP address character strings. > >Here are our options. > >(1.A) Leave things as they are. > >So two ACI values that have the same IP address for a machineSubject, but >using different representations, will not be equal, even if all the other >fields in the ACI are the same. > >For example, these three ACI values mean the same thing but are not equal >as things are currently defined: > > grant:r#[all]#authnLevel:strong:ipAddress:::10.9.8.7 > grant:r#[all]#authnLevel:strong:ipAddress:::10.09.08.07 > grant:r#[all]#authnLevel:strong:ipAddress:0:0:0:0:0:0:10.9.8.7 > >If I wanted to use the componentFilterMatch matching rule to search for >ACIs that contain a particular IP address, e.g. with this filter, > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.machineSubject.ipAddress.*.single", > rule caseIgnoreMatch, value "::10.9.8.7" }) > >then I will only find the ACIs with exactly the representation of the IP >address I've chosen to search on. Also, the lexicographic ordering of IP >address textual representations doesn't conform to the natural ordering >of IPv6 addresses, so I can't write a sensible filter to match ACIs with IP >addresses less than or greater some presented value (according to the >caseIgnoreOrderingMatch rule "::10.9.8.7" is greater than "::10.10.8.7" !). > >(1.B) Constrain the ABNF for so that each IP address can be >represented in only one way. > >There are a number of ways this could be done. One solution is to disallow >leading zero digits in all fields, require leading zero fields to be >compressed, but otherwise mandate the x:x:x:x:x:x:d.d.d.d form be used, >so for example, ::10.9.8.7 is okay but ::10.09.08.07 and >0:0:0:0:0:0:10.9.8.7 >are not. This would clean up the equality matching, but the ordering >relationship is still all wrong. Different constraints would enable sensible >ordering matches but require less convenient representations of legacy >IPv4 addresses. > >(1.C) Change the ASN.1 type corresponding to to >IPAddress ::= OCTET STRING (SIZE(16)). > >The conceptual data type for IP addresses that directoryComponentsMatch >operates on then becomes the address's 128 bit identifier. This implies a >notional translation from the textual representation (the ABNF for an ACI >doesn't change) into the 128 bit identifier before any comparison takes >place. >The default matching rule that directoryComponentsMatch applies to IPAddress >component values will be octetStringMatch. > >These three ACI values will be equal because the corresponding 128 bit >identifier is the same in each case according to octetStringMatch: > > grant:r#[all]#authnLevel:strong:ipAddress:::10.9.8.7 > grant:r#[all]#authnLevel:strong:ipAddress:::10.09.08.07 > grant:r#[all]#authnLevel:strong:ipAddress:0:0:0:0:0:0:10.9.8.7 > >Because of the change to the associated ASN.1, the binary representation >of an ACI would contain IP addresses as their 128 bit identifiers >regardless of the textual representation used in the LDAP string >representation of the ACI value. It also means that if an ACI value is >converted to the binary representation and then back into the LDAP >string representation the textual representation of the IP addresses >may change (e.g. the first ACI value above may come back looking like >the third value). > >Also, component matching becomes more awkward because the textual >representations cannot be used. To search for ACIs that contain a >particular IP address I would have to use a filter like this: > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.machineSubject.ipAddress.*.single", > rule octetStringMatch, value > '0000000000000000000000000a090807'H }) > >It works but it isn't pretty. At least octetStringOrderingMatch conforms >to the appropriate ordering relationship for IP addresses so >componentFilterMatch can be used to find ACIs containing IP addresses >greater than or less than an asserted value. > >(1.D) Derive a variant of directoryComponentsMatch that compares the textual >representations of IP addresses in exactly the way we want. > >We can define an equality matching rule for IP address strings, let's call >it ipAddressMatch, which simply evaluates to true if and only if the >component value and assertion value represent the same 128 bit >IPv6 address, regardless of the format in which they are presented. > >To make ipAddressMatch semantics apply when matching IP address fields of >values of the entryACI and subtreeACI attributes the equality matching rule >for these attributes has to be replaced with a variant of >directoryComponentsMatch, let's call it aciMatch, which is just like >directoryComponentsMatch except that it uses ipAddressMatch to compare >IPAddress components. I've provided some text at the end of this message >that shows how this would be written up in the ACM draft. > >These three ACI values will be equal according to aciMatch: > > grant:r#[all]#authnLevel:strong:ipAddress:::10.9.8.7 > grant:r#[all]#authnLevel:strong:ipAddress:::10.09.08.07 > grant:r#[all]#authnLevel:strong:ipAddress:0:0:0:0:0:0:10.9.8.7 > >If I want to search for ACIs that contain a particular IP address then >this filter, > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.machineSubject.ipAddress.*.single", > rule ipAddressMatch, value "::10.9.8.7" }) > >will find the ACIs with any valid representation of the IP address (e.g. >::10.9.8.7, ::10.09.08.07 and 0:0:0:0:0:0:10.9.8.7 will match each other). > >If we also define an ipAddressOrderingMatch that conforms to the necessary >ordering relationship for IP addresses then componentFilterMatch can also >be used to find ACIs containing IP addresses greater than or less than an >asserted value. > >---------------------------------------------------------------------------- >--- > >2) It isn't clear what sort of matching should apply to a >in a subject. > >The ASN.1 type corresponding to in the ABNF for an ACI is UserID. >UserID is defined to be a UTF8String in the -08 draft of the Access >Control Model. A revised draft is expected to be submitted by Friday (20th) >in which the corresponding ASN.1 type will have changed to OCTET STRING. >There are pros and cons either way, but there is also an improved solution >in the same style as (1.D). > >The is one form of authorization identity defined in RFC 2829 and >is rendered as a UTF8 character string. RFC 2829 imposes no particular >interpretation on the authorization identity strings. Whether, for example, >"SMITH" and "smith" represent the same identity or different identities >is a local implementation or deployment matter. Spaces in the identity >strings may or may not be significant. If is mapped to an ASN.1 >UTF8String directoryComponentsMatch will default to a caseIgnoreMatch of >identities, possibly regarding two separate identities as the same identity. >If is mapped to an ASN.1 OCTET STRING directoryComponentsMatch >will default to an octet comparison of the identities, possibly failing >to recognize two authorization identities as being the same. > >Here are the options. > >(2.A) Retain OCTET STRING as the ASN.1 type of UserID. > >This is the conservative approach. > >The disadvantage of having UserID defined as an OCTET STRING is that if >I want to use componentFilterMatch to search for ACIs that contain a >particular then I can only apply octetStringMatch to the UserID >component, e.g. like so: > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.idBasedSubject.oneSubject.user", > rule octetStringMatch, value '736D697468'H }) > >I can't use caseIgnore or caseExact equality, ordering or substrings rules. >They are undefined on OCTET STRING components. > >(2.B) Change the ASN.1 type of UserID back to UTF8String. > >If a deployment uses case sensitive user IDs two ACIs that apply to >completely different users can evaluate to equal. For example, these >two ACIs would be equal: > > grant:r#[all]#authnLevel:strong:authzId-u:SMITH > grant:r#[all]#authnLevel:strong:authzId-u:smith > >and so couldn't appear in the same entry. That presents a problem for >managing >ACIs if "SMITH" and "smith" are different users. > >The advantage of defining UserID as a UTF8String is that it is possible >to use componentFilterMatch in a more convenient way to search for ACIs >that contain a particular user ID, e.g. with a filter like this: > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.idBasedSubject.oneSubject.user", > rule caseIgnoreMatch, value "smith" }) > >It is also possible to use ordering or substrings rules, and the caseExact >counterparts of the caseIgnore rules. The client chooses between caseIgnore >and caseExact matching to suit their deployment. > >(2.C) Derive a variant of directoryComponentsMatch that compares UTF8String >UserID components character by character. > >UserID is defined to be a UTF8String again and we define an equality >matching rule, let's call it characterStringMatch, which evaluates to >true if and only if the attribute/component value and assertion value >match exactly character by character. Letter case and all spaces are >significant. > >If we aren't already doing so to implement (1.D), we define aciMatch >as a variant of directoryComponentsMatch, to (additionally) >compare UserID components using characterStringMatch. > >These two ACI values will not be equal according to aciMatch >(the conservative approach): > > grant:r#[all]#authnLevel:strong:authzId-u:SMITH > grant:r#[all]#authnLevel:strong:authzId-u:smith > >However, because UserID is a UTF8String it is possible to use filters >like these: > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.idBasedSubject.oneSubject.user", > rule caseIgnoreMatch, value "smith" }) > > (entryACI:componentFilterMatch:=item:{ > component > "subject.pureSubject.idBasedSubject.oneSubject.user", > rule caseExactMatch, value "smith" }) > >---------------------------------------------------------------------------- >--- > >The easiest thing to do is just stay with the status quo, options (1.A) >and (2.A), and accept their idiosyncracies. With regard to (1), IP address >subjects should be discouraged anyway, so perhaps we shouldn't be too >worried >about how well they are matched. > >The solutions with the nicest all round properties are (1.D) and (2.C). >What follows is the text that would be added to the Access Control Model >draft to effect these changes. Then the only other changes that need to >be made are to replace directoryComponentsMatch with aciMatch in the >definitions for entryACI and subtreeACI, and to redefine the UserID ASN.1 >type as a UTF8String. No changes to the ABNF would be required. > >---------------------------------------------------------------------------- >--- > >The LDAP definition for the aciMatch matching rule is: > >( NAME 'aciMatch' > SYNTAX 1.2.36.79672281.1.5.3 ) > >The aciMatch matching rule is derived from the directoryComponentsMatch >matching rule in [DirCompMatch]. The derived matching semantics of >aciMatch are defined by the following table, using the convention >described in Section 7.2 of [DirCompMatch]. > > ASN.1 Type | Matching Rule > ============+===================== > UserID | characterStringMatch > IPAddress | ipAddressMatch > > >The LDAP definition for the characterStringMatch matching rule is: > >( NAME 'characterStringMatch' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) > >The characterStringMatch rule evaluates to true if and only if the >attribute or component value and the assertion value have the same >number of characters and corresponding characters are the same. >Letter case and whitespace characters are significant in the comparison. >This matching rule may be applied to attribute or component values >of the DirectoryString ASN.1 type, any of the ASN.1 restricted character >string types, or their ASN.1 subtypes. > > >The LDAP definition for the ipAddressMatch matching rule is: > >( NAME 'ipAddressMatch' > SYNTAX ) > >The ipAddressMatch rule evaluates to true if and only if the attribute >or component value and the assertion value represent the same 128 bit >IPv6 address identifier, regardless of the textual format in which they >are presented. > >The LDAP definition for the IPAddress syntax is: > >( DESC 'IPAddress' ) > >This syntax corresponds to the IPAddress ASN.1 type from Section 4.1.2. >The LDAP string representation of attribute or assertion values in this >syntax is described by the rule in Section 4.1.1. > >---------------------------------------------------------------------------- >--- > >Cast your votes ! > >Regards, >Steven From list@netscape.com Tue Jul 24 16:22:48 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA18423 for ; Tue, 24 Jul 2001 16:22:47 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OKLfB28417; Tue, 24 Jul 2001 13:21:41 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OK8n626744; Tue, 24 Jul 2001 13:08:49 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 13:08:49 -0700 (PDT) Message-Id: <5.0.2.1.0.20010724145148.00a6b508@popmail2.austin.ibm.com> X-Sender: stokes@popmail2.austin.ibm.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Tue, 24 Jul 2001 15:08:31 -0500 To: ietf-ldapext@netscape.com From: Ellen Stokes Subject: generalized permission for controls Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"YBtAVB.A.PgG.NXdX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Folks, Mark Davidson proposed a generalized permission for controls in his note dated July 6 on ACM permissions. ------------------------------------------------------------------------------ ACI = rights "#" target "#" generalSubject permission = "x" ; execute control ; permission u can only be used on controls target = "[all]" / "[entry]" / (attribute *("," attribute)) / "[controls]" / (controlType *("," controlType)) controlType is defined in RFC2251 Control use - can use control where aci is active (this replaces the g permission in a more general way) ------------------------------------------------------------------------------- The authors like this idea and are working on text to incorporated this into the draft and move the getEffectiveRights control (and permission) in line with this proposal. We'll be putting a synopsis of this out shortly to the list. In the interim, any comments? Ellen From list@netscape.com Tue Jul 24 17:27:36 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA24674 for ; Tue, 24 Jul 2001 17:27:34 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6OKGeB26236; Tue, 24 Jul 2001 13:16:41 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6OK9BY27284; Tue, 24 Jul 2001 13:09:11 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 13:09:11 -0700 (PDT) Message-Id: <5.0.2.1.0.20010724145706.00ad71d0@popmail2.austin.ibm.com> X-Sender: stokes@popmail2.austin.ibm.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Tue, 24 Jul 2001 15:08:56 -0500 To: ietf-ldapext@netscape.com From: Ellen Stokes Subject: Fwd: too many permissions in the ACM Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"V1wH_C.A.UnG.eXdX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Folks, Since Rob Byrne put forward this proposal to remove the t and p permissions, there has been no response to this on the list. Note also that the 'g' permission will go away and is being replaced with the generalized control permission (see my previous email on 'generalized permission for controls). We plan to change the draft to reflect this proposal. So, speak your comments now. Ellen >Resent-Date: Thu, 12 Jul 2001 23:16:19 -0700 (PDT) >Sender: Robert.Byrne@Sun.COM >Date: Fri, 13 Jul 2001 08:14:29 +0200 >From: robert byrne >Organization: Sun Microsystems >X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) >X-Accept-Language: en >To: ietf-ldapext@netscape.com >Subject: too many permissions in the ACM >Resent-From: ietf-ldapext@netscape.com >X-Mailing-List: >X-Loop: ietf-ldapext@netscape.com >Resent-Sender: ietf-ldapext-request@netscape.com > > >Folks, > >This is continuing the issue Mark and others raised in the "ACM >permission" thread about the fact that there are too many permissions in >this model and the consequent complexity/manageability/security >implications of that. In this thread I want to focus on resolving this >problem as best we can. > >If you think that too-many-permissions is a flaw in this model then you >need to propose a way to fix that. Presumably the way to do that is to >drop some of the functionality that this large permissions set is >providing. However if you do that then you need to be explicit about >the functionality you are dropping so that the list can decide if that >simplicty/functionality trade off is the right thing. The way to >proceed >here is to pick a permission you don't like, go section 5, see where >it's used and see if you can live without the granularity/functionality >that permission is providing. Then you need to explain that to the >list. > >To help a bit, I have included a previous mail where I outlined the >functionality each permission provides and includes a proposal to drop >two of the permissions ("t" and "p") with an explanation of why I think >that >would be acceptable. > >Rob. > > > Mark (and others who have commented on "too many permissions"), > > > > Let's distinguish between compressing the list of permissions by > > overloading permission names (eg. why not use "read" as an > > attribute-level permission AND an entry-level permission) and dropping > > permission names which means dropping functionality from the model (eg. > > dropping "t" means you don't want to support the returnDN concept > > anymore). > > > > Here's one way to compress but not lose functionality, by reusing > > permission names and relying on whether the aci is an entry-level or > > attribute-level aci to make the difference--I've commented out the old > > permission with a ";" along with an explanation of what replaces it: > > > > " > > Permissions (some of which apply to both entries and attribute): > > > > r Read Read attribute values or Entries > > w Write Modify-add values or rename an entry's DN. > > ; replaced with "d" o Obliterate Modify-delete values > > s Search Search entries with specified > > attributes or browse the specified entry > > p searchPresence Presence only filters > > c Compare Compare attributes > > ; replaced with "a" m Make Make attributes on a new entry > > below > > this entry > > a Add Add an entry or attribute below this entry > > d Delete Delete this entry or attribute > > e Export Export entry & subordinates to new > > location > > i Import Import entry & subordinates below this > > entry from some location > > ; replaced with "w" n RenameDN Rename an entry's DN > > ; replaced with "s" b BrowseDN Browse an entry's DN > > ; replaced with "r" v ViewEntry A read level entry permission > > t ReturnDN Allows DN of entry to be disclosed in > > an operation result > > u Unveil This is the discloseOnError permission > > g GetEffectiveRights This is get effective rights > > permission > > " > > > > This reduces the permissions set from 17 to 12. But does that really > > aid understanding ? The point being that although the admin now has a > > smaller permission set that hasn't changed the fact that "w" on an > > attribute means something different to "w" on an entry. Also, by not > > overloading permissions we could, without confusion, mix attribute-level > > and entry-level permissions in the same aci (note though that currently > > an aci either contains entry-level or attribute-level permissions but > > not both). > > > > So, to dicsuss dropping functionality. First, Mark, I do not think it's > > a good idea to drop filter/search and compare permissions--they just > > seem too fundamental. I do however see two low hanging candidates to > > drop, namely "t" and "p". "t" is concerned with supporting aliasing in > > the ACM, "p" is a refinement on the search filter permission. I would > > encourage those who think we have too many permissions to at first > > consider dropping these guys. The reason I think returnDN is a good > > candidate is that hardly anyone approves of aliasing (the iPlanet LDAP > > server doesn't support it and anyone that does seems to regret > > it--performance/complexity issues). The reason I think "p" might be a > > good candidate is that it's really a refinement of "s" and could be > > viewed as just too much functionality. Dropping "t" and "p" and using > > the above "compression" gets us down to 10 permissions. > > > > After that I think it gets more difficult to find easy stuff to throw > > out: people have argued for the inclusion of "u" (disclose on error) and > > the getEffectiveRights control is key to managing deployments of this > > ACM so I think "g" (that says who can use this control) is also > > important--Mark your controlType/"use" idea could work for that but I > > think that deserves a seperate thread. The exotic looking "e" and "i" > > are concerned with the complex moddn operation and I think they make the > > required permissions for moddn easier to understand (see required perms > > for moddn in section 5). We enforce an entry-add time permission at the > > attribute-level too ("m"), again people argued for this, their point > > being that just relying on an entry-level "a" and allowing _any_ > > attribute to be added based on that is just too coarse. Another point > > here is that, for deployments where any of this extra functionality is > > not required, then the management tool for acis (and let's hope there is > > one!) can hide these extra permissions by not exposing them and > > granting/not_granting them by default; the point being that in that the > > tool can help hide the "too many permissions" complexity. > > > > To summarize: the way to approach the "too many permissions" problem is > > to first agree on the functionality we are willing to drop, if any. > > After that whether we overload permissions or not is probably not > > critical. > > > > Rob. > > > > Mark Davidson wrote: > > > > > > I have been thinking about simplifying the permissions > > > in the ACM and also adding permissions for controls. How > > > about: > > > > > > permissions for attributes: read, modify, create, delete > > > permissions for entries: read, modify, create, delete > > > > > > and add control OID ass a possible target with a permission > > > of use > > > > > > so: > > > > > > ACI = rights "#" target "#" generalSubject > > > > > > permission = "r" / ; read > > > "m" / ; modify > > > "c" / ; create > > > "d" / ; delete > > > "u" ; use > > > ; permission u can only be used on controls > > > > > > target = "[all]" / "[entry]" / (attribute *("," attribute)) / > > > "[controls]" / (controlType *("," controlType)) > > > > > > controlType is defined in RFC2251 > > > > > > Granting these permissions allows: > > > > > > Entry read - allows access to DN > > > Entry modify - can change DN > > > Entry create - can create an entry below this entry > > > Entry delete - can delete this entry > > > > > > Attribute read - can read attribute > > > Attribute modify - can modify replace attribute values > > > Attribute delete - can modify delete attribute values > > > Attribute create - can modify add attribute values > > > > > > Control use - can use control where aci is active (this > > > replaces the g permission in a more > > > general way) > > > > > > This does not give quite the same detailed level of > > > control as the current scheme, but is much easier > > > to understand from an administration point of view, > > > rather that a protocol point of view. > > > > > > Mark > > From list@netscape.com Tue Jul 24 20:17:33 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA02755 for ; Tue, 24 Jul 2001 20:17:32 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6P0GOB01963; Tue, 24 Jul 2001 17:16:24 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6P0GOU11502; Tue, 24 Jul 2001 17:16:24 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 17:16:24 -0700 (PDT) Message-ID: <00003275598f$00000e71$00003212@> To: From: bridgetkml7@yahoo.com Subject: 4 Years of College Could Cost Nothing! Date: Tue, 24 Jul 2001 17:42:42 -0500 X-Priority: 1 X-MSMail-Priority: High Resent-Message-ID: <"iXjAb.A.AzC.W_gX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com $ $ $ $ $ $ THE PROGRAM EVERYONE HAS BEEN WAITING FOR! $ $ $ $ $ $ Starting Today You Can Earn $8,000 to $32,000 Every Month! For details on this unique program click on the hyperlink below: http://www.geocities.com/sacredcash100 if you have a problem with the above hyperlink send us a email at mailto:lnppn2@yahoo.com?subject=show me: WE will send you a new link. To be removed from this mailing list type remove in the subject box mailto:lndpn5@yahoo.com?subject=remove, or fax us at 1561.273.2567 with your email address and remove me. From list@netscape.com Wed Jul 25 01:03:55 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA14209 for ; Wed, 25 Jul 2001 01:03:54 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6P52bv00736; Tue, 24 Jul 2001 22:02:37 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6P52co03183; Tue, 24 Jul 2001 22:02:38 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 22:02:38 -0700 (PDT) Message-Id: <5.1.0.14.0.20010724215857.00aa36c8@mail.dtasi.com> X-Sender: bgreenblatt@mail.dtasi.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 24 Jul 2001 22:01:50 -0700 To: Ellen Stokes , ietf-ldapext@netscape.com From: Bruce Greenblatt Subject: Re: generalized permission for controls In-Reply-To: <5.0.2.1.0.20010724145148.00a6b508@popmail2.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"BGbARC.A.Ow.pLlX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com I would like to see this kept out of the main draft, and moved forward as a separate item. I think that the rationale that is applied here should be similar to what was applied in my "application defined permissions" draft. In actuality, I think that this is really pretty much the same as the mechanism that I defined in the draft: http://search.ietf.org/internet-drafts/draft-greenblatt-ldap-perms-00.txt Bruce At 03:08 PM 7/24/01 -0500, Ellen Stokes wrote: >Folks, > >Mark Davidson proposed a generalized permission for >controls in his note dated July 6 on ACM permissions. >------------------------------------------------------------------------------ >ACI = rights "#" target "#" generalSubject > >permission = "x" ; execute control >; permission u can only be used on controls > >target = "[all]" / "[entry]" / (attribute *("," attribute)) / >"[controls]" / (controlType *("," controlType)) > >controlType is defined in RFC2251 > >Control use - can use control where aci is active (this >replaces the g permission in a more general way) >------------------------------------------------------------------------------- > >The authors like this idea and are working on text to >incorporated this into the draft and move the >getEffectiveRights control (and permission) in line with >this proposal. > >We'll be putting a synopsis of this out shortly to the list. > >In the interim, any comments? > >Ellen ============================================== Bruce Greenblatt, Ph. D. Directory Tools and Application Services, Inc. http://www.directory-applications.com From list@netscape.com Wed Jul 25 01:44:49 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA20312 for ; Wed, 25 Jul 2001 01:44:48 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6P5hcB03041; Tue, 24 Jul 2001 22:43:38 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6P5hdY14944; Tue, 24 Jul 2001 22:43:39 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 22:43:39 -0700 (PDT) Message-Id: <200107250543.f6P5h6g26915@ywing.netscape.com> From: rr06283 To: ietf-ldapext@netscape.com Subject: »e¤ë»P´ç°²ªº¤Ñ°ó -- ´¶¦N®q X-Mailer: Mail Bomber Reply-To: rr06283@pchome.com.tw Date: Wed, 25 Jul 2001 13:24:54 +0800 Mime-Version: 1.0 Content-Type: text/html; charset=big5 Resent-Message-ID: <"ur6_q.A.9oD.IylX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6P5hcB03041 Content-Transfer-Encoding: quoted-printable EZiBon =AE=C8=B9C=BA=F4

=A1@

<= b>EZiBon =AE=C8=B9C=BA=F4 - =B4=B6=A6N=AE= q=B1M=BF=E8

[ =AE=C8=B9C=BA=F4=AD=BA=AD=B6 ]

=A1@

<= /td>

=BBe=A4=EB=BBP=B4=E7=B0=B2=AA=BA=A4=D1=B0=F3 -- =B4=B6=A6N=AEq

=A1@

= ; =B1z= =B9=EF=B4=B6=A6N=AEq=AA=BA=A6L=B6H=ACO=A4=B0=BB=F2=A9O?

=ACO=AE=FC=C5y=A1B=ACO=BC=F6=B1a=B4=C4=D5=CD=BE=F0=A1= B=ACO=A8R=AE=F6=A1B=C1=D9=ACO=A5u=ACO=A4=F4=A4W=AC=A1=B0=CA=B4=E7=B0=B2=AE= q...

=A8=E4=B9=EA=B4=B6=A6N=AEq=C1=D9=A6=B3=A7A=A4=A3=AA=BE= =B9D=AA=BA=B3=B0=A4W=A8=C9=A8=FC...

=A5=EC=A8l=B6=E9SPA=A1B=AE=FC=B5s=B2=EE=A1B=A4=DB=A6h= =A9_=A9]=B6=A1=A5D=C3D=BC=D6=B6=E9=A1B=C2O=AAL=C3M=A4j=B6H=A1B=B5U=A4l=A8= q=A1B......!

=A1@

=A9=D2=A5H,= =A6=B3=A4H=BB=A1...

=B4=B6=A6N=AEq=A5u=ADn=BB=F9=AE=E6=B4=B6=A4=CE, =B5=B4=B9=EF=ACO=B3=CC=A6n=AA=BA=BBe=A4=EB=A9M=B4=E7=B0= =B2=AA=BA=A4=D1=B0=F3... [ =B9=DA=A4=DB=B4=B6=A6N=AEq ]

=ADp=B9=BA=A5~=A5X=AE=C8= =B9C=A1B=B4=E7=BBe=A4=EB=AA=BA=AAB=A4=CD=AD=CC...=

=A1@

=A5u=ADn=B1z=AD=C7=A4H= =A6P=A6=E6, =B2{=A6b=A8=EC=B4=B6=A6N=AEq=BA=C6=A8g=B3p=BB=BB=A4=AD= =A4=D1...

=A4=A3=A5=CE=A6A=AA=E1= ~~2=B8U=A6h=A4=B8~~ , =A5u=ADn 14900 =A4=B8 ( =A5u=C0u=AB=DD=B5=B9=A8=E2=A4H=A6P= =A6=E6=A1B=B2{=AA=F7=B5=B2= =B1b=AA=BA=AAB=A4=CD=B3=E1! )

=A4@=A4H=ABe=A9=B9=AA=BA=AAB=A4=CD, =A7=DA=AD=CC=A5u=AF=E0=A9M=B1z=BB=A1 Sorry !

=A4=A3=B9L=A4]=ACO=A4=A3=B6Q=B0=D5! =AA=B1=A4=AD=A4=D1= =ACO 15700 =A4=B8, =C1=D9=ACO=AD=C8=B1o...(=B6g=A5=BD=A5[ 500 =A4=B8) = ; [ =B9=DA=A4=DB=B4=B6=A6= N=AEq=A4=AD=A4=D1=B0=B2=B4=C1 ]

=A7N=AF= =BA=B8=DC	=AF=BA=AC=DD=A4H=A5=CD, =AB=F6=B3o=B8=CC=B5=B9= =A9p=A6n=A6h=AF=BA=B8=DC...= .
<= font size=3D"2">=B1=DF=C0\=AE=C9=A1A =A4p=A4k=A8=E0=A6n=A9_=AA= =BA=B0=DD=A1G=A1u=B6=FD=B6=FD=A1A=A9p=AB=E7=BB=F2=B7\|=A9M=AA=A8=AA=A8=B5=B2= =B1B=A9O=A1H=A1v =A5=C0=BF=CB=AC=DD=AC=DD=A4=F7=BF=CB=A1A=BB=A1= =A1G=A1u=AC=DD=A7a=A1I=B3s=AB=C4=A4l=B3=A3=C4=B1=B1o=A9_=A9=C7=A1K=A1v

=A5x=A5_=A5=AB=ABn=A8=CA=AAF=B8=F4=A4G=AC= q206=B8=B914=BC=D3

=A5=E6=C6[=BA=EE=B2=C42063=B8=B9 =AB~=ABO(=A6r)0769=B8=B9

=AAA=B0=C8=B1M=BDu: 02-25183070

e-mail: service@ezibon.com.tw

From list@netscape.com Wed Jul 25 02:20:03 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAA01900 for ; Wed, 25 Jul 2001 02:20:03 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6P6I9v24349; Tue, 24 Jul 2001 23:18:09 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6P6IB623846; Tue, 24 Jul 2001 23:18:11 -0700 (PDT) Resent-Date: Tue, 24 Jul 2001 23:18:11 -0700 (PDT) Message-Id: <5.1.0.14.0.20010724230736.03104510@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 24 Jul 2001 23:14:31 -0700 To: Ellen Stokes From: "Kurt D. Zeilenga" Subject: Re: generalized permission for controls Cc: ietf-ldapext@netscape.com In-Reply-To: <5.0.2.1.0.20010724145148.00a6b508@popmail2.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"pEbOvB.A.O0F.hSmX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com I would suggest this be left out of the specification and instead addressed by generalizing permissions to grant access based upon a categorization of the type of the access (read,write,...) being made as opposed to the operation/sub-operation used to access the directory. Kurt At 01:08 PM 7/24/2001, Ellen Stokes wrote: >Folks, > >Mark Davidson proposed a generalized permission for >controls in his note dated July 6 on ACM permissions. >------------------------------------------------------------------------------ >ACI = rights "#" target "#" generalSubject > >permission = "x" ; execute control >; permission u can only be used on controls > >target = "[all]" / "[entry]" / (attribute *("," attribute)) / >"[controls]" / (controlType *("," controlType)) > >controlType is defined in RFC2251 > >Control use - can use control where aci is active (this >replaces the g permission in a more general way) >------------------------------------------------------------------------------- > >The authors like this idea and are working on text to >incorporated this into the draft and move the >getEffectiveRights control (and permission) in line with >this proposal. > >We'll be putting a synopsis of this out shortly to the list. > >In the interim, any comments? > >Ellen From list@netscape.com Wed Jul 25 04:16:25 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id EAA04252 for ; Wed, 25 Jul 2001 04:16:24 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6P8FDv28708; Wed, 25 Jul 2001 01:15:13 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6P8FGg21534; Wed, 25 Jul 2001 01:15:16 -0700 (PDT) Resent-Date: Wed, 25 Jul 2001 01:15:16 -0700 (PDT) From: Subject: Hardcore Fuck Fest right Here! Date: Wed, 25 Jul 2001 18:15:24 Message-Id: <90.51715.635380@jen.com> Reply-To: nomore@usa.net Mime-Version: 1.0 Content-Type: text/html; charset="us-ascii" Resent-Message-ID: <"WMXsXB.A.3PF.SAoX7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Untitled

FRESHMAN COLLEGE SLUTS THAT WILL DO ANYTHING FOR COCK!
NO TEEN IS SAFE FROM BEING POUNDED!

ONLY $2.95 TO HAVE THESE YOUNG BITCHES SLURP UP YOUR JUICES!

LIVE TEEN FUCKING - XXX COLLEGE SLUT CHAT - AND OVER 75,000 IMAGES AND VIDEOS!!!

If you would like to unsubscribe write to us here

From list@netscape.com Wed Jul 25 06:38:59 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id GAA08197 for ; Wed, 25 Jul 2001 06:38:58 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6PAZRv10057; Wed, 25 Jul 2001 03:35:27 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6PAZQM28310; Wed, 25 Jul 2001 03:35:26 -0700 (PDT) Resent-Date: Wed, 25 Jul 2001 03:35:26 -0700 (PDT) Message-Id: <200107251033.GAA07591@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; CC: ietf-ldapext@netscape.com From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-zeilenga-ldap-namedref-04.txt Date: Wed, 25 Jul 2001 06:33:38 -0400 Sender: nsyracus@cnri.reston.va.us Resent-Message-ID: <"3NV_7C.A.B2G.hDqX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Named Subordinate References in LDAP Directories Author(s) : K. Zeilenga Filename : draft-zeilenga-ldap-namedref-04.txt Pages : 13 Date : 24-Jul-01 This document details schema and protocol elements for representing and manipulating named subordinate references in LDAP [RFC2251] directories. A referral object is used to hold subordinate reference information in the directory. These referral objects hold one or more URIs [RFC2396] contained in values of the ref attribute type and are used to generate protocol referrals and continuations. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-zeilenga-ldap-namedref-04.txt Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-zeilenga-ldap-namedref-04.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-zeilenga-ldap-namedref-04.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <20010724132345.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-zeilenga-ldap-namedref-04.txt --OtherAccess Content-Type: Message/External-body; name="draft-zeilenga-ldap-namedref-04.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <20010724132345.I-D@ietf.org> --OtherAccess-- --NextPart-- From list@netscape.com Wed Jul 25 11:32:37 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA01526 for ; Wed, 25 Jul 2001 11:32:35 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6PFVRB14080; Wed, 25 Jul 2001 08:31:27 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6PFVQc22060; Wed, 25 Jul 2001 08:31:27 -0700 (PDT) Resent-Date: Wed, 25 Jul 2001 08:31:27 -0700 (PDT) DATE: 25 Jul 01 2:21:20 PM FROM: O69m60YU5@excite.com Message-ID: TO: emailtosells2-0-0-2@hotmail.com SUBJECT: Direct E-Mail Svcs. Resent-Message-ID: <"SHhJJC.A.UYF.NZuX7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com TIRED OF ENDLESSLY POSTING YOUR ONLINE CLASSIFIED AD AND GETTING NO RESULTS? There are over 7000 such sites scattered about the web; and quite frankly, none of them generate enough traffic to be worth your while. Even when someone finds or visits one of these sites, your ad is hopelessly lost in a myriad of similar offerings. Another frustration is search engines. If you are not in the Top 10, forget about high-traffic on your web site. Not everyone can be in the Top 10 and stay there; when there are estimates of four million web pages! How do we know? We know because that's exactly what we used to do. The greatest way of marketing this century is undoubtedly direct e-mail. It's similar to the postman delivering a letter to your mailbox. There is NO stumbling on to it! The ability to promote your product, service, website, or MLM/network marketing opportunity to millions instantly is what advertisers have been dreaming of for over 100 years. We will e-mail your one page promotion to a list of our general addresses. The greatest part is, it's completely affordable. ----------------------------------------------------------------------- NOTICE: Absolutely no pornography, chain letters, get rich quick, pyramid schemes, or any threatening or questionable materials. ----------------------------------------------------------------------- STANDARD PRICING AND PROCEDURES ----------------------------------------------------------------------- EXTRACTING: Our list of general Internet addreses are actually extracted from the most popular web sites on the Internet. The addresses are verified and run through our purification process. The process includes addresses run against our custom remove filter of 2,492 keywords, as well as through our 192MB remove /flamer list. The EDU, ORG, GOV, MIL, and US domains are removed, as well as other domains that asked not to receive e-mail. ----------------------------------------------------------------------- SET-UP FEE: $150.00 This will cover the costs of uploading files, Internet Access (ISP), and software set-up. ----------------------------------------------------------------------- EVALUATION: $350.00 (optional) One of our marketing specialists will evaluate your sales letter, and offer his/her expertise on how to make it successful. ----------------------------------------------------------------------- STANDARD PRICING: (Emails Delivered) 1 Million- $725.00 per 2 Million- $675.00 per 3 Million & up- $600.00 per ----------------------------------------------------------------------- SPECIAL OFFER! This introductory offer of $350.00 includes: 1. Set-Up Fee 2. Evaluation of Sales Letter 3. 300,000 e-mails delivered ----------------------------------------------------------------------- PAYMENT POLICY All services must be paid in full prior to delivery of advertisement. Under NO CIRCUMSTANCES will any sales or marketing strategies be discussed until payment is received. ----------------------------------------------------------------------- If you are serious about Direct Email Marketing--Fax the following form to (413) 638-8517 ---------------------------------------------------------------------- PLEASE FILL THIS FORM OUT COMPLETELY! Contact Name: _____________________________________________ Business Name: ______________________________________ Business Type: ______________________________________ # Years in Business: _________________________ Address: _________________________________________________ City: ____________________ State: ______ Zip: ______________ Country: _______________ Email Address: _______________________________________________ Phone: __________________________Fax: ____________________________ ----------------------------------------------------------------------- ****************Remove Instructions******************** ******************************************************** To be removed from future mailings!!!! All REMOVE requests AUTOMATICALLY honored upon receipt. mailto:email-address-remove@excite.com?subject=take-my-email-off PLEASE understand that any effort to disrupt, close or block this REMOVE account can only result in difficulties for others wanting to be removed from our mailing list as it will be impossible to take anyone off the list if the remove instruction is not received. ******************************************************* From list@netscape.com Wed Jul 25 21:13:32 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA28010 for ; Wed, 25 Jul 2001 21:13:30 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6Q1Bxv03648; Wed, 25 Jul 2001 18:12:00 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6Q1C0217704; Wed, 25 Jul 2001 18:12:00 -0700 (PDT) Resent-Date: Wed, 25 Jul 2001 18:12:00 -0700 (PDT) Date: Thu, 26 Jul 2001 10:07:30 +0900 Message-Id: <200107260107.KAA00820@cnet0001.> Reply-To: <_benell@excite.com> From: "bigexec.net" To: "5253@aol.com" <5253@aol.com> Subject: Blazing Traffic Content-Type: text/plain; charset="us-ascii";format=flowed Content-Transfer-Encoding: 7bit Resent-Message-ID: <"vKRdQC.A.QUE.d52X7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Triple Your Business in 60 Days or Less !! Generate traffic to your website by the thousands!!! Have complete control on who receives your ad. Get thousands of Targeted visitors!!! Why it Works. Because you can deliver your message to millions of people for a fraction of the cost of conventional advertising. That's right it's less than a classified ad that would only reach a fraction of the audience. What we offer you. A complete turn-key operation for you. * Total Control- We can expose your product to hundreds of millions of people of your choosing. * Full Marketing Team - Our marketing team will help you create an effective marketing piece for your campaign . * FREE use of software - we will provide you with stste of the art software specifcally designed to contact all the prospects you need. * 100% customer service and tech support - Your success is our success !! EASY As 1...2...3... It's easy to get started simply reply today and we will set you up with this fantastic system, specifically designed for "Your success on The Net" Call 702-252-4626 To Unsubscribe to this email list, please go to _benell@excite.com and type "ELIMINATE" in the subject line. Thank you. From list@netscape.com Thu Jul 26 11:57:25 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id LAA19394 for ; Thu, 26 Jul 2001 11:57:24 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6QFtvv11482; Thu, 26 Jul 2001 08:55:58 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6QFtwc12794; Thu, 26 Jul 2001 08:55:58 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 08:55:58 -0700 (PDT) Message-Id: <5.1.0.14.0.20010726083346.035a6950@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Thu, 26 Jul 2001 08:52:09 -0700 To: robert byrne From: "Kurt D. Zeilenga" Subject: Re: generalized permission for controls Cc: Ellen Stokes , ietf-ldapext@netscape.com In-Reply-To: <3B602FD6.1C1F34C9@Sun.COM> References: <5.1.0.14.0.20010724230736.03104510@127.0.0.1> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"0abMX.A.cHD.M2DY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com At 07:57 AM 7/26/2001, robert byrne wrote: >This is a bit curt for me :). Can you elaborate ? "assert" allows assertion of values (compare, search filters) "read" allows reading of values (search read) "write" allows update of values (add, delete, modify, moddn) We've discussed this before... arguments pro and con are in the archives. Kurt From list@netscape.com Thu Jul 26 13:34:51 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA23939 for ; Thu, 26 Jul 2001 13:34:50 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6QEvXB11524; Thu, 26 Jul 2001 07:57:33 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6QEvW608231; Thu, 26 Jul 2001 07:57:32 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 07:57:32 -0700 (PDT) Sender: Robert.Byrne@Sun.COM Message-ID: <3B602F7F.D29CBCFD@Sun.COM> Date: Thu, 26 Jul 2001 16:55:59 +0200 From: robert byrne Organization: Sun Microsystems X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: Bruce Greenblatt CC: Ellen Stokes , ietf-ldapext@netscape.com Subject: Re: generalized permission for controls References: <5.1.0.14.0.20010724215857.00aa36c8@mail.dtasi.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"pkOr_C.A.LAC.Z_CY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Bruce, I think there are some important differences between this controlType idea and Application Defined Permissions: 1. ADPs are informational only, the controlType would affect directory operations that had controls attached. 2. ADPs are motivated by considerations (however worthy) from outside of LDAP. The controlType is trying to address an extensibility that is built into LDAP, namely the ability to define controls that modify operation semantics. Rob. Bruce Greenblatt wrote: > > I would like to see this kept out of the main draft, and moved forward as a > separate item. I think that the rationale that is applied here should be > similar to what was applied in my "application defined permissions" > draft. In actuality, I think that this is really pretty much the same as > the mechanism that I defined in the draft: > http://search.ietf.org/internet-drafts/draft-greenblatt-ldap-perms-00.txt > > Bruce > > At 03:08 PM 7/24/01 -0500, Ellen Stokes wrote: > >Folks, > > > >Mark Davidson proposed a generalized permission for > >controls in his note dated July 6 on ACM permissions. > >------------------------------------------------------------------------------ > >ACI = rights "#" target "#" generalSubject > > > >permission = "x" ; execute control > >; permission u can only be used on controls > > > >target = "[all]" / "[entry]" / (attribute *("," attribute)) / > >"[controls]" / (controlType *("," controlType)) > > > >controlType is defined in RFC2251 > > > >Control use - can use control where aci is active (this > >replaces the g permission in a more general way) > >------------------------------------------------------------------------------- > > > >The authors like this idea and are working on text to > >incorporated this into the draft and move the > >getEffectiveRights control (and permission) in line with > >this proposal. > > > >We'll be putting a synopsis of this out shortly to the list. > > > >In the interim, any comments? > > > >Ellen > > ============================================== > Bruce Greenblatt, Ph. D. > Directory Tools and Application Services, Inc. > http://www.directory-applications.com From list@netscape.com Thu Jul 26 13:35:24 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA24068 for ; Thu, 26 Jul 2001 13:35:23 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6QEx4B12024; Thu, 26 Jul 2001 07:59:05 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6QEx4s09111; Thu, 26 Jul 2001 07:59:04 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 07:59:04 -0700 (PDT) Sender: Robert.Byrne@Sun.COM Message-ID: <3B602FD6.1C1F34C9@Sun.COM> Date: Thu, 26 Jul 2001 16:57:26 +0200 From: robert byrne Organization: Sun Microsystems X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: "Kurt D. Zeilenga" CC: Ellen Stokes , ietf-ldapext@netscape.com Subject: Re: generalized permission for controls References: <5.1.0.14.0.20010724230736.03104510@127.0.0.1> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"kNOpHC.A._NC.2ADY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Kurt, This is a bit curt for me :). Can you elaborate ? Rob. "Kurt D. Zeilenga" wrote: > > I would suggest this be left out of the specification > and instead addressed by generalizing permissions > to grant access based upon a categorization of the > type of the access (read,write,...) being made as > opposed to the operation/sub-operation used to access > the directory. > > Kurt > > At 01:08 PM 7/24/2001, Ellen Stokes wrote: > >Folks, > > > >Mark Davidson proposed a generalized permission for > >controls in his note dated July 6 on ACM permissions. > >------------------------------------------------------------------------------ > >ACI = rights "#" target "#" generalSubject > > > >permission = "x" ; execute control > >; permission u can only be used on controls > > > >target = "[all]" / "[entry]" / (attribute *("," attribute)) / > >"[controls]" / (controlType *("," controlType)) > > > >controlType is defined in RFC2251 > > > >Control use - can use control where aci is active (this > >replaces the g permission in a more general way) > >------------------------------------------------------------------------------- > > > >The authors like this idea and are working on text to > >incorporated this into the draft and move the > >getEffectiveRights control (and permission) in line with > >this proposal. > > > >We'll be putting a synopsis of this out shortly to the list. > > > >In the interim, any comments? > > > >Ellen From list@netscape.com Thu Jul 26 14:41:17 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA24013 for ; Thu, 26 Jul 2001 13:35:00 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6QGXkB26180; Thu, 26 Jul 2001 09:33:46 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6QGXjA10115; Thu, 26 Jul 2001 09:33:45 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 09:33:45 -0700 (PDT) Message-Id: <5.1.0.14.0.20010726092925.00ab4c40@mail.dtasi.com> X-Sender: bgreenblatt@mail.dtasi.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Thu, 26 Jul 2001 09:33:05 -0700 To: robert byrne From: Bruce Greenblatt Subject: Re: generalized permission for controls Cc: Ellen Stokes , ietf-ldapext@netscape.com In-Reply-To: <3B602F7F.D29CBCFD@Sun.COM> References: <5.1.0.14.0.20010724215857.00aa36c8@mail.dtasi.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Resent-Message-ID: <"maWGpD.A.9cC.mZEY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Even so, the mechanism used to define the permission is (essentially) the same as for ADP. I also note that the control will be embedded in an existing operation, which possibly has other controls. The interaction between the ACI for the operation, the ACI for this control and the ACI for all of the other controls is not defined by this. I believe the interaction to be potentially very complex, and best left for a separate document. Bruce At 04:55 PM 7/26/01 +0200, robert byrne wrote: >Bruce, > >I think there are some important differences between this controlType >idea and Application Defined Permissions: > >1. ADPs are informational only, the controlType would affect directory >operations that had controls attached. > >2. ADPs are motivated by considerations (however worthy) from outside of >LDAP. The controlType is trying to address an extensibility that is >built into LDAP, namely the ability to define controls that modify >operation semantics. > >Rob. > >Bruce Greenblatt wrote: > > > > I would like to see this kept out of the main draft, and moved forward as a > > separate item. I think that the rationale that is applied here should be > > similar to what was applied in my "application defined permissions" > > draft. In actuality, I think that this is really pretty much the same as > > the mechanism that I defined in the draft: > > http://search.ietf.org/internet-drafts/draft-greenblatt-ldap-perms-00.txt > > > > Bruce > > > > At 03:08 PM 7/24/01 -0500, Ellen Stokes wrote: > > >Folks, > > > > > >Mark Davidson proposed a generalized permission for > > >controls in his note dated July 6 on ACM permissions. > > >----------------------------------------------------------------------- > ------- > > >ACI = rights "#" target "#" generalSubject > > > > > >permission = "x" ; execute control > > >; permission u can only be used on controls > > > > > >target = "[all]" / "[entry]" / (attribute *("," attribute)) / > > >"[controls]" / (controlType *("," controlType)) > > > > > >controlType is defined in RFC2251 > > > > > >Control use - can use control where aci is active (this > > >replaces the g permission in a more general way) > > >----------------------------------------------------------------------- > -------- > > > > > >The authors like this idea and are working on text to > > >incorporated this into the draft and move the > > >getEffectiveRights control (and permission) in line with > > >this proposal. > > > > > >We'll be putting a synopsis of this out shortly to the list. > > > > > >In the interim, any comments? > > > > > >Ellen > > > > ============================================== > > Bruce Greenblatt, Ph. D. > > Directory Tools and Application Services, Inc. > > http://www.directory-applications.com ============================================== Bruce Greenblatt, Ph. D. Directory Tools and Application Services, Inc. http://www.directory-applications.com From list@netscape.com Thu Jul 26 16:15:05 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA09127 for ; Thu, 26 Jul 2001 16:15:04 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6QKDnv08434; Thu, 26 Jul 2001 13:13:49 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6QKDog21944; Thu, 26 Jul 2001 13:13:50 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 13:13:50 -0700 (PDT) Subject: Do you know there secrets? -hqxpljlnyys To: tilly24@xcfou.operamail.com.netscape.com Date: Thu, 26 Jul 2001 11:21:34 -0800 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: 8BIT Message-Id: <5rq43dnc.458u1e@f0g4vp.yahoo.com> From: pen567@altavista.com X-Mailer: Internet Mail Service (5.5.2448.0) Resent-Message-ID: <"Ngq_hB.A.NVF.6nHY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8BIT O U R - S o f t w a re - will - S H A P E - y o u - i n t o - a - I N T E R N E T - d e t e c t i v e
Click Here For Detailed Information.

T H E - U N M A T C H A B L E - i n t e r n e t - P r i v a t e - E y e - s o f t w a r e
Click Here For Detailed Information.

click here to be removed from our mailing list. From list@netscape.com Thu Jul 26 20:41:06 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA26248 for ; Thu, 26 Jul 2001 20:41:05 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6R0bxB18565; Thu, 26 Jul 2001 17:37:59 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6R0bww08817; Thu, 26 Jul 2001 17:37:58 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 17:37:58 -0700 (PDT) Message-Id: <5.1.0.14.0.20010726173115.00aff450@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Thu, 26 Jul 2001 17:34:47 -0700 To: Bruce Greenblatt From: "Kurt D. Zeilenga" Subject: Re: generalized permission for controls Cc: robert byrne , Ellen Stokes , ietf-ldapext@netscape.com In-Reply-To: <5.1.0.14.0.20010726092925.00ab4c40@mail.dtasi.com> References: <3B602F7F.D29CBCFD@Sun.COM> <5.1.0.14.0.20010724215857.00aa36c8@mail.dtasi.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"mkvaCB.A.FJC.ifLY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com At 09:33 AM 7/26/2001, Bruce Greenblatt wrote [trimmed]: >I also note that the control will be embedded in an existing operation, which possibly has other controls. The interaction between the ACI for the operation, the ACI for this control and the ACI for all of the other controls is not defined by this. I believe the interaction to be potentially very complex, I concur with this statement. >and best left for a separate document. I suggest we re-engineer the ACM to be less tied to the specific operation used to access the directory and more tied to the kind of access operations provide to the directory. Kurt From list@netscape.com Thu Jul 26 21:17:04 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA27453 for ; Thu, 26 Jul 2001 21:17:04 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6R1FxB28733; Thu, 26 Jul 2001 18:15:59 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6R1FxI23847; Thu, 26 Jul 2001 18:15:59 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 18:15:59 -0700 (PDT) Message-Id: <200107270115.f6R1FHb20522@ywing.netscape.com> From: "David & Kim Angell" To: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Date: Thu, 26 Jul 2001 19:11:35 Resent-Message-ID: <"Miou5D.A.L0F.MDMY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6R1FxB28733 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ietf.org id VAA27453 > Like you, I have probably deleted more of these get rich quick mails than > I could care to remember! > > However, I read about this program in the newspaper and then saw it on TV > and thought … why not give it a try? Someone is going to make money out of > this, why shouldn't it be me? > > This program claims that people can make over half a million dollars ever > every 4 to 5 months from their home for a one-time investment of only $25 > U.S. Dollars. > > Yeah right? That was my reaction too … but if you do the math you can see > where they are coming from. > > Due to the popularity of this letter on the Internet, a national weekly > news program recently devoted an entire show to the investigation of the > program described below, to see if it really can make people money. The > show also investigated whether or not the program was legal.Their findings > proved once and for all that there are "absolutely NO Laws prohibiting the > participation in the program and if people can follow the simple > instructions, they are bound to make a lot of money with only $25 out of > pocket cost". > > DUE TO THE RECENT INCREASE OF POPULARITY AND RESPECT THIS PROGRAM HAS > ATTAINED, IT IS CURRENTLY WORKING BETTER THAN EVER. > > This is what existing users had to say: > > "Thanks to this profitable opportunity. I was approached many times before > but each time I passed on it. I am so glad I finally joined just to see > what one could expect in return for the minimal effort and money required. > To my astonishment, I received total $610,470.00 in 21 weeks, with money > still coming in". > > Pam Hedland, Fort Lee, New Jersey. > > Here is another testimonial: > > "This program has been around for a long time but I never believed in it. > But one day when I received this again in the mail I decided to gamble my > $25 on it. I followed the simple instructions and walaa... 3 weeks later > the money started to come in. First month I only made $240.00 but the next > 2 months after that I made a total of $290,000.00. So far, in the past 8 > months by re-entering the program, I have made over $710,000.00 and I am > playing it again. The key to success in this program is to follow the > simple steps and to NOT change anything. > > More testimonials later but first, > > ** PRINT THIS NOW FOR YOUR FUTURE REFERENCE ** > > FOLLOW THE SIMPLE INSTRUCTION BELOW AND YOUR FINANCIAL DREAMS WILL COME > TRUE, GUARANTEED! INSTRUCTIONS: > > Order all 5 reports shown on the list below. For each report, send $5 > CASH, THE NUMBER OF THE REPORT YOU ARE ORDERING and YOUR E-MAIL ADDRESS to > the person whose name appears ON THAT LIST next to the report. MAKE SURE > YOUR RETURN ADDRESS IS ON YOUR ENVELOPE IN THE TOP LEFT CORNER in case of > any mail problems. When you place your order, make sure you order each of > the 5 reports. You will need all 5 reports so that you can save them on > your computer and resell them. > > YOUR TOTAL COST $5 X 5 = $25.00. Within a few days you will receive, via > e-mail, each of the 5 reports from these 5 different individuals. Save > them on your computer so they will be accessible for you to send to the > 1,000's of people who will order them from you. Also, make a floppy of > these reports and keep it on your desk in case something happens to your > computer. IMPORTANT - DO NOT alter the names of the people who are listed > next to each report, or their sequence on the list, in any way other than > what is instructed below in step "1 through 6" or you will loose out on > the majority of your profits. Once you understand the way this works, you > will also see how it does not work if you change it. Remember, this method > has been tested, and if you alter, it will NOT work!!! People have tried > to put their friends/relatives names on all five thinking they could get > all the money. But it does not work this way. Believe us, we all have > tried to be greedy and then nothing happened. So, do not try to change > anything other than what is instructed. If you do, it will not work for > you. Remember, honesty reaps the reward!!! > > 1. After you have ordered all 5 reports, take this advertisement and > REMOVE the name & address of the person in REPORT # 5. (This person has > made it through the cycle and is no doubt counting his fortune.) > > 2. Move the name & address in REPORT #4 down TO REPORT #5. > > 3. Move the name & address in REPORT #3 down TO REPORT #4. > > 4. Move the name & address in REPORT #2 down TO REPORT #3. > > 5. Move the name & address in REPORT #1 down TO REPORT #2 > > 6. Insert YOUR name & address in the REPORT #1 Position. > > ** VERY IMPORTANT: PLEASE MAKE SURE YOU COPY EVERY NAME AND ADDRESS > ACCURATELY! > > Take this entire letter, with the modified list of names, and save it on > your Computer. DO NOT MAKE ANY OTHER CHANGES. Save this on a disk as well > just in case if you lose any data. > > To assist you with marketing your business on the Internet, the 5 reports > you purchase will provide you with invaluable marketing information which > includes how to send bulk e-mails legally, where to find thousands of free > classified ads and much more. > > THERE ARE 2 PRIMARY METHODS TO GET THIS VENTURE GOING: > > METHOD # 1: BY SENDING BULK E-MAIL LEGALLY > > Let's say that you decide to start small, just to see how it goes, and we > will assume you and those involved send out only 5,000 e-mails each. Let's > also assume that the mailing receives only a 0.2% response (the response > could be much better but lets just say it is only 0.2%. Also many people > will send out hundreds of thousands of e-mails instead of only 5,000 > each). Continuing with this example, you send out only 5,000 e-mails. With > a 0.2% response, that is only 10 orders for Report #1. Those 10 people > responded by sending out 5,000 e-mails each for a total of 50,000. Out of > those 50,000 e-mails only 0.2% responded with orders. That's = 100 people > responded and ordered Report #2. Those 100 people mail out 5,000 e-mails > each for a total of 500,000 e-mails. The 0.2% response to that is 1000 > orders for Report #3. Those 1000 people send out 5,000 e-mails each for a > total of 5 million e-mails sent out. The 0.2% response to that is 10,000 > orders for Report #4. Those 10,000 people send out 5,000 e-mails each for > a total of 50,000,000 (50 million) e-mails. The 0.2% response to that is > 100,000 orders for Report #5. THAT'S 100,000 ORDERS TIMES $5 EACH = > $500,000.00 (half million). > > Your total income in this example is: > > $50+ > > $500+ > > $5,000 + > > $50,000+ > > $500,000 > > Grand Total = $555,550.00 > > NUMBERS DO NOT LIE.GET A PENCIL & PAPER AND FIGURE OUT THE WORST POSSIBLE > RESPONSES AND NO MATTER HOW YOU CALCULATE IT, YOU WILL STILL MAKE A LOT OF > MONEY! REMEMBER, THIS IS ASSUMING ONLY 10 PEOPLE ORDERING OUT OF 5,000 YOU > MAILED TO. > > Dare to think for a moment what would happen if everyone, or half, or even > one quarter of those people, mailed 100,000 e-mails each or more? There > are over 150 million people on the Internet worldwide and counting. > Believe me, many people will do just that, and more! > > METHOD #2: BY PLACING FREE ADS ON THE INTERNET > > Advertising on the net is very inexpensive and there are hundreds of FREE > places to advertise. Placing a lot of free ads on the Internet will easily > get a larger response. We strongly suggest you start with Method #1 and > add METHOD #2 as you go along. > > For every $5 you receive, all you must do is e-mail them the Report they > ordered. That's it. Always provide same day service on all orders. This > will guarantee that the e-mail they send out, with your name and address > on it, will be prompt because they can not advertise until they receive > the report. > > ___________ AVAILABLE REPORTS_____________ > > ORDER EACH REPORT BY ITS NUMBER & NAME ONLY. > > Notes: Always send $5 cash (U.S. CURRENCY) for each Report. Checks are NOT > accepted. Make sure the cash is concealed by wrapping it in at least 2 > sheets of paper. On one of those sheets of paper, write the NUMBERand NAME > of the Report you are ordering, YOUR E-MAIL ADDRESS and your name and > postal address. > > PLACE YOUR ORDER FOR THESE REPORTS NOW: > > Report #1:"The Insider's Guide to Advertising for Free on the Net" > Order Report #1 from: > > Kimberly Angell > 4 Image Drive > Lovell, Wy 82431 > USA > > Report #2: "The Insider's Guide to Sending Bulk E-mail on the Net" > Order Report #2 from: > > J. Warne > P. O. Box 310 > Lakeside, CA 92040-9998 > USA > > Report #3:"The Secret to Multilevel Marketing on the Net" > Order Report #3 from: > > Colt Hall > P.O. Box 2812 > Midland, TX 79702-2812 > USA > > Report #4:"How to Become a Millionaire Utilizing MLM & the Net" > Order Report #4 from: > > Bernadine Bohmbach > 6501 87th St. NW > Burlington, ND 58722 > USA > > Report #5:"How to Send 1 Million E-mails For Free" > Order Report #5 from: > > Kimik > P. O. Box 175 > Alta Loma, CA 91701-0175 > USA > > Follow these guidelines to guarantee your success: > > * If you do not receive at least 10 orders for Report #1 within 2 weeks, > continue sending e-mails until you do. > > * After you have received 10 orders, 2 to 3 weeks after that you should > receive 100 orders or more for REPORT #2.If you did not, continue > advertising or sending e-mails until you do. > > * Once you have received 100 or more orders for Report #2, YOU CAN RELAX, > because the system is already working for you, and the cash will continue > to roll in! > > THIS IS IMPORTANT TO REMEMBER: > > * Every time your name is moved down on the list, you are placed in front > of a different report. You can keep track of your progress by watching > whichreport people are ordering from you. > > * IF YOU WANT TO GENERATE MORE INCOME SEND ANOTHER BATCH OF E- MAILS AND > START THE WHOLE PROCESS AGAIN. There is NO LIMIT to the income you can > generate from this business!!! > > THE FOLLOWING IS A NOTE FROM THE ORIGINATOR OF THIS PROGRAM: > > "You have just received information that can give you financial freedom > for the rest of your life, with NO RISK and JUST A LITTLE BIT OF EFFORT. > You can make more money in the next few weeks and months than you have > ever imagined. > > Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way.It > works exceedingly well as it is now. Remember to e-mail a copy of this > exciting report after you have put your name and address in Report #1 > andmoved others to #2.... #5 as instructed above. One of the people you > send this to may send out 100,000 or more e-mails and your name will be on > every one of them.Remember though, the more you send out the more > potential customers you will reach.So my friend, I have given you the > ideas, information, materials and opportunity to become financially > independent. IT IS UP TO YOU NOW! > > ********** MORE TESTIMONIALS*********** > > "My name is Mitchell. My wife, Jody and I live in Chicago. I am an > accountant with a major U.S. Corporation and I make pretty good money. > When I received this program I grumbled to Jody about receiving "junk > mail". I made fun of the whole thing, spouting my knowledge of the > population and percentages involved. I "knew" it wouldn't work. Jody > totally ignored my supposed intelligence and few days later she jumped in > with both feet. I made merciless fun of her, and was ready to lay the old > "I told you so" on her when the thing didn't work. Well, the laugh was on > me! Within 3 weeks she had received 50 responses. Within the next 45 days > she had received a total of $147,200.00 all cash! I was shocked. I have > joined Jody in her "hobby". > > Mitchell Wolf, M.D., Chicago, Illinois > > "Not being the gambling type, it took me several weeks to make up my mind > to participate in this plan. But conservative that I am, I decided that > the initial investment was so little that there was just no way that I > wouldn't get enough orders to at least get my money back. I was surprised > when I found my medium size post office box crammed with orders. I made > $319,210.00 in the first 12 weeks. The nice thing about this deal is that > it does not matter where people live. > > There simply isn't a better investment with a faster return and so big". > > Dan Sondstrom, Alberta, Canada > > "I had received this program before. I deleted it, but later I wondered if > I should have given it a try. Of course, I had no idea who to contact to > get another copy, so I had to wait until I was e-mailed again by someone > else...11 months passed then it luckily came again... I did not delete > this one! I made more than $490,000 on my first try and all the money came > within 22 weeks". > > Susan De Suza, New York, N.Y. > > "It really is a great opportunity to make relatively easy money with > little cost to you. I followed the simple instructions carefully and > within 10 days the money started to come in. In my first month I made $ > 20,560.00 and by the end of third month my total cash count was $ > 362,840.00. Life is beautiful, Thanks to Internet". > > Fred Dellaca, Westport, New Zealand > > ORDER YOUR REPORTS TODAY AND GET STARTED ON OUR ROAD TO FINANCIAL FREEDOM! > > If you have any questions of the legality of this program, contact the > Office of Associate Director for Marketing Practices, Federal Trade > Commission, Bureau of > > Consumer Protection, Washington, D.C. > > ONE TIME MAILING, NO NEED TO REMOVE > > This message is sent in compliance of the proposed bill SECTION 301. Per > Section 301, Paragraph (a)(2)(C) of S. 1618. Further transmission to you > by the sender of this e-mail may be stopped at no cost to you by replying > to this email with the word "Remove" in the subject line. > > This message is not intended for residents in the State of Washington, > screening of addresses has been done to the best of our technical ability. From list@netscape.com Fri Jul 27 02:45:34 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAA26857 for ; Fri, 27 Jul 2001 02:45:33 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6R6iOv14319; Thu, 26 Jul 2001 23:44:24 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6R6iQk18700; Thu, 26 Jul 2001 23:44:26 -0700 (PDT) Resent-Date: Thu, 26 Jul 2001 23:44:26 -0700 (PDT) X400-Received: by mta BAWMTA in /c=gb/admd=attmail/prmd=ba/; Relayed; 27 Jul 2001 06:44:12 Z X400-Received: by /c=gb/admd=attmail/prmd=ba/; Relayed; 27 Jul 2001 06:44:12 Z X400-MTS-Identifier: [/c=gb/admd=attmail/prmd=ba/; 0604D3B610DBC003-BAWMTA] Content-Identifier: 0604D3B610DBC003 Content-Return: Allowed X400-Content-Type: P2-1988 ( 22 ) Conversion: Allowed Original-Encoded-Information-Types: IA5-Text Priority: normal Disclose-Recipients: Prohibited Alternate-Recipient: Allowed X400-Originator: Dominic.J.Steinitz@BritishAirways.com X400-Recipients: non-disclosure; Message-Id: <"0604D3B610DBC003*/c=GB/admd=ATTMAIL/prmd=BA/o=British Airways PLC/ou=CORPLN1/s=Steinitz/g=Dominic/i=J/"@MHS> Date: 27 Jul 2001 06:44:12 Z From: "Steinitz, Dominic J" To: ietf-ldapext Subject: C LDAP API Resent-Message-ID: <"qe9e9.A.0jE.I3QY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Forgive me if I am asking the wrong sort of question for this group. What is the status of the the C API? I've looked through www.ietf.org and I can find draft-ldapext-ldap-c--api-05.txt which is dated 17 November 2000 and expired May 2001. It says it replaces rfc1823. Given the draft has expired and I could find no later draft, does this mean the draft is unlikely to progress to being an rfc? Dominic. ------------------------------------------------------------------------------------------------- 21st century air travel http://www.britishairways.com From list@netscape.com Fri Jul 27 04:43:30 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id EAA01737 for ; Fri, 27 Jul 2001 04:43:29 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6R8gBB17001; Fri, 27 Jul 2001 01:42:11 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6R8gBw13021; Fri, 27 Jul 2001 01:42:11 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 01:42:11 -0700 (PDT) Sender: Ludovic.Poitou@Sun.com Message-ID: <3B61295D.CFBFB457@Sun.com> Date: Fri, 27 Jul 2001 10:42:05 +0200 From: Ludovic Poitou Organization: Sun Microsystems Inc. X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.8 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: "Steinitz, Dominic J" CC: "Taylor, Martin S" , ietf-ldapext , prasanta , jimse Subject: Re: LDAP Password Policy draft... References: <"009623B593B5C004*/c=GB/admd=ATTMAIL/prmd=BA/o=British Airways PLC/ou=CORPLN1/s=Steinitz/g=Dominic/i=J/"@MHS> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"GniedC.A.CLD.hlSY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit "Steinitz, Dominic J" wrote: > 1. In Section 6.1 "Bind Operation", 2, B, paragraph 3: what is the StartTLS operation? It doesn't appear in RFC2251 and no reference is given. I will add reference to the StartTLS extended operation (RFC 2830). > > > 2. In Section 7 "Client Implementation by LDAP operation", the following is specified: > > The scenarios in the following operations assume that the client > attached a passwordPolicyRequest control to the request message of > the operation, and thus MAY receive a passwordPolicyResponse control > in the response message. In the event that the passwordPolicyRequest > control was not sent, no passwordPolicyRequest control is returned. > All other instructions remain the same. > > I couldn't find anything that specified what happens if the client doesn't attach a passwordPolicyRequest control and the password has expired, for example. Clearly the server can't return a passwordPolicyResponse control because Section 6 "Server Implementation by LDAP Operation" specifies: > > The scenarios in the following operations assume that the client has > attached a passwordPolicyRequest control to the request message of > the operation. In the event that the passwordPolicyRequest control > was not sent, no passwordPolicyRequest control is returned. All > other instructions remain the same. Ok, I will add text about what to do when there's no passwordPolicyRequest control and a password has expired. I think that the only solution is that the server should return the same LDAP error and specify the reason of the error in the message. > > 3. In Section 8 "Administration of a Password Policy", the following is specified: > > A password policy MUST be defined for a particular subtree of the > DIT by adding to an LDAP subentry whose immediate superior is the > root of the subtree, the pwdPolicy auxiliary object class. > The scope of the password policy is the same as the default scope of > an LDAP subentry as defined in section 5.1.2 of [SubEntry]. > > It is possible to define password policies for different password > attributes within the same pwdPolicy entry, by specifying multiple > values of the pwdAttribute. But password policies could also be in > separate sub entries as long as they are contained under the same > LDAP subentry. > > I think the first sentece of the second paragraph says that the same policy can apply to two attributes, for example, > > objectClass: pwdPolicy > pwdAttribute: userPassword > pwdAttribute: sn > > It's not clear why the second sentence begins with "But" as it refers to two different password policies not two password attributes. Does it mean that an entry could have two sub entries each with an objectClass of pwdPolicy but one with a pwdAttribute of userPassword, say, and the other with a pwdAttribute of sn, say? I suggest something like: > > "It is also possible to define password policies for different password attributes by using separate sub entries as long as they are contained under the same LDAP subentry" > The idea is that if you define set 2 attributes, the password policy is identical for both attributes. However you may want to define 2 different password policies for 2 separate attributes with the same scope. I'll try to clarify the text. > > 4. Is this draft generally implemented? Perhaps this isn't a question for this mailing list. I'm curious to know because if I modify my client would I have anything to test against? > > > Dominic. Thanks for your feedback. Ludovic. > > > ------------------------------------------------------------------------------------------------- > 21st century air travel http://www.britishairways.com -- Ludovic Poitou Sun Microsystems Inc. iPlanet E-Commerce Solutions - Directory Group - Grenoble - France From list@netscape.com Fri Jul 27 15:36:19 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA23766 for ; Fri, 27 Jul 2001 15:36:18 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6RJZ2B12770; Fri, 27 Jul 2001 12:35:02 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6RJZ2s27450; Fri, 27 Jul 2001 12:35:02 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 12:35:02 -0700 (PDT) Date: Fri, 27 Jul 2001 11:41:07 -0700 (PDT) From: Subbu Subramaniam To: Ludovic Poitou cc: ietf-ldapext@netscape.com, prasanta@netscape.com, jimse@novell.com Subject: Re: LDAP Password Policy draft... In-Reply-To: <3B5807CD.B5FE0AC0@Sun.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Resent-Message-ID: <"a2ScaD.A.isG.kJcY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Hi Ludovic, The definition of the pwdInHistory (section 4.2.4) should also include the text regarding hashed passwords. If the client hashes the password before sending it over to the server (a recommended method, instead of sending cleartext passwords over the network and storing them as cleartext strings on the server as well), the history cannot be verified. To that end, I would also like to see an attribute (say, 'pwdSupportedSncryptionSchemes') added to the pwdPolicy objectclass, that specifies the encryption schemes supported by the server. The clients can then make use of this value to decide which encryption scheme is to be used to encrypt the password before sending it over for updates. This attribute should be multi-valued, each value specifying a supported encryption scheme. This would help protect against clients sending over a password of type {MD5}oiwejr98wur98uw, and the server treating this whole string as a plaintext password!! Thanks, -Subbu On Fri, 20 Jul 2001, Ludovic Poitou wrote: > Hi LDAP-Ext members, > > A update to the LDAP Password Policy draft has been submited (and > attached here by). > > We did a general editing pass and modified the section 6 and 7 for > conformance to rfc 2119 and the section 8 for clarification. > The document is now complete and we would like to make it progress to > Proposed Standard. > We solicit your comments on the document. > > Thank you and best regards, > > Ludovic. > > -- > Ludovic Poitou > Sun Microsystems Inc. > iPlanet E-Commerce Solutions - Directory Group - Grenoble - France > > > -- Subbu Subramaniam Mirapoint, Inc. Tel: (408)720-3798 http://www.mirapoint.com From list@netscape.com Fri Jul 27 16:38:35 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA00912 for ; Fri, 27 Jul 2001 16:38:29 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6RKbHB09534; Fri, 27 Jul 2001 13:37:18 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6RJOiw14367; Fri, 27 Jul 2001 12:24:45 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 12:24:45 -0700 (PDT) Message-ID: <3B617511.27CBA72F@netscape.com> Date: Fri, 27 Jul 2001 10:05:05 -0400 From: mcs@netscape.com (Mark C Smith) Organization: iPlanet E-Commerce Solutions X-Mailer: Mozilla 4.77 [en] (Windows NT 5.0; U) X-Accept-Language: en MIME-Version: 1.0 To: "Steinitz Dominic J" CC: ietf-ldapext Subject: Re: C LDAP API References: <"0604D3B610DBC003*/c=GB/admd=ATTMAIL/prmd=BA/o=British Airways PLC/ou=CORPLN1/s=Steinitz/g=Dominic/i=J/"@MHS> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Resent-Message-ID: <"N_Fe3D.A.icD.u_bY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit "Steinitz, Dominic J" wrote: > > Forgive me if I am asking the wrong sort of question for this group. > > What is the status of the the C API? > > I've looked through www.ietf.org and I can find draft-ldapext-ldap-c--api-05.txt > which is dated 17 November 2000 and expired May 2001. It says it replaces rfc1823. > > Given the draft has expired and I could find no later draft, does this mean > the draft is unlikely to progress to being an rfc? Not, I do not believe that is the case. The C API document is almost done, but some serious issues were raised during the last working group last call that have not been fully addressed yet (and as editor I was discouraged from publishing a new I-D until all of the outstanding issues had been addressed). Progress has been unreasonably slow though, and as document editor I accept most of the blame for that problem. I will step up my energy level and provide a schedule for completion of this document to the LDAPEXT chairs soon. I believe most working group participants would still like to see the C LDAP API document published as an RFC, and last time we checked consensus was to continue on the standards track path. -- Mark Smith Netscape Directory Product Development From list@netscape.com Fri Jul 27 17:05:45 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA03814 for ; Fri, 27 Jul 2001 17:05:44 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6RL4cB17930; Fri, 27 Jul 2001 14:04:38 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6RCCnY11614; Fri, 27 Jul 2001 05:12:49 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 05:12:49 -0700 (PDT) Message-Id: <200107271212.f6RCCQU15332@xwing.aoltw.net> From: "John Reed" To: Subject: AAA Credit In 24 Hours !!!! Sender: "John Reed" Mime-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Date: Fri, 27 Jul 2001 08:09:33 -0400 Content-Transfer-Encoding: 8bit Resent-Message-ID: <"caDAAB.A.G1C._qVY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit
Here's How You Can Have
a Brand New
Credit Profile in 24 Hours!
The
Best Part is... It's 100% Legal, 100% Ethical, and Fully GUARANTEED!

Dear Friend,

Do you have bad credit,
judgements, bankruptcies or
any other credit problems?
Does it seem like your bad
credit is holding
you back from qualifying for a major
credit card, car loan,
or even a department store card?

Are you sick of the
embarrassment of being rejected at
your attempts to get
any credit at all? If so... I've got
some extremely good
news for you.

I Will
Show You Precisely How to Get a New, Separate, Clean
Credit File... and it will be Clear of Any Past Credit History!

And it's 100% LEGAL!

It doesn't matter, if you have judgements!
It doesn't matter, if you've filed for bankruptcy!
It doesn't matter, if you've been foreclosed!
It doesn't matter, if you have a tax lien!
It doesn't matter, if have been a slow payer in the past!

It Doesn't Matter, Because Your Credit File Will Be Completely
New
And Completely Independent Of Any Negative Past File!

With my kit...within
the next 60 days, you will quickly and easily

Get ALL Major Credit Cards
Learn Basic and Advanced
Credit Billing Techniques
Get Bank Loans FAST and
Simple
Get Mortgages NOW
Have AAA Credit on "Your
Brand New File" in 30-60 Days
Get INSTANT Credit From
Real Department Stores
Car Loans FAST and SIMPLE
And much, much more!

CLICK HERE TO LEARN MORE

Remove

From list@netscape.com Sat Jul 28 20:45:07 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA12940 for ; Sat, 28 Jul 2001 20:45:06 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6RN4HB02892; Fri, 27 Jul 2001 16:04:17 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6RN4Iw19117; Fri, 27 Jul 2001 16:04:18 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 16:04:18 -0700 (PDT) Message-Id: <5.1.0.14.0.20010727153402.00b03778@127.0.0.1> X-Sender: kurt@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Fri, 27 Jul 2001 16:01:01 -0700 To: Subbu Subramaniam From: "Kurt D. Zeilenga" Subject: Re: LDAP Password Policy draft... Cc: Ludovic Poitou , ietf-ldapext@netscape.com, prasanta@netscape.com, jimse@novell.com In-Reply-To: References: <3B5807CD.B5FE0AC0@Sun.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Resent-Message-ID: <"9P6S9.A.bpE.uNfY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com At 11:41 AM 7/27/2001, Subbu Subramaniam wrote: >The definition of the pwdInHistory (section 4.2.4) should also include the >text regarding hashed passwords. I've haven't examined the proposed text yet, but I would be very leery about depending any of this specification upon RFC 2307 hashed passwords. Besides being experimental, this feature directly conflicts with the standard track specification of userPassword [RFC 2256]. >If the client hashes the password before >sending it over to the server (a recommended method, instead of sending >cleartext passwords over the network and storing them as cleartext strings >on the server as well), the history cannot be verified. RFC 2307 userPasswords (experimental) and RFC 3112 authPasswords (informational) should be protected as if they were clear text. If exposed, they are subject to off-line dictionary attacks. >To that end, I would also like to see an attribute (say, >'pwdSupportedSncryptionSchemes') added to the pwdPolicy objectclass, that >specifies the encryption schemes supported by the server. The clients can >then make use of this value to decide which encryption scheme is to be used >to encrypt the password before sending it over for updates. Hopefully RFC 3062 becomes more widely adopted so that clients need not concern themselves with how the directory stores the password. >This attribute should be multi-valued, userPassword is, off course, multi-valued (and so is authPassword). >each value specifying a supported encryption scheme. >This would help protect against clients sending over a password of type >{MD5}oiwejr98wur98uw, and the server treating this whole string as a >plaintext password!! That's exactly what is. Per RFC 2256, userPassword holds values which are clear text passwords. Also, responding to an early portion of this thread, Ludovoc said: > However you may want to define 2 different password policies for > 2 separate attributes with the same scope. I would suggest that two different policies be held in two separate subentries. Kurt From list@netscape.com Sat Jul 28 20:48:28 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA13500 for ; Sat, 28 Jul 2001 20:48:27 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6S31wB06649; Fri, 27 Jul 2001 20:01:59 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6S31xk16822; Fri, 27 Jul 2001 20:01:59 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 20:01:59 -0700 (PDT) Date: Fri, 27 Jul 2001 20:01:29 -0700 (PDT) Message-Id: <200107280301.f6S31Tb27782@ywing.netscape.com> From: zfb5u@msn.com To: drtrqzbb9@msn.com Reply-To: clairsafe126@excite.com Subject: Increase Sales, Accept Credit Cards! [srf8w] Resent-Message-ID: <"dKrxG.A.eGE.lsiY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com We provide businesses of ALL types an opportunity to have their own no hassle Credit Card Merchant Account with NO setup fees. Good credit, bad credit, no credit -- not a problem! 95% approval rate! You will be able to accept all major credit cards including Visa, MasterCard, American Express and Discover, as well as debit cards, ATM and check guarantee services. You will have the ability to accept E-checks over the Internet with a secure server. To insure that you wont miss a sale, you will be able to accept checks by Phone or Fax. We can handle ANY business and client type! If you already have a merchant account we can lower your rates substantially with the most competitive rates in the industry and state of the art equipment and software. We will tailor a program to fit your budget and you wont pay a premium for this incredible service! If you are a U.S. or Canadian citizen and are interested in finding out additional information or to speak with one of our reps, reply to this email and include the following contact information: Your Name, Phone Number (with Area/Country code), and if possible, a best time to call. One of our sales reps will get back to you shortly. Thank you for your time. If you wish to be removed from our mailing list, please reply to this email with the subject "Remove" and you will not receive future emails from our company. From list@netscape.com Sat Jul 28 20:48:35 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA13529 for ; Sat, 28 Jul 2001 20:48:32 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6S21QB22308; Fri, 27 Jul 2001 19:01:26 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6S21RU04128; Fri, 27 Jul 2001 19:01:27 -0700 (PDT) Resent-Date: Fri, 27 Jul 2001 19:01:27 -0700 (PDT) From: Subject: EARN $46,000 IN THE NEXT 90 DAYS!!!!! Date: Sat, 28 Jul 2001 01:23:44 Message-Id: <720.556965.250889@SERVER1> Resent-Message-ID: <"kg73M.A.6_.0zhY7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com WORK AT HOME USING YOUR COMPUTER!!! __________________________________________________ Dear Friend, You can earn $46,000 or more in next the 90 days sending e-mail. Seem impossible? Read on for details (no, there is no "catch")... __________________________________________________ "AS SEEN ON NATIONAL TV" Thank you for your time and Interest. This is the letter you've been reading about in the news lately. Due to the popularity of this letter on the internet, a major nightly news program recently devoted an entire show to the investigation of the program described below, to see if it really can make people money. The show also investigated whether or not the program was legal. Their findings proved once and for all that there are, absolutely no laws prohibiting the participation in the program. This has helped to show people that this is a simple, harmless and fun way to make some extra money at home. The results of this show has been truly remarkable. So many people are participating that those involved are doing, much better than ever before. Since everyone makes more as more people try it out, its been very exciting to be a part of lately. You will understand once you experience it. "HERE IT IS BELOW" __________________________________________________ *** Print This Now For Future Reference *** The following income opportunity is one you may be interested in taking a look at. It can be started with VERY LITTLE investment and the income return is TREMENDOUS!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ If you would like to make at least $46,000 in less than 90 days! Please read the enclosed program...THEN READ IT AGAIN!!! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ THIS IS A LEGITIMATE, LEGAL, MONEY MAKING OPPORTUNITY. It does not require you to come into contact with people, do any hard work, and best of all, you never have to leave the house except to get the mail. If you believe that someday you'll get that big break that you've been waiting for, THIS IS IT! Simply follow the instructions, and your dreams will come true. This multi-level e-mail order marketing program works perfectly...100% EVERY TIME. Email is the sales tool of the future. Take advantage of this non-commercialized method of advertising NOW!!! The longer you wait, the more people will be doing business using e-mail. Get your piece of this action!!! MULTI-LEVEL MARKETING (MLM) has finally gained respectability. It is being taught in the Harvard Business School, and both Stanford Research and the Wall Street Journal have stated that between 50% and 65% of all goods and services will be sold through multi-level methods by the mid to late 1990's. This is a Multi-Billion Dollar industry and of the 3,500,000 millionaires in the WORLD, 20% ( 700,000) made their fortune in the last several years in MLM. Moreover, statistics show that over 100 people become millionaires everyday through Multi- Level Marketing. You may have heard this story before, but over the summer Donald Trump (A MULTI-BILLIONAIRE, ONE OF THE WEALTHIEST MEN IN THE WORLD) made an appearance on the David Letterman show. Dave asked him what he would do if he lost everything and had to start over from scratch. Without hesitating, Trump said he would find a good network marketing company and get to work. The audience started to hoot and boo him. He looked out at the audience and dead-panned his response "That's why I'm sitting up here and you are all sitting out there!" With network marketing you have two sources of income. Direct commissions from sales you make yourself and commissions from sales made by people you introduce to the business. Residual income is the secret of the wealthy. It means investing time or money once and getting paid again and again and again. In network marketing, it also means getting paid for the work of others. This program is currently being utilized in more than 50 different countries across the world. The enclosed INF0RMATION is something I almost let slip through my fingers. Fortunately, sometime later I re-read everything and gave some thought and study to it. My name is Johnathon Rourke. Two years ago, the corporation I worked at for the past twelve years down-sized and my position was eliminated. After unproductive job interviews, I decided to open my own business. Over the past year, I incurred many unforeseen financial problems. I owed my family, friends and creditors over $35,000. The economy was taking a toll on my business and I just couldn't seem to make ends meet. I had to refinance and borrow against my home to support my family and struggling business. AT THAT MOMENT something significant happened in my life and I am writing to share the experience in hopes that this will change your life FOREVER FINANCIALLY!!! In mid December, I received this program via e-mail. Six month's prior to receiving this program I had been sending away for INF0RMATION on various business opportunities. All of the programs I received, in my opinion, were not cost effective. They were either too difficult for me to comprehend or the initial investment was too much for me to risk to see if they would work or not. One claimed that I would make a million dollars in one year...it didn't tell me I'd have to write a book to make it! But like I was saying, in December of 1997 I received this program. I didn't send for it, or ask for it, they just got my name off a mailing list. THANK GOODNESS FOR THAT!!! After reading it several times, to make sure I was reading it correctly, I couldn't believe my eyes. Here was a MONEY MAKING PHENOMENON. I could invest as much as I wanted to start, without putting me further into debt. After I got a pencil and paper and figured it out, I would at least get my money back. But like most of you I was still a little skeptical and a little worried about the legal aspects of it all. So I checked it out with the US Post Office (1-800-725-2161 24-hrs) and they confirmed that it is indeed legal! After determining the program was LEGAL and NOT A CHAIN LETTER, I decided "WHY NOT." Initially I sent out 100,000 e-mails. It cost me about $15 for my time on-line. The great thing about e-mail is that I don't need any money for printing to send out the program, and because all of my orders are fulfilled via e-mail, the only expense is my time. I am telling you like it is, I hope it doesn't turn you off, but I promised myself that I would not "rip-off" anyone, no matter how much money it cost me. In less than one week, I was starting to receive orders for REPORT #1. By January 13, I had received 26 orders for REPORT #1. Your goal is to "RECEIVE at least 20 ORDERS FOR REPORT #1 WITHIN 2 WEEKS. IF YOU DON'T, SEND OUT MORE PROGRAMS UNTIL YOU DO!" My first step in making $46,000 in 90 days was done. By January 30, I had received 196 orders for REPORT #2. Your goal is to "RECEIVE AT LEAST 100+ ORDERS FOR REPORT #2 WITHIN 2 WEEKS. IF NOT, SEND OUT MORE PROGRAMS UNTIL YOU DO. ONCE YOU HAVE 100 ORDERS, THE REST IS EASY, RELAX, YOU WILL MAKE YOUR $46,000 GOAL." Well, I had 196 orders for REPORT #2, 96 more than I needed. So I sat back and relaxed. By March 1, of my e-mailing of 100,000, I received $42,000 with more coming in every day. I paid off ALL my debts and bought a much needed new car. Please take time to read the attached program, IT WILL CHANGE YOUR LIFE FOREVER!!! Remember, it won't work if you don't try it. This program does work, but you must follow it EXACTLY! Especially the rules of not trying to place your name in a different place. It won't work, you'll lose out on a lot of money! In order for this program to work, you must meet your goal of 20+ orders for REPORT #1, and 100+ orders for REPORT #2 and you will make $46,000 or more in 90 days. I AM LIVING PROOF THAT IT WORKS!!! If you choose not to participate in this program, I am sorry. It really is a great opportunity with little cost or risk to you. If you choose to participate, follow the program and you will be on your way to financial security. If you are a fellow business owner and are if financial trouble like I was, or you want to start your own business, consider this a sign. I DID! Sincerely, Johnathon Rourke ------------------------------------------------------------------ ------ A PERSONAL NOTE FROM THE ORIGINATOR OF THIS PROGRAM: By the time you have read the enclosed program and reports, you should have concluded that such a program, and one that is legal, could not have been created by an amateur. Let me tell you a little about myself. I had a profitable business for 10 years. Then in 1979 my business began falling off. I was doing the same things that were previously successful for me, but it wasn't working. Finally, I figured it out. It wasn't me, it was the economy. Inflation and recession had replaced the stable economy that had been with us since 1945. I don't have to tell you what happened to the unemployment rate... because many of you know from first hand experience. There were more failures and bankruptcies than ever before. The middle class was vanishing. Those who knew what they were doing invested wisely and moved up. Those who did not, including those who never had anything to save or invest, were moving down into the ranks of the poor. As the saying goes, "THE RICH GET RICHER AND THE POOR GET POORER." The traditional methods of making money will never allow you to "move up" or "get rich", inflation will see to that. You have just received INF0RMATION that can give you financial freedom for the rest of your life, with "NO RISK" and "JUST A LITTLE BIT OF EFFORT." You can make more money in the next few months than you have ever imagined. I should also point out that I will not see a penny of this money, nor anyone else who has provided a testimonial for this program. I have already made over 4 MILLION DOLLARS! I have retired from the program after sending out over 1,600,000 programs. Now I have several offices that make this and several other programs here and over seas. Follow the program EXACTLY AS INSTRUCTED. Do not change it in any way. It works exceedingly well as it is now. Remember to e-mail a copy of this exciting report to everyone you can think of. One of the people you send this to may send out 100,000 or more...and your name will be on everyone of them! Remember though, the more you send out the more potential customers you will reach. So my friend, I have given you the ideas, INF0RMATION, materials and opportunity to become financially independent, IT IS UP TO YOU NOW! "THINK ABOUT IT" Before you delete this program from your mailbox, as I almost did, take a little time to read it and REALLY THINK ABOUT IT. Get a pencil and figure out what could happen when YOU participate. Figure out the worst possible response and no matter how you calculate it, you will still make a lot of money! You will definitely get back what you invested. Any doubts you have will vanish when your first orders come in. IT WORKS! Jody Jacobs, Richmond, VA HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU THOUSANDS OF DOLLAR$ INSTRUCTIONS: This method of raising capital REALLY WORKS 100% EVERY TIME. I am sure that you could use up to $46,000 or more in the next 90 days. Before you say "BULL... ", please read this program carefully. This is not a chain letter, but a perfectly legal money making opportunity. Basically, this is what you do: As with all multi-level businesses, we build our business by recruiting new partners and selling our products. Because of the global nature of the internet, you will be able to recruit new multi-level business partners from all over the world, and we offer a product for EVERY dollar sent. YOUR ORDERS COME BY MAIL AND ARE FILLED BY E-MAIL, so you are not involved in personal selling. You do it privately in your own home, store or office. This is the GREATEST Multi-Level Mail Order Marketing anywhere. This is what you MUST do: 1. Order all 5 reports shown on the list below(you can't sell them if you don't order them). a. For each report, send $5.00 CASH, the NAME & NUMBER OF THE REPORT YOU ARE ORDERING, YOUR E-MAIL ADDRESS, and YOUR NAME & RETURN ADDRESS (in case of a problem) to the person whose name appears on the list next to the report. MAKE SURE YOUR RETURN ADDRESS IS ON YOUR ENVELOPE IN CASE OF ANY MAIL PROBLEMS! b. When you place your order, make sure you order each of the five reports. You will need all five reports so that you can save them on your computer and resell them. c. Within a few days you will receive, via e-mail, each of the five reports. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. 2. IMPORTANT-- DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than is instructed below in steps "a" through "g" or you will lose out on the majority of your profits. Once you understand the way this works, you'll also see how it doesn't work if you change it. Remember, this method has been tested, and if you alter it, it will not work. a. Look below for the listing of available reports. b. After you've ordered the five reports, take this advertisement and REM0VE the name and address under REPORT #5. This person has made it through the cycle and is no doubt counting their $46,000! Also, change the name of the company, the address, and the REM0VE e-mail address on the top of this document to your own. c. Move the name and address under REPORT #4 down to REPORT #5. d. Move the name and address under REPORT #3 down to REPORT #4. e. Move the name and address under REPORT #2 down to REPORT #3. f. Move the name and address under REPORT #1 down to REPORT #2. g. Insert your name/address in the REPORT #1 position. Please make sure you copy every name and address ACCURATELY! 3. Take this entire letter, including the modified list of names, and save it to your computer. Make NO changes to the instruction portion of this letter. Your cost to participate in this is practically nothing (surely you can afford $25). You obviously already have an Internet connection and e-mail is FREE! To assist you with marketing your business on the internet, the 5 reports you purchase will provide you with invaluable marketing INF0RMATION which includes how to send bulk e- mails, where to find thousands of free classified ads and much, much more. In addition you will be provided with INF0RMATION on Internet Marketing Clubs such as INTERNET MARKETING RESOURCES(IMR): This is one the premiere internet marketing clubs on the INTERNET. This club provides a forum where internet marketers from all over the world can exchange ideas and secrets on Internet Marketing. In addition, members of this club are provided free internet marketing tools and services for the Do-Yourself-Internet-Marketer. They will provide you with free bulk e-mail software and up to 1,000,000 fresh e-mail addresses each week. This club will provide you with hundreds of free resources which include: How to obtain free web sites, how to obtain top rankings in search engines for your web-site, how to send bulk e-mail into AOL and CompuServe, how to market your products on newsgroups, free classified ads, electronic malls, bulletin boards, banner ads and much more. There are two primary methods of building your downline: METHOD #1: SENDING BULK E-MAIL Let's say that you decide to start small, just to see how it goes, and we'll assume you and all those involved send out only 2,000 programs each. Let's also assume that the mailing receives a 0.3% response. Using a good list the response could be much better. Also, many people will send out hundreds of thousands of programs instead of 2,000. But continuing with this example, you send out only 2,000 programs. With a 0.3% response, that is only 6 orders for REPORT #1. Those 6 people respond by sending out 2,000 programs each for a total of 12,000. Out of those 0.3%, 36 people respond and order REPORT #2. Those 36 mail out 2,000 programs each for a total of 72,000. The 0.3% response to that is 216 orders for REPORT #3. Those 216 send out 2,000 programs each for a 432,000 total. The 0.3% response to that is 1,296 orders for REPORT #4. Those 1,296 send out 2,000 programs each for a 2,592,000 total. The 0.3% response to that is 7,776 orders for REPORT #5. That's 7,776 $5 bills for you, CASH!!! Your total income in this example is$30 + $180 + $1,080+ $6,480 + $38,880 for a total of $46,650!!! REMEMBER FRIEND, THIS IS ASSUMING 1,994 OUT OF THE 2,000 PEOPLE YOU MAIL TO WILL DO ABSOLUTELY NOTHING AND TRASH THIS PROGRAM! DARE TO THINK FOR A MOMENT WHAT WOULD HAPPEN IF EVERYONE, OR HALF SENT OUT 100,000 PROGRAMS INSTEAD OF 2,000. Believe me, many people will do just that, and more! By the way, your cost to participate in this is practically nothing. You obviously already have an internet connection and e-mail is FREE!!! REPORT #2 and #5 will show you the best methods for bulk emailing, tell you where to obtain free bulk e-mail software and where to obtain e-mail lists and show you how to send out 1,000,000 e-mails for free. METHOD #2 - PLACING FREE ADS ON THE INTERNET 1. Advertising on the 'Net is very, very inexpensive, and there are HUNDREDS of FREE places to advertise. Let's say you decide to start small just to see how well it works. Assume your goal is to get ONLY 6 people to participate on your first level. (Placing a lot of FREE ads on the internet will EASILY get a larger response.) Also assume that everyone else in YOUR ORGANIZATION gets ONLY 6 downline members. Follow this example to achieve the STAGGERING results below. 1st level--your 6 members with $5 ($5 x 6).......................$30 2nd level--6 members from those 6 ($5 x 36)...................$180 3rd level--6 members from those 36 ($5 x 216)............ $1,080 4th level--6 members from those 216 ($5 x 1,296)........ $6,480 5th level-6 members from those 1,296 ($5 x 7,776)... .$38,880 ................................................................. .......................$46,650 __________________________________________________ Remember friends, this assumes that the people who participate only recruit 6 people each. Think for a moment what would happen if they got 20 people to participate! Many people will get 100's of participants! THINK ABOUT IT! For every $5.00 you receive, all you must do is e-mail them the report they ordered. THAT'S IT! ALWAYS PROVIDE SAME- DAY SERVICE ON ALL ORDERS! This will guarantee that the e-mail THEY send out, with YOUR name and address on it, will be prompt because they can't advertise until they receive the report! __________________________________________________ AVAILABLE REPORTS __________________________________________________ *** Order Each REPORT by NUMBER and NAME *** Notes: ALWAYS SEND $5 CASH (US CURRENCY) FOR EACH REPORT CHECKS NOT ACCEPTED ALWAYS SEND YOUR ORDER VIA FIRST CLASS MAIL ALWAYS SEND NEW BILLS AS FOREIGN BANKES DONT ACCEPT OLD / UGLY ONES!!!! Make sure the cash is concealed by wrapping it in at least two sheets of paper. On one of those sheets of paper, include: (a) the number & name of the report you are ordering, (b) your e-mail address, and (c) your name & postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW: __________________________________________________ REPORT #1 "The Insider's Guide to Advertising for Free on the Internet" ORDER REPORT #1 FROM: Ian Scott 43 Coldstram Dr. Little Sutton, Merseyside.CH66 4JZ England __________________________________________________ REPORT #2 "The Insider's Guide to Sending Bulk E-mail on the Internet" ORDER REPORT #2 FROM: Frieda Gschwind Im Wasen 4 CH - 4104 Oberwil Switzerland __________________________________________________ REPORT #3 "The Secrets to Multilevel Marketing on the Internet" ORDER REPORT #3 FROM: Marc Haller Hupperstrasse 41 CH - 4415 Lausen Switzerland __________________________________________________ REPORT #4 "How to become a Millionaire utilizing the Power of Multilevel Marketing and the Internet" ORDER REPORT #4 FROM: Sebastian Broj Ludwig-Rosenberg-Ring 9 21031 Hamburg Germany __________________________________________________ REPORT #5 "How to SEND 1,000,000 e-mails for FREE" ORDER REPORT #5 FROM: Tim Hilling Hanns-Eisler-Str. 5 04318 Leipzig Germany __________________________________________________ There currently more than 175,000,000 people on-line worldwide! ******* TIPS FOR SUCCESS ******* * TREAT THIS AS YOUR BUSINESS! Be prompt, professional, and follow the directions accurately. * Send for the five reports IMMEDIATELY so you will have them when the orders start coming in because: When you receive a $5 order, you MUST send out the requested product/report. * ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE. * Be patient and persistent with this program. If you follow the instructions exactly, your results WILL BE SUCCESSFUL! * ABOVE ALL, HAVE FAITH IN YOURSELF AND KNOW YOU WILL SUCCEED! ******* YOUR SUCCESS GUIDELINES ******* Follow these guidelines to guarantee your success: If you don't receive 20 orders for REPORT #1 within two weeks, continue advertising or sending e-mails until you do. Then, a couple of weeks later you should receive at least 100 orders for REPORT#2. If you don't, continue advertising or sending e-mails until you do. Once you have received 100 or more orders for REPORT #2, YOU CAN RELAX, because the system is already working for you, and the cash will continue to roll in! THIS IS IMPORTANT TO REMEMBER: Every time your name is moved down on the list, you are placed in front of a DIFFERENT report. You can KEEP TRACK of your PROGRESS by watching which report people are ordering from you. If you want to generate more income, send another batch of e-mails or continue placing ads and start the whole process again! There is no limit to the income you will generate from this business! Before you make your decision as to whether or not you participate in this program. Please answer one question. DO YOU WANT TO CHANGE YOUR LIFE? If the answer is yes, please look at the following facts about this program: 1. YOU ARE SELLING A PRODUCT WHICH DOES NOT COST ANYTHING TO PRODUCE! 2. YOU ARE SELLING A PRODUCT WHICH DOES NOT COST ANYTHING TO SHIP! 3. YOU ARE SELLING A PRODUCT WHICH DOES NOT COST YOU ANYTHING TO ADVERTISE! 4. YOU ARE UTILIZING THE POWER OF THE INTERNET AND THE POWER OF MULTI-LEVEL MARKETING TO DISTRIBUTE YOUR PRODUCT ALL OVER THE WORLD! 5. YOUR ONLY EXPENSES OTHER THAN YOUR INITIAL $25 INVESTMENT IS YOUR TIME! 6. VIRTUALLY ALL OF THE INCOME YOU GENERATE FROM THIS PROGRAM IS PURE PROFIT! ******* T E S T I M O N I A L S ******* This program does work, but you must follow it EXACTLY! Especially the rule of not trying to place your name in a different position, it won't work and you'll lose a lot of potential income. I'm living proof that it works. It really is a great opportunity to make relatively easy money, with little cost to you. If you do choose to participate, follow the program exactly, and you'll be on your way to financial security. Fred Dellaca, Westport, New Zealand My name is Mitchell. My wife, Jody, and I live in Chicago, IL. I am a cost accountant with a major US Corporation and I make pretty good money. When I received the program I grumbled to Jody about receiving "junk mail." I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Jody totally ignored my supposed intelligence and jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work... well, the laugh was on me! Within two weeks she had received over 50 responses. Within 45 days she had received over $147,200 in $5 bills! I was shocked! I was sure that I had it all figured and that it wouldn't work. I AM a believer now. I have joined Jody in her "hobby." I did have seven more years until retirement, but I think of the "rat race" and it's not for me. We owe it all to MLM. Mitchell Wolf MD., Chicago, IL The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Sincerely yours, Pam Hedland Halmstad, Sweden Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back. I surprised when I found my medium-size post office box crammed with orders! For awhile, it got so overloaded that I had to start picking up my mail at the window. I'll make more money this year than any 10 years of my life before. The nice thing about this deal is that it doesn't matter where people live. There simply isn't a better investment with a faster return. Dan Sondstrom, Alberta, Canada I had received this program before. I deleted it, but later I wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed another program, ..11 months passed then it came...I didn't delete this one!...I made more than $41,000 on the first try!! Mohamed, Cairo, Egypt This is my third time to participate in this plan. We have quit our jobs, and will soon buy a home on the beach and live off the interest on our money. The only way on earth that this plan will work for you is if you do it. For your sake, and for your family's sake don't pass up this golden opportunity. Good luck and happy spending! Sam Lee Suva, Fiji Islands ORDER YOUR REPORTS TODAY AND GET STARTED ON YOUR ROAD TO FINANCIAL FREEDOM! NOW IS THE TIME FOR YOUR TURN DECISIVE ACTION YIELDS POWERFUL RESULTS __________________________________________________ PLEASE NOTE: If you need help with starting a business, registering a business name, learning how income tax is handled, etc., contact your local office of the Small Business Administration (a Federal agency) 1-(800)827-5722 for free help and answers to questions. Also, the Internal Revenue Service offers free help via telephone and free seminars about business tax requirements. Your earnings and results are highly dependent on your activities and advertising. This letter constitutes no guarantees stated nor implied. In the event that it is determined that this letter constitutes a guarantee of any kind, that guarantee is now void. Any testimonials or amounts of earnings listed in this letter may be factual or non-verifiable. If you have any question of the legality of this letter contact the Office of Associate Director for Marketing Practices Federal Trade Commission Bureau of Consumer Protection in Washington DC. From list@netscape.com Sat Jul 28 20:52:38 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA15042 for ; Sat, 28 Jul 2001 20:52:37 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6SLkKv17147; Sat, 28 Jul 2001 14:46:20 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6SLkKE22118; Sat, 28 Jul 2001 14:46:20 -0700 (PDT) Resent-Date: Sat, 28 Jul 2001 14:46:20 -0700 (PDT) From: Message-ID: <00005d2f192e$00004c34$00004372@mail3.bestbrightest.net> To: Subject: Summer Travel Sweeps!. 17266 Date: Fri, 20 Jul 2001 14:44:55 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Reply-To: lihueiee@MoscowOffice.com Resent-Message-ID: <"gScfUC.A.AZF.qKzY7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable

From list@netscape.com Sun Jul 29 05:52:24 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id FAA14598 for ; Sun, 29 Jul 2001 05:52:23 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6T9oUB13737; Sun, 29 Jul 2001 02:50:30 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6T9oVM12526; Sun, 29 Jul 2001 02:50:31 -0700 (PDT) Resent-Date: Sun, 29 Jul 2001 02:50:31 -0700 (PDT) Date: Sun, 29 Jul 2001 02:50:06 -0700 (PDT) From: rngd@a1fel.feld.cvut.cz Reply-To: rngd@a1fel.feld.cvut.cz To: 3706@a1fel.feld.cvut.cz Message-ID: <0996400470.0545444692@svtix.feld.cvut.cz> Subject: ADV: Easy No Creditcard Access 1466629 Content-Type: text/plain; charset="us-ascii";format=flowed Content-Transfer-Encoding: 7bit Resent-Message-ID: <"_jC4lB.A.UDD.kx9Y7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit Warning: This offer is intended for adults of legal age ONLY! We have a solution to your problem! Guaranteed! Problem: 1. You have been denied access to adult websites using your credit card? 2. You are afraid to give out your credit info over the internet and are dying to view an adult website? Solution: No credit card, no hassles, just 100% pure hardcore action! Full access by following the link below. http://www.instant-access.ws . Watch high-profile adult film starlets spread, spit, get sprayed and swallow through a colossal series of adult orgies, hardcore threesomes and sex toy slut-fests. We offer the widest range of sex pics, video clips and fetishes on the internet. All tastes covered. Gain full and complete access to our site no credit card needed ever. http://www.instant-access.ws Simply click the link below and follow the instructions to take advantage of this incredible, Time Sensitive offer: http://www.instant-access.ws Remember that by clicking the link and following the simple instructions you will be able to watch the adult stars anytime you decide. So, what are you waiting for? No credit card, no hassles, just 100% pure hardcore action! http://www.instant-access.ws IMPORTANT: To be removed from this list, simply click the link below. You will be added to our remove list. REMOVE MESSAGE: This message is being sent in full compliance with US Postal and Lottery Laws, Title 18, Section 1302 and 1341, or Title 18, Section 3005 in the US code, also in the code of federal regulations, Volume 16, Sections 255 and 436. If you would like to be removed from our E-Mail list, please click here mailto:remove9001@xyz002.com?subject=Remove , click send, and you will be removed from our list immediately. If the mailto link is not clickable please send a blank email to remove9001@xyz002.com and put "remove" in the subject line, click send, and you will be removed from our list immediately. ately. *** From list@netscape.com Sun Jul 29 17:12:42 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA04236 for ; Sun, 29 Jul 2001 17:12:41 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6TLBTv19666; Sun, 29 Jul 2001 14:11:29 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6TLBUk18057; Sun, 29 Jul 2001 14:11:30 -0700 (PDT) Resent-Date: Sun, 29 Jul 2001 14:11:30 -0700 (PDT) Message-ID: <77882001702921214800@pavilion> X-EM-Version: 5, 0, 0, 19 X-EM-Registration: #01B0530810E603002D00 X-Priority: 3 Reply-To: norlie777@aol.com X-MSMail-Priority: Normal From: "Patsy Norlie" To: ietf-ldapext@netscape.com Subject: #### IT'S FREE - TALKFREE AMERICA ### Date: Sun, 29 Jul 2001 14:02:14 -0700 MIME-Version: 1.0 Content-type: text/plain; charset="US-ASCII" X-Apparently-From: Norlie777@aol.com Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by aka.mcom.com id f6TLBS118022 Resent-Message-ID: <"H54mkB.A.sZE.AwHZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 8bit IT'S FREE - TALKFREE AMERICA requires no investment, no membership fees, no enrollment fees, and no application fees. There are no hidden costs! No one has to pay more or settle for less! Opportunity COMPOUNDED PROFIT-SHARING - The TALKFREE AMERICA "COMPOUNDED PROFIT-SHARING PROGRAM "was designed to allow anyone who is currently paying a monthly telephone bill to benefit from the non-monopoly, competitive enviroment intended by the Telecommunications Act of 1996. So where do you fit in and how can you benefit from the Act? The TALKFREE AMERICA "COMPOUNDED PROFIT-SHARING PROGRAM" allows its members to share in its portion of $250,000,000,000 (two hundred and fifty billion dollars) in deregulated revenues. All you need to qualify to receive a profit-sharing check each and every month is to have telephone service in your name or own a business that purchases service. To begin the process, you must have an existing TALKFREE member assist you in completing a Member Agreement/Service Application. All you are required to provide is a copy of your current telephone bill, no more than ninety days old, which shows all your features and the total amount you pay each month. Your telephone service will continue to be provided by the same company you now pay each month. TALKFREE requires no membership fees, no application fees, and no enrollment fees. There are no hidden costs! You won't be paying a penny more than you now pay and your telephone service will be identical, except now, ... you can get paid for having service instead of paying to have service! Our standard policy is, should you for some reason elect not to participate in TALKFREE'S member referral and profit-sharing program, then as a "Non-Referring" member, you are guaranteed to receive ... 10% off of your monthly telephone bill for as long as you wish! go to http://www.talkfreeamericainc.com/getpaid2talk Go TO http://www.talkfreeamericainc.com/getpaid2talk Patsy Norlie Get your free web cell phone here http://www.cellphonetoolbox.com/DMI/8953 From list@netscape.com Sun Jul 29 17:19:38 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA04428 for ; Sun, 29 Jul 2001 17:19:38 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6TLIZv20422; Sun, 29 Jul 2001 14:18:35 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6TLIac19617; Sun, 29 Jul 2001 14:18:36 -0700 (PDT) Resent-Date: Sun, 29 Jul 2001 14:18:36 -0700 (PDT) Date: Sun, 29 Jul 2001 14:18:02 -0700 (PDT) Message-Id: <200107292118.f6TLI2b05754@ywing.netscape.com> Reply-To: From: "dfre453@yahoo.com" To: "5615@home.com" <5615@home.com> Subject: We pay cash, Now! Content-Type: text/plain; charset="us-ascii";format=flowed Content-Transfer-Encoding: 7bit Resent-Message-ID: <"YqkuSD.A.-xE.q2HZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit WE PAY CASH, NOW! We will pay you a lump sum of cash for Eight years of your Military and Government pensions, or your VA diusability. We pay top dollar! Go to: www.tfund2000.com and click on Military/Government pensions. To be removed, please send a blank email with the word remove in the subject line. From list@netscape.com Sun Jul 29 17:51:51 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA05259 for ; Sun, 29 Jul 2001 17:51:50 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6TLoBB04583; Sun, 29 Jul 2001 14:50:11 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6TLoBE26359; Sun, 29 Jul 2001 14:50:11 -0700 (PDT) Resent-Date: Sun, 29 Jul 2001 14:50:11 -0700 (PDT) Date: Sun, 29 Jul 2001 14:49:48 -0700 (PDT) Message-Id: <200107292149.f6TLnmU10525@xwing.aoltw.net> From: 3tc10b10r@msn.com To: cm41@msn.com Reply-To: lonniesearchwell341@excite.com Subject: Do you owe the IRS money? [fr4wb] Resent-Message-ID: <"imC-v.A.dbG.RUIZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Have tax problems? Do you owe the IRS money? If your debt is $10,000 US or more, we can help! Our licensed agents can help you with both past and present tax debt. We have direct contacts with the IRS, so once your application is processed we can help you immediately without further delay. Also, as our client we can offer you other services and help with other problems such as: - Tax Preparation - Audits - Seizures - Bank Levies - Asset Protection - Audit Reconsideration - Trust Fund Penalty Defense - Penalty Appeals - Penalty Abatement - Wage Garnishments .. and more! To receive FREE information on tax help, please fill out the form below and return it to us. There are no obligations, and supplied information is kept strictly confidential. Please note that this offer only applies to US citizens. Application processing may take up to 10 business days. ********** Full Name: State: Phone Number: Time to Call: Estimated Tax Debt Size: ********** Thank you for your time. Note: If you wish to receive no further advertisements regarding this matter or any other, please reply to this e-mail with the word REMOVE in the subject. From list@netscape.com Sun Jul 29 21:59:02 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA10791 for ; Sun, 29 Jul 2001 21:59:01 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6U1vpv22126; Sun, 29 Jul 2001 18:57:52 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6U1vqI13668; Sun, 29 Jul 2001 18:57:52 -0700 (PDT) Resent-Date: Sun, 29 Jul 2001 18:57:52 -0700 (PDT) From: Ws8x6z559@millionaireintraining.com DATE: 29 Jul 01 11:01:20 PM Message-ID: SUBJECT: Turn $5 into $10,000 in 1 Week Resent-Message-ID: <"_lEX8C.A.KVD.e8LZ7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com AS SEEN ON NATIONAL TV: \~ Making over half million dollars every 4 to 5 months from your home for an investment of only $5 U.S. Dollars expense one time THANK'S TO THE COMPUTER AGE AND THE INTERNET ! ================================================== BE A MILLIONAIRE LIKE OTHERS WITHIN A YEAR!!! Before you say ''Bull'', please read the following. This is the letter you have been hearing about on the news lately. Due to the popularity of this letter on the Internet, a national weekly news program recently devoted an entire show to the investigation of this program described below, to see if it really can make people money.\~ The show also investigated whether or not the program was legal. Their findings proved once and for all that there are ''absolutely NO Laws prohibiting the participation in the program and if people can -follow the simple instructions, they are bound to make some mega bucks with only $5 out of pocket cost''. DUE TO THE RECENT INCREASE OF POPULARITY & RESPECT THIS PROGRAM HAS ATTAINED, IT IS CURRENTLY WORKING BETTER THAN EVER. This is what one had to say: '' Thanks to this profitable opportunity. I was approached many times before but each time I passed on it. I am so glad I finally joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received total $ 610,470.00 in 21 weeks, with money still coming in''. Pam Hedland, Fort Lee, New Jersey. THIS IS THE FASTEST, EASIEST PROGRAM YOU WILL EVER DO. Complete it in one hour and you will never forget the day you first received it. The following is a plan to benefit you and your future. BE PREPARED TO GET EXCITED...YOU WON'T BE DISAPPOINTED!!! Read the following and you will agree this is a very exciting opportunity. Only invest a little bit of time, and your reward could mean thousands of dollars! Good luck! - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - IT'S OUTRAGEOUS!!! With two hours of work I have made over US$11,000 in the last three weeks..and my investment was just $5!!! I LOVE IT! Thank you 11,000 x's! Julie M. St. Louis - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ARE YOU IN NEED OF MONEY RIGHT NOW? HOW DOES $10,000 IN TWO WEEKS SOUND? Don't laugh! Try this for a change while you wait for the others to start working. One hour of work to get started and no mailing lists! ************************************************************************* Esquire Marketing Newsletter Gift Club This service is 100% legal (Refer to US Postal and Lottery Laws, Title 18, Section 1302 and 1341, or Title 18, Section 3005 in the US code, also in the code of federal regulations, Volume 16, Sections 255 and 436, which state a product or service must be exchanged for money received) ************************************************************************ Here's How It Works Unlike many other programs, this three level program is more realistic and much, much faster. Because it is so easy, the response rate for this program is VERY HIGH AND VERY FAST, and you will see results in two weeks or less! Just in time for next month's bills! You only mail out 20 copies (not 200 or more as in other programs). You should also send them to people who send you their programs because they know these programs work and they are already believers in the system! Besides, this program is MUCH, MUCH FASTER and has a HIGHER RESPONSE RATE! Even if you are already in a program, stay with it, but do yourself a favor and DO THIS ONE as well. START RIGHT NOW! It's simple and takes a very small investment. It will pay off long before other letters even begin to trickle in! Just give ONE person a $5 gift. That's all! Follow the simple instructions and in two weeks you will have US$10,000 in your bank account! Because of the LOW INVESTMENT, SPEED, and HIGH PROFIT POTENTIAL, this program has a VERY HIGH RESPONSE RATE! Just one (1) US$5 bill. That's your investment!!! ************************************************************************ Follow These Simple Instructions 1) On a blank sheet of paper write Please add me to your mailing list. Write your name and address clearly and include your email address for future mailings and courtesy follow ups. Fold it around a US$5 and send it to the FIRST name on the list (#1). Only the first person on the list gets your name and a five dollor gift. 2) Retype only the list, removing the FIRST (#1) NAME FROM THE LIST. Move the other two names UP and ADD YOUR NAME to the list in the THIRD (#3) position. 3) Send out 20 copies of this letter. NOTE: by sending this letter via EMAIL, the response time is much faster, and you save the expenses of envelopes, stamps, and copying services. Consider this, MILLIONS of people surf the internet everyday, all day, all over the world! Fifty thousand new people get on the internet every month! An excellent source of names is the people who send you other programs and the names listed on the letter they send you. Your contact source is UNLIMITED! It boggles my mind to think of all the possibilities! Mail, or should I say Email, your letter TODAY! It's so easy. One hour of your time. THAT'S IT! To send your newsletter by Email: 1) Go to "edit" and select all 2) Go to "edit" and "copy" 3) Start (compose) a new Email message 4) Address your Email and Subject blocks 5) Go to "edit" and "paste" After you have pasted this article to your new Email, delete the old header and footer (Subject, Date, To, From, Ect.) Now you can edit the names and addresses with ease. I recommend deleting the top name, adding your name and address to the bottom of the list, then simply changing the numbers. THERE'S NOTHING MORE TO DO. When your name reaches the first position in a few days, it will be your turn to collect your gifts. The gifts will be sent to you by 1,500 to 2,000 people like yourself, who are willing to invest US$5 and one hour to receive US$10,000 in cash. That's all! There will be a total of US$10,000 in US$5 bills in your mailbox in two weeks. US$10,000 for one hours work! I think it's WORTH IT, don't you? GO AHEAD--TRY IT. IT'S US$5! EVEN IF YOU MAKE JUST 3 OR 4 THOUSAND, WOULDN'T THAT BE NICE? IF YOU TRY IT, IT WILL PAY! - - - - - - - - - TRUE STORY Cindy Allen writes: I ran this gift summation four times last year. The first time I received over $7,000 in cash in less than two weeks and over $10,000 in cash in the next three times I ran it. I can't begin to tell you how great it feels not to have to worry about money anymore! I thank God for the day I received this letter! It has truly changed my life! Don't be afraid to make gifts to strangers--they'll come back to you in ten-fold. So, let's keep it going and help each other out in these tough and uncertain times. - - - - - - - - - CAN I DO IT AGAIN? OF COURSE YOU CAN--this plan is structured for everyone to send only 20 letters each. However, you are certainly not limited to 20. Mail out as many as you can. Every 20 letters you send has a return of $10,000 or more. If you can mail forty, sixty, eighty, or whatever, GO FOR IT! THE MORE YOU PUT INTO IT THE MORE YOU GET OUT OF IT. Each time you run this program, just follow steps 1 thru 3 and everyone on your gift list benefits! Simple enough? You bet it is! Besides, there are no mailing lists to buy (and wait for), and trips to the printer or copier, and you can do it again and again with your regular groups or gifters, or start up a new group. Why not? It beats working! Each time you receive an MLM offer, respond with this letter! Your name will climb to the number one position at dizzying rates. Follow the simple instructions, and above all, PLEASE PLAY FAIR. That's the key to this programs success. Your name must run the full gamut on the list to produce the end results. Sneaking your name higher up on the list WILL NOT produce the results you think, and it only cheats the other people who have worked hard and have earned the right to be there. So please, play by the rules and the $$$ will come to you! - - - - - - - - - - - - - MAIL YOUR LETTERS OUR TODAY - - - - - - - - - - $$$ Together we will prosper! $$$ GOOD LUCK!!! ************************************************************************ 1. R. Brace 8a Lower Avenue Bishop's Falls, NF A0H 1C0 Canada 2. B. Taylor P.O.Box 26001 Fredericton, N.B. E3A 5V8 3. Pathos P.O. Box 278 Wood Dale, IL 60191 ************************************************************************ Wishing you the best in all you do! You probably don't believe this will work, but if you don't try it you will never know. That's the way I felt. Try it. You won't be sorry. From list@netscape.com Mon Jul 30 02:13:57 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id CAA03861 for ; Mon, 30 Jul 2001 02:13:56 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6U6AsB22172; Sun, 29 Jul 2001 23:10:54 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6U6Atg08091; Sun, 29 Jul 2001 23:10:55 -0700 (PDT) Resent-Date: Sun, 29 Jul 2001 23:10:55 -0700 (PDT) From: Subject: Totally amateur and horny as a rhino! Date: Mon, 30 Jul 2001 16:13:10 Message-Id: <685.72247.526600@jen.com> Reply-To: nomore@usa.net Mime-Version: 1.0 Content-Type: text/html; charset="us-ascii" Resent-Message-ID: <"rv05oB.A.B-B.tpPZ7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Amateur Glamor

HAVE YOU EVER WONDERED WHAT THE GIRL NEXT DOOR DOES IN HER SPARE TIME?AMATEUR GLAMOR HAS THE ANSWER!!!
AMATEUR GLAMOR HAS OVER 10'000 DIFFERENT HORNY AMATEURS TO CHOOSE FROM - ALL TASTES COVERED! 62,000+ IMAGES OF REAL AMATEURS GETTING POUNDED! SEE LIVE HIDDEN CAMERA FUCKING, SHOWERING, THE GIRLS DONT EVEN KNOW THEY'RE BEING WATCHED!
POSERS - HARDCORE - VIDEOS - 100% TOTALLY AMATEUR
WWW.AMATEURGLAMOR.COM

From list@netscape.com Mon Jul 30 06:13:10 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id GAA13476 for ; Mon, 30 Jul 2001 06:13:10 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6UAC4v25313; Mon, 30 Jul 2001 03:12:04 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6UAC3Q01012; Mon, 30 Jul 2001 03:12:03 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 03:12:03 -0700 (PDT) Reply-To: From: "gfyt563@hotmail.com" To: "7537@yahoo.com" <7537@yahoo.com> Subject: WE PAY CASH NOW! Content-Type: text/plain; charset="us-ascii";format=flowed Content-Transfer-Encoding: 7bit Message-Id: <20010730101152706.PMVG.21729.t-mta4.odn.ne.jp@mta4.odn.ne.jp> Date: Mon, 30 Jul 2001 19:11:53 +0900 Resent-Message-ID: <"OdWq6D.A.KP.yLTZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit WE PAY CASH, NOW! We will pay you a lump sum of cash for Eight years of your Military and Government pensions, or your VA diusability. We pay top dollar! Go to: www.tfund2000.com and click on Military/Government pensions. www.tfund2000.com To be removed, please send a blank email with the word remove in the subject line. From list@netscape.com Mon Jul 30 07:55:41 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id HAA18180 for ; Mon, 30 Jul 2001 07:55:35 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6U8aev29941; Mon, 30 Jul 2001 01:36:40 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6U8ags09853; Mon, 30 Jul 2001 01:36:42 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 01:36:42 -0700 (PDT) From: hispyserviceip0@excite.com Subject: Increase Sales, Accept Credit Cards! Date: Sun, 29 Jul 2001 22:37:49 -0700 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_212E_00004E96.00007674" X-Priority: 3 X-MSMail-Priority: Normal Message-Id: <20010730083621.HBNS2118.tomts7-srv.bellnexxia.net@spectal2.spectal.ca> Resent-Message-ID: <"Y8QAkD.A.VZC.YyRZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com ------=_NextPart_000_212E_00004E96.00007674 Content-Type: text/html;
INCREASE YOUR SALES - DOUBLE YOUR PROFITS

ACCEPT CREDIT CARDS OVER THE INTERNET
AND EXPLODE YOUR SALES M ** TODAY! **

PROCESS SALES FROM YOUR VIRTUAL TERMINAL

SECURE INTERNET ORDER PAGE PROCESSING

PROCESS VISA, MASTERCARD, DISCOVER, & AMERICAN EXPRESS

We Approve the following Types of Businesses:

*Mail Order / Phone Sales / Internet / Swap Meet / Seminar
*Home Based - Business Start-Ups - Small & Large Volume
*Everyone Is Welcome! 98% Approved!! Even Problem Credit...

*** Internet Special ***

FREE APPLICATION FEE  *** FREE SITE INSPECTION
* Save $195.00 * limited time offer

We offer Competitive Rates & Fees,
as well as the best customer service & support in the industry.
Accepting Credit Cards can Double or Triple your Sales.
Quit Watching Others Get Rich - Apply Today!

Here's a List of the Fees:

1) Application Set-Up Fee FREE Site Inspection Photos FREE "Save $195.00"

2) Discount Rate for Internet sales is 2.25% + .30 per transaction.

3) PROCESSING SYSTEM: Secure Virtual Terminal + Secure Real Time Processing.

4) TERMS:   $39.95 per month x 36 month Lease/Purchase <or> Cash Price: $750.00



5) FREE Set-Up for American Express & Discover (approved separately).



HOW TO GET STARTED:

E-MAIL or FAX The Following Pre-Qualification Form To:

E-Mail: arockfordb@excite.com    Fax: (419) 715-0786

Pre-Qualification Form:

Legal Business Name:

Business DBA:

Product or Service Sold:

Average Credit Card Sale Amount:

Estimated Monthly Volume:

Date Business Opened:

Home Based "yes or no"

Business Street Address:

City:

State:            Zip:

Ownership Type:

Sole Owner, Partnership, Corporation, or Non-Profit.

Date Business Opened:

Principle One Info:

Name:

Percentage of Ownership:

Home Street Address:

City:

State:        Zip:

Principle Two Info:

Name:

Percentage of Ownership:

Home Street Address:

City:

State:        Zip:

Best Day Phone Number:

Business Phone Number:

Fax Number:

Best Time To Call:

How Did You Find Our Company?

Comments:

We are now able to provide merchants with the most affordable solution for on-line Credit Card Processing. This new system allows merchants to hook up their web sites simply, easily, and quickly to a secure socket layer (SSL) server to process orders on-line. Below are some of the features of this one of a kind system.

Secure Credit Card Processing.
Innovative state of the art Security for your Electronic Commerce.
Automatic Encryption for each transaction.
Ease, Speed and Convenience of all On-Line Credit Card Ordering. Worldwide secure processing of credit card sales transactions, 24 hours … 7 days a week.
Give your customers the option of ordering via Credit Card or Check for Convenient Payment and Spontaneous Purchases. Receive a Credit Card Authorization in Real-Time (within 3 to 5 seconds).
Customer and Merchant receipt system.
Custom receipt system with Address Verification System (AVS).
Receive funds directly into your local bank account - automatically.
Services are not limited to any particular operating system, web browser or server technology.

Food For Thought...

Net spending to hit $1 trillion!

A study from IDC says e-commerce will hit the trillion dollar mark in 2003.

Internet commerce is poised to hit the trillion dollar mark as early as 2003, according to a new study from International Data Corp.

The Framingham, Mass.-based research firm said that the Web will also become less U.S.-centric, with an estimated 65 percent of Web users coming from other countries by 2003.

The online buying phenomenon will be driven by larger purchases, and more shoppers, IDC said. The number of Web buyers is expected to jump from 31 million in 1998 to more than 183 million in 2003.

IDC isn't the only one expecting big things from Internet commerce. Forrester Research of Cambridge, Mass. expects business-to-business hard goods sales online will hit $1.3 trillion by 2003 and Jupiter Communications predicts teenagers alone will spend $1.3 billion online by 2002.

------=_NextPart_000_212E_00004E96.00007674-- From list@netscape.com Mon Jul 30 16:50:28 2001 Received: from netscape.com (r2d2.netscape.com [205.217.237.47]) by ietf.org (8.9.1a/8.9.1a) with SMTP id QAA23743 for ; Mon, 30 Jul 2001 16:50:28 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6UKmvB16890; Mon, 30 Jul 2001 13:48:57 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6UKmvk17883; Mon, 30 Jul 2001 13:48:57 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 13:48:57 -0700 (PDT) From: Message-Id: <200107292230.WAA0000021555@ibn-tofail.iam.net.ma> Subject: Increase Sales, Accept Credit Cards! Date: Sun, 29 Jul 2001 14:12:29 -0700 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_555F_00001834.000073B0" X-Priority: 3 X-MSMail-Priority: Normal Resent-Message-ID: <"THEvPB.A.iWE.3gcZ7"@glacier> To: ietf-ldapext@netscape.com Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com ------=_NextPart_000_555F_00001834.000073B0 Content-Type: text/html;

INCREASE YOUR SALES - DOUBLE YOUR PROFITS

ACCEPT CREDIT CARDS OVER THE INTERNET
AND EXPLODE YOUR SALES M ** TODAY! **

PROCESS SALES FROM YOUR VIRTUAL TERMINAL

SECURE INTERNET ORDER PAGE PROCESSING

PROCESS VISA, MASTERCARD, DISCOVER, & AMERICAN EXPRESS

We Approve the following Types of Businesses:

*Mail Order / Phone Sales / Internet / Swap Meet / Seminar
*Home Based - Business Start-Ups - Small & Large Volume
*Everyone Is Welcome! 98% Approved!! Even Problem Credit...

*** Internet Special ***

FREE APPLICATION FEE *** FREE SITE INSPECTION
* Save $195.00 * limited time offer

We offer Competitive Rates & Fees,
as well as the best customer service & support in the industry.
Accepting Credit Cards can Double or Triple your Sales.
Quit Watching Others Get Rich - Apply Today!

Here's a List of the Fees:

1) Application Set-Up Fee FREE Site Inspection Photos FREE "Save $195.00"

2) Discount Rate for Internet sales is 2.25% + .30 per transaction.

3) PROCESSING SYSTEM: Secure Virtual Terminal + Secure Real Time Processing.

4) TERMS: $39.95 per month x 36 month Lease/Purchase <or> Cash Price: $750.00

5) FREE Set-Up for American Express & Discover (approved separately).

HOW TO GET STARTED:

E-MAIL or FAX The Following Pre-Qualification Form To:

E-Mail: arockfordb@excite.com Fax: (419) 715-0786

Pre-Qualification Form:

Legal Business Name:

Business DBA:

Product or Service Sold:

Average Credit Card Sale Amount:

Estimated Monthly Volume:

Date Business Opened:

Home Based "yes or no"

Business Street Address:

City:

State: Zip:

Ownership Type:

Sole Owner, Partnership, Corporation, or Non-Profit.

Date Business Opened:

Principle One Info:

Name:

Percentage of Ownership:

Home Street Address:

City:

State: Zip:

Principle Two Info:

Name:

Percentage of Ownership:

Home Street Address:

City:

State: Zip:

Best Day Phone Number:

Business Phone Number:

Fax Number:

Best Time To Call:

How Did You Find Our Company?

Comments:

We are now able to provide merchants with the most affordable solution for on-line Credit Card Processing. This new system allows merchants to hook up their web sites simply, easily, and quickly to a secure socket layer (SSL) server to process orders on-line. Below are some of the features of this one of a kind system.

Secure Credit Card Processing.
Innovative state of the art Security for your Electronic Commerce.
Automatic Encryption for each transaction.
Ease, Speed and Convenience of all On-Line Credit Card Ordering. Worldwide secure processing of credit card sales transactions, 24 hours … 7 days a week.
Give your customers the option of ordering via Credit Card or Check for Convenient Payment and Spontaneous Purchases. Receive a Credit Card Authorization in Real-Time (within 3 to 5 seconds).
Customer and Merchant receipt system.
Custom receipt system with Address Verification System (AVS).
Receive funds directly into your local bank account - automatically.
Services are not limited to any particular operating system, web browser or server technology.

Food For Thought...

Net spending to hit $1 trillion!

A study from IDC says e-commerce will hit the trillion dollar mark in 2003.

Internet commerce is poised to hit the trillion dollar mark as early as 2003, according to a new study from International Data Corp.

The Framingham, Mass.-based research firm said that the Web will also become less U.S.-centric, with an estimated 65 percent of Web users coming from other countries by 2003.

The online buying phenomenon will be driven by larger purchases, and more shoppers, IDC said. The number of Web buyers is expected to jump from 31 million in 1998 to more than 183 million in 2003.

------=_NextPart_000_555F_00001834.000073B0-- From list@netscape.com Mon Jul 30 20:11:37 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA03572 for ; Mon, 30 Jul 2001 20:11:35 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6V0ALv17113; Mon, 30 Jul 2001 17:10:21 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6V0AMQ10433; Mon, 30 Jul 2001 17:10:22 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 17:10:22 -0700 (PDT) To: xy6578gg.com@xwing.aoltw.net Message-ID: <199702170025.GAA08056@xy6578gg.com> Date: Mon, 30 Jul 01 19:00:08 EST From: sandy82162@yahoo.com Subject: PAY 5$ AND COLLECT CASH BY MAIL FOR WEEKS!!! Reply-To: sandy82162@yahoo.com Comments: Authenticated sender is Resent-Message-ID: <"yrKXbB.A.NhC.qdfZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Hello, What if I told you that you could make hundreds or even thousands of dollars just by spending $5.00 US... Thats right just 5 US dollars! Well if you told me that a week ago I would have laughed at the idea but, I couldn't resist and I spent the $5.00 since then I have collected over $195.00 and the money is still coming in steadily. Now I'm no marketing expert and I don't have alot of money to advertise either, but I sent out about 100 emails in my spare time (about an hour) and the results I got for my effort is astounding! The fact of the matter is that most people are willing to part with $5, after all, what do they have to lose? Just $5 which isn't even enough to eat lunch these days! BE PREPARED TO GET EXCITED... YOU WILL NOT BE DISAPPOINTED!!! Why it is different from other opportunities?: 1 - Now, when you have questions you can simply e-mail those above you on the list. Everyone lists their e-mail address, so that any problems can be taken care of. You can also e-mail people before you get involved and get their testimonies so that you can get excited about it. Because of this it is much easier to market to prospects. 2 - No CHEATERS! As you can see below in instruction #1, before anyone can make money from this program, it must be proven by those ahead on the list that they did pay their initial fee of $5. This prevents cheaters from putting their name on the top of the list and getting profits, when they never mailed their $5. 3- Confirmation email allows you to keep track of who is working to move your name up the list. This is a one-time effort, and then you leave it and watch the money pour in. REMEMBER, you can continue ALL your programs in which you are currently involved and this will only take an hour or so to set up! THIS IS HOW IT WORKS. This is a three level program that is much faster, because it is so easy, the response rate for this program is VERY HIGH AND VERY FAST. And you will see results in two weeks or less! Just one (1) US$5 bill. That's your investment ! ! ! YES this is legal! (Read at bottom of message, for more details) HERE ARE THE INSTRUCTIONS; 1) E-mail the person on position #4 with the subject header "REMITTANCE INQUIRY". In the body of your message, type the information contained in position #3. And underneath write "Did you receive your $5 from the person mentioned above?" 2) When you receive confirmation from the person on position #4, you may proceed as follows: On a blank sheet of paper write: "Please add me to your mailing list and E-mail me confirmation of your receipt of my $5 remittance". Write your name and address clearly and include your email address for confirmation mailing and courtesy follow ups. Fold it around a US$5 and send it to the FIRST name on the list (#1). IMPORTANT: Wrap additional paper (black colored paper is ideal) so that the $5 inside can not be seen when your letter is held against a strong light. This is to prevent thievery! 3)send a blank email to the person in position #3, with the subject "new member". (This will show you how many people are working to move your name to the #1 position) 4) RETYPE the Name List. Move the FIRST NAME (#1) to the FOURTH (#4) position. Move the SECOND (#2) and THIRD (#3) NAMES UP and ADD YOUR NAME to the list in the THIRD (#3) position. NOTE: Only the fourth (#4) name in the original list is dropped. 5) AFTER you have received an e-mail confirming receipt of your remittance, then SEND out 20 emailed copies of your edited letter (or more, if you wish to have more potential) . 6) ENJOY your trip to the mailbox ! After a few days, watch the envelopes start coming in virtually EVERY DAY, not once a fortnight, or once a month. THAT'S IT! How simple is that? _______________________________________________________________________ CURRENT NAME LIST: #1 Cynthia Kelley 5610 dellwood dr. austin, TX USA 78723 e-mail: http://us.f149.mail.yahoo.com/ym/Compose?To=prospernow@consultant.com&YY=12149&order=down&sort=date&pos=0 #2 B. Heck 8009 n lombard way Portland, OR USA, 89052 E-MAIL: http://us.f149.mail.yahoo.com/ym/Compose?To=cashrewards10@yahoo.com&YY=12149&order=down&sort=date&pos=0 #3 Sandra Laska 320 Jobs Hill Road Ellington, CT USA 06029 email: http://us.f149.mail.yahoo.com/ym/Compose?To=sandy82162@yahoo.com&YY=12149&order=down&sort=date&pos=0 #4 B. L. Jones 1399 s. green valley parkway #817 Henderson, NV USA 89052 e-mail: http://us.f149.mail.yahoo.com/ym/Compose?To=fivedollarclub2001@yahoo.com&YY=12149&order=down&sort=date&pos=0 _______________________________________________________________________ Consider this, MILLIONS of people surf the internet every day, all day, all over the world! Fifty thousand new people get on the internet every month! It boggles my mind to think of all the possibilities! E-mail, your letter TODAY! It's so easy. THERE'S NOTHING MORE TO DO. When your name reaches the first position in a week or so, it will be your turn to collect your gifts. The gifts will be sent to you by Hundreds or 1000's of people like yourself (average accomplishment rate is 20 - 25 percent), who are willing to invest US$5 and an hour or so to receive anywhere from Hundred$ to Thousand$ in cash. That's ALL! I think it's WORTH IT, don't you? GO AHEAD--TRY IT. IT'S ONLY 5 Buck$ ! EVEN IF YOU MAKE a few Hundred $$'s or just 3 OR 4 THOUSAND $$'s, WOULDN'T THAT BE NICE? Would that be helpful in paying a few bills, or, that special gift you have been wanting for your significant other, or, that little vacation you have been planning for? IF YOU TRY IT, IT WILL PAY! - - - - - - - - CAN I DO IT AGAIN? - - - - - - - - OF COURSE YOU CAN -- this plan is structured for everyone to send only 20 letters each. However, you are certainly not limited to 20. Mail out as many as you can. Every 20 letters you send has an average return of Hundred$$ to Thousand$$. If you can mail forty, sixty, eighty, or whatever, GO FOR IT! THE MORE ENERGY YOU PUT INTO IT ... ... ... .. ... ... THE MORE $$$'s YOU GET OUT OF IT !!! Why not? It beats working! Each time you receive an MLM offer, respond with this letter! Your name will climb to the number one position at dizzying rates. Follow the simple instructions, and PLEASE PLAY FAIR. The BUILT-IN MECHANISM against cheating will FRUSTRATE the cheaters! So please, play by the rules and the $$$ will come!!! From list@netscape.com Mon Jul 30 22:04:09 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id WAA09247 for ; Mon, 30 Jul 2001 22:04:08 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6V22hv23768; Mon, 30 Jul 2001 19:02:44 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6V22jg00808; Mon, 30 Jul 2001 19:02:45 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 19:02:45 -0700 (PDT) Date: Mon, 30 Jul 2001 19:02:10 -0700 (PDT) Message-Id: <200107310202.f6V22Ax11197@ywing.netscape.com> To: talentscouts1@mindspring.com From: Subject: Looking for Actors, Models, Singers and Dancers!! Resent-Message-ID: <"AOXaP.A.CM.CHhZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Recruiting all those wanting a career in entertainment!! (acting, dancing, singing and modeling). World Star Talent Agency is actively pursuing new talent and fresh faces. Our professional experience ranges from modeling, dancing, singing and acting. We work for you to get your look in front of Talent Agents, Casting Directors, Producers, Modeling Agencies, Commercial Agencies, Print Agencies, Video Media, TV, Theatrical and Cinema Agents. We specialize and take pride in placing new talent. In fact, agencies are often looking just for that - New and fresh looks with little to no experience...... WE SPECIALIZE IN THIS! The following list represents some of the jobs we have helped place our clients in: TV and Cinema: The Practice Blow Friends Frazier ER Nash Bridges Legally Blonde Traffic TV Commercials: Budweiser Coca Cola Mitsubishi Castrol Oil AT&T Ford Print advertisements: Polo Tommy Hilfiger Gap Ballys Guess Nautica Victoria's Secret Este Lauder Bebe Music Videos: Limp Bizcut Janet Jackson Brittany Spears Metallica Jessica Simpson And hundreds more.... Your one time investment of only $19.95 covers our expenses to put your photos and resume into our database. Once in our database your face and resume will be accessible by over a thousand Talent Agents, Casting Directors, Producers, Modeling Agencies, Commercial Agencies, Print Agencies, Video Media, TV, Theatrical, Cinema Agents and anyone else actively seeking new talent. World Star Talent Agency is contracted to be paid by the Talent Agents that hire you. We get paid only when you are hired. WE DO NOT MAKE MONEY UNLESS YOU DO!! What we need from you is: 1. Headshot (full body shot optional) 2. Your resume and or a brief story of yourself (bio). Rest assured there is no entertainment experience necessary. Just the desire to be in the entertainment industry. 3. Your complete mailing address, telephone number, e-mail and all other contact information you can give us. 4. A check or money order for $19.95 payable to: World Star Talent Agency Inc. 5. Put all of the above in an envelope and mail to: World Star Talent Agency Inc. 8491 Sunset Blvd. Suite 175 Hollywood, CA 90069 Why put it off today when you will be on your way to being a STAR tomorrow? Please no videos at this time. From list@netscape.com Tue Jul 31 01:18:47 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA20030 for ; Tue, 31 Jul 2001 01:18:46 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6V5Hcv15463; Mon, 30 Jul 2001 22:17:39 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6V5Hek11184; Mon, 30 Jul 2001 22:17:40 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 22:17:40 -0700 (PDT) Message-ID: <000020324ee1$00002995$00000a92@> To: From: kathy897bb@yahoo.com Subject: Join the Middle Class Rich! Date: Mon, 30 Jul 2001 23:22:01 -0500 X-Priority: 1 X-MSMail-Priority: High Resent-Message-ID: <"9wX8-B.A.YuC.z9jZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com $ $ $ SERIOUS MONEY! What EVERYONE Has Been Waiting For! $ $ $ Starting Today You Can Earn $2,000 to $8,000 in a Matter of Weeks! For details on this money making opportunity click on the hyperlink below: http://www.geocities.com/bumpercash If you have a problem with the above hyperlink send us a email at mailto:jimmydee236@yahoo.com?subject=show me: WE will send you a new link. To be removed from this mailing list type remove in the subject box mailto:lndpn8@yahoo.com?subject=remove, or fax us at 1561.273.2567 with your email address and remove me. From list@netscape.com Tue Jul 31 01:51:12 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id BAA24100 for ; Tue, 31 Jul 2001 01:51:10 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6V5o2v24021; Mon, 30 Jul 2001 22:50:02 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6V5o3c17368; Mon, 30 Jul 2001 22:50:03 -0700 (PDT) Resent-Date: Mon, 30 Jul 2001 22:50:03 -0700 (PDT) From: speedyone2@arabia.com To: Undisclosed@ywing.aoltw.net, Recipients@ywing.aoltw.net Message-ID: <0000700f5c71$00002d57$000001b5@> Subject: speedyone2@arabia.com Date: Mon, 30 Jul 2001 21:10:26 -0700 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal Resent-Message-ID: <"-TGykC.A.7OE.KckZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: quoted-printable Eliminate your credit card debt without filing = bankruptcy!

Are you tired of making minimum payments = and barely getting by?
Are you drowning in debt?
Are you ready for a change and some freedom?

What will buying this package do for me?

*It will terminate your credit card debt!
(Major credit cards only - Not department store cards or gas cards)
*This covers cash advances!
*This covers unsecured loans as well!
*It will allow you to stop making monthly payments immediately!
*It will empower you to take back the control of your life!

*Unlike bankruptcy this keeps your affairs completely private!
Only you, the creditors, and the credit bureau will know.

However, you will not lose your home, or any other assets!

*You will no longer be able to use those credit cards.

The price of this package runs between = $1300-$2000.
SPECIAL DISCOUNT UNTIL AUGUST 8TH!
$450 OFF....but only until AUGUST 8th!

We offer a gurantee and accept all forms of payment!

This program has been used successfully for 7 years!

For more information please call: = 1-800-320-9895 Ext 7486

This works in the US ONLY!

To opt out of our mailing list simply reply to this email.

Eliminate your = credit card debt without filing bankruptcy!

Are you tired of making minimum payments and = barely getting by?

From list@netscape.com Tue Jul 31 07:23:33 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id HAA12745 for ; Tue, 31 Jul 2001 07:23:33 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6VBMDv25257; Tue, 31 Jul 2001 04:22:13 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6VBMDs29439; Tue, 31 Jul 2001 04:22:13 -0700 (PDT) Resent-Date: Tue, 31 Jul 2001 04:22:13 -0700 (PDT) Message-Id: <200107311121.f6VBLZx01391@ywing.netscape.com> X-Sent: 31 Jul 2001 11:22:00 GMT From: "Roger Jack" To: <4248016@mcimail.com> Subject: LEGITIMATE INTERNET MLM MAIL ORDER SYSTEM!!! Sender: "Roger Jack" Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Date: Tue, 31 Jul 2001 07:21:45 -0400 Reply-To: "Roger Jack" Resent-Message-ID: <"mp3DCD.A.nLH.jTpZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com X-MIME-Autoconverted: from 8bit to quoted-printable by netscape.com id f6VBMDv25257 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by ietf.org id HAA12745 Hello, My name is Roger Jack from Toronto Ontario Canada. Before you put me in the trash, I just want to say this system really works! Everything that's explained in this campaign letter works exactly the way it's designed - To Make YOU rich! I am a real person that once doubted this system and is now reaping the awesome rewards because I gave it a chance! For the price of one night out at the movies you can own a proven money making vehicle to earn YOU the cash you want without any bosses or time cards. I beg of you to please put your skepticisms aside for 5 minutes and understand how this WILL work for you! It's simple. It works. I proudly present to you your opportunity…. ************* Make a descent income independently in less than 90 Days! -If this message was sent to you in error then please forgive me (delete right away) and I'll tell someone who IS interested in EARNING money BIG 100% Purely LEGITIMATE, LEGAL, Fail-safe and dummy proof! It works (like designed) but only for those who follow it to the letter!! Please read this program... Then Read it Again!! ----------------------------------------------------------------- #############...........INSTRUCTIONS:............################ ----------------------------------------------------------------- This cookie-cutter method of raising capital REALLY WORKS! I am sure that you could easily earn 10 times your current salary or more in the next 90 days. Before you say "BULL... ", please read this program carefully. This is not a chain letter, but a perfectly legal money making opportunity. Basically, this is what you do: As with all multi-level businesses, we build our business by recruiting new partners and selling our products. Every state in the USA (or province in Canada) allows you to recruit new multi-level business partners, and we offer a product for EVERY dollar sent. Your orders COME BY MAIL & are FULFILLED by E-MAIL, so you are never involved in personal selling. You do it privately in your own home, store or office. This is the GREATEST multi-level mail order marketing anywhere: This is what you MUST do: 1.) Order all 5 reports shown on the list below: (you can't sell them if you don't order them). * When you place your order, make sure you order each of the five reports. You will need all five reports so that you can save them on your computer and resell them. Within a few days you will receive, via e-mail, each of the five reports. Save them on your computer so they will be accessible for you to send to the 1,000's of people who will order them from you. 2.) IMPORTANT-- DO NOT alter the names of the people who are listed next to each report, or their sequence on the list, in any way other than is instructed below in steps "a" through "f" or you will lose out on the majority of your profits. Once you understand the way this works, you'll also see how it doesn't work if you change it. Remember, this method has been tested, and if you alter it, it will not work. a. Look below for the listing of available reports. b. After you've ordered the five reports, take this Advertisement and remove the name and address under REPORT #5. This person has made it through the cycle and is no doubt laughing all the way to the bank! c. Move the name and address under REPORT #4 down to REPORT #5. d. Move the name and address under REPORT #3 down to REPORT #4. e. Move the name and address under REPORT #2 down to REPORT #3. e. Move the name and address under REPORT #1 down to REPORT #2. f. Insert YOUR name/address in the REPORT #1 position. Please make sure you copy every name and address ACCURATELY! 3.) Take this entire letter, including the modified list of names, and save it to your computer. Make NO changes to the Instruction portion of this letter. Your cost to participate in this is practically nothing (surely you can afford $25). You obviously already have an Internet Connection and e-mail is FREE! To assist you with marketing your business on the internet, the 5 reports you purchase will provide you with invaluable marketing information which includes how to send bulk e-mails, where to find thousands of free classified ads and much, much more. The reports will provide you information on the hottest internet marketing clubs such as INTERNET MARKETING RESOURCES (IMR): This is one the premiere internet marketing clubs on the INTERNET. The club specializes in providing free internet marketing tools and services for the Do-Yourself-Internet-Marketer. They will provide you with free bulk e-mail software and millions of fresh e-mail addresses each week. AVAILABLE REPORTS *** Order Each REPORT by NUMBER *** Notes: -- Send $5 CASH (U.S. CURRENCY) for EACH report. CHECKS NOT ACCEPTED. -- ALWAYS SEND YOUR ORDER VIA FIRST CLASS MAIL. Make sure the cash is concealed by wrapping it in at least two sheets of paper. On one of those sheets of paper, include: (a) the number of the report you are ordering, (b) your e-mail address, and (c) your name & postal address. PLACE YOUR ORDER FOR THESE REPORTS NOW: ------------------------------------------------------------------ REPORT #1: The Insiders Guide to Advertising For Free On The Net Order Report #1 from: Roger Jack 40-1110 Finch Ave. W. Suite 1001 Toronto, Ontario Canada M3J3M2 (receive a limited bonus from me to jump start your success) ------------------------------------------------------------------ REPORT #2: The Insiders Guide to Sending Bulk Email On The Net Order Report #2 from: Pierre Fuentes 131 Hillcroft Drive Markham, Ontario Canada L3S 1G3 ------------------------------------------------------------------ REPORT #3: The Secret To Multi Level Marketing On The Net Order Report #3 from: K. Conner 2128 Mountain Road Halifax, Va. 24558 USA ------------------------------------------------------------------ REPORT #4: How to Become A Millionaire Using MLM and The Net Order Report #4 from: Joanne Denton 4239 Holland Rd, Suite #784-602 Virginia Beach VA 23462 USA ------------------------------------------------------------------ REPORT #5: How To Send One Million Emails For Free Order Report #5 from: Kristin Butler 32 Mccullough rd. Cody, Wy 82414 USA ------------------------------------------------------------------ Basically where you come in is to advertise and remember: THE MORE YOU ADVERTISE THE MORE YOU WILL SUCCEED!!!! About 50,000 new people get online every month! There are two primary methods of building your downline: METHOD # 1: SENDING BULK E-MAIL Let's say that you decide to start small, just to see how it goes, and we will assume you and those involved send out only 5,000 e-mails each. Let's also assume that the mailing receive only a 0.2% response.(the response could be much better but lets just say it is only 0.2% . Also many people will send out hundreds of thousands e-mails instead of only 5,000 each). Continuing with this example, you send out only 5,000 e-mails. With a 0.2%response, that is only 10 orders for report #1. Those 10 people responded by sending out 5,000 e-mail each for a total of 50,000. Out of those 50,000 e-mails only 0.2% responded with orders. That = 100 people responded and ordered Report #2. Those 100 people mail out 5,000 e-mails each for a total of 500,000 e-mails. The 0.2% response to that is 1000 orders for Report #3. Those 1000 people send out 5,000 e-mails each for a total of 5 million e-mails sent out. The 0.2% response to that is 10,000 orders for Report #4. Those 10,000 people send out 5,000 e-mails each for a total of 50,000,000 e-mails. The 0.2% response to that is 100,000 orders for Report # 5. THAT'S 100,000 ORDERS TIMES $5 EACH = $500,000.00 (half million). Your total income in this example is: $50+ $500+ $5,000 + $50,000+ $500,000.........Grand Total = $555,550.00 NUMBERS DO NOT LIE. GET A PENCIL & PAPER AND FIGURE OUT THE WORST POSSIBLE RESPONSES! NO MATTER HOW YOU CALCULATE IT, YOU WILL STILL MAKE FAR MORE MONEY THAN YOU INVEST! REMEMBER FRIEND, THIS IS ASSUMING ONLY 10 PEOPLE ORDERING OUT OF 5,000 YOU MAILED TO. Dare to think for a moment what would happen if everyone, or even one 3rd of those people mailed 100,000 e-mails each or more? There are over 150 million people on the Internet worldwide and counting. Believe me, many people will do just that, and more! METHOD #2 : BY PLACING FREE ADS ON THE INTERNET Advertising on the net is very very inexpensive and there are hundreds of FREE places to advertise. Placing a lot of free ads on the Internet will easily get a larger response. We strongly suggest you start with Method # 1 and add METHOD #2 as you go along. REPORT #2 will show you the best methods for bulk e-mailing, tell you where to obtain free bulk e-mail software and where to obtain e-mail lists. THINK ABOUT IT! For every $5.00 you receive, all you must do is e-mail them the report they ordered. THAT'S IT! ALWAYS PROVIDE SAME-DAY SERVICE ON ALL ORDERS! This will guarantee that the e-mail THEY send out with YOUR name and address on it will be prompt because they can't advertise until they receive the report! THERE'S NOTHING MORE TO DO. As your name reaches position 2, 3, 4 and 5 the more five Dollar bills you will receive. How many thousands could you receive? (****GIVE THIS A TRY I PROMISE YOU WON'T BE SORRY****) ******* TIPS FOR SUCCESS ******* -- TREAT THIS AS YOUR BUSINESS! Be prompt, professional, and follow the directions accurately. -- Send for the four reports IMMEDIATELY so you will have them when the orders start coming in because: When you receive a $5 order, you MUST send out the requested product/report. -- ALWAYS PROVIDE SAME-DAY SERVICE ON THE ORDERS YOU RECEIVE. -- Be patient and persistent with this program. If you follow the instructions exactly, your results WILL BE SUCCESSFUL! -- ABOVE ALL, HAVE FAITH IN YOURSELF AND KNOW YOU WILL SUCCEED! ------------------------------------------------------------------ ******* T E S T I M O N I A L S ******* This program does work, but you must follow it EXACTLY! Especially the rule of not trying to place your name in a different position, it won't work and you'll lose a lot of potential income. I'm living proof that it works. It really is a great opportunity to make relatively easy money, with little cost to you. If you do choose to participate, follow the program exactly, and you'll be on your way to financial security. Steven Bardfield, Portland, OR ************************************************************ My name is Mitchell. My wife, Jody, and I live in Chicago, IL. I am a cost accountant with a major U.S. Corporation and I make pretty good money. When I received the program I grumbled to Jody about receiving "junk mail." I made fun of the whole thing, spouting my knowledge of the population and percentages involved. I "knew" it wouldn't work. Jody totally ignored my supposed intelligence and jumped in with both feet. I made merciless fun of her, and was ready to lay the old "I told you so" on her when the thing didn't work... well, the laugh was on me! Within two weeks she had received over 50 responses. Within 45 days she had received over $147,200 in $5 bills! I was shocked! I was sure that I had it all figured and that it wouldn't work. I AM a believer now. I have joined Jody in her "hobby." I did have seven more years until retirement, but I think of the "rat race" and it's not for me. We owe it all to MLM. Mitchell Wolf MD., Chicago, IL ************************************************************ The main reason for this letter is to convince you that this system is honest, lawful, extremely profitable, and is a way to get a large amount of money in a short time. I was approached several times before I checked this out. I joined just to see what one could expect in return for the minimal effort and money required. To my astonishment, I received $36,470.00 in the first 14 weeks, with money still coming in. Charles Morris, Esq. ************************************************************ Not being the gambling type, it took me several weeks to make up my mind to participate in this plan. But conservative that I am, I decided that the initial investment was so little that there was just no way that I wouldn't get enough orders to at least get my money back. Boy, was I surprised when I found my medium-size post office box crammed with orders! For awhile, it got so overloaded that I had to start picking up my mail at the window. I'll make more money this year than any 10 years of my life before. The nice thing about this deal is that it doesn't matter where people live. There simply isn't a better investment with a faster return. Paige Willis, Des Moines, IA ************************************************************ I had received this program before. I deleted it, but later I wondered if I shouldn't have given it a try. Of course, I had no idea who to contact to get another copy, so I had to wait until I was e-mailed another program, ....11 months passed then it came...I didn't delete this one! I made more than $41,000 on the first try!! Violet Wilson, Johnstown, PA *********************************************************** This is my third time to participate in this plan. We have quit our jobs, and will soon buy a home on the beach and live off the interest on our money. The only way on earth that this plan will work for you is if you do it. For your sake, and for your family's sake don't pass up this golden opportunity. Good luck and happy spending! Kerry Ford, Centerport, NY ************************************************************ I am a real person and this is a real program! Greetings, Hopefully my name is still on the list. I am a retired attorney. Approximately, two years ago a man came to me with a letter similar to this one. He asked me to verify the fact that this letter was legal. I told him I would review it and get it back to him. When I first read the letter a week and a half later, we met in my office to discuss the letter. I told him that the letter he originally brought me was not 100% legal and I advised him to make a small change in the letter so it would be. I was still curious about the letter, so he proceeded to explain how the letter works. I thought it was a long shot and decided against participating. However, before he left, I asked him to keep me updated on his results. About two months later, he called to tell me he had received over $40,000 in cash. I did not believe him. He suggested that I try his idea and find out for myself. I thought about it for a couple of days and then I realized I had nothing to lose, only some money to gain. If nothing else I would make my investment back, so I asked him for a copy of the letter. I followed the instructions exactly, mailed out 100,000 e-mails and sure enough, the money started arriving. It came slowly at first, but after three weeks I was getting more mail in than I could open in a day. After about 3 months , the money stopped coming in. I kept a precise record of my earnings and at the end they totaled $58,493. I was earning a good living as an attorney. However, as anyone in the legal profession will tell you, there is a lot of stress that comes with the job. I told myself that if things really started working out, I could retire from my practice and play golf with in a few years. I decided to try the letter again, but this time I sent out 500,000 e-mails. Well, three months later, my earnings totaled $89,178. I just couldn't believe it. I met with my old client for lunch to find out why or even how this letter was working so well. He told me that there are five names on the list instead of six and with this program your only sending $5 to those five people instead of $10 each. That fact alone resulted in many more returns. The other part was guaranteeing that the whole program was legal, since no one wants to risk participating in something illegal. This program has provided me with an independent income and thus allowed me to retire early. My name is Bill Covington, and my Law Practice of 27 years I operated in Houston. ************************************************************ ORDER YOUR REPORTS TODAY AND GET STARTED ON YOUR ROAD TO FINANCIAL FREEDOM! NOW IS THE TIME FOR YOUR TURN DECISIVE ACTION YIELDS POWERFUL RESULTS _______________________________________________________ Thank you for your time and consideration. Your earnings are highly dependent on your activities and advertising. The information contained on this site and in the report constitutes no guarantees stated or implied. In the event that it is determined that this site or report constitutes a guarantee of any kind, that guarantee is now void. The earnings amounts listed on this site and in the report are estimates only. If you don't try it - you will NEVER Know !! ~It Works ~ It's Legal ~ It's Easy ~ So WHY NOT ?!? _________________________________________________________________ GOOD LUCK AND HAVE FUN! _________________________________________________________________ From list@netscape.com Wed Aug 1 00:00:24 2001 Received: from netscape.com (c3po.netscape.com [205.217.237.46]) by ietf.org (8.9.1a/8.9.1a) with SMTP id OAA09362 for ; Tue, 31 Jul 2001 14:55:36 -0400 (EDT) Received: from aka.mcom.com (aka.mcom.com [205.217.237.180]) by netscape.com (8.10.0/8.10.0) with ESMTP id f6VI8Sv16636; Tue, 31 Jul 2001 11:08:28 -0700 (PDT) Received: (from list@localhost) by aka.mcom.com (8.10.0/8.10.0) id f6VI8TE15299; Tue, 31 Jul 2001 11:08:29 -0700 (PDT) Resent-Date: Tue, 31 Jul 2001 11:08:29 -0700 (PDT) Message-Id: <200107311808.f6VI81D23343@xwing.aoltw.net> To: From: kyoko@tama.or.jp Subject: Re: YOUR CREDIT FILE!! 31396 Date: Tue, 31 Jul 2001 10:57:37 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal Reply-To: megu3@gold.ocn.ne.jp Resent-Message-ID: <"5oaD_B.A.qtD.bQvZ7"@glacier> Resent-From: ietf-ldapext@netscape.com X-Mailing-List: X-Loop: ietf-ldapext@netscape.com Precedence: list Resent-Sender: ietf-ldapext-request@netscape.com Content-Transfer-Encoding: 7bit $$ GUARANTEED WAY TO QUICKLY HAVE EXCELLENT CREDIT!! $$ Dear Friend, Give yourself the ADVANTAGE of enjoying life more with EXCELLENT CREDIT!! Over the past 8 years I have perfected a system called the Proven Credit Advantage Program. It's a guaranteed way for legally getting an excellent credit rating almost instantly. Here's how: If you have bad credit you will simply go through my easy 5 step program to quickly get a new, legal, unblemished credit file and establish Excellent Credit. If you don't have bad credit, but want to make your existing credit EXCELLENT, we will go straight to STEP 5. Step 1 - Because no two people in the United States have the same Social Security Number, Banks and Creditors access your credit file almost entirely by your SS#. You will not want to change your Social Security Number because it is extremely difficult to do so and you need it for your Employment, Taxes and Social Security Benefits. The FEDERAL PRIVACY ACT OF 1974 clearly states that only the Government and your employer can force you to use your SS#. Because of this law you are allowed to legally use another 9 digit number to use in place of your Social Security # on credit applications. The first day you become our client, you will receive your own number through the Employer Identification Number Program. You will need us for this because 95% of all Employer Identification Numbers, although 9 digits, do not look anything like Social Security Numbers and cannot be used on credit applications. We will legally get you an Employer Identification Number that fits in the same range of Social Numbers in use today. Because the Federal Laws do not require you to give your SS# to anyone besides your Employer and the Government, you can now legally use this number in place of your SS# on credit applications. Remember, your new number will only be used for new credit. Step 2 - No two people with the same name have the same mailing address, so you will need to obtain a new mailing address for use on your new credit file. A friend, relative or mailbox address in your area will be perfect. Step 3 - No two people with the same name have the same telephone numbers, so you will also need a new telephone number for use on your new credit file. A friend, relative, voice mail or pager will again work perfectly. Step 4 - With your new Social Security number, new address and new telephone number we will open your new credit file. It will now be totally impossible for any creditor to know anything about your past credit history. Step 5- To guarantee that you will quickly have EXCELLENT CREDIT, we will assist you in instantly adding UNLIMITED positive information to your credit file. This is an unknown way of adding real accounts to your new credit file to give you an Excellent Credit Rating in less than 15 days. As you know, the more positive information on your credit file, the more money banks will lend you. Countless clients of ours have credit lines over $100,000 because of our Proven Credit Advantage Program! When we are finished you will receive a copy of your credit file proving that you now have excellent credit! This will take less than 15 days. You will now be able to easily qualify for ANY credit you apply for! To be on the road to EXCELLENT CREDIT simply send us your name, complete mailing address including zip code and telephone number (optional), along with a check or money order payable to American Financial Services Inc. for $29.95. Send to: American Financial Services Inc. Attn.: Mike Robbins 311 N. Robertson Blvd. Suite 625 Beverly Hills, CA 90210 All necessary paperwork along with a telephone number to contact us for assistance will be sent to you priority mailed to you within 3 business days. $$$$ RISK FREE DOUBLE YOUR MONEY BACK GUARANTEE!! $$$$ My Proven Credit Advantage Program unconditionally guarantees you will qualify for personal loans, business loans, credit cards, auto loans, home loans and any other credit you apply for! If you are not able to qualify for credit after using my program, simply return your Proven Credit Advantage Program along with your denial letter and your $29.95 investment will be refunded DOUBLE! That's a $59.90 refund if this doesn't work like I said! I make this guarantee to you because the Proven Credit Advantage Program has already helped over 15,000 people just like you. I KNOW it works - all you need to do is sign up TODAY! I truly look forward to making you another SATISFIED CLIENT!! ................................................................ Yes! I deserve excellent credit. Please enroll me in the Proven Credit Advantage Program. Enclosed is my check/money order for $29.95. The following information is for our records only and does not need to be your new credit file information. First Name______________________________ Last Name________________________________ Address__________________________________ City_____________________________________ State_______________Zip__________________ Telephone(optional)______________________ e-mail___________________________________ If you would prefer to download your Proven Credit Advantage Program, simply check below and we will e-mail you a download upon receipt of your order. Otherwise we will Priority Mail your program to the above address. ___ Please e-mail me my PROVEN CREDIT ADVANTAGE PROGRAM to the above e-mail address. ___ Please send me my PROVEN CREDIT ADVANTAGE PROGRAM via United States Priority Mail to the above address. Send $29.95 to: American Financial Services Inc. Attn: Mike Robbins 311 N. Robertson Blvd. Suite 625 Beverly Hills, CA 90210 This e-mail is never sent unsolicited! You have been sent this email because we received your e-mail address in an opt-in database for individuals interested in information to improve their financial situation. If this e-mail has reached you in error please respond to: optmeoutnow44@hotmail.com with remove in the subject line.


Registration Form (US and Canada Only)
Please fill out this form if you would like to be included in the registry=2E= For accuracy and publication purposes, please complete and send this form at the earliest opportunity=2E There is no charge or obligation to be listed in The Registry=2E=

Your Name
Your Company
Title
Address
City
State or Province
Country
ZIP/Postal Code
Day Time Telephone
Home Phone	(Not To Be Published)
Email

U.S. homeowner	yes no
First name
Last name
Phone number
E-mail address
Street address
City
State
Zip
Value
Balance
Payment
2nd balance
Payment
Amount of cash wanted
Area of interest
Employer
Annual gross income
Credit	excellentgood fair poor


	=AE=C8=B9C=B1M=B7= ~=A4J=A4f=BA=F4=AF=B8 www.ET-Mall.com.tw =B5=B9=B1z=A5=FE=A5@=AC=C9...