Subject: [Tools-discuss] IETF tools list issues (update)

From: "Frank Ellermann" <[email-masked]>
Date: Sat, 19 Jul 2008 20:47:40 +0200

Hi, an updated list of issues from my POV:

* the RFC-I problem was fixed (= ietf.org unlisted),
  an update sent via GMaNe might be trapped in the
  moderation queue or in a meeting with Dave Null:
  <http://article.gmane.org/gmane.discuss/11839>

* various errata are still AWOL, for a complete list
  of 667 RFCs with reported errata as of 2008-07-08
  see <[email-masked]>, available in
  <http://article.gmane.org/gmane.ietf.tools/1109> 
  <http://www.ietf.org/mail-archive/web/tools-discuss/current/msg01563.html>

* the "challenge" wasn't identified as challenge by
  GMaNe, I'm not sure if that is a bug or a feature
  in practice.  Here is the "raw" challenge message:
  <http://article.gmane.org/gmane.ietf.tools/1114/raw>

  RFC 3834 issues in this "challenge":
  1 - The envelope sender address was the ordinary list
      address, the list bounce address might be better,
      see RFC 3834 chapter 3.3
  2 - There was no OPTIONAL (RFC 3834 chapter 3.1.8)
      Precedence: list (or similar) header field
  3 - There was no RECOMMENDED (3.1.7) Auto-Submitted
      header field 
  4 - There were no RECOMMENDED (3.1.6) References and
      In-Reply-To header fields with the Message-ID of
      the challenged article, IMO that would be good
  5 - There was no OPTIONAL (3.1.5) Auto: subject tag
  6 - There was no RECOMMENDED (3.1.2) Reply-To header
      field, that's bad in conjunction with the next
      points
  7 - The 2822-From was not a list owner address or say
      [email-masked] as RECOMMENDED in
      3.1.1, it was the list address, IMO that's wrong.

* GMaNe considered the challenge as ordinary mail from
  the list to all members, and that is how I got it, as
  ordinary "article" in a "newsgroup" gmane.ietf.tools.

  At that time I had no idea what is wrong and decided
  to send a "response" as requested, but "just in case"
  I used another route:  Via Gmail corresponding to the
  2822-From in the mail that triggered the challenge, a
  bad idea on my side.

  The list identified my address as subscribed, missed
  that it was "response" to its prior "challenge", and
  sent the response to all IETF Tools list members not
  limited to GMaNe:

  <http://article.gmane.org/gmane.ietf.tools/1115>
  <http://www.ietf.org/mail-archive/web/tools-discuss/current/msg01568.html>

  Likely the C/R system is still waiting for a response
  via GMaNe, I'll test that later.  RFC 3834 does not
  mention the problem of a "response" on another route,
  but I think C/R systems should find such responses -
  especially if the "challenge" claims to use only the
  subject to find "responses", not the envelope sender.

 Frank  

      

_______________________________________________
Tools-discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tools-discuss

---

From: "Frank Ellermann" <[email-masked]>
Date: Sat, 19 Jul 2008 22:02:59 +0200

> via GMaNe, I'll test that later.

Done - it was still waiting, only for the message that
triggered the original "challenge".  Because I reposted
it later you got that twice - please ignore this dupe:
<http://article.gmane.org/gmane.ietf.tools/1135/raw>

Apparently a later article with the same sender address
was dropped.  This message might make it, because the
sender address is now confirmed.  Or it triggers a new
challenge, because the sender address is unsubscribed.

When a spambot answers any "challenge" the C/R system
is defeated, is it really that simple ?

 Frank

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 31 Jul 2008 10:39:38 +0100

Hi Frank,

On 2008-07-19 19:47 Frank Ellermann said the following:
...
>       3.1.1, it was the list address, IMO that's wrong.

I'll be releasing 2 new versions of postconfirm (the challenge
issuing tool) over the next week or so, and plan to address at
least issues 3, 4, and 6, and possibly also 1 and 7 above in the
second of those releases.

Best,

	Henrik

---

From: "Frank Ellermann" <[email-masked]>
Date: Thu, 31 Jul 2008 13:41:44 +0200

> second of those releases.

Thanks.  This is a rather weird case, GMaNe got three further
challenges, where GMaNe apparently changed its addresses for
unlear reasons unilaterally from local@gmane to [email-masked]
style on different IETF lists.

Because I knew the drill I simply confirmed this using the same
route via GMaNe, not via another mail provider, and that worked.

 Frank