Subject: Re: #1310 Approved

From: [email-masked]
Date: Mon, 7 Aug 2006 11:54:11 -0700 (PDT)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

I wrote:

>>The fact that it cannot be neither enforced nor detected is sufficient.

>It can be enforced mechanically by including that header in some digital
>signature.

You can digitally sign all the crap you want, it will still be crap.

There is no way for any enforcement of the contents of that header, and no
way to detect crap even if the crap is signed.

>But in the meantime, it can be and regularly is detected by observant
>Newscops who then try to send LARTs to the perpetrator's ISP.

"Observant Newscops" have no idea of all the possible valid values I
could put in an Approved header. They would likewise have no clue if
the moderator of a group gave me permission to post something and I
put his address in the Approved header.

>Nothing stops working.

Then the MUST does not meet RFC2119 requirements and must be removed.

>But that is not a requirement for using "MUST". You
>are also allowed to use "MUST" for security issues, and that is the
>justification here.

This is not a "security" issue, and even were it one, since you cannot
detect an invalid contextual (vs. syntactically incorrect) value, and
nothing should be doing anything with the value in the first place, the
MUST is still incorrect.

---

From: [email-masked]
Date: Tue, 8 Aug 2006 13:10:15 -0700 (PDT)

Frank Ellermann <nobody@xxxxxxxxxxxxxxxxx>:

>Software trying to match Approved: header fields with moderated
>newsgroups can't work with forged addresses (= addresses used
>_without_ the permission of the mailbox owner).

What software tries to match approved header fields with addresses
contained therein? Remember that current standards do not mandate an
address in that header field, so they would already fail with valid
headers.

>That should suffice for legal action ...

You have got to be kidding. You think a MUST appearing in our standard
will be a valid basis for legal action? You think someone ought to be
sued or go to jail because they did not put their own address in the
Approved header of an article they posted?

The fact remains that agents have even less idea of what is "legal" in
that header than they do in the From header, and trying to mandate 
something that they simply do not care about and does not break anything
is a violation of RFC2119.

---

From: [email-masked]
Date: Wed, 9 Aug 2006 13:49:05 -0700 (PDT)

"Charles Lindsey" <chl@xxxxxxxxxxxxxxxx>:

>Yes, I agree. The Internet is plagued with scams and spams of every sort.
>Do these not count as "harm"

Not in the context of a technical standard.

>and should not standards set things up so as
>to make life as hard as possible for the s[cp]ammers?

If only.

>What is in the Current draft regarding Approved will not of itself cure
>all the ills of the Internet, but it is a step in that direction.

What complete and utter nonsense. What is in the current draft regarding
Approved will do nothing at all to prevent internet scamming or spamming.
It is an unenforcable mandate that is undetectable outside the poster's
server and usually undetectable there, too.

And aren't YOU the fellow who just told me there is no point in my taking 
part in a discussion if I ignore the proposed changes, just as you have 
done here? Yes:

>There is not much point in your taking part in a discussion if you are
>going to ignore all the proposed changes that have been made and merely
>continue to rant about the unmodified text which people have already
>agreed needs to be changed.

Pot. Kettle.