Xref: utzoo news.groups:26759 alt.flame:26267 comp.unix.internals:1598 rec.pets:17926 talk.bizarre:58262
Path: utzoo!attcan!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uunet!pallas!dlee
From: dlee@pallas.athenanet.com (Doug Lee)
Newsgroups: news.groups,alt.flame,comp.unix.internals,rec.pets,talk.bizarre
Subject: Tracking down the "PLEASE HELP ME!!!!!" (vmunix file) poster
Summary: who's rissa@gargoyle.uchicago.edu?  Who's been uuencoding lately?
Message-ID: <469@pallas.athenanet.com>
Date: 21 Dec 90 05:04:49 GMT
Reply-To: dlee@athenanet.com (Doug Lee)
Followup-To: comp.unix.internals
Lines: 53
Expires:
Sender:

[Followups directed to comp.unix.internals; I don't know where this belongs,
but at least I get that...]

Pardon me if this has been said before; this is not the most up-to-date
news feed ...

The recently posted "vmunix" file is, in fact, a small text file uuencoded
about 12 or 13 times with the last "begin" line missing:

----CUT HERE----
	Congratulations!    You've found the secret message again, D00D!
Someone trying to be funny hinted the "PLEASE HELP ME!!!!!" article was
written by
		rissa@gargoyle.uchicago.edu (Patricia O Tuama)

Of course it was NOT!  "Classic BIFF" forgeries already take enough time,
there's no time to do some "Classic JJ" as well.  I did enjoy the unknown
forger's article though.  I don't think he's one of the regulars in
alt.flame, because they wouldn't be able to create such an eminent forgery!

Oh, complaining about waste of bandwidth is useless, honey.
Send email flames to rissa@world.std.com if you wish, dear.
See if I care.
					at that point trish, very amused

----CUT HERE----

First, since I don't have the original "PLEASE HELP ME!!!!!" article and its
associated "core" file, I would be interested in someone determining if that
was also similarly encoded.  Second, I have no way of knowing where the
		rissa@gargoyle.uchicago.edu id came from, and this might also
be useful information.  Last (and probably least likely), I'm wondering if it
is possible to A) determine, at least approximately, from which machine the
article was sent, and B) who on that machine executed the required number of
uuencodes at about the time of the posting.

For the curious, here is an explanation of the file's decoding, to the best
of my recollection:

Starting with the article in a file, say, v1:
    Remove everything above the first "garbage" line.
    Insert "begin 644 v2" above line 1.
    do forever {
        uudecode the resulting file.
        stop if text file reached;
        else [file with "begin 000 /dev/null" line obtained]
            change "begin 000 /dev/null" to "begin 644 v<i>", <i> being the
              next integer after that used in the current filename.
    }

I believe I reached about v13.
-- 
Doug Lee  (dlee@athenanet.com or uunet!pallas!dlee)