Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!utgpu!water!watmath!mgvax!root
From: root@mgvax.UUCP
Newsgroups: talk.religion.misc,news.admin,news.sysadmin
Subject: Re: From the REAL Ken Arndt???
Message-ID: <532@mgvax.UUCP>
Date: Fri, 17-Apr-87 20:21:31 EST
Article-I.D.: mgvax.532
Posted: Fri Apr 17 20:21:31 1987
Date-Received: Sat, 18-Apr-87 06:08:47 EST
References: <9322@decwrl.DEC.COM> <666@prometheus.UUCP>
Organization: Mike Gore, Waterloo Ont. Canada
Lines: 38
Xref: utgpu talk.religion.misc:2576 news.admin:285 news.sysadmin:98
Summary: now from mit-eddie ?


In faked article <666@prometheus.UUCP>, arndt@prometheus.UUCP 
	(ken arndt) is supposed to have writen:
> Oh Dear.  Children.  Be warned.  Some person for some reason is sending
> messages via "prometheus.UUCP!arndt" claiming to be ME!!  Imagine that.

[munch...]

This was the path I found to my site:
	Path: mgvax!watmath!clyde!rutgers!mit-eddie
		!genrad!decvax!ucbvax!prometheus.UUCP!arndt

The greatest common root path shows that likely mit-eddie pulling this stunt
for this particular case [ not others ]... The REAL problem with this sort of 
trick is that the faked messages will bounce real articles from prometheus.UUCP 
when/if the ID _matches_ because news rejects duplicate incoming messages... 

What can be done about this is that the greatest common root path can be found
by collecting paths from the news logs at major sites. While people can
fake a path that routes through their site , their site name and
the path to the destination can not be faked without help further
down the link. Of course these are well known problems with news,
but then again the software was writen for honest people... 

I would be interested in the "Path:" lines of the following news
posting from various site admins. [ /usr/lib/news/log or such ]. 
I have already been looked into the UUCP map database, the
two following article were likely faked ... _if_ the maps are up todate,
and also by noting that the article ID's were a few days out of sync with 
'real' postings from prometheus...

	Apr 11 17:22	<607@prometheus.UUCP> ng talk.religion.misc 
	Apr 11 17:23	<606@prometheus.UUCP> ng talk.religion.misc 

Best Regards,

# At Home: 	watmath!mgvax!root, watmath!mgvax!mike
# Note: 	do not use an '@' in a path to 'mgvax' (old mail software)