Date: 27 AUG 92 20:45:55 GMT
Newsgroups: vmsnet.networks.tcp-ip.multinet
X-Return-path: <info-multinet-relay@TGV.COM>
X-RFC822-From: "Mike Sullenberger (415) 926-2294" <mls@SLAC.STANFORD.EDU>
From: "Mike Sullenberger  926-2294" <mls@SLAC.STANFORD.EDU>
Subject: Problems with NETFIND (cont).
X-Envelope-to: info-multinet@tgv.com
X-VMS-To: in%"schwartz@latour.cs.colorado.edu"
X-VMS-Cc: 
Organization: The INFO-MULTINET Community

>Date: Wed, 26 Aug 1992 03:32:31 -0600
>From: Mike Schwartz <schwartz@latour.cs.colorado.edu>
>Subject: RE:  BIG complaint about NETFIND
>To: mls@SLAC.STANFORD.EDU
>
>Mike,

>I added some code to Netfind to check for SMTP servers that report
>erroneous info.  So, even if you don't make the change to the server I
>suggested, people should no longer get invalid information about your site.
>Note that this change has not yet propogated to the Netfind server run by
>the Gopher folks - I told them about it, but for now they are still running
>an older version.
> - Mike

Is the fix that you have made global or did you just put in a flag for 
SERV01.SLAC.STANFORD.EDU?  If it is not a global change then there are very 
likely many site Postmasters that are wondering why mail is being addressed to 
totally inappropriate hosts. 

If your are going to try doing SMTP Mailer functions then you need to do ALL of 
the things that an SMTP Mailer needs to do and one of the primary things is that 
it OBEYS the Domain Nameservice MX records.  Under NO circumstances should you 
send an SMTP EXPN command to any node except for the nodes that are  pointed to 
by MX records (unless there are not any MX records), also remember to go through 
your MX records in the correct order.

--------------------------------------------------------------------------------

>Date: Wed, 26 Aug 1992 11:24:38 -0600
>From: Mike Schwartz <schwartz@latour.cs.colorado.edu>
>Subject: RE:  BIG complaint about NETFIND
>To: mls@SLAC.STANFORD.EDU

>Ok, I'll fix the seed database entries.

> - Mike

--------------------------------------------------------------------------------

>Date: Wed, 26 Aug 1992 11:37:32 -0600
>From: Mike Schwartz <schwartz@latour.cs.colorado.edu>
>Subject: RE:  BIG complaint about NETFIND
>To: mls@SLAC.STANFORD.EDU

>This is also a consequence of the fact that the Gopher people don't keep
>their Netfind server up-to-date.  I fixed this problem a while ago on
>the University of Colorado server.
>
>I'd like to point out that Netfind is a purely voluntary effort.  I am
>not paid to do it - it is simply the outcome of a research prototype I
>built.  The tone of your messages imply that I am somehow obligated to fix
>things with respect to your domain.  I'm doing this out of a community
>spirit.  Perhaps in the future when you see things like this you can take
>the situation into account before you fire off an angry message.
> - Mike

You don't get the point.  I am not asking you to make changes to NETFIND so that 
I can use it, but so that it does not cause problems to other people on the 
network.  These are changes I certainly feel that you are obligated to fix and 
to fix them quickly.  Anytime that a program such as NETFIND comes on the 
network which provides mis-information and forces me to waste my time to clear 
up the confusion, then I will certainly fire off angry messages.  

--------------------------------------------------------------------------------

>Date: Thu, 27 Aug 1992 09:41:09 -0600
>From: Mike Schwartz <schwartz@latour.cs.colorado.edu>
>Subject: RE:  A problem with NETFIND (fyi)
>To: mls@SLAC.STANFORD.EDU

>Mike, I'm surprised at you.  This "problem with Netfind" was in reality a
>problem with the information your mailer gives out.  Moreover, one day
>after you told me about it, I changed Netfind to detect such problems,
>and not give out the invalid information.
> - Mike

Stop calling SERV01.SLAC.STANFORD.EDU a MAILER Node.  Just because it happens to 
run an SMTP Deamon on it is NOT relevant.  If an outside SMTP mailer ignores the 
MX records and sends SMTP commands to the node then that mailer is BROKEN (in 
your case NETFIND is BROKEN) and it deserves whatever it might get.

I forwarded our communication to a wider list so that other Postmasters on the 
network would not have to waste alot of their time figuring out why people from 
all over the world were sending mail destined for people that were not even at 
their site to a some host in their domain.

Actually you have done one service to the network.  You have pointed out very 
dramatically how easy it is to envade someones privacy on the network.  It looks 
like I will now have to look into shuting down access from offsite to all of the 
services that NETFIND abuses, maybe I should have shutdown these services before 
now.  There are a lot of government sites, ours included, that do not look 
kindly on this type of probing.  If we want to allow general electronic access 
to essentually private information (there are many privacy issues that need to 
be resolved first) then we would do it the correct way by putting up, for 
example, an OSI X.500 directory server or a WHOIS server.

Mike Sullenberger


X-Gateway-Source-Info: INTERNET