From: anon-admin@twwells.com
Subject: Re: monthly APS announcement
Date: Tue, 1 Sep 1992 16:28:16 GMT
Organization: None, Mt. Laurel, NJ

Mr. Carp, your announcement has a number of factual errors and
unjustifiable implications. Here are the corrections.

> There are three main differences between this service and the APS at
> twwells.com:
>
>         1.      Email send to khijol!anonasar@saturn.upl.com is
>                 stripped of headers and .sig stuff, then forwarded
>                 to alt-sexual-abuse-recovery@ucbvax.berkeley.edu.
>                 Mail is never posted directly to the net.

This is supposed to be a meaningful difference? With your system,
e-mail goes to khijol, is stripped of identifying info, forwarded
to alt-sexual-abuse-recovery@ucbvax.berkeley.edu and then posted.
In mine, the only difference is that the posting is done directly
at twwells.com; there is no forwarding step. In *neither* system
is e-mail posted directly to the net.

>         2.      Since all email is going through a common mailbox
>                 on khijol, it is impossible for anonymous posters
>                 to receive email through this service.  This is
>                 considered an additional safety feature.

Passive voice is wonderful for obscuring the fact that not
everyone agrees with you. You and some others may consider this a
safety feature; however, the reality is that it makes no material
difference given the existence of the several other anonymous
e-mail services around. (Never mind the highly debatable point of
whether the existence of anonymous e-mail results in a decrease
in safety, say, in comparison with using the net in the first
place.)

On twwells.com, BTW, when you first use the system, e-mail will
not be forwarded to you. Unlike the khijol service, you can
change that.

>         3.      Since khijol is not directly reachable from the
>                 Internet, and is not available via dialup lines,
>                 this makes it virtually immune to attack from
>                 unauthorized access.  Khijol has successfully
>                 survived a concerted attack by "crackers" intent
>                 on gaining access to the proprietary software base
>                 stored there, as well as the well-known "Morris
>                 worm" incident, and has been in more-or-less continuous
>                 service (via uucp access) for more than three years.

You put this paragraph in a list of differences, with the
implication that twwells.com is on the Internet and so subject to
unauthorized access. In fact, twwells.com is, like khijol, a uucp
only site. Twwells.com has never, in its four year existence,
suffered any kind of breach. This status is maintained by access
software written by me and by constant monitoring.

However, there is one difference between the two sites that is of
interest to the truly paranoid. :-) When you post through either
service, the e-mail that will become the posting is routed
through your local network, probably through the Internet, and
then through the uucp network. During all this time, your e-mail
address remains attached to your posting; it doesn't get removed
until the e-mail hits khijol or twwells.com. Rather obviously,
the fewer the sites involved in transferring the e-mail to the
posting service, the better. Also, the more secure and
trustworthy the intervening sites, the better.

My site is directly connected (via uucp) to two Internet sites.
These two sites are decwrl and uunet, both of which get high
marks for trustworthiness and security. (Even better: both have
such a high volume of e-mail passing through them that their
system administrators aren't likely to spot your e-mail, even if
they happen to be looking in the right place. :-) Your e-mail to
twwells.com will go directly from your local network or system to
the Internet and then directly to mine. However, khijol does not
appear to be so closely connected to the Internet; e-mail goes
through at least one other system before getting there. It is my
hope that Mr. Carp has taken care to see that all of the sites
that handle his incoming e-mail are trustworthy. Provided that he
has, both systems should be approximately equally secure.

---
Bill                            { uunet | decwrl | telesci }!twwells!bill
bill@twwells.com
Newsgroups: alt.sexual.abuse.recovery