From: karl@ddsw1.mcs.com (Karl Denninger)
Subject: Re: The 'ASALA/SDPA/ARF' 'kucukucus' Would Like 'Tamamidis,' I Think.
Organization: Macro Computer Solutions, Inc., Chicago, IL
Date: Sat, 15 Aug 1992 04:04:41 GMT
X-Disclaimer:  Material posted in this article is the sole responsibility of
                the poster and does not represent MCSNet or the system owners.

In article <9208130024.A5607qi@anadolu.michigan.com> han@anadolu.michigan.com (hasan.b.mutlu) writes:
>
><1992Aug13.031756.12296@ddsw1.mcs.com>
>karl@ddsw1.mcs.com (Karl Denninger)
>
>>>If you as a 'spiritual wieneramus,' abound with so much ignorance,
>>>what about lesser 'palikaryas?'
>
>>Now c'mon Hasan, lets be honest here.
>
>Why not?
>
>>Can you discredit the posting from ibm.com recently which detailed some
>>sendmail logs showing that Cosar had forged a posting to appear as if it
>>came from you via Anadolu.Michigan.Com?
>
>I already did. Are you claiming that 'anadolu.michigan.com' is not a 
>legitimate address for 'mutlu?' I am responsible for every single
>article posted from 'anadolu.michigan.com' or 'ddsw1.mcs.com.'

Nope.  I am not claiming that at all.  Anadolu.michigan.com is quite a
legitimate address, as is "ddsw1.mcs.com" :-)

However, it would appear from the logs posted that Ahmet Cosar forged a
message so as to appear to have came from you.  All I am interested in (for
curiosity's sake; I'm certainly not upset if you want others to post in your
name or likeness) is whether you agree that he did this with your knowledge
and consent.

My interest here is in whether the article cited really did originate at
anadolu, or if it was forged to >appear< to have come from anadolu.  As
you're quite aware, people have a lot of fun forging articles that appear 
to have come from you (and I too) occasionally.  Its quite a bit of fun to 
run these down when they appear.  

I'm interested (for academic reasons) in whether or not the article cited was:

1)	From you, and vectored through Ahmet's machine for traffic control
	or other reasons.
2)	From Ahmet, forged to appear as if from you, with your consent.
3)	From Ahmet, forged to appear as if from you, WITHOUT your consent.

You see, #3 is reprehensible.  #2 casts some interesting shadows over the 
entire idea of you being the author of your works.  #1 is quite normal 
procedure, especially in times of heavy system load; nothing wrong there.

I can draw any of the above conclusions from the evidence.  There isn't
enough there to >know< what happened.  That is why I asked.  It looks
suspicious to route postings through Ahmet's machine instead of directly
into Michigan.Com; why take the extra hop?

>>While logs can be forged just like anything else, this evidence certainly 
>>looked like quite a smoking gun to me...
>
>This is utter assertion, without even a hint of factual data to 
>confirm it, Karl.

Really?  Sendmail logs are easily analyzed; the patterns are well-known.
Unless the people who provided them from the un-involved sites (ucbvax, etc)
are corrupt (and what reason would they have to be?), or Zap* has changed
the logs (possible, but no evidence for this) it does indeed look like Ahmet
Cosar either originated or forwarded a mail message intended to be posted as
if it originated with you. 

Whether it did originate with you is the point, and if it did not, was this
with or without your knowledge and consent?

--
Karl Denninger (karl@ddsw1.MCS.COM, <well-connected>!ddsw1!karl)
Data Line: [+1 312 248-0900] Anon. arch. (nuucp) 00:00-06:00 C[SD]T
Request file: /u/public/sources/DIRECTORY/README for instructions