From: peter@zeus.DIALix.oz.au (Peter Wemm)
Newsgroups: news.software.nn
Subject: Re: Posting problems? - The **REAL** Reason.. (Blush..)
Date: 15 Sep 1992 06:20:43 GMT
Organization: Karam Pty. Ltd., Perth, Western Australia.
NNTP-Posting-Host: zeus.dialix.oz.au

peter@zeus.DIALix.oz.au (Peter Wemm) writes:
>peter@zeus.DIALix.oz.au (Peter Wemm) writes:
>>I have recieved mail to the effect that some of the articles that I have
>>posted were not transmitted correctly in some parts of the world..

>Well.. It seems that something bizare happened at my news-feed site...

>If somebody who has the power to cancel these wishes to do so, then by all
>means, DO IT!

>Thanks...

After recieving an enlightening piece of mail from
David Seddon <djs@csis.dit.sciro.au>, it seems that there were a few extra
lines added onto the end of the patch #17 posting.  This most likeley
originated from when I posted from a brand new installation of INN that
was experimentally running instead of Cnews.  The batcher was not putting
a blank line before the 2nd #! rnews in the batch, and my cnews neighbor
was ignoring the bytecount of the first article, and looking for "\n#! rnews"
as the article seperator.

David seemed to think that the patch program (or nn's internal patch driver)
might have been seeing the #! rnews and EXECUTING it...  This (if true)
would be a ***HUGE*** security hole, as anybody posting diffs to the net
could include arbitary shell commands....  Any if you are patching as
root, watch out!

I'll add that I tested this on my machine a moment ago, and it nothing
happened, and I can't see it in the source anywhere..

I thought I'd better point this out, in case there is a super-duper
patch program out there that does "a bit more" :-) than my one does 
(Gnu patch-2.12u7).

>Date: Tue, 15 Sep 92 11:26:41 EST
>From: David Seddon <djs@csis.dit.csiro.au>
>Message-Id: <9209150126.AA28840@lynx.csis.dit.csiro.au>
>To: peter@zeus.dialix.oz.au
>Subject: A possible reason for your blank postings
>
>    Patch 17, as I received it here had the following lines at the end:
>
> #! rnews 11939
> Path: zeus!not-for-mail
> ~From: peter@zeus.DIALix.oz.au (Peter Wemm)
> ~Newsgroups: news.software.nn,comp.sourc
>
>I had assumed that these were the cause of all those blank postings. I haven't
>tried it, but I had assumed that when people were doing the 
>
>    patch <patch17
>
>command, these lines were somehow generating the blank postings.  Just
>compare the blank postings with these lines.  This site did not generate
>any blank postings as I editing the patches, removing all unnecessary
>lines before doing the patch command.  I hope this information may
>help you in tracking down the problem.
>
>-- 
>David.Seddon@csis.dit.csiro.au
>Centre for Spatial Information Systems,             Phone  +61-6-2750936
>CSIRO Division of Information Technology,           Fax    +61-6-2571052
>GPO Box 664,  Canberra  ACT  2601,  Australia.

--
Peter Wemm : peter@zeus.dialix.oz.au   If it's broke, fix it (The MS-DOS way)
Work phone: +61-9-479-1855    If it aint broke, don't touch it (The Unix way)
Fax: +61-9-479-1134   If we can't fix it, it ain't broke (Maintainer's Motto)
Newsgroups: news.software.nn