The Cancel FAQ Skirv's Homepage - Recent Updates 25 Sep 2008 2007 In Review My best pictures from 2007. Worth looking at. 04 Sep 2008 Alcatraz - 25 Jun 2008 /And that's it!/ 04 Sep 2008 Jeanne Visit - 14 Aug 2008 *One more real gallery to go...* 04 Sep 2008 Jacob and Amber's Wedding: 06-09 Aug 2008 *The last of the big ones*/The end is in sight!/ 03 Sep 2008 Winchester Mystery House - 22 Jun 2008 /And there's another big one/*He might actually catch up at this rate!* 03 Sep 2008 San Francisco Trip - 23 Aug 2008 *Another small one, but very up-to-date* 03 Sep 2008 Danny and Celeste at Stanford /And another small one/ 03 Sep 2008 San Francisco Zoo - 29 Mar 2008 *Another big one bitten off* 02 Sep 2008 Misc Shots, to 30 Aug 2008 /And that was more important/ 02 Sep 2008 Filoli - 09 Mar 2008 *That was a small one*/But important, in its own way/ Personal Info Home Personal Pictures Friends History Archives GPG Sigs Movie Reviews Projects Projects Software Resumé Usenet Posts Moderation FAQs Killfile B8MB Other Sites Work skirvin.net killfile.org Journal Misc Mirrors Bookmarks Contact Info The Cancel FAQ FAQs Cancel Messages: Frequently Asked Questionsv1.8Follow this link for a text-only version of the FAQ.Archive-name: usenet/cancel-faq/part1 /part2 /part3 /appendixPosting-Frequency: monthlyLast-modified: 1999/09/30Version: 1.8URL: http://www.killfile.org/faqs/cancel.htmlThis document contains information about cancel messages on Usenet, suchas who is allowed to use them, how they operate, what to do if yourmessage is cancelled, and the like. It does not contain detailed instructions on how to cancel a third party's posts. It is not intended to be a fully technical document; its audience is the average Usenet user, up to a mid-level administrator.This document is not meant to be a comprehensive explanation of Usenetprotocols, or of Usenet itself, but a basic knowledge of these conceptsis assumed. Please refer to news.announce.newusers, RFC1036, and/orRFC1036bis if you wish to learn them.Disclaimers: The information contained within is potentially hazardous;applying it without the permission of your news administrator may causethe revocation of your account, civil action against you, and even thepossibility of criminal lawsuits. The author of this document is in no way liable for misuse of the information contained within, nor is he inany way responsible for damages related to the use or accuracy of theinformation. Proceed at your own risk.Table of ContentsI. What are cancel messages? A. What are cancel messages? B. Are cancel messages the only way to delete amessage? C. Where can I find cancel messages? D. Who is generally allowed to issue cancels? E. When and why are cancel messages allowed? F. How are they issued? G. How do I cancel my own post? H. Who decided on these rules?II. How do cancels work? A. What is control? control.cancel? How do I receive them? B. What standards are there for cancelling posts? C. What is the format of a cancel message? D. Do all news sites accept all forms of cancels? E. How do I alias out a pseudosite?III. So your post was cancelled... A. Why was my post cancelled? B. I have the cancel message right in front of me. Why was it cancelled? C. But I wasn't doing anything wrong! Why was it cancelled? D. Look, pal, I said I wasn't doing anything wrong, and I meant it. I didn't break any rules that I can see. Why was my post cancelled? E. sigh Then what do I do about it?IV. What does it take to cancel messages? A. I want to cancel posts! How do I do it? B. I'm not kidding; I really want to do it. How do I do it? C. What is a cancelbot? D. Sounds cool. Where do I get one? E. What? Why not? F. Fine then, I'll write it myself. G. Right; I've got a cancelbot. Now what?V. That idiot forge-cancelled my posts! A. My post is gone; it was forge-cancelled, wasn't it? B. No, I'm sure, it was cancelled. Why? C. How do I track the bastard down? D. Who's done this before? E. What, are there only bad guys? F. Is there anything I can do on my own?VI. What moral issues are involved with cancel messages?VII. What's going to happen to cancels in the future? A. What are authenticated cancels? B. Are there any other Usenet methods to delete messages? C. Why are some people turning off cancels altogether? D. What is NoCeM? E. What is PGP?VIII. What about these other things? A. What is Lazarus? B. What is Dave the Resurrector? C. What was the Judges-L mailing list? D. What is the UDP?IX. What are the current cancel issues? A. What are the cancel-on-sight rules? B. Are HTML postings cancellable? C. What happened to copyright cancels? D. What should be done about unaccountable spam cancellers? E. What should be done about open news servers? F. How should hierarchies opt out of spam cancels?ChangesTo DoContributorsPointers Appendix A: Dave the Resurrector 1. What is Dave the Resurrector? 2. Why is Dave necessary? 3. What cancels are authorized? 4. What messages are reposted? 5. What is the format of the reposts? 6. So how do I cancel my own posts when Dave is around? 7. What about other Resurrector bots?Appendix B: Retromoderation 1. What is retromoderation? 2. Why is retromoderation so popular? 3. What's wrong with retromoderation? 4. When is retromoderation alright?I. What are cancel messages? A. What are cancel messages? Cancel messages are a specialized form of message to Usenetthat, when they arrive at a server, request that the post bearing the Message-ID contained within be deleted. In essence, a cancel message,if heeded, cancels another post. Hence the name. B. Are cancel messages the only way to delete a message? No. Usenet is transitory; not every message will be on all newsservers at all times. In fact, cancels are fairly rare; the cause of amissing message is very rarely a cancel. First of all, it takes some period of time for a message topropagate to all news servers that wish to carry the message. This isinherent in the Usenet system; messages take time to arrive. In somecases, they do not arrive at all. More commonly, messages are deleted after a certain period of timeso that more messages can take their place - this process is known asexpiration. The amount of time that a post exists varies from server toserver, and is usually based on the size and content-type of the articleand the newsgroups to which it was posted; servers typically save postsfor anywhere from a day to several weeks. As this happens on all newsservers and is not consistent, expiration is the number one cause of"missing" messages. As time goes on, the software itself has begun to change. Messages posted in HTML, messages containing picture attachments, anything posted more than a few times, even messages with more than about five newsgroups in their headers, all of these are subject to automatic filtering by newer news software; ask your news administrators for details about what is doneat your site. Finally, there are more specific causes for missing messages.Your message may have been replaced by another post using a Supersedes:header; your news administrators may be running NoCeM, which selectivelydeletes posts when used on a server level; etc. Ask your administratorsfor more information about your system's policies, expirations times, andso forth. If your post is missing, do not instantly assume that yourmessage was cancelled. A good rule of thumb is "no cancel message, nocancel". If you can find the cancel, then your post was cancelled; if you can't, it probably wasn't. C. Where can I find cancel messages? As you must have a cancel message to show that your message wascancelled, it is a good idea to know where to look for them. The bestanswer, in the short term, is to search control for the cancel (seesection II.A. for details). If you are unable tofind them there, the Usenet search engines may be able to help - using Dejanews or AltaVista, search for youremail address and the string 'cancel', and you may be able to find anycancels issued for your posts. It should be noted that, for various reasons, the above methodsof finding cancel messages are becoming increasingly ineffective. Anysuggestions or technical help in solving this problem would be greatlyappreciated by the Usenet community. D. Who is generally allowed to issue cancels? In general terms, the only people that are always authorized toissue cancels for a message are the original author of the message andthe postmaster at the site the message was posted from. However, thereare rules that allow third-party cancels in specific circumstances, suchas group moderation, spam and spew cancellations, article forgeries, anda few other limited circumstances; those people in charge of theseduties are generally authorized to issue cancels directly relating tothe job. E. When and why are cancel messages allowed? When Usenet was created, cancels were meant to be only issued bythe original poster of a message. They were implemented so that someonecould take back their words, remove information that was no longeraccurate, replace inaccurate information, and other, similar purposes. As time went on, more uses for cancel messages have been found.Third party cancellations are now generally allowed if they are notcontent-based; posting private mail is often more than frowned upon, andnewsgroup voting fraud may be stopped with a forged cancel; in the moreextreme cases, ads to inappropriate groups are cancelled, threads thatare crossposted to too many groups go away, and some even cancel inorder to just disrupt a newsgroup. This is not to say that this isaccepted; on the contrary, cancelling based on a new criterion is usually more than hotly contested. RFC1036bis, section 7.1, is the most "authoritative" list of validreasons for cancel messages; however, because it is not a formal RFC andbecause Usenet changes so quickly, it should not be considered the finalword on such matters. The following reasons are probably the most apt tobe considered valid by any random news administrator: First person cancels are performed by the original poster of a message. They are explicitly allowed by the news system - a user is always authorized to cancel anything that he or she posts, for any reason, within the limits imposed by his or her administrators, the moderators or maintainers of those groups affected by the cancels, and the user's individual moral code. This authority extends to messages written on another system. Second person cancels are performed by those people officially "incharge" of a user, ie the person's news administrator and the newsgroupmoderators and hierarchy administrators affected by the user's posts, orany party authorized to act on their behalf by said user or administrator.These cancels, too, are officially authorized. Third person cancels are generally frowned upon, unless they aremade based on one of the following criteria: Moderator cancels The moderator of a newsgroup has absolute authority over thatgroup. This includes the right to issue cancels for posts that he or shedid not authorize. Retromoderation is a subset of this, in which thegroup is moderated only by the issuing of cancel messages; private hierarchies may generally be considered retromoderated by the owner of thegroup, while the legitimacy of the cancels in more public hierarchies is up for debate. For more information on creating moderated groups, see news.groups or news.groups.questions. Spam/EMP cancels Spam or EMP, a message posted to Usenet separately multiple times, is generally accepted as a major threat to Usenet. Therefore, anythingposted too many times is automatically cancelled, with no regard tothe content of the post. Currently, the cancellation threshold is 20 posts; for more information, see the Spam Thresholds FAQ. Spew cancels A spew is a long series of similar articles posted over and over again, due either to a malfunctioning program or malicious intent. They are almost universally considered to be a good use for cancels. However, there has yet to be an accepted broad definition of the term "spew" - right now, it mostly fits under "I know it when I see it". For more discussion of spews, see news.admin.net-abuse.policy. ECP cancels ECP, or Excessive Cross-Posting, is when a message is posted totoo many groups at the same time. Much the same as spam cancellations,if a message is crossposted to too many groups, it will be cancelledwithout regard to content. Currently, the cancellation threshold is a BI of 20 (the BI is "the sum of the square roots of the number of newsgroups in which each of the postings appears"); as with spam/EMP cancels, see the SpamThresholds FAQ for details. Binaries in a non-binary group Much of Usenet does not want binary messages, usually for spacereasons. To accommodate those that do, the alt.binaries.* andcomp.binaries.* hierarchies were created. However, there are still somebinary messages posted to other Usenet groups; these are often cancelled without regard to content, based on the size of the binary. For moreinformation, see news.admin.net-abuse.policy, where the specifics arebeing debated. The bincancel FAQconcerns binary cancels in particular. Forgeries in the user's name It has become more and more common for people to post messageswith false attribution lines. If a message is attributed to a user, theymay cancel it or authorize others to cancel it as if they has posted itthemselves. F. How are they issued? Cancel messages are sent out as a standard Usenet post, exceptthey contain a "Control: cancel " header. If a system thataccepts cancels receives the message, the post with the specifiedmessage ID is deleted from that system. Most major newsreaders allow readers to cancel their own postswith a key press. Third-party cancels are more complicated, and mustfollow several conventions; please refer to section II.B for details. G. How do I cancel my own post? Most major newsreaders allow you to cancel your message with afew keypresses. To cancel your own post, press the following key(depending on your newsreader) while reading your message: Newsreader Command to cancel (case-sensitive) OS/System Reader Unix rn/trn C tin D nn C gnus-emacs C slrn Esc-^C pine none Unix/X xrn 'Cancel' button knews Post/Cancel Article OpenVMS Anu News 'cancel' newsrdr 'cancel' PC/Windows Free Agent (pre-v1.1) Article/Cancel Free Agent Message/Cancel Usenet Message Agent (v0.99g,v1.5/32.451,v1.5/32.452) Post/Cancel Usenet Message Agent Message/Cancel Usenet Message Waffle typeCANCEL at the inter-message prompt News Xpress Article/Cancel Post Turnpike Article/Cancel Article WinVN Article/Cancel Outlook Express Right-click on article/Cancel News Xpress Article/Cancel Post Anawave Gravity Article/Cancel Internet News File/Cancel Message Xnews Article/Cancel Message PC/OS/2 NR/2 Article/Cancel Macintosh Nuntius Article/Cancel Article NewsWatcher Special/Cancel MacSOUP Message/Cancel most browsers Special/Cancel Web Browsers Netscape Edit/Cancel This Message Opera 7.x/M2 In 'Sent' folder, right-click on article/Cancel post Netscape (pre-v2.0) none Mosaic none Lynx none Internet Explorer 4.0 compose/cancel messages Generic/Multi-System Yarn c If you know of any other news readers that allow cancels, havecorrections for any of the above readers, or whatever, please mailme with the information. H. Who decided on these rules? Usenet is a cooperative venture of many thousands of sites world-wide. It was designed with the principle of mass communication in mind;not much thought was put into security, because it didn't seem necessaryat the time. As the need to control the system became evident, so too didthe potential for abuse; out of these two needs, these rules grew. As for who actually designed the rules: each site owns its ownmachines, and can set set policy over its own systems and users. Eachsite can decide their own expiration policies, what other sites to acceptmessages from, what control messages they will accept, and so forth;however, it's generally much easier to have a standard set of rules towork with, to improve efficiency and promote some level of consistencyacross the network. These rules were designed by the system administratorsin charge of the systems that Usenet runs on and the users that Usenetserves, in order to give a framework under which to run Usenet as a whole.In short: the rules were made by your administrators and those that theychoose to listen to. And if you have any problems with this, you should see if you canmake your administrators listen to you.II. How do cancels work? A. What is control? control.cancel? How do I receive them? control is a pseudo-newsgroup made up of all posts on a news system containing the Control: header, which is used to create or deletenewsgroups, perform internal systems checks, cancel posts, and so forth.It is mostly an administrative convenience. On many systems, control is broken up into several componentsautomatically by the software. If this is true, there are severalnewsgroups: control.newgroup (for the creation of new groups),control.rmgroup (for the removal thereof), control.cancel (for cancelmessages), and so forth. If the software is configured this way, cancelmessages will appear in control.cancel. All cancels are either recorded in control or control.cancel,depending on the system type. If a post was cancelled recently enough, arecord of the cancel will be here - if there is no cancel in the group,then either there was no cancel or the cancel message itself has expired(see section I.B.). Unfortunately, the latter situation has become more and morecommon as time passes. Most major news servers have begun to expirecontrol messages after extremely short time periods, ranging from a coupleof days to a couple of hours; even the major Usenet search engines havebegun to cut short their cancel message archives. The rule of "no cancelmessage, no cancel" still holds, but more burden for finding the cancelmessage is being placed on the reader. If you cannot read control (or control.cancel), ask your newsadministrator for help. B. What standards are there for cancelling posts? When cancelling your own post, the only standards are thesoftware requirements. Third-party cancels, however, have certainstandards that should be followed. There are three main reasons for following these standards whenusing third-party cancels. First is to identify the canceller, whichgives the practice accountability. The second is to make sure that a particular message is only cancelled once. Finally, some news administrators would rather not accept certain cancels, and a standard will allow them to opt out of the system. The first standard is simple to fulfill; all legitimate third-party cancels include an "X-Cancelled-By:" header, containing the emailaddress where the canceller can be contacted. This also implies that thecanceller is willing to respond to comments and complaints; if the mail issimply ignored, the canceller is violating this first standard. The second problem is solved much more creatively. The $alzconvention (named after Richard Salz, the creator of INN), specifies that the message ID for a cancel message prepend the message ID of the original message with the string "cancel.". For example:Original Message ID: <48u6e8$lqi@vixen.cso.uiuc.edu> Cancel Message ID: <cancel.48u6e8$lqi@vixen.cso.uiuc.edu>Note that this particular standard should not be done formoderator cancels. - Tim, 2004/01/16 The third problem, that of sites wanting to opt out certaintypes of cancels, can be solved by adding certain "pseudo-sites" to thepath of the cancel; if a particular site wishes to not accept cancelsof that type, they can alias out that pseudo-site. For information onhow to do this, see section II.E. The commonly accepted pseudo-sites are as follows: Pseudosite Purpose cyberspam!usenet Spam/EMP cancels (universal) spewcancel!cyberspam!usenet Spew cancels mmfcancel!cyberspam!usenet Make.Money.Fast cancels bincancel!cyberspam!usenet Binary (in a non-Binary group) cancels adcancel!cyberspam!usenet Ad cancels (for the biz.* hierachy only) retromod!cyberspam!usenet Retromoderation cancelsNote the lack of of 'moderator' pseudo-site. - Tim, 2004/01/16 The !usenet part denotes that something must come after that part of the path; it is not necessary for it to be usenet. Multiple pseudo-sites may be used in one message. For more information on cancel formatting, please refer to theNewsgroup Care Cancel Cookbook by Rosalind Hengeveld. C. What is the format of a cancel message? Here's an example, a spam cancel by Chris Lewis, that followsall of the standard conventions (plus a few extras), reformatted to fitinto 80 columns):Date: 8 Jun 1997 15:43:37 GMTPath: vixen.cso.uiuc.edu!ais.net!newsfeed.direct.ca!News1.Vancouver.iSTAR.net! news.istar.net!n1van.istar!hammer.uoregon.edu!nrchh45.rich.nt.com!bcarh8ac. bnr.ca!despams.ocunix.on.ca!cyberspam!not-for-mailFrom: clewis@ferret.ocunix.on.ca (Chris Lewis)Approved: clewis@ferret.ocunix.on.caX-Cancelled-by: clewis@ferret.ocunix.on.caSender: Photorep45@ibm.netMessage-ID: <cancel.5ne625$f2b$25@news.internetmci.com>Newsgroups: alt.recovery.aaSubject: cmsg cancel <5ne625$f2b$25@news.internetmci.com>Control: cancel <5ne625$f2b$25@news.internetmci.com>X-No-Archive: YesX-Spam-Type: WOODSIDELines: 7WOODSIDE spam cancelled by clewis@ferret.ocunix.on.caOriginal Subject: Sell YourPhotosNYC.AgencyTotal spams this type to date: 1888Total this spam type for this user: 1041Total this spam type for this user today: 503Originating site: internetmci.comComplaint addresses: spamcomplaints@mci.net postmaster@mci.net Points to note: the 'Sender' line matches the original author ofthe message, while the 'From' line points at the canceller, as does the 'X-Cancelled-By' header. The Message-ID follows the $alz convention, andthe proper pseudo-site is present in the 'Path' header. It should also benoted that the 'X-Spam-Type' and 'X-No-Archive' headers are optional, asis all information in the body of the cancel. D. Do all news sites accept cancels? No. Many news sites have decided that, for whatever reason,they do not want cancels; others merely do not want certain types ofcancels. Dave Hayes, for example, runs a "Site of Virtue", which notonly ignores cancels but drops them without distributing them; patches for INN to do this are available from his Freedom Knights Homepage.America Online, Dejanews, Zippo, and many other news sites to not honorcancels of any sort. E. How do I alias out a pseudosite? INN v1.5 and beyond include shunning mechanisms out of the box;just edit the newsfeeds file and follow the instructions fromthe comments. Other, older news server software is less likely to include such mechanisms. If anyone's got information for other systems, I'd love toinclude it.III. So your post was cancelled... A. Why was my post cancelled? It probably wasn't. Unless you can find a copy of the cancel in control, it is very,very unlikely that your post was actually cancelled. Before you beginto worry about a forged cancel, figure out the expiration times forarticles on your system and note whether or not your newsreader justrefuses to show you articles marked as 'read'; these are the most commoncauses for "missing" articles. B. I have the cancel message right in front of me. Why was it cancelled? Most cancels nowadays are for cleanup of various forms ofnet-abuse. If you posted your message to too many places, or too manytimes, it will generally be cancelled, regardless of the content of thepost. For details about what is cancelled and why, read news.admin.net-abuse.usenet, or check the news.admin.net-abuse FAQ. Also, if youreceived a mail on the subject from a spam cancellers, read itcarefully; it should probably explain why your message was cancelled. C. But I wasn't doing anything wrong! Why was it cancelled? There's still legitimate reasons beyond official net-abuse tocancel posts. The moderator of a moderated newsgroup is permitted to cancel any messages in his newsgroup that he does not approve of. There really isn't much recourse in this case; it's pretty much impossible to impeach a moderator, and the only thing you can really do about their actions is complain for a while or make a competing group. Individual newsgroups and hierarchies, especially local hierarchies, may have rules permitting them to cancel messages posted there. Again, there isn't much you can do about these cases, beyond reasoning with the administrators and/or not using their hierarchy. Your post may have inadvertantly triggered the searching criteria for a continuing spam. If you contact the spam-canceller in such a case, you can usually figure out a way to solve the problem. Your postmaster may have decided that they didn't like your post. In this case, the only real recourse you have is to get a new service provider. D. Look, pal, I said I wasn't doing anything wrong, and I meant it. I didn't break any rules that I can see. Why was my post cancelled? I don't know. E. sigh Then what do I do about it? Post about it to news.admin.net-abuse.usenet. Make sure toinclude the full headers and text of the cancel, an explanation of whatthe article was about, and any possible motives for the cancelling that you can think of. The administrators there will, if you're polite, try to help. For more information, read section V.IV. What does it take to cancel messages? A. I want to cancel posts! How do I do it? You must be kidding. B. I'm not kidding; I really do want to do it. How do I do it? sigh Well, I'll bet you really haven't thought about it very much yet. Read this section before you do anything, alright? Anyway... On a small scale, you can issue them by hand - see the Newsgroup Care CancelCookbook for the details and warnings you'll need to get started. On a bigger scale, you're going to want a cancelbot. C. What is a cancelbot? A cancelbot is a program that searches for messages matching acertain pattern and sends out cancels for them; it's basically anautomated cancel program, run by a human operator. D. Sounds cool. Where do I get one? If you have to ask, you're probably going to have a hard timegetting one, and even if you do you probably won't be impressed withthe quality. I wouldn't even consider using a cancelbot unless you'vewritten it yourself or know exactly what it's doing (in which case youmight as well have written it yourself anyway). E. What? Why not? Giving out a cancelbot is like handing out loaded guns with nosafeties. Even if the recipient is well-intentioned, screw-ups arefatal; you need the proper training first. There may be people out therethat will still give you that gun without the training, of course, butit's a good idea to question their motives... In general, until you know exactly how to use a cancelbot, youshouldn't be experimenting with one - and most people that write the 'botsknow this. Cancelbots are dangerous, and can be used irresonsibly; morethan that, if you screw up with a cancel-bot you can cause largeproblems, and it's fairly easy to screw up. For these and other reasons,it's generally accepted that only those that are willing and able towrite their own cancelbot will ever actually get one. Sidenote: even if you trust the source of the code, it's not agood idea to trust it blindly. What security holes might it have? Whatbugs may be in it? Is it optimized for hte ways that you're planning onusing it? It's a lot safer to write your own code than to rely upon others; not only is it easier to modify for yourself, at least then you have an idea what's still wrong with it... F. Fine then, I'll write it myself. Sure, go right ahead, but a word of wisdom: make sure you knowwhat you're doing. Richard Depew,Usenet's current major bincanceller, was one of the firstpeople to use cancelbots in a large way. One of the most famousbot-related incidents of all time was his ARMM cascade, in which a simple spelling error on his part caused a large spew in news.admin.policyfor several hours before it was turned off. It was generally considered a Big Oops. Richard's incident was also far from the worst; that honor would have to go to the incident where a misconfigured cancelbot was auto-cancelling everything from netcom.com. Bigger Oops. And these examplesjust scratch the surface of what can go wrong when writing acancelbot... Before you test out your cancelbot on actual Usenet stuff,double and triple check to make sure it works. Make sure that you've gone through all the potential bugs and vulnerabilities -- add safeties, redundancies, internal logic checks, and what have you. Start a local group, test the 'bot out in that group only. Whatever. Just remember, you only get one chance at this, so do it right... While writing a cancelbot, make sure you follow the conventionsthat you plan on using ($alz, etc). In addition, once you've got the basics down, mail Chris Lewis. He'll give you some more tips. G. Right; I've got a cancelbot. Now what? Well, the obvious thing is to start using it. Don't.Before you do anything dumb, make sure you've considered everything; cancelsraise plenty of interesting questions, and using a cancelbot isn'tsomething to enter into lightly. Before you do anything, make sure you've thought a lot aboutall of the following issues. Trust me, you'll need it. Who is going to be affected by this, and how will they react? Cancelbots tend to affect a lot of people. By running one, youare messing with a lot of people -- and, generally, making them upset.Many are going to complain. Some are going to retaliate. Succinctly, before you start up your cancelbot, make sure you can handle any incoming mailbombs, that your network's security is strong enough to stand up to persistent cracking attempts, that you're on good enough terms with your bosses and administrators that they won't fire you or drop your account the second they get any complaints about you, that you've gotten your phone number made unlisted, and that you've got a good lawyer handy. That's a start, at least. What kinds of problems will this cause legally? In the USA, at least, the current best information/guess about the legality of cancel messages says that non-content-based third party cancels are legal, and that content-based ones are illegal. However, this has just plain not been tested in anything resembling a court of law, and wouldn't apply to other countries even if it had been tested. Even if cancels are legal in your place of work, of course, this doesn't mean that you won't face legal harassment. It's almost trivially easy to find some reason to sue somebody today; if you hork somebody off by cancelling their posts, there is a chance that they'll try this on you. Remember, to many it often doesn't matter if they're going to win or lose the lawsuit; all that is important is that they have forced you to spend money and time to respond to the charges. Regardless - there is definitely some legal risk associated with third-party cancels. This risk is probably enough that you should talk with your higher-ups first, or, if possible, a lawyer. It could save you a lot of trouble down the line. Is this a moral thing to do? Even if cancel messages were perfectly legal, they still aren't the nicest thing in the the world. By issuing a cancel you are deleting somebody else's words; many would call this censorship, and, even if their use is justified, they may be right. The most commonly used moral argument about cancels is known as the "slippery slope". The use of cancel messages leads down the road to censorship, which is a Bad Thing; however, it may be possible to keep the system under control by staying near the top. The further cancels go, however, the more likely it is that they cannot be controlled - and once that happens, any benefit they may have once held will be gone. Common practice says that non-content-based cancels are not censorship. Instead, they are based on how "loud" the message was said; it's not censorship to stop someone from blaring their message out in the middle of the night using a megaphone. This hopefully means spam cancels and their like are not yet out of control, and that we haven't gone so far down that we can't return; then again, this point is certainly up to debate.Do I really have the time to deal with this? Operating a cancelbot takes a lot of time. Just on a technical level, the 'bot has to be written, the parameters have to be set and constantly updated, and the thing watched to make sure it works; that, though, is the least of your worries. Once you get the 'bot running, people are going to take notice. Result: you will get comments, you might get praise, and you will probably get complaints. You *must* listen to them if you want to continue running your 'bot responsibly. No, you don't have to respond to everything, especially the more juvenile flames, but you do have to make sure you listen to suggestions and problems; after all, if your 'bot is cancelling something it shouldn't be cancelling, you'll only find out when somebody tells you. If you don't have time to deal with these comments and complaints, then just give up now. Trust me, you'll be better off. Do I know for sure what this program will be used for? If people don't accept the purpose of your cancelbot, then your cancelbot will not be effective for anything except getting a whole lot of flames and your account nuked. As such, before you start cancelling you should make sure you won't get rejected from the job. Make yourself some rules: What kinds of posts will I be cancelling? Will I be expanding these criteria later? How accountable will I be? What if somebody asks me to include (or exclude) their hierarchy? Will I give out my code to others? (Recap: the standard uses for third-party cancels are spams, spews,moderated group cleanup, binaries in non-binary groups, and forgeries. See section I.D for details.) Have I double- and triple-checked my code? Again, screwing up your code can cause big problems. Beforeyou're ready to go operational, make absolutely sure that you know thatthe code works 100% of the time. I'd personally recommend asking yourself "could I operate this while drunk?" There are no second tries here; don'tgive yourself a chance to screw it up. This is, of course, especially important if your code is evergoing to be viewed by another human being... Do I know what's happened in the past? The history of Usenet and cancels goes back a long, long way;it's not only fairly interesting stuff, but it teaches interestinglessons. Before you start the cancelbots, you should probably know whatthey were used for before; with knowledge comes power, after all, and thisway you won't start repeating the mistakes of your predecessors. Am I following all of the rules? While they may not be conventions, there are certain basic rulesthat are usually followed by operators of cancelbots that shouldprobably be followed. A notice of the cancels should be posted tonews.admin.net-abuse.bulletins; the original poster and their postmastershould be notified; a representative copy, or link to such, should beappended to the notice of cancellation. You should have a reliable contactaddress, so as to be fully accountable for your actions. And, as usual, all of the official conventions should be followed exactly. If you're not doing them "nicely", you're going to get morecomplaints than otherwise - and rightfully so. And if you aren'tcapable of doing them nicely, then you probably shouldn't be issuing cancels at all. Remember, it has been proven time and again that nice, politecancel notifications make less enemies than angry, flamish ones. It's probably a good idea to make your notifications as kind as possible - though they should always include as much information (or links to information) as you can possibly fit in. Do I actually have to do this? If you hadn't figured it out already, cancelbots are a pain inthe butt. If for no other reason, because of this you should probably reconsider whether this is really necessary. If your problem has to do with too much off-topic or irrelevanttraffic, maybe cancels aren't the solution. Talk about moderation withthe regulars of the newsgroup you're worrying about; someone might bewilling to help moderate the group, or maybe they have another idea tosolve the problem. Maybe mailing the offenders a polite message saying"your message is off-topic" would help, or perhaps it will take mailingthe posters' administrators before they'll stop; either way might be moreeffective than cancels. Even if reasoning with everyone you can think of doesn't work, youcan still try other approaches. Post about it to news.admin.net-abuse.usenet; the regulars there have trained themselves to deal with obnoxious sites, and will help you if necessary. In many cases, you can stop the problem with judicious use of killfiles. And, if all else fails, you can always try NoCeM. In general, just make sure you've tried every alternativebefore you start cancelling anything. It's a pain to start, it's a biggerpain to continue, and the biggest pain comes when you finally want to stop...V. That idiot forge-cancelled my posts! A. My post is gone; it was forge-cancelled, wasn't it? Before you do anything, check section III; double-check to make sure that someone really did cancel your post before you get all upset. Remember, no cancel message, no cancel. B. No, I'm sure, it was cancelled. Why? There are as many reasons to cancel a post as there are cancelmessages. Most cancels are issued for valid reasons (which are detailed in previous sections), but sometimes they are done for what many people would consider illegitimate reasons. The people that issue such cancels are known as "rogue cancellers"; these are the ones to worry about. Why do they do it? It depends. One popular excuse, started by theinfamous Church of Scientology, is that the message was a "Trade Secret" whichmust be protected. Another excuse has become prevalent in recent years is"if one may cancel, all may cancel" - the theory being that cancel messagesthemselves are evil and must be stopped, and the way to do this is to abusethe hell out of them so that sites will turn them off. Oddly, both of theseexcuses generally lead to cancels aimed at those the cancellers have declared"enemy", and usually end up backfiring. All of those reasons, though, are pretty much just excuses. Whatare the real reasons that somebody would do something like this? Simple: they want to keep something out from under public scrutiny, they didn't like what you said, or they just want to destroy a few messages. And yes, those are very bad reasons. In any case, rogue cancellers such as the above are *not* acceptedby the Usenet community. End of story. The hunts to track down roguecancellers often reach near-epic proportions, the searchers often spanningthe globe, and virtually all such quests end with, at the very least, thecancels ending. C. How do I track the bastard down? If you have the cancel message, the best first step to trackingdown the canceller is to post a (single) copy of the message tonews.admin.net-abuse.usenet with a brief explanation of what's going on. The people on that group are veterans at tracing Usenet messages; they can probably help. While they're at it, they may also explain why your message may havebeen cancelled legitimately, in case there's anything you missed. For rudimentary analysis of who cancelled your post, check theNNTP-Posting-Host: header of the cancel. While it is possible to forgethis header, it generally will say which machine was used to issue thecancel message. Other, less-forgable headers include the Path: andSender: headers, and occasionally the Message-ID: header. D. Who's done this before? In the past, there have been many rogue cancellers of variousskill, competence, and intelligence. Some are gone; others are still onthe run, but appear occasionally. Here are a few of the most famous. Kevin Jay Lipsitz: "Krazy Kevin", as he called himself in his spams, cancelled many posts on news.admin.net-abuse.misc concerning his spams. His theory was that, by cancelling the posts, it would take more effort to shut him down; on this point he failed miserably, instead merely causing the implementation of Dave the Resurrector. During his time as a spammer Kevin was kicked off of many ISPs, but he has not been heard of for several months. CrackerBuster: in December of1994, an unknown computer person decided that he didn't like alt.2600,and decided to declare war on the group and anyone that supported it. Inone of the first mass newsgroup attacks, CB issued cancels for everymessage in alt.2600 and alt.current- events.net-abuse and then floodedthe groups with thousands of his own messages, effectively ruining them.Chris Lewis did much of the work cleaning up the mess; after hewas done, he realized that he had himself a fully working cancelbot;after getting some updated detection software from Jonathan Kamens, Chrisbegan work as Usenet's most prominent major spam canceller. Crusader: Crusader's actions beganwith a very large neo-Nazi mass email, sent several times to just aboutevery email address in existance. There were many systems involved in thesending of this unprecedented attack, most of which were cracked; thisdidn't stop a team of news.admin.* regulars from deciding they were goingto track the perpetrators down. To slow down the trace, the peoplebehind Crusader began to cancel all of the messages about the massmailings; this merely forced the creation of a short-term mailing listand furthered the group's resolve to stop the attack. While the trailstopped at a cracked system in Italy, the mailings eventually stopped andthe cancels ended. Ellisd: soon after the passing of theCommunications Decency Act, an anonymous user on Netcom decided to canceleverything in alt.binaries.pictures.erotica.* and alt.sex.* as "indecentfilth". The account was shut down within hours; however, Ellisdcontinued to forge cancels from other machines, forging them to appear tocome from his (now non-existant) Netcom account. Ellisd was entirelystopped within another couple of days; his only real effect had been toshow that the cancellation of "morally questionable" material would notbe tolerated. The Pseudosite Incident: Septemberof 1996 was a hard month for Usenet. Having endured many varied newsgroup and mail bombs, the next assault came in the form of tens of thousandsof cancel messages. Possibly modeled after the 'ellisd' incident ofseveral months before, several parties unknown began issuing cancelsusing several new pseudosites such as "geekcancel" (in comp.*) and"kikecancel" (in soc.culture.israel). Needless to say, this resulted ina whole pile of ticked off people. The cancels stopped a few dayslater, and Chris Lewis reposted virtually all of the cancelled messages,but the damage was done. The pseudosite attack has started up several more times since theinitial run, most prominently in the "Michael Franowski" continuingforgeries and the cancel/voter fraud attack upon news.lists.nocem. This latter attack forced UUNet to close down its open news port. The CancelBunny: the Church of Scientology, a remarkablyparanoid organization, has several "secret scriptures" that have longbeen distributed over Usenet. To stop this, the evidence shows thatthey have called in someone with computer knowledge to cancel posts thatcontain any of their scriptures -- or anything that they didn't like.This brought the entire religion to the attention of Usenet, and alt.religion.scientology is a very well-read (and high traffic) group asa result. The cancels, however, were generally accepted to be Bad Things.Therefore, a group of people decided that they were going to hunt downthe (anonymous) CancelBunny, as it had been named, by checking frombunches of sites. Several CancelBunnies have been tracked down and losttheir accounts; more keep popping up, only to be bashed back down justas quickly. The cancels by the CancelBunny are generally on comp.org.eff.talkand alt.religion.scientology. Cancels to a.r.s are reported by Lazarus. NewsAgent: HipCrime, an anonymous programmer with fairly anarchist views, one day decided to write a publicly available Usenet cancellation engine. His stated reason was the standard "if one may cancel, all may cancel" excuse; however, when he first unleashed his 'bot, he targeted moderated groups, anything administration-related, and everything else that he personally disliked. It quickly became apparent that his work was merely intended to destroy Usenet; as such, some of Usenet's more prominent anti-administration kooks joined him in what they saw as the final anti-Usenet war. It surprised them to no end when they soon found that their cancels had stopped being effective, because too many sites knew how to fight the attack. Since then, NewsAgent has morphed and become more public-domain. The software no longer issues cancel messages; instead, it issues long randomly-generated messages with Supersedes: headers, which destroy posts in a less-tracable and more-destructive manner (and which are almost immediately themselves cancelled, and the original messages reposted). Hipcrime has also written other variants of NewsAgent which send out other Control messages, creating thousands of bogus newsgroups on unwatched servers or causing a few individuals to be mailbombed but otherwise doing little damage. More worrisome is that older versions are in the hands of many people who wish to use the software maliciously, who are now using it to attack individual newsgroups. Even this is generally stopped after a couple of days, however. Overall, NewsAgent has merely made life a bit more difficult for news administrators and a bit more chaotic for standard Usenet users. Too bad. E. What, are there only bad guys? No, of course not; they're just the most prominent. There are plenty of important good guys, too -- the ones that perform the thankless job of cancelling spam, spew, MMF, and all the rest, basically keepingUsenet usable. Among the most famous spam cancellers include the CancelMoose [the first major spam canceller, author of NoCeM, now retired from cancelling], Chris Lewis [the mostprominent spam canceller of all time], and Jonathan Kamens [writer of the best spam detection software to date]. Most of the other cancellers can befind on news.admin.net-abuse.*. F. Is there anything I can do on my own? Of course. Notify the postmaster at the offending site, or upstream site. If you can determine where the cancels are coming form, mailthe postmaster at that site (or abuse@site, if present) with yourcomplaints. If this doesn't work, you may want to try notifying thepeople that give the site its newsfeed; for details on how to determinethis, read the Spam Tracking FAQ. Alias out the offending site. Your news administrator may be capable of making your machine notaccept posts from a certain other machine. If necessary, this can beused to ignore the cancel messages on your own site. Ignore the cancels Most major cancel attacks are fairly easy to categorize, based ona common header or message body. It is possible to run software, such asCleanfeed, toignore those cancels based on the common pattern; if you've got the timeto update your filters fairly often, you may even be able to head offfurther attacks. Write and run a Resurrection 'bot. It is possible to run a 'bot that reposts everything that iscancelled; the most famous example of this is Dave the Resurrector, whichprotects the news.admin.* hierarchy and is detailed in Appendix A. If youwant to do something similar, you can be a great help at stopping roguecancel attacks. Call in the official authorities. As was previously said, forged cancels are in a legal grey area.If you want to call in the legal authorities, you probably can, andsomething may be done. The general recommendation of this, though, is "don't do it". Anykind of legal judgment on this matter sets a precedent; at this point,we're almost happier without one. VI. What moral issues are involved with cancel messages? I'll answer this question succinctly: Lots. The moral issues related to cancel messages are among the mostinteresting, and distressing, part of the issue. Third-party cancels,spam and binary cancels, retromoderation, moderators in general, thefull "slippery slope" argument, the "Usenet is an anarchy" argument, "you'reviolating my first amendment rights!" and "without cancels, Usenet wouldhave died under the weight of the spam long ago"... This FAQ, though, isn't really the best place to get into it. For lack of space and time, I cannot get into these issues indetail here, however important they may be. If you want a start on thismatter, read the news.admin.net-abuse FAQ, along with the newsgroups.It's at least a start.VII. What's going to happen to cancels in the future? A. What are authenticated cancels? Usenet was not built with security in mind; the fact that it'srelatively simple to forge a cancel proves this. As time goes on, though, the need for security is becoming moreand more obvious. One way of making this security would be to changethe software to only accept cancels that include verification of a matchbetween the poster and the canceller; such verification might take theform of a PGP-signature or some other similar method. There have been many methods proposed to accomplish this; atthis point, none are in wide use. If anyone would like to write somesoftware to accomplish this, please do so, and discuss it on news.admin.misc;the CancelMoose has a few suggestions for authenticated cancels on his web page. B. Are there any other Usenet methods to delete messages? Of course. How does the Supersedes: header work? Commonly used for periodic postings and other informationupdates, the Supersedes: header replaces an old message with a new one.t is especially useful for FAQ maintainers, who use it to replace oldversions of the FAQ with more up-to-date ones - this FAQ, for example,uses it. To replace the message <4b6uce$ou7@vixen.cso.uiuc.edu>, youwould want to add the header:Supersedes: <4b6uce$ou7@vixen.cso.uiuc.edu> The use of Supersedes: is otherwise basically the same as acancel message, and third-party superseding should be treated the sameas third-party cancels. How does the Expires: header work? By adding the Expires: header to your post, you can override thestandard expiration time on most systems and make your message be deletedfrom most systems at a time of your choosing. This is especially usefulfor time-dated information and FAQs which are meant to be reposted on aregular basis. If you wantyour message to expire at 7:50:06pm (PST) on 2/11/96, add the followingheader:Expires: Sun, 11 Feb 1996 19:50:06 PST Your message should expire by this date. It may also expireearlier, depending on the system setup and expiry times. What is the Also-Control: header? The Also-Control: header acts just like a standard Control:header, except that the post is also filed in whatever groups it wasposted to, as opposed to being filed in control. Otherwise, the two areinterchangeable. C. Why are some people turning off cancels altogether? Until authenticated cancels catch on, there are no options toavoid forged cancels and allow unforged ones. One option, advocated by a few, vocal people that don't want to allow such forgery, is to not accept cancels at all. If you want to do so, you're welcome to, but it probably isn't the best option, at least in the near future. D. What is NoCeM? NoCeM, pronounced "No See-Umm", is a piece of news softwarewritten to mostly replace cancel messages. Instead of deleting themessages automatically, NoCeM works by allowing anyone to send out amessage that basically states "you don't want to read this". Indiviualnews systems or users may then act on these messages as they see fit,from deleting the messages or marking them as read, to merely ignoringthe advice altogether, to even marking those messages to be read as soonas possible. The idea is being hailed as a worthy replacement forthird-party cancels by many news administrators, and it is slowly gaining support. CancelMoose authored the client software, which is currently available for most Unix clients that can use PGP. news.lists.nocemhas been created for the distribution of NoCeM messages; discussion of theprotocol belongs in news.software.misc.For more information on NoCeM, refer to the Moose's homepage.E. What is PGP? PGP stands for "Pretty Good Privacy", and is a greatly heraldedencryption program made for everyday use. It is at the heart of mostauthenticated cancel schemes, NoCeM, and much other Usenet software.Unfortunately, the import and export laws regarding the software vary,making its availibility questionable in countries other than the USA. PGP is a topic on its own, and as such has several FAQs of itsown, as well as several newsgroups. For more information, I recommend youread one of these FAQs, such as the comp.security.pgp FAQ. VIII. What about these other things? A. What is Lazarus? Lazarus is a program written for use on alt.religion.scientologyby |
|
