I thought I'd let you know how things stand w.r.t. the "Great
Ferret Recipe Forgery".
 
The Received lines indicated that the messages came from, or
were injected at Reed U.  The message that you saw had a Received:
line of:
 
    Received: from 128.252.133.1 by reed.edu (/\==/\ Smail3.1.25.1 #25.21)
        id <[log in to unmask]>; Tue, 22 Sep 92 23:31 PDT
 
Seeing an unadorned IP address here is pretty unusual.  Generally means
that the sending system isn't known to the receiving system.  A pointing
finger.  There were no preceeding Received: lines, and the only
subsequent one was uunet.ca.  Which is *hard* to break into.
 
[The first message didn't have the "from ..." clause.  Reed upgraded
their version of Smail which resulted in more information.]
 
Telnetting to that address gives out the information that the machine
name is "wuecl", and is running SunOS.
 
WHOIS at nic.ddn.mil shows that 128.252 is Washington University in
Missouri, aka "wustl.edu".  The NIC doesn't have this specific IP
address listed as a "known host", just the higher level domain.
 
Telnetting to "wuecl.wustl.edu" succeeds, and is the same machine as
first telnetted to.
 
H'm.  Interesting.  I wonder...
 
Grepping the mailing list addressees, there is no "wuecl".  Too bad.
 
Going by traditional naming conventions, "wuecl" *probably* stands
for "Washington University Engineering Computing Lab".  Which tends
to suggest an open access machine that isn't necessarily "home"
to any users.  So I should look for wustl.edu:
 
Bingo!
 
    [log in to unmask]          (Karl Stiefvater)
 
And, interestingly enough, Karl was a member of the list from just
before the previous "incident" in March 19 (that I caught):
 
|             Issue number: 201
|        Date: Sun Dec 15 09:52:03 EST 1991
|
| ...
| ...
|----------------------------------------
|Date: Sat, 14 Dec 91 23:56 PST
|From: [log in to unmask] (Karl Stiefvater)
|
|Subject: suscribe subscribe
|Please add me to the mailing list.. I love ferrets.
|   Thanks,
 
And Karl hasn't submitted *anything* to the list since then.
 
All circumstantial to be sure - anyone with the slightest talent
would have known how to forge the IP address to protect against
this sort of backtracking.  And fingering the one person at WU
on the list is more than a little tenuous.  It could even be
someone else at WU playing a joke on Karl.
 
It certainly wouldn't stand up in a court of law.  But I'm pretty
satisfied - the evidence fits juvenile harassing behaviour - wanting
to see the ruckus.  What's worse is that the evidence points to our
"friend" being staff or graduate student.  Because normally undergrads
get their accounts purged after each term, but the message was bit-for-bit
identical in March and in September...  At least a talented person could
come up with a different and better one after all that time...
 
This is my position: forgeries, regardless of content, are totally
unacceptable.  You can say anything you want, including trying to
get your jollies from starting a flame war, *provided* that your
real name is there.  Freedom of speech does include jokes in very
poor taste, but it's coupled with the responsibility of being known
for who you really are - except in special circumstances that don't
apply here - certainly not to harassing behaviour.
 
This is not to say that I would have permitted an unforged Ferret
Recipe through the mailing list.  I would still have trashed it.
But I wouldn't have gotten mad.
 
This is what I *could* do: send mail off to the administrator
at Reed and at Washington U including all of the evidence above.
Not because of the content, but because of the forgery, misuse
of resources, and pointing out the security problem at both
Reed and WU.  And I know that many organizations, including
Universities, take a very dim view of such behaviour, regardless
of content.  Up to and including expulsion or firing (eg: sendsys
bombing, email harassment).
 
But I'm not going to do this.  In fact, I'm not even going to
pull Karl's subscription to the FML.  After all, I could be
wrong.  Though, I don't imagine that WU would take any serious
action unless they were able to prove using their own logs that
friend Karl was responsible.  On the other hand, if I'm not,
Karl'll get to see the messages on the FML telling him what an
ass he is.
 
Grow up child.
 
[Posted in FML issue 0322]