Message-ID: <35C69EA3.195FAA49@bga.com>
	Date: Tue, 04 Aug 1998 00:39:47 -0500
	From: Julie Haugh <jfh@bga.com>
Organization: Girls "R" Good
  Newsgroups: alt.support.srs,news.admin.net-abuse.usenet
     Subject: Proof of Unauthorized Cancellations

I'm going to break with tradition and put xxxxxxxx's screel at the
end of my message.

I'm going to describe a method which any UNIX user can employ to
determine that Ms. xxxxx is our mad canceller.

1). Connect to the NNTP port of the public NNTP server that xxxxxxxx
    has been using.

    % telnet 203.36.132.2 nntp

2). Locate an article in alt.support.srs which is a "Supersede" of
    a legitimate article.  Verify that the "NNTP-Posting-Host" is
    set to 203.36.132.2

3). Copy the message ID down and enter it as the command to the NNTP
    server.

    article <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$1@twwells.com>

4). Save the output of the NNTP server to a file for future
    reference and then quit from the server

    quit

5). Observe that the "NNTP-Posting-Host" of the message on that
    server differs from the "NNTP-Posting-Host" of the message on
    your server.

6). Reverse map the IP address in the NNTP-Posting-Host to the name
    of the host which actually issued the "Supersede".

    % host 153.37.200.52
    Name: 1Cust52.tnt3.redmond.wa.da.uu.net
    Address: 153.37.200.52
    Aliases:

7). Observe that the host which actually posted the message is the
    UUNET POP in Redmond, WA.

Feel free to do this for yourself -- just make sure you don't cut
and paste anything so xxxxxxxx can't accuse you of forging or
falsifying information.

If you wish to verify that she is continuing to issue cancels
via her account at Northwest Nexus, search for articles with an
NNTP posting host on that Australian ISP with a NNTP-Posting-Host
which is a NWNexus POP.  I found over a hundred which were.

So that xxxxxxxx cannot accuse me of "cutting and pasting", I
encourage you to repeat this exercise yourself.  I've attached
the "script" session I used to write this article.

Because I have found examples of unauthorized article cancellation
involving Northwest Nexus, UUNET Communications and AT&T, I have
copied those three companies on this article.  I trust that their
abuse and fraud departments will look into this.

c.e.l.e.s.t.e.s.. wrote:
> 
> I did not make this mess Diane.
> 
> So go ahead and cut and paste IP addresses from articles I post to
> alt.support.srs into that so called evidence.
> 
> I am sorry whatever happened to you happened.
> I am sorry you have to get a new ISP.
> 
> I just want to see alt.support.srs get back to discussing srs topics, like
> most other people. I have been saying that for quite a while now. I am as
> sick of the trolling, the outing the canceling, the spewing, whatever.
> 
> You can dump another copy my name into the archives if it makes you feel
> better. At this point its insignificant.
> 
> I am sorry.
> 
> Maybe one of the famous urban legends can help you.
> I am a victim too. You, a lot of other people and this anonymous monster
> have plastered MY NAME all over the news archives, NOT yours. That monster
> made infinite copies of those outing posts of me, you know. I was hurt by
> this too.
> 
> I am a victim in this too!
> 
> Where is Dave the Resurrector to get my name out of the usenet archive
> databases?
> 
> So don't call me villain
>   - we are all victims.
> The news group is a victim too,
> I founded that news group.
> now what?
> 
> Yuck ...

-- 
Julianne Frances Haugh             Life is either a daring adventure
Mail: jfh AT bga.com                   or nothing at all.
					    -- Helen Keller

Script started on Tue Aug  4 00:25:43 1998
rpp386-> set -o vi
rpp386-> telnet feed1.bga.com nntp
rpp386-> 
rpp386-> telnet 203.36.132.2 nntp
Trying 203.36.132.2...
Connected to 203.36.132.2.
Escape character is '^]'.
200 203.36.132.2 DNEWS Version 4.5h, S0, posting OK 
help
100 Legal commands
  authinfo user Name|pass Password
  article [MessageID|Number]
  body [MessageID|Number]
  check MessageID
  date
  group newsgroup
  head [MessageID|Number]
  help
  ihave
  last
  list [active|active.times|newsgroups|subscriptions]
  listgroup newsgroup
  mode stream
  mode reader
  newgroups yymmdd hhmmss [GMT] [<distributions>]
  newnews newsgroups yymmdd hhmmss [GMT] [<distributions>]
  next
  post
  slave
  stat [MessageID|Number]
  takethis MessageID 
  xgtitle [group_pattern]
  xhdr header [range|MessageID]
  xover [range]
  xpat header range|MessageID pat [morepat...]
.

article <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$1@twwells.com>
220 5893 <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$1@twwells.com> article retrieved - head and body follows
Message-ID: <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$1@twwells.com>
Supersedes: <mrgpgrngtl.6q5f4s$nh2$1@twwells.com>
Subject: Re: Rosalind its bizarre
From: Anonymous <nobody@replay.com>
Sender: Anonymous <nobody@replay.com>
Approved: Anonymous <nobody@replay.com>
Newsgroups: alt.support.srs
Date: 3 Aug 1998 23:53:59 GMT
X-No-Archive: Yes
X-NNTP-Posting-Host: basement.replay.com [194.109.9.44]
X-XS4ALL-Date: 3 Aug 1998 23:54:02 GMT
X-To: mail2news@basement.replay.com
Remailed-By: Anonymous Remailer <cpmailer@htp.org>
X-Mailer: AnonPost. Post anonymously to Usenet.
X-Mail2News-Info-Url: http://www.replay.com/mail2news/
X-Mail2News-Error-To: abuse@replay.com
Organization: mail2news@replay.com
NNTP-Posting-Host: 153.37.200.52
Lines: 2
Path: 203.36.132.2!news.replay.com!mail2news-gw


.

quit
205 closing connection - goodbye!
Connection closed by foreign host.
rpp386-> 
rpp386-> host  153.37.200.52
Name: 1Cust52.tnt3.redmond.wa.da.uu.net
Address: 153.37.200.52
Aliases:

rpp386-> exit
Script done on Tue Aug  4 00:36:46 1998