Follow this link for the HTML version of this FAQ From: tskirvin@uiuc.edu (Tim Skirvin) Reply-to: tskirvin@uiuc.edu Newsgroups: news.admin.net-abuse.bulletins,news.admin.net-abuse.usenet,news.admin.net-abuse.sightings,news.admin.net-abuse.misc,news.answers Followup-to: news.admin.net-abuse.usenet Subject: Cancel Messages: Frequently Asked Questions, Part 1/3 (v1.31) Summary: This is a list of Frequently Asked Question about cancel messages on Usenet. It mainly discusses how cancels work, who issues them, their history, and what to do about them. It is more of a general purpose FAQ than anything else; it's not required reading anywhere, just more of a reference. Approved: news-answers-request@mit.edu Message-ID: Supersedes: Expires: Wed, 15 Jan 1997 00:00:00 GMT Archive-name: usenet/cancel-faq/part1 Posting-Frequency: monthly Last-modified: 1996/11/21 Version: 1.31 URL: http://www.uiuc.edu/ph/www/tskirvin/cancel.html Cancel Messages Frequently Asked Questions Part 1/3 This document contains information about cancel messages on Usenet, such as who is allowed to use them, how they operate, what to do if your message is cancelled, and the like. It does not contain detailed instructions on how to cancel a third party's posts. It is not intended to be a fully technical document; its audience is the average Usenet user, up to a mid-level administrator. This document is not meant to be a comprehensive explanation of Usenet protocols, or of Usenet itself, but a basic knowledge of these concepts is assumed. Please refer to news.announce.newusers, RFC1036, and/or RFC1036bis if you wish to learn them. Disclaimers: The information contained within is potentially hazardous; applying it without the permission of your news administrator may cause the revocation of your account, civil action against you, and even the possibility of criminal lawsuits. The author of this document is in no way liable for misuse of the information contained within, nor is he in any way responsible for damages related to the use or accuracy of the information. Proceed at your own risk. Table of Contents > = In other parts of the FAQ ================= I. What are cancel messages? A. What are cancel messages? B. Are cancel messages the only way to delete a message? C. Where can I find cancel messages? D. Who is generally allowed to issue cancels? E. When and why are cancel messages allowed? F. How are they issued? G. How do I cancel my own post? H. Who decided on these rules? II. How do cancels work? A. What is control? control.cancel? How do I receive them? B. What standards are there for cancelling posts? C. What is the format of a cancel message? D. Do all news sites accept all forms of cancels? E. How do I alias out a pseudosite? III. So your post was cancelled... A. Why was my post cancelled? B. I have the cancel message right in front of me. Why was it cancelled? C. But I wasn't doing anything wrong! Why was it cancelled? D. Look, pal, I said I wasn't doing anything wrong, and I meant it. I didn't break any rules that I can see. *Why was my post cancelled?* E. *sigh* Then what do I do about it? >IV. What does it take to cancel messages? >V. That idiot forge-cancelled my posts! >VI. What moral issues are involved with cancel messages? >VII. What's going to happen to cancels in the future? >VIII. What about these other things? >Changes >To Do >Contributors >Pointers I. What are cancel messages? ============================ A. What are cancel messages? Cancel messages are a specialized form of message to Usenet that, when they arrive at a server, request that the post bearing the Message-ID contained within be deleted. In essence, a cancel message, if heeded, cancels another post. Hence the name. B. Are cancel messages the only way to delete a message? No. Usenet is transitory; not every message will be on all news servers at all times. In fact, cancels are fairly rare; the cause of a missing message is very rarely a cancel. First of all, it takes some period of time for a message to propagate to all news servers that wish to carry the message. This is inherent in the Usenet system; messages take time to arrive. In some cases, they do not arrive at all. More commonly, messages are deleted after a certain period of time, in order to save on hard drive space. This period of time varies depending on a variety of issues, including the newsgroups the message was posted to, the size of the article, the author of the article, and so forth. This is the most common cause for missing posts, as it happens on all news servers, and is not consistent. As time goes on, the software has been begun to be changed. A current trend is to have the news transport software automatically drop all messages with more than a certain number of groups in the headers, ranging from five to fifteen or more; this varies by site, and you should ask your news administrators for details. Finally, there are more specific causes for missing messages. Your message may have been replaced by another post using a Supersedes: header; your news administrators may be running NoCeM, which selectively deletes posts when used on a server level; etc. Ask your administrators for more information about your system's policies, expirations times, and so forth. If your post is missing, do not instantly assume that your message was cancelled. A good rule of thumb is "no cancel message, no cancel"; if you can find the cancel, then your post was probably cancelled. C. Where can I find cancel messages? As you must have a cancel message to show that your message was cancelled, it is a good idea to know where to look for them. The best answer, in the short term, is to search control for the cancel (see section II.A. for details); if you are unable to find them there, the Usenet search engines may be able to help. Using Dejanews (http://www. dejanews.com) or AltaVista (http://www.altavista.digital.com), a search for your email address and the string 'cancel' will turn up most cancel messages issued for your posts. D. Who is generally allowed to issue cancels? In general terms, the only people that are always authorized to issue cancels for a message are the original author of the message and the postmaster at the site the message was posted from. However, there are rules that allow third-party cancels in specific circumstances, such as group moderation, spam and spew cancellations, article forgeries, and a few other limited circumstances; those people in charge of these duties are generally authorized to issue cancels directly relating to the job. E. When and why are cancel messages allowed? When Usenet was created, cancels were meant to be only issued by the original poster of a message. They were implemented so that someone could take back their words, remove information that was no longer accurate, replace inaccurate information, and other, similar purposes. As time went on, more uses for cancel messages have been found. Third party cancellations are now generally allowed if they are not content-based; posting private mail is often more than frowned upon, and newsgroup voting fraud can be stopped with a forged cancel; in the more extreme cases, ads to inappropriate groups are cancelled, threads that are crossposted to too many groups go away, and some even cancel in order to just disrupt a newsgroup. This is not to say that this is accepted; on the contrary, cancelling based on a new criterion is more than hotly contested. RFC1036bis, section 7.1, is the most authoritative list of valid reasons for cancel messages; the following reasons, however, are considered valid by virtually all news administrators: 1. First person cancels are explicitly allowed by the news system. A user is *always* authorized to cancel anything that he or she posts, for any reason. This authority extends to messages written on another system. 2. Second person cancels are performed by those people officially in charge of a user, ie the person's news administrator. These, too, are officially authorized in all circumstances, as are cancellations by a third-party explicitly authorized by the poster's news admin. 3. Third person cancels are generally frowned upon, unless they are made based on one of the following criteria: a. Moderator cancels The moderator of a newsgroup has absolute authority over that group. This includes the issuing of cancels for posts that he or she did not authorize. Retro-moderation is a subset of this, in which the group is moderated only by the issuing of cancel messages; private hierarchies may generally be considered retro-moderated by the owner of the group, while the legitimacy of the cancels in more public hierarchies is up for debate. For more information on creating moderated groups, see news.groups or news.groups.questions. b. Spam/EMP cancels Spam or EMP, a message posted to Usenet separately multiple times, is generally accepted as a major threat to Usenet. Therefore, anything posted too many times is automatically cancelled, with no regard to the content of the post. Currently, the threshold is 20 posts. For more information, see the Spam Thresholds FAQ. c. Spew cancels A spew is a series of messages posted over and over again, usually due to a malfunctioning program reposting old messages or posting a new message too many times; these are virtually universally accepted as a good use for cancel messages. The definition of a spew is currently being fleshed out in order to classify spews that were not an accident, but to this point there is no full consensus on the wording. d. ECP cancels ECP, or Excessive Cross-Posting, is when a message is posted to too many groups at the same time. Much the same as spam cancellations, if a message is crossposted to too many groups, it will be cancelled without regard to content. Currently, the threshold is a BI of 20 (the BI is "the sum of the square roots of the number of newsgroups in which each of the postings appears"); as with information on spam/EMP cancels, see the Spam Thresholds FAQ for details. e. Binaries in a non-binary group Much of Usenet does not want binary messages, usually for space reasons. To accommodate those that do, the alt.binaries.* and comp.binaries.* hierarchies were created. However, there are still some binary messages posted to various Usenet groups; these are often cancelled without regard to content, based on the size of the binary. For more information, see news.admin.net-abuse.policy, where the specifics are being debated. The bincancel FAQ, which is located at http://ursula. uoregon.edu/~geniac/binfaq.txt, concerns binary cancels in particular. f. Forgeries in the user's name It has become more and more common for people to post messages with false attribution lines. If a message is attributed to a person, even if they did not post it, they may cancel it or authorize others to cancel it. g. Unauthorized copyrighted material Related to the forgery issue (above), there are many cases on Usenet where the copyrighted material of one person is posted by another. There is a consensus emerging that such posts are cancellable by the holder of the copyright, though many other legal issues may be involved in the future. As with many other topics, this issue is still being discussed; for more information, see news.admin.net-abuse.policy. F. How are they issued? Cancel messages are sent out as a standard Usenet post, except they contain a "Control: cancel " header. If a system that accepts cancels receives the message, the post with the specified message ID is deleted from that system. Most major newsreaders allow readers to cancel their own posts with a key press. Third-party cancels are more complicated, and must follow several conventions; please refer to section II.B for details. G. How do I cancel my own post? Most major newsreaders allow you to cancel your message with a few keypresses. To cancel your own post, press the following key (depending on your newsreader) while reading your message: Unix rn/trn: 'C' tin: 'D' gnus-emacs: 'C' nn: 'C' slrn: Esc-^C pine: none Unix/X xrn: 'Cancel' button knews: Post/Cancel Article PC/Windows Free Agent: Article/Cancel Agent: Message/Cancel Usenet Message News Xpress: Article/Cancel Post Turnpike: Article/Cancel Article WinVN: Article/Cancel Internet News: File/Cancel Message PC/OS/2 NR/2: Article/Cancel Macintosh Nuntius: Articles/Cancel Article NewsWatcher: Special/Cancel Message most browsers: Special/Cancel Message Web Browsers Netscape: Edit/Cancel This Message (version 2.0+) Mosaic: none Lynx: none Generic/Multi-System Yarn: 'c' If you know of any new readers that allow cancels, have corrections to any of the above, or whatever, please mail tskirvin@uiuc.edu with the information. H. Who decided on these rules? Usenet is a cooperative venture of many thousands of sites world-wide. It was designed with the principle of everyone communicating together in mind; not much thought was put into security and the like. Each site owns its own machines; that's the fundamental concept behind the rules. Each site can decide whether they want to accept cancels, what sites to accept messages from, and the like. On this principle, Usenet can be called a cooperative anarchy. In other words, the people that decided on these rules are your system administrators, and those people that they listen to. II. How do cancels work? ======================== A. What is control? control.cancel? How do I receive them? control is a pseudo-newsgroup made up of all posts on a news system containing the Control: header, which is used to create or delete newsgroups, perform internal systems checks, cancel posts, and so forth. It is mostly an administrative convenience. On many systems, control is broken up into several components automatically by the software. If this is true, there are several newsgroups: control.newgroup (for the creation of new groups), control.rmgroup (for the removal thereof), control.cancel (for cancel messages), and so forth. If the software is configured this way, cancel messages will appear in control.cancel. All cancels are either recorded in control or in control.cancel, depending on the software used by your news server. If a post was cancelled recently, a record of the cancel *will* be in here; if there is no cancel in this group, there was no cancel. In addition, if necessary, there are news systems that keep logs of virtually everything on Usenet, such as DejaNews (http://www.dejanews.com) and Alta Vista (http://www.altavista.digital.com). If you cannot read control or control.cancel, ask your news administrator. B. What standards are there for cancelling posts? When cancelling your own post, the only standards are the software requirements. Third-party cancels, however, have certain standards that should be followed. There are three main reasons for following these standards when using third-party cancels. First is to identify the canceller, which gives the practice accountability. The second is to make sure that a particular message is only cancelled once. Finally, some news administrators would rather not accept certain cancels, and a standard will allow them to opt out of the system. The first standard is simple to fulfill; all legitimate third- party cancels include an "X-Cancelled-By:" header, containing the email address of the canceller. The second problem is solved much more creatively. The $alz convention (named after Richard Salz, the creator of INN), specifies that the message ID for a cancel message prepend the message ID of the original message with the string "cancel.". For example: Original Message ID: Cancel Message ID: The third problem, that of sites wanting to opt out certain types of cancels, can be solved by adding certain "pseudo-sites" to the path of the cancel; if a particular site wishes to not accept cancels of that type, they can alias out that pseudo-site. For information on how to do this, see section II.E. The commonly accepted pseudo-sites are as follows: cyberspam!usenet Spam/EMP cancels (universal) spewcancel!usenet Spew cancels mmfcancel!usenet Make.Money.Fast cancels bincancel!usenet Binary (in a non-Binary group) cancels adcancel!usenet Ad cancels (for the biz.* hierarchy only) retromod!usenet Retro-Moderation cancels The !usenet part denotes that something must come after that part of the path; it is not strictly necessary. Multiple pseudo-sites can be used in one message. C. What is the format of a cancel message? Here's an example, a spam cancel by Chris Lewis, that follows all of the standard conventions (reformatted to fit into 80 columns): -- Path: vixen.cso.uiuc.edu!newsfeed.internetmci.com!in1.uu.net!corpgate! crchh327.rich.bnr.ca!nrchh45.rich.nt.com!bcarh8ac.bnr.ca!ferret.ocunix. on.ca!cyberspam!not-for-mail Date: 22 Jan 1996 09:35:33 EST From: pspoole@hiwaay.net (Patrick Poole) Newsgroups: soc.culture.african Message-ID: Control: cancel Subject: cmsg cancel Approved: clewis@ferret.ocunix.on.ca X-Cancelled-By: clewis@ferret.ocunix.on.ca Lines: 3 EMP/ECP (aka SPAM) cancelled by clewis@ferret.ocunix.on.ca. See news.admin.net-abuse.announce, report 19960122.06 for further details -- D. Do all news sites accept cancels? No. Many news sites have decided that, for whatever reason, they do not want cancels; others merely do not want certain types of cancels. Dave Hayes, for example, runs a "Site of Virtue", which not only ignores cancels but drops them without distributing them; patches for INN to do this are availible from his Freedom Knights Homepage, at http://www.jetcafe.org/~dave/usenet. E. How do I alias out a pseudosite? Under garden-variety INN, it is difficult to alias out a site. Dave Barr, however, maintains the unofficial releases of INN; INNunoff3 and beyond (availible at http://www.math.psu.edu/barr/INN.html) include a "shun" patch, which aliases out individual sites. *The following information is untested! Try at your own risk!* [Update: I've gotten reports that this doesn't work. Until I'm positive of this, though, I'll leave it in; send me any information you have on it...] Under CNews, edit your sysfile at the following line: ME/cyberspam,spewcancel: [standard acceptance groups/distributions] This should make the system believe that the pseudosiutes 'cyberspam' and 'spewcancel' are you, and it will not take messages with them in the path. (If anyone's got information for other systems, I'd love to include it.) III. So your post was cancelled... ================================== A. Why was my post cancelled? It probably wasn't. It's very, *very* likely that you post was not cancelled. If you can't find a copy of the cancel in control, it probably wasn't cancelled. Check the expiry times on your site, check whether your newsreader junks read posts, and check control.cancel before complaining about somebody forging a cancel for your post. B. I have the cancel message right in front of me. Why was it cancelled? Most cancels nowadays are for cleanup of various forms of net-abuse. If you posted your message to too many places, or too many times, it will generally be cancelled, regardless of the content of the post. For details about what is cancelled and why, read news.admin. net-abuse.usenet, or check the news.admin.net-abuse FAQ. Also, if you received a mail on the subject from a spam cancellers, read it carefully; it should probably explain why your message was cancelled. C. But I wasn't doing anything wrong! Why was it cancelled? There's still legitimate reasons beyond official net-abuse to cancel posts. The moderator of a moderated newsgroup is permitted to cancel messages in his newsgroup that he did not approve. Individual newsgroups and hierarchies may have rules permitting them to cancel messages posted there; this applies especially to local hierarchies and non-Big 8/alt.* hierarchies. Your post may have unintentionally met the searching criteria for the auto-cancel of a continuing spam; contact the canceller in this case. Your postmaster may have decided that they didn't like your post; if this is really a problem, I recommend that you get a new service provider. D. Look, pal, I said I wasn't doing anything wrong, and I meant it. I didn't break any rules that I can see. *Why was my post cancelled?* I don't know. E. *sigh* Then what do I do about it? Post about it to news.admin.net-abuse.usenet. Make sure to include the full headers and text of the cancel, an explanation of what the article was about, and any possible motives for the cancelling that you can think of. The administrators there will, if you're polite, try to help. For more information, read section V. -- Copyright 1996, Tim Skirvin. All rights reserved. http://www.uiuc.edu/ph/www/tskirvin/cancel.html From: tskirvin@uiuc.edu (Tim Skirvin) Reply-to: tskirvin@uiuc.edu Newsgroups: news.admin.net-abuse.bulletins,news.admin.net-abuse.usenet,news.admin.net-abuse.sightings,news.admin.net-abuse.misc,news.answers Followup-to: news.admin.net-abuse.usenet Subject: Cancel Messages: Frequently Asked Questions, Part 2/3 (v1.31) Summary: This is a list of Frequently Asked Question about cancel messages on Usenet. It mainly discusses how cancels work, who issues them, their history, and what to do about them. It is more of a general purpose FAQ than anything else; it's not required reading anywhere, just more of a reference. Approved: news-answers-request@mit.edu Supersedes: Message-ID: Expires: Wed, 15 Jan 1997 00:00:00 GMT Archive-name: usenet/cancel-faq/part2 Posting-Frequency: monthly Last-modified: 1996/11/21 Version: 1.31 URL: http://www.uiuc.edu/ph/www/tskirvin/cancel.html Cancel Messages Frequently Asked Questions Part 2/3 This document contains information about cancel messages on Usenet, such as who is allowed to use them, how they operate, what to do if your message is cancelled, and the like. It does not contain detailed instructions on how to cancel a third party's posts. It is not intended to be a fully technical document; its audience is the average Usenet user, up to a mid-level administrator. This document is not meant to be a comprehensive explanation of Usenet protocols, or of Usenet itself, but a basic knowledge of these concepts is assumed. Please refer to news.announce.newusers, RFC1036, and/or RFC1036bis if you wish to learn them. Disclaimers: The information contained within is potentially hazardous; applying it without the permission of your news administrator may cause the revocation of your account, civil action against you, and even the possibility of criminal lawsuits. The author of this document is in no way liable for misuse of the information contained within, nor is he in any way responsible for damages related to the use or accuracy of the information. Proceed at your own risk. Table of Contents > = In other parts of the FAQ ================= >I. What are cancel messages? >II. How do cancels work? >III. So your post was cancelled... IV. What does it take to cancel messages? A. I want to cancel posts! How do I do it? B. I'm not kidding; I really do want to do it. How do I do so?. C. What is a cancelbot? D. Sounds cool. Where do I get one? E. What? Why not? F. Fine then, I'll write it myself. G. Right; I've got a cancelbot. Now what? 1. Who is going to be affected by this, and how will they react? 2. What kinds of problems will this cause legally? 3. Is this a moral thing to do? 4. Do I really have the time to deal with this? 5. Do I know for *sure* what this program will be used for? 6. Have I double- and triple-checked my code? 7. Do I know what's happened in the past? 8. Am I following all of the rules? 9. Do I actually have to do *this*? V. That idiot forge-cancelled my posts! A. My post is gone; it was forge-cancelled, wasn't it? B. No, I'm sure, it was cancelled. Why? C. How do I track the bastard down? D. Who's done this before? E. What, are there only bad guys? F. Is there anything I can do on my own? 1. Notify the postmaster at the offending site, or upstream site. 2. Alias out the offending site. 3. Call in the official authorities. VI. What moral issues are involved with cancel messages? >VII. What's going to happen to cancels in the future? >VIII. What about these other things? >Changes >To Do >Contributors >Pointers IV. What does it take to cancel messages? ========================================= A. I want to cancel posts! How do I do it? You must be kidding. B. I'm not kidding; I really do want to do it. How do I do so? *sigh* Well, I'll bet you really haven't thought about it very much yet. Read this section before you do anything, alright? Anyway... On a small scale, you can issue them by hand. On a large scale, you're going to want a cancelbot. C. What is a cancelbot? A cancelbot is a program that searches for messages matching a certain pattern and sends out cancels for them; it's basically an automated cancel program, run by a human operator. D. Sounds cool. Where do I get one? If you have to ask, you're probably going to have a hard time getting a decent one. Don't even consider using a cancelbot unless you've written it yourself. E. What? Why not? Giving out a cancelbot is like handing out loaded guns with no safeties. Even if the recipient is well-intentioned screw-ups are fatal; you need the proper training first. Until you know *exactly* how to use a cancelbot, few people will share the code. This is done for a variety of reasons, not the least of which is that they're dangerous, and can be used irresponsibly. More than that, though, if you screw up with a cancel-bot, you can cause *large* problems. For these and other reasons, it's generally accepted that only those that are willing to write their own cancelbot are able to get one. Besides, it probably isn't a good idea to trust any code that can cause so much damage unless you wrote it yourself. What security holes might it have? What bugs are still in it? It's a lot safer to write it yourself; I know I wouldn't use any of the publicly distributed sourcecode for something that important... F. Fine then, I'll write it myself. Sure, go right ahead, but a word of wisdom: make sure you know what you're doing. Richard Depew (red@redpoll.mrfs.oh.us) was one of the first people to use cancelbots in a large way. One of the most famous cancelbot-related incidents of all time was the ARMM cascade, in which a simple spelling error on his part caused a large spew in news.admin.policy before it was turned off. It was generally considered a Big Oops. Richard's incident was also far from the worst; that honor would have to go to the incident where a misconfigured cancelbot was auto- cancelling everything from netcom.com. Bigger Oops. And these examples just scratch the surface of what can go wrong when writing a cancelbot... Before you test out your cancelbot on actual Usenet stuff, double and triple check to make sure it *works*. Make sure that you've gone through all the potential bugs and vulnerabilities -- add safeties, redundancies, internal logic checks, and what have you. Start a local group, test it out in that group *only*. Whatever. Just remember, you only get one chance at this; do it right. While writing a cancelbot, make sure you follow the conventions that you plan on using ($alz, etc). In addition, once you've got the basics down, mail Chris Lewis (clewis@ferret.ocunix.on.ca). He'll give you some more tips. G. Right; I've got a cancelbot. Now what? Well, the obvious thing is to start using it. But don't. Before you do so, make sure you've considered *everything*; cancels raise plenty of interesting questions, and using a cancelbot isn't something to enter into lightly. Before you do anything, make sure you've thought a _lot_ about _all_ of the following issues. Trust me, you'll need it. 1. Who is going to be affected by this, and how will they react? Cancelbots tend to affect a lot of people. By running one, you are messing with a lot of people -- and, generally, making them upset. Many are going to complain. Many are going to retaliate. Succinctly, before you start up your cancelbot, make sure you've got procmail installed, that your machine can stand up to persistent cracking attempts, that you are on good terms with all of your bosses and administrators, that you have made your phone number unlisted, and that you've got a good lawyer handy. That's a start, at least. 2. What kinds of problems will this cause legally? The best information available about the legality of cancel messages says that non-content-based third party cancels are legal, and that content-based ones may not be. However, this has just plain not been tested in anything resembling a court of law. This will cause you problems if you expect to cancel posts. 3. Is this a moral thing to do? Even if cancel messages are perfectly legal, they still aren't the nicest thing in the the world. You *are* deleting somebody else's words; by many, this will be called censorship, and in many cases they are probably right. The most commonly used moral argument about cancels is known as the "slippery slope". The use of cancel messages leads down the road to censorship, which is a Bad Thing; however, it is possible to keep the system under control if you stay near the top. The further cancels go, however, the more likely it is that they *can't* be controlled, and once that happens, all is lost. But in the mean time, those small steps can help the functioning of the system immensely. Common practice says that non-content-based cancels are not censorship. Instead, they are based on how "loud" the message was said; it's not censorship to disallow someone to blare their message out in the middle of the night using a megaphone. Hopefully, this means that spam cancels and the like are not out of control, that we haven't gone too far down the slope to return; however, that point is definitely up to debate. Before you do anything, make sure you know what you might be causing. 4. Do I really have the time to deal with this? Operating a cancelbot takes a lot of time. Just on a technical level, the 'bot has to be written, the parameters have to be set, and the thing watched to make sure it works; that, though, is the least of your worries. Once you've got it going, people are *going* to take notice. As a result, you will get comments, you might get praise, and you will probably get complaints. And you've got to deal with them. If you expect your bot to continue working, you're going to have to put out a lot of time to deal with it all -- be it positive, negative, or neutral. It may seem like a small issue, but it's definitely something worth mentioning. Being held up to constant public scrutiny isn't easy. 5. Do I know for *sure* what this program will be used for? Remember, if people don't accept what your cancelbot is doing, your cancelbot will not be effective. Before you start cancelling, make sure that you won't be rejected from the job. Make yourself some rules. As a recap, the standard uses for third-party cancels are spam cancels, moderated group cleanup, binaries in non-binary groups, spews, forgeries, and the like. See section I.D for details. One more thing on this: remember that you may give out your code here at some point. If you were to do so, how could your cancelbot be used? Have you put in some safeguards? 6. Have I double- and triple-checked my code? Again, screwing up your code can cause *big* problems. Before you're ready to go operational, make absolutely sure that you know that the code works 100% of the time. There are no second tries here. 7. Do I know what's happened in the past? The history of Usenet and cancels goes back a long, long way; it's not only fairly interesting stuff, but it teaches interesting lessons. Before you start the cancelbots, you should probably know what they were used for before. With knowledge comes power, after all. 8. Am I following all of the rules? While they may not be conventions, there are certain basic rules that are usually followed by operators of cancelbots that should probably be followed. A notice of the cancel should be posted to news.admin.net-abuse.bulletins; the original poster and their postmaster should be notified; a representative copy, or link to such, should be appended to the cancellation notice. You should have a reliable contact address, so as to be fully accountable for your actions. And, as usual, all official conventions should be followed exactly. If you're not doing them nicely, you're going to get more complaints than otherwise -- and rightfully so. And if you aren't capable of doing them nicely, then you shouldn't be issuing cancels at all. Remember, it has been proven time and again that nice, polite cancel notifications make less enemies than flamish ones. It's probably a good idea to make your notifications as kind as possible -- though they should also include as much information (or links to information) as you can possibly fit in. 9. Do I actually have to do *this*? If you hadn't figured it out already, cancelbots are a pain in the butt. If for no other reason, you should probably think very carefully over whether this is really necessary. Are you ready to do this? Talk about it with the regulars of the groups you're dealing with. Make sure they know what's going on. See if someone else is willing to help you. It might help; it might not. It's worth a shot. If there are problems with too much irrelevant traffic, it might be a good idea to moderate the group; see news.groups for details. Are cancels the best solution to the problem? Sometimes, writing letters to the offenders is a good enough solution; people will generally solve the problem themselves, if given the chance. If that doesn't work, try mailing postmaster at the offender's machine (in some cases, the correct address would be abuse@site), so the user's administrators may try to help. Even if reasoning with everyone you can think of doesn't work, you can still try other approaches. Post about it to news.admin.net-abuse. usenet; the regulars there have been trained to deal with obnoxious sites, and will help you if necessary. In many cases, you can stop the problem with judicious use of killfiles. And, if all else fails, you can try NoCeM; see section VII.D. for details. In general, just make sure you've tried *every* alternative before you start cancelling. It's a pain. Trust me. V. That idiot forge-cancelled my posts! ======================================= A. My post is gone; it was forge-cancelled, wasn't it? Before you do anything, check section III; double-check to make sure that someone really *did* cancel your post before you get all upset. Remember, no cancel message, no cancel. B. No, I'm sure, it was cancelled. Why? There are as many reasons to cancel a post as there are cancel messages, and it shows. Most cancels are issued for valid reasons (which are detailed in previous sections), but sometimes they are done for what many people would consider illegitimate reasons. The people that issue such cancels are known as "rogue cancellers"; they are the ones to worry about. Why do they do it? It depends. One popular excuse, started by the infamous Church of Scientology, is that the message was a "Trade Secret" which has to be protected. This excuse is generally considered bogus, and will rarely stand up to scrutiny; kids, don't try this at home. What are the *real* reasons, though, that someone did this? Well, there are two basic reasons: they want to keep something out of the light, or they don't like what you said. Both are pretty bad. In any case, rogue cancellers are *not* accepted by the Usenet community. End of story. The hunts to track down rogue cancellers often reach near-epic proportions, and virtually always end with, at the very least, the cancels ending. C. How do I track the bastard down? If you have the cancel message, the best first step to tracking down the canceller is to post one of the cancel messages to news.admin.net-abuse.usenet with an explanation of what's going on. The people on that group are veterans at tracing Usenet messages; they can probably help. While you're at it, they may also explain why your message may have been cancelled legitimately, in case there's anything you missed. For rudimentary analysis of who cancelled your post, check the NNTP-Posting-Host: header of the cancel. While it is possible to forge this header, it generally will say which machine was used to issue the cancel message. Other possible headers may be the Path: header and possibly the Sender: or Message-ID: headers. D. Who's done this before? In the past, there have been many rogue cancellers, of various skill, competence, and intelligence. Some are gone; others are still on the run, but appear occasionally. Here are a few of the most famous. o Kevin Jay Lipsitz: "Krazy Kevin", as he calls himself in his spams, has cancelled many posts on news.admin.net-abuse.misc concerning his spams. His theory is that, by cancelling the posts, it will take more effort for his spams to be cancelled. To this point, he's failed miserably. Instead, he encouraged the creation of Dave the Resurrector by Chris Lewis. Kevin has been kicked off many ISPs, but is still at large. o CrackerBuster: CB was an unknown computer person that decided a while back that he didn't like alt.2600. Because of this, he decided to wage war on the group -- and anyone that supported it. He issued cancels for every message in the group, as well as alt.current-events. net-abuse, and them flooded them with his own messages. All of this, though, is not without its good side; as a result of his work, Chris Lewis, a prominent spam canceller, fixed up his cancelbot, got a better detector, and got to work at cancelling spam. Netcom eventually cancelled CB's account. o Crusader: last year, there was a *very* large neo-Nazi e-mail spam sent through several systems. Many systems were involved in one capacity or another, most of them cracked. To slow down the trackers, the perpetrators cancelled all messages about the spam to news.admin.net-abuse. misc; all that was accomplished was the creation of a short-term mailing list to track him or her down. The e-mail spam has since stopped, and the cancels ended. o Ellisd: soon after the passing of the Communications Decency Act, an anonymous user on Netcom once decided to cancel everything in alt.binaries.pictures.erotica.* and alt.sex.* as "indecent filth". Further, after the account was shut down (within hours), the person continued to forge cancels from other accounts to make them appear to come from Netcom, in an attempt to implicate them. The only real effect of the incident was to show that the cancellation of "morally questionable" material would not be tolerated. o The Pseudosite Incident: September of 1996 was a hard month for Usenet. Having endured many varied newsgroup and mail bombs, the next assault came in the form of tens of thousands of cancel messages. Possibly modeled after the ellisd incident of several months before, several parties unknown began issuing cancels using several new pseudosites such as "geekcancel" (in comp.*) and "kikecancel" (in soc.culture.israel). Needless to say, this resulted in a whole pile of ticked off people. The cancels stopped a few days later, and Chris Lewis reposted virtually all of the cancelled messages, but the damage was done. Recently the pseudosite attack has started up again, in response to the proposal to make a newsgroup for the NoCeM (VII.D.) protocol. There has been a call to force UUNet to close its open news port in reaction to this most recent attack; hopefully, this will help stop this problem in the future. o The CancelBunny: the Church of Scientology, a remarkably paranoid organization, has several "secret scriptures" that have long been distributed over Usenet. To stop this, the evidence shows that they have called in someone with computer knowledge to cancel posts that contain any of their scriptures -- or anything that they didn't like. This brought the entire religion to the attention of Usenet, and alt.religion.scientology is a very well-read (and high traffic) group as a result. The cancels, however, were generally accepted to be Bad Things. Therefore, a group of people decided that they were going to hunt down the (anonymous) CancelBunny, as it had been named, by checking from bunches of sites. Several CancelBunnies have been tracked down and lost their accounts; more keep popping up, only to be bashed back down just as quickly. The cancels by the CancelBunny are generally on comp.org.eff.talk and alt.religion.scientology. Cancels to a.r.s are reported by Lazarus (VIII.C). E. What, are there only bad guys? No, of course not; they're just the most prominent. There are plenty of important good guys, too -- the ones that perform the thankless job of cancelling spam, spew, MMF, and all the rest, basically keeping Usenet usable. Most of them hang around on news.admin.net-abuse.*. The most famous are the CancelMoose (moose@cm.org) [retired], Chris Lewis (clewis@ferret.ocunix.on.ca), John "jem" Milburn (dogbert@xpat.com), Jonathan Kamens (jik@mit.edu) [inventor of the best scanning software to date], Benjamin "Snowhare" Franz (snowhare@netimages.com), Richard Depew (red@redpoll.mrfs.oh.us), and Robert Braver (rbraver@ohww.norman.ok.us). F. Is there anything I can do on my own? Of course. 1. Notify the postmaster at the offending site, or upstream site. If you can determine where the cancels are coming form, mail postmaster at that site with your complaints, or, in many cases, abuse@site. If this doesn't work, you may want to try notifying the people that give the site its feed; for details on how to determine this, check the Spam Tracking FAQ. 2. Alias out the offending site. Your news administrator is capable of making your machine not accept posts from a certain other machine. If necessary, this can be used to ignore the cancel messages on your own site. 3. Call in the official authorities. As was previously said, forged cancels are in a legal grey area. If you want to call in the legal authorities, you probably can, and something may be done. The general recommendation of this, though? Don't do it. Any kind of legal judgment on this matter sets a precedent; at this point, we're almost happier without one. VI. What moral issues are involved with cancel messages? ======================================================== I'll answer this question succinctly: Lots. The moral issues related to cancel messages are among the most interesting, and distressing, part of the issue. Third-party cancels, spam and binary cancels, retro-moderation, moderators in general, the "slippery slope" argument, the "Usenet is an anarchy" argument, "you're violating my first amendment rights!" and "without cancels, Usenet would have died under the weight of the spam long ago"... This FAQ, though, isn't really the best place to get into it. For lack of space and time, I cannot get into these issues in detail here, however important they may be. If you want a start on this matter, read the news.admin.net-abuse FAQ, along with the newsgroups. It's at least a start. -- Copyright 1996, Tim Skirvin. All rights reserved. http://www.uiuc.edu/ph/www/tskirvin/cancel.html From: tskirvin@uiuc.edu (Tim Skirvin) Reply-to: tskirvin@uiuc.edu Newsgroups: news.admin.net-abuse.bulletins,news.admin.net-abuse.usenet,news.admin.net-abuse.sightings,news.admin.net-abuse.misc,news.answers Followup-to: news.admin.net-abuse.usenet Subject: Cancel Messages: Frequently Asked Questions, Part 3/3 (v1.31) Summary: This is a list of Frequently Asked Question about cancel messages on Usenet. It mainly discusses how cancels work, who issues them, their history, and what to do about them. It is more of a general purpose FAQ than anything else; it's not required reading anywhere, just more of a reference. Approved: news-answers-request@mit.edu Supersedes: Message-ID: Expires: Wed, 15 Jan 1997 00:00:00 GMT Archive-name: usenet/cancel-faq/part3 Posting-Frequency: monthly Last-modified: 1996/11/21 Version: 1.31 URL: http://www.uiuc.edu/ph/www/tskirvin/cancel.html Cancel Messages Frequently Asked Questions Part 3/3 This document contains information about cancel messages on Usenet, such as who is allowed to use them, how they operate, what to do if your message is cancelled, and the like. It does not contain detailed instructions on how to cancel a third party's posts. It is not intended to be a fully technical document; its audience is the average Usenet user, up to a mid-level administrator. This document is not meant to be a comprehensive explanation of Usenet protocols, or of Usenet itself, but a basic knowledge of these concepts is assumed. Please refer to news.announce.newusers, RFC1036, and/or RFC1036bis if you wish to learn them. Disclaimers: The information contained within is potentially hazardous; applying it without the permission of your news administrator may cause the revocation of your account, civil action against you, and even the possibility of criminal lawsuits. The author of this document is in no way liable for misuse of the information contained within, nor is he in any way responsible for damages related to the use or accuracy of the information. Proceed at your own risk. Table of Contents > = In other parts of the FAQ ================= >I. What are cancel messages? >II. How do cancels work? >III. So your post was cancelled... >IV. What does it take to cancel messages? >V. That idiot forge-cancelled my posts! >VI. What moral issues are involved with cancel messages? VII. What's going to happen to cancels in the future? A. What are authenticated cancels? B. Are there any other Usenet methods to delete messages? C. Why are some people turning off cancels altogether? D. What is NoCeM? E. What is PGP? VIII. What about these other things? A. What is Lazarus? B. What is Dave the Resurrector? C. What was the Judges-L mailing list? D. What is the UDP? Changes To Do Contributors Pointers VII. What's going to happen to cancels in the future? ===================================================== A. What are authenticated cancels? Usenet was not built with security in mind. The fact that it's relatively simple to forge a cancel proves this. As time goes on, though, the need for security is becoming more and more obvious. One way of making this security would be to change the software to only accept authenticated cancels, or cancels that verify the identity of the original author before deleting the post. There have been many methods proposed to accomplish this; at this point, none are in wide use. If anyone would like to write some software to accomplish this, please do so, and discuss it on news.admin. misc; the CancelMoose has a few suggestions for authenticated cancels on his web page at http://www.cm.org. B. Are there any other Usenet methods to delete messages? Of course. 1. How does the Supersedes: header work? Commonly used for periodic postings and other information updates, the Supersedes: header replaces an old message with a new one. To replace the message , you would want to add the header: Supersedes: The use of Supersedes: is otherwise basically the same as a cancel message, and third-party Superseding should be treated the same as third-party cancels. 2. How does the Expires: header work? By adding the Expires: header to your post, you can make your message be deleted from most systems at a certain time. For instance, if you want your message to expire at 7:50:06 (PST) on 2/11/96, add the following header: Expires: Sun, 11 Feb 1996 19:50:06 PST Your message should expire by this date. It may also expire early, depending on the storing system's expiry times. 3. What is the Also-Control: header? The Also-Control: header acts just like a standard Control: header, except that the post is also filed in whatever groups it was posted to, as opposed to being filed in control. Otherwise, the two are interchangeable. C. Why are some people turning off cancels altogether? In the mean time, there are few options to avoid forged cancels. One option, advocated by a very few (but also very vocal) people, is to not accept cancels at all. If you want to do so, you're welcome to, but it probably isn't the best option. D. What is NoCeM? NoCeM, pronounced "No See-Umm", is a piece of news software written to mostly replace cancel messages. Instead of deleting the messages automatically, NoCeM works by allowing anyone to send out a message that basically states "you don't want to read this". Indiviual news systems or users may then act on these messages as they see fit, from deleting the messages or marking them as read, to merely ignoring the advice altogether, to even marking those messages to be read as soon as possible. The idea is being hailed as a worthy replacement for cancels by many news administrators, and it is slowly gaining support. Cancelmoose (moose@cm.org) authored this software, which is currently availible for most Unix clients that can use PGP (VII.E). Several newsgroups are also being created to use the software. For more information on NoCeM, refer to http://www.cm.org/. E. What is PGP? PGP stands for "Pretty Good Privacy", and is a greatly heralded encryption program made for everyday use. It is at the heart of most authenticated cancel schemes, NoCeM, and most other Usenet software. Unfortunately, the import and export laws regarding the software vary, making its availibility questionable in countries other than the USA. PGP is a topic on its own, and as such has several FAQs of its own, as well as several newsgroups. For more information, I recomend you read one of these FAQs, such as the alt.security.pgp FAQ (availible at http://www.quadralay.com/www/Crypt/PGP/pgp00.html). VIII. What about these other things? ==================================== A. What is Lazarus? Lazarus is a program written for use on alt.religion.scientology by Homer Wilson Smith (homer@light.lightlink.com). It monitors control and posts a message to a.r.s whenever it finds a message relating to the group. The basic effect of this is that all cancels are *very* visible. For more information on why this was necessary, refer to Ron Newman's "The Church of Scientology vs the Net" page, at http://www. cybercom.net/~rnewman/scientology/home.html. B. What is Dave the Resurrector? After a particularly obnoxious run of cancels from sent by Kevin Lipsitz (using accounts fraudulently obtained from ixc.net), Chris Lewis decided that it was time to implement a program to repost anything that was cancelled on news.admin.net-abuse.misc. The Resurrector, named Dave, was the result. The practical effect of this is that cancels on news.admin. net-abuse.misc (and now the rest of news.admin.net-abuse.*) are not effective. The name was suggested by Tim Skirvin (*wave*) for reasons only he knows; Chris accepted the name in honor of Dave Hayes, of news.admin.* fame (see the net.legends FAQ for details). C. What was the Judges-L mailing list? A while back, a guy named David Stodolsky decided that he was going to be in charge of cancels on Usenet. He set up a mailing list to this effect, Judges-L, and expected to start up. The rest of the world didn't exactly want him to be Emperor of Usenet. After a short flamewar, an early FAQ on Cancel Messages was written as a result of the Judges-L list; while technically accurate, it had little influence on the creation of this FAQ. In the mean time, the Judges-L list was dissolved; David Stodolsky is rarely seen on Usenet anymore. D. What is the UDP? UDP stands for the "Usenet Death Penalty", the final weapon against those that attempt to abuse Usenet. It is never entered into lightly. Originally, the UDP referred to auto-cancellation of all messages from a certain site as a final solution to too much abuse. As Usenet terms tend to change over time, the meaning mutated into meaning to refer to the aliasing out of a certain site by many major sites, thus "shunning" them off of Usenet. In recent times, both definitions have been used at the same time. The original version, however, is currently more commonly accepted. Changes ======= v1.0 -> v1.01 Updated the style slightly Clarified the meanings of EMP and ECP Added a section in I, "Where can I find cancel messages?" Added some newsreaders' cancel buttons v1.01 -> v1.1 Updated the addresses to have the HTML version Got some information about CNews Got approval for posting to news.answers Fixed a few errors here and there v1.1 -> v1.2 Added slrn to the newsreaders' cancel buttons list Updated the section on NoCeM Added a section on PGP Made a few slight cosmetic changes v1.2 -> v1.25 Added references to the Bincancel FAQ Updated the definition of a spew Added "unauthorized copyrighted material" to the list of valid reasons for cancel messages (with disclaimers). Added Agent's cancel button Added a disclaimer for the CNews information v1.25 -> v1.3 Added references to the Spam Thresholds FAQ Added references to Dave Hayes' "Site of Virtue" page Changed the definition of a 'spew' Updated IV.E. Added a section on the ellisd and pseudosite cancel incidents v1.3 -> v1.31 Updated the newsgroups, based on the recent news.admin. net-abuse.* reorganization Added a link to the news.admin.net-abuse Homepage Updated the cancelbot section to warn against publicly distributed ones Updated the information on the psuedosite cancel attack To Do ===== This is, of course, not entirely finished. I still have a few things to do with it, and some things that I need to figure out before I can write anything more; this what will hopefully be in future versions. Fill in the technical sections in general, especially with other software. Add a section on things that *shouldn't* be cancelled, and why. Expand the UDP and NoCeM sections a *lot*. Maybe they even deserve their own FAQ... Contributors ============ In creating this FAQ, I discovered one important thing: it's a *lot* of work. These are the people that have helped me out in doing it, with suggestions, moral support, or whatever. Thank you all. I couldn't have done this without you. Literally. And, if I missed anyone, don't hesitate to speak up... Johann Beda j-beda@uiuc.edu CancelMoose moose@cm.org Ian Collier imc@comlab.ox.ac.uk Peter Da Silva peter@bonkers.taronga.com Richard Depew red@redpoll.mrfs.oh.us Frans P. de Vries fpv@xymph.iaf.nl Ernie Diaz trebor@slip.net Arnould Engelfriet galactus@stack.urc.tue.nl J.D. Falk jdfalk@cybernothing.org Follower of the Clawed Albino edmcdo01@terra.spd.louisville.edu The Gentleman gentlman@alinc.com Howard Goldstein hg@n2wx.ampr.org Dave Hayes dave@jetcafe.org Jim Hill jthill@netcom.com Jonathan Kamens jik@mit.edu Tom Lewis thomas.lewis@me.gatech.edu Chris Lewis clewis@ferret.ocunix.on.ca Charles H. Lindsey chl@clw.cs.man.ac.uk Guy Macon guymacon@deltanet.com John Milburn jem@xpat.com Bernhard Muenzer mue@gsf.de Ron Newman rnewman@cybercom.net Matthew Paden mpaden@emory.edu Joshua Putnam josh@wolfenet.com John Rickard jrr@atml.co.uk Chris Salter chris@loncps.demon.co.uk Wolfgang Schelongowski ws@xivic.ruhr.de Keith Thompson kst@thomsoft.com Jason Untulis untulis@netcom.com Dimitri Vulis dlv@bwalk.dm.com Matthew P Wiener weemba@sagi.wistar.upenn.edu Michael Wise mjwise@unixg.ubc.ca Dick Yuknavech rey@mindspring.com Pointers ======== For more information on cancel messages, or for information on related issues, try checking some of the following pages: Related FAQs ------------ news.admin.net-abuse FAQ http://www.cybernothing.org/faq/net-abuse-faq.html Advertising on Usenet FAQ http://www.danger.com/advo.html The Spam Tracking FAQ (draft) http://ddi.digital.net/~gandalf/spamfaq.html The Spam Thresholds FAQ http://www.uiuc.edu/ph/www/tskirvin/spam.html The Bincancel FAQ http://ursula.uoregon.edu/~geniac/binfaq.txt Utilities --------- GFilter, a filter patch for INN http://www.backplane.com/news/ Adcomplain shell script http://www.rdrop.com/~billmc/adcomplain Purge-binaries, an anti-binary script http://www.tju.edu/~theall1/tools/purge-binaries/ NoCeM http://www.cm.org/nocem.html RFCs ---- RFC 1036 -- Usenet Guidelines http://www.cis.ohio-state.edu/htbin/rfc/rfc1036 RFC 1855 -- Netiquette Guidelines http://www.cis.ohio-state.edu/htbin/rfc/rfc1855 RFC 1036bis (temporary) http://www.uiuc.edu/ph/www/tskirvin/rfc1036b Newsgroups ---------- news.announce.newusers news.answers news.admin.announce news.admin.net-abuse.bulletins news.admin.net-abuse.email news.admin.net-abuse.misc news.admin.net-abuse.policy news.admin.net-abuse.sightings news.admin.net-abuse.usenet news.admin.misc news.groups Additional/Other ---------------- The Jargon File http://www.ctrl-c.liu.se/~ingvar/jargon/ net.legends FAQ http://www.uiuc.edu/ph/www/tskirvin/legends.html news.admin.net-abuse Homepage http://www.uiuc.edu/ph/www/tskirvin/nana/ -- Copyright 1996, Tim Skirvin. All rights reserved. http://www.uiuc.edu/ph/www/tskirvin/cancel.html