326759 - mozilla.* newsgroups are leaking.

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Dave Miller [:justdave]]

There's been sporadic reports from people on the newsgroups that they're finding the mozilla.* groups on servers other than Giganews and Google.  At first (because of the servers mentioned) I was assuming they were "private feed" servers who were using client methods to pull the newgroups.  Today I got a heads-up from Google that they're receiving messages and control messages for our groups in their feeds coming in from servers other than Giganews that show they originated at Giganews.

I've opened a ticket with Giganews.

Comment 1

[Dave Miller [:justdave]]

OK, Giganews hasn't been able to find any internal evidence of things leaking, and Google seems to have misplaced the evidence they thought they had, and haven't seen any more since.

If this is still happening, please reopen, BUT we need evidence submitted when you do so.  If you find things showing up elsewhere, please grab copies of a few posts, *with full headers*, including the Path header at the top, and attach them to this bug.  Thanks.

Comment 2

[Dave Miller [:justdave]]

And just for my records (since I'll be surprised if this isn't reopened) the ticket number at Giganews to reopen for this is 234620.

Comment 3

[Frank Wein [:mcsmurf]]

Ok so, posts from mozilla.* show up on news.t-online.com (and vice versa).
Test posting in mozilla.test sent to news.t-online.com and read on news.mozilla.org:
Path: border1.nntp.dca.giganews.com!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.mozilla.org!news.mozilla.org.POSTED!not-for-mail
NNTP-Posting-Date: Fri, 17 Mar 2006 14:15:26 -0600
From: Frank Wein <[e-mail]>
Newsgroups: mozilla.test
Subject: news.t-online.com Test
Date: Fri, 17 Mar 2006 21:17:21 +0100
Organization: T-Online
Message-ID: <dvf58l$912$01$[e-mail]>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Real-X-Trace: news.t-online.com 1142626389 01 9250 V0cUvot6KVAu2ZX 060317 20:13:09
X-Real-X-Complaints-To: [e-mail]
X-ID: rBkiV6ZboejKxi2hfMhtMX+ZJxk91Kecg-yUmvFJaa7UGobzhhiTkT
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060316 SeaMonkey/1.5a
Lines: 1
NNTP-Posting-Host: 194.25.134.126
X-Trace: sv3-QBaTcYuye/WfD+gqIIhSB3QiImlBdKaTeotuZJM/lwQmePOTypkaNAHuEpjEKy4+DC86Io3NTQPO2di!CwP/KFD6sT/v/LXsn6m9N+n5LWlv8qLqJRs7zhN9pMj6yCBgXw8EtD2XVHjFeAI9VAT2BeDgZZQ=
X-Complaints-To: [e-mail]
X-DMCA-Complaints-To: [e-mail]
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.32
Xref: number1.nntp.dca.giganews.com mozilla.test:424

testing 3 2 1

Test posting in mozilla.test sent to news.mozilla.org and read on news.t-online.com:
Path: news.t-online.com!newsmm00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!border1.nntp.dca.giganews.com!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.mozilla.org!news.mozilla.org.POSTED!not-for-mail
NNTP-Posting-Date: Fri, 17 Mar 2006 14:10:13 -0600
Date: Fri, 17 Mar 2006 21:14:25 +0100
From: Frank Wein <[e-mail]>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a1) Gecko/20060316 SeaMonkey/1.5a
MIME-Version: 1.0
Newsgroups: mozilla.test
Subject: news.mozilla.org Test
X-Enigmail-Version: 0.94.0.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Message-ID: <[e-mail]>
Lines: 1
NNTP-Posting-Host: 84.147.89.239
X-Trace: sv3-xb6samtyqfLeaceEnswbLWspGvSoEeFz8SJJWD1zG/NFCtjJWRGXm0kZx/JPO0uamoWzb2VvZ/I00x8!davaGA/ZPwderMqpwxty0/Prakyt7oX+tSFt2EGJfXc/szVA/L6eMAFhu8mis5xAgpeXX8doTzI=
X-Complaints-To: [e-mail]
X-DMCA-Complaints-To: [e-mail]
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.32
Xref: news.t-online.com mozilla.test:260

testing 1 2 3

Comment 4

[Dave Miller [:justdave]]

OK, the ticket at Giganews has been reopened, and I've forwarded the new evidence along. :)

Comment 5

[Dave Miller [:justdave]]

Giganews is still disclaiming responsibility.  They don't even have an outgoing feed going to the next server on the list in the Path line, so either it's going out through Google and Google isn't adding an entry on the Path line or someone's injecting it by stealth via a client connection.

Ticket has been forwarded to Google to verify it on their end.

Comment 6

[Dave Miller [:justdave]]

OK, Google hasn't found anything either, but we do have more clues.  Some more detailed tracing seems to indicate t-online.de is using READER mode to pull and insert articles to news.mozilla.org.  Bounced back to Giganews...

Comment 7

[Dave Miller [:justdave]]

(In reply to comment #6)
> OK, Google hasn't found anything either, but we do have more clues.  Some more
> detailed tracing seems to indicate t-online.de is using READER mode to pull and
> insert articles to news.mozilla.org.  Bounced back to Giganews...

OK, Giganews has confirmed.  t-online.de is using READER mode to pull and insert messages.  The question now is what do we want to do about it?

Comment 8

[Chris Ilias [:cilias]]

This may be bleedingly obvious, but I think the first action would be to find an admin address, and simply send him/her a polite request to remove the groups from t-online.de, and stop pulling articles from news.mozilla.org.

According to the headers posted here: [e-mail]

Comment 9

[Frank Wein [:mcsmurf]]

I posted some questions about this to their internal newsgroup (that was just once, i don't want take this issue out of your hands :). Some excerpts from their response (they have some kind of support team which reads this group):
* [e-mail] is responsible for handling this
* it's probably a service for their customers
* news.mozilla.org is a free accessible server and this is probably some argument for the newsmaster to take the articles from there
* T-Online uses Cleanfeed for filtering EMP
* T-Online has a working abuse desk (Note: I can confirm this, they have a good abuse desk) and news.t-online.com requires the user to be authed (you can only use this server if you use T-Online as ISP; T-Online works as feed so for some free newsservers but there are several servers in between those servers)
* news.mozilla.org might not be able to handle all abuse cases because no auth is required

So if you want to complain, try the newsmaster@t.o address, not sure how far you maybe want to allow other servers to carry the groups (there was some discussion if this should be possible).

Comment 10

[Dave Miller [:justdave]]

OK, my next question then...  has anyone seen it showing up anywhere other than news.t-online.de?  Is news.t-online.de pulling it only for their own customers or are they then making it available to usenet as well?  If they're pulling it only for their own customers and not allowing it to propagate my personal opinion is to not make such a big fuss over it.  They're not the official source, and we can still spamcancel anything they post on our server (if it's spammy) since they're using READER mode to post it (we only have trouble with spamcancels if it looks like it originated on another server).

Comment 11

[Frank Wein [:mcsmurf]]

Check news://news.mozilla.org/[e-mail], there someone said news.readfreenews.com carries the mozilla.* groups with the following path:
Path: authen.yellow.readfreenews.net!green.octanews.net!news-out.octanews.net!teal.octanews.net!news-out1.kabelfoon.nl!newsfeed.kabelfoon.nl!bandi.nntp.kabelfoon.nl!newsfeed.freenet.de!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!local01.nntp.dca.giganews.com!nntp.mozilla.org!news.mozilla.org.POSTED!not-for-mail

I'm not sure if postings originating on this server arrive on news.mozilla.org so (i do not have access to it).

Comment 12

[»Q«]

(In reply to comment #11)
> Check news://news.mozilla.org/[e-mail],
> there someone said news.readfreenews.com carries the mozilla.* groups with the
> following path:
> Path: authen.yellow.readfreenews.net!green.octanews.net!news-out.octanews.net!teal.octanews.net!news-out1.kabelfoon.nl!newsfeed.kabelfoon.nl!bandi.nntp.kabelfoon.nl!newsfeed.freenet.de!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!local01.nntp.dca.giganews.com!nntp.mozilla.org!news.mozilla.org.POSTED!not-for-mail

That was me, and I'm sorry I was inadvertently using "X-No-Archive: yes" at 
the time, so Google doesn't have a copy of my posts in the thread.
readfreenews.net and several other Usenet servers have the posts which 
t-online has gotten from Giganews.

> I'm not sure if postings originating on this server arrive on news.mozilla.org
> so (i do not have access to it). 

I don't know about posts made by t-online customers to t-online servers.
Posts made to the other Usenet servers propagate across Usenet, but not 
to Giganews' news mozilla.org server.  IMO that's a Bad Thing, as some users 
will think they've reached the support ng when actually most of the Champs &c. 
will never see their posts.

Comment 13

[Dave Miller [:justdave]]

Ticket #12434384 opened with t-online.de

Comment 14

[Dave Miller [:justdave]]

(In reply to comment #13)
> Ticket #12434384 opened with t-online.de

I haven't heard a darn thing back from T-Online, but I've been told on IRC that the newsgroups have disappeared off their servers.

I'll consider this resolved unless someone finds *new* evidence out there that it's still happening.

Comment 15

[»Q«]

Posts made to the free Usenet server nntp.aioe.org are making it to news.mozilla.org.

Two examples are in mozilla.support.firefox, Message-IDs <[e-mail]> and <e0iisp$bps$[e-mail]>.

Here are the posts made to Usenet, with headers:
<http://howardk.freenix.org/msgid.cgi?ID=114384446700>
<http://howardk.freenix.org/msgid.cgi?ID=114384473800>

And here are Google's copies, gotten from Giganews/n.m.o:
<http://groups.google.com/group/mozilla.support.firefox/msg/47fb047993ec01f2?dmode=source>
<http://groups.google.com/group/mozilla.support.firefox/msg/6f6313c6571e82c0?dmode=source>

Note that in both cases, the n.m.o versions are stamped with 
"NNTP-Posting-Host: 158.64.14.86", though they were posted to Usenet by different people (I posted the first one.)  It appears that the machine at 158.64.14.86 is connecting to n.m.o in reader mode to get those posts through.

AIOE has a contact page, <http://www.aioe.org/contacts.html>, and its admin reads alt.free.newsservers.

Comment 16

[Chris Ilias [:cilias]]

Reopening as per comment #15

Comment 17

[Dave Miller [:justdave]]

Is this worth fighting?

FWIW, I did get a reply from t-online the following day (I forgot to post about it here).  They were basically pissed that we thought we had any right to keep it to ourselves, but complying none-the-less.

BTW, doing searches currently, I can't find any record of any messages with the NNTP-Posting-Host mentioned in comment 15 on news.mozilla.org.

Comment 18

[Chris Ilias [:cilias]]

(In reply to comment #17)
> BTW, doing searches currently, I can't find any record of any messages with the
> NNTP-Posting-Host mentioned in comment 15 on news.mozilla.org.

http://groups.google.com/group/mozilla.test/msg/350fa86327852e9e?dmode=source
news://news.mozilla.org/e0pqqt$588$[e-mail]

Comment 19

[gwtc]

(In reply to comment #15)

I'm adding to this one.  There are 4 postings that I found on aioe and there are replies to one of them, but they're not showing up on news.mozilla.org.  It could be cox that is doing this.  I've put 5 stars [*****] so you can find where the message starts; and they're in the m.s.firefox newsgroup

*****The first one is posted:
Path: emma.aioe.org!eleonora.aioe.org!aioe.org!zen.net.uk!dedekind.zen.co.uk!cox.net!news-xfer.cox.net!p01!dukeread04.POSTED!53ab2750!not-for-mail
From: jst <[e-mail]>
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
Newsgroups: mozilla.support.firefox
Subject: Problems on specific page
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 4
Message-ID: <%hxZf.13$ZW3.5@dukeread04>
Date: Fri, 07 Apr 2006 12:27:21 -0500
NNTP-Posting-Host: 24.255.242.237
X-Complaints-To: [e-mail]
X-Trace: dukeread04 1144430843 24.255.242.237 (Fri, 07 Apr 2006 13:27:23 EDT)
NNTP-Posting-Date: Fri, 07 Apr 2006 13:27:23 EDT
Organization: Cox Communications
Xref: emma.aioe.org mozilla.support.firefox:3221

When I try to log onto a friends soccer site it flashes or blinks off & 
on,it does not do it in IE.Is there something I need to set in the browser??

http://twestsoccer.com/home.html


*****The next one is a reply to the above:

Path: emma.aioe.org!eleonora.aioe.org!aioe.org!news.moat.net!cox.net!news-xfer.cox.net!p01!dukeread11.POSTED!53ab2750!not-for-mail
From: "Coleen" <[e-mail]>
Newsgroups: mozilla.support.firefox
References: <%hxZf.13$ZW3.5@dukeread04>
Subject: Re: Problems on specific page
Lines: 14
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
X-RFC2646: Format=Flowed; Response
Message-ID: <mIKZf.37$9c6.13@dukeread11>
Date: Sat, 8 Apr 2006 03:42:57 -0500
NNTP-Posting-Host: 68.226.63.164
X-Complaints-To: [e-mail]
X-Trace: dukeread11 1144485778 68.226.63.164 (Sat, 08 Apr 2006 04:42:58 EDT)
NNTP-Posting-Date: Sat, 08 Apr 2006 04:42:58 EDT
Organization: Cox Communications
Xref: emma.aioe.org mozilla.support.firefox:3223

I'm just an amateur user so I may be barking up the wrong tree here.  But I 
used the CSS viewer to check out the page and text-decoration=blink is 
defined in the style sheet for the page.  Perhaps FF is doing what it is 
supposed to and IE is not.

*****and then there is a reply to that reply:

Path: emma.aioe.org!eleonora.aioe.org!aioe.org!news.moat.net!news.linkpendium.com!news.linkpendium.com!cox.net!news-xfer.cox.net!p01!dukeread11.POSTED!53ab2750!not-for-mail
From: "Coleen" <[e-mail]>
Newsgroups: mozilla.support.firefox
References: <%hxZf.13$ZW3.5@dukeread04> <mIKZf.37$9c6.13@dukeread11>
Subject: Re: Problems on specific page
Lines: 23
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
X-RFC2646: Format=Flowed; Response
Message-ID: <WXKZf.38$9c6.21@dukeread11>
Date: Sat, 8 Apr 2006 03:59:32 -0500
NNTP-Posting-Host: 68.226.63.164
X-Complaints-To: [e-mail]
X-Trace: dukeread11 1144486774 68.226.63.164 (Sat, 08 Apr 2006 04:59:34 EDT)
NNTP-Posting-Date: Sat, 08 Apr 2006 04:59:34 EDT
Organization: Cox Communications
Xref: emma.aioe.org mozilla.support.firefox:3224

After I posted that last message, I decided to experiment.  I used the 
EditCS extension and removed the text-decoration from the td selector (is 
that the correct word?) in the page's style sheet and viola!!!!  The 
blinking stopped.

*****Then there is a new message:

Path: emma.aioe.org!eleonora.aioe.org!aioe.org!newspeer1.de.telia.net!newspeer4.de.telia.net!de.telia.net!nx01.iad01.newshosting.com!newshosting.com!130.81.64.211.MISMATCH!cycny01.gnilink.net!spamkiller.gnilink.net!gnilink.net!trnddc07.POSTED!3208ae66!not-for-mail
From: Keith Underwood <[e-mail]>
User-Agent: Thunderbird 1.5 (Windows/20051201)
MIME-Version: 1.0
Newsgroups: mozilla.support.firefox
Subject: Asp
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 8
Message-ID: <NIzZf.283$WL4.99@trnddc07>
Date: Fri, 07 Apr 2006 20:12:29 GMT
NNTP-Posting-Host: 71.99.95.47
X-Complaints-To: [e-mail]
X-Trace: trnddc07 1144440749 71.99.95.47 (Fri, 07 Apr 2006 16:12:29 EDT)
NNTP-Posting-Date: Fri, 07 Apr 2006 16:12:29 EDT
Xref: emma.aioe.org mozilla.support.firefox:3222

Does anyone know when Mozilla will finally get the bugs out
of asp pages.  Most seem to work fine, but if the page
opens a child page with photos, like when I view the
interior photos for RV's, the photos do not enlarge
when clicked.  If I open Internet Explorer (yuck)
those pages work fine.

kunderwood

Comment 20

[Dave Miller [:justdave]]

aioe is taken care of.

http://news.aioe.org/webnews.php?zz=x&tipo=article.php&id=263&group=aioe.news.helpdesk#263

Comment 21

[gwtc]

(In reply to comment #20)
> aioe is taken care of.
> 
> http://news.aioe.org/webnews.php?zz=x&tipo=article.php&id=263&group=aioe.news.helpdesk#263
> 

That sounds great, but in the mean time here's another one.  This was posted on the usenet2.ath.cx servers:

Path: usenet2.ath.cx!usenet.ath.cx!news.ispa.de!newsfeed.freenet.de!newsfeed0.kamp.net!newsfeed.kamp.net!news.osn.de!diablo2.news.osn.de!news.tele.dk!news.tele.dk!small.news.tele.dk!newsfeed.bahnhof.se!195.197.54.117.MISMATCH!feeder1.news.jippii.net!reader1.news.jippii.net!53ab2750!not-for-mail
From: "T.Kulmala" <[e-mail]>
Newsgroups: mozilla.support.firefox
Subject: Removing file, edit, etc menus from guest user?
Lines: 21
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.2869
X-RFC2646: Format=Flowed; Original
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
Message-ID: <wS00g.3292$[e-mail]>
Date: Sat, 15 Apr 2006 10:02:50 +0300
NNTP-Posting-Host: 85.76.245.22
X-Complaints-To: [e-mail]
X-Trace: reader1.news.jippii.net 1145084444 85.76.245.22 (Sat, 15 Apr 2006 10:00:44 EEST)
NNTP-Posting-Date: Sat, 15 Apr 2006 10:00:44 EEST
Organization: Saunalahti Customer
Xref: usenet2.ath.cx mozilla.support.firefox:416

Hello all,

I'm trying to create a protected environment over windows XP where web 
browser would be the only thing that a guest user is able to use. Everything 
has went fine so far, but now I'm having problems with choosing the browser. 
With Internet Explorer the restriction policies are easy to make in windows 
environment, but what about Firefox? I would like to use it instead of IE 
but I wasn't able to find any information about the following 2 questions:

1. Is it possible to lock users home page to some certain page so that they 
would not be able to change it?

2. Another question I have is that is there any way of hiding the file, 
edit, view, etc menus from users?



Best regards,
Tapio Kulmala

Comment 22

[»Q«]

(In reply to comment #21)

gwtc, that one was actually posted to news.jippii.net.  The mozilla.* groups are on too many Usenet servers to hope to have them removed.  The best that can be done is for someone to post occasional pointers to n.m.o.  FWIW, the only one of the Usenet groups where I see any traffic is the Firefox one, and traffic there is very light.

Comment 23

[»Q«]

Attachment: headers of three leaked posts, 2 August 2008

I've attached the headers of three posts made to news.mozilla.org which 
have made it to Usenet.  Each of them has a Path header indicating that
the post went from Giganews to a server called news4us.nl.

I guess it would be nice if the Giga folks could have a look at this.

Comment 24

[»Q«]

(In reply to comment #23)
> Each of them has a Path header indicating that the post went from Giganews
> to a server called news4us.nl.

If I am reading <http://www.news4us.nl/html/peering.html> correctly, they are
pulling from n.m.o as a client, bypassing peering.  n.m.o is listed under 
"Pull & posting feeds" at the bottom of the page.  Admin contact info is at the 
top of the page.

Comment 25

[»Q«]

In light of my last couple comments (23, 24), I think this should be reopened.
I've just re-checked, and the leakage continues.