On Fri, 9 Sep 1994 01:19:34 -0500 Winship said:
>About an hour after I sent my first item about this I thought maybe it
>came from someone reading the list via a gateway (such as
>bit.listerv.autocat).  Is that a possibility?  If so, is there a way we
>can allow folk to read from the gateway but not to post, short of full
>moderation?  Put something in the Filter= field?
 
Filter will only stop the domain or person you indicate.
The best way is to put full moderation. But there are acouple of things you
should look for. You CAN forge the Accepted field...
Number two, if you use reply the message will go back to the newsgroup
(via the moderator) He (the bad guy) may change the To: field and send it
directly to the list. So that's another problem right there. If he is in the
list the message will go through. If you have an Editor in the list watch out
for the Tag: Field.
 
>Someone suggested setting the header to FULL might show enough info to
>guess who the real sender was (not anything that will help now, but maybe
>of aid in the future).  I don't want to do that for the entire list, but I
>did change my personal sub to that.  What goes into the Approved-by:
>field?  Our subscribers are self-editors, everything else comes through
>me.  So, if the From: says one thing and Sender: or a resent field says
>something else, would it show up in the Approved-by: field?  For example,
>someone forges an item with From: [log in to unmask] and
>Sender:[log in to unmask] .  Would [log in to unmask] show in the Approved-by:
>field ?
 
It will only help you find out if the message is forged by looking at the
Tag: Field, by the message ID, and of course by the Original From field.
 
>        Douglas Winship    Austin, Texas    [log in to unmask]
>                    Secondary AUTOCAT Listowner
 
Spiros