Proton Pass is now available for everyone.
As the name suggests, Proton Pass is an encrypted password manager, one
of the most highly demanded services from the Proton community in our
annual surveys. <https://proton.me/pass/download>

Am 05.08.23 um 06:00 schrieb Proton Manager:
>
> Proton Pass is now available for everyone.
> As the name suggests, Proton Pass is an encrypted password manager, one
> of the most highly demanded services from the Proton community in our
> annual surveys. <https://proton.me/pass/download>

X-posting over four groups with a fake identity?
Even worse: Using one of the worst Troll-servers.
Not really helping your case ...

Path:
news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Proton Manager <Proton@invalid.invalid>
Newsgroups:
alt.comp.software.thunderbird,alt.comp.software.firefox,alt.comp.os.windows-11,alt.comp.os.windows-10
Subject: Proton Pass is available for free.
Date: Sat, 5 Aug 2023 05:00:00 +0100
Organization: Aioe.org NNTP Server

--
Alea iacta est

Jörg Lorenz <hugybear@gmx.ch> wrote:
> Am 05.08.23 um 06:00 schrieb Proton Manager:
> >
> > Proton Pass is now available for everyone.
> > As the name suggests, Proton Pass is an encrypted password manager, one
> > of the most highly demanded services from the Proton community in our
> > annual surveys. <https://proton.me/pass/download>
>
> X-posting over four groups with a fake identity?
> Even worse: Using one of the worst Troll-servers.
> Not really helping your case ...

Well, he's not actually *using* "one of the worst Troll-servers", but
*faking* that he's using it:

> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail

> Organization: Aioe.org NNTP Server

I.e. using news.eternal-september.org, but faking Aioe.org (which is
no longer online).

On Sat, 5 Aug 2023 07:40:27 +0200, Jörg Lorenz wrote:
> Am 05.08.23 um 06:00 schrieb Proton Manager:
> > [quoted text muted]
>
> X-posting over four groups with a fake identity?
> Even worse: Using one of the worst Troll-servers.
> Not really helping your case ...
>

And yet you reposted what you objected to, giving it
extra publicity.

--
Stan Brown, Tehachapi, California, USA
https://BrownMath.com/
Shikata ga nai...

Am 05.08.23 um 12:24 schrieb Frank Slootweg:
> Jörg Lorenz <hugybear@gmx.ch> wrote:
>> Am 05.08.23 um 06:00 schrieb Proton Manager:
>>>
>>> Proton Pass is now available for everyone.
>>> As the name suggests, Proton Pass is an encrypted password manager, one
>>> of the most highly demanded services from the Proton community in our
>>> annual surveys. <https://proton.me/pass/download>
>>
>> X-posting over four groups with a fake identity?
>> Even worse: Using one of the worst Troll-servers.
>> Not really helping your case ...
>
> Well, he's not actually *using* "one of the worst Troll-servers", but
> *faking* that he's using it:
>
>> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
>
>> Organization: Aioe.org NNTP Server
>
> I.e. using news.eternal-september.org, but faking Aioe.org (which is
> no longer online).

Correct but makes things even worse.

--
Alea iacta est

Frank Slootweg <this@ddress.is.invalid> wrote:

> Jörg Lorenz <hugybear@gmx.ch> wrote:
>> Am 05.08.23 um 06:00 schrieb Proton Manager:
>>>
>>> Proton Pass is now available for everyone.
>>> As the name suggests, Proton Pass is an encrypted password manager, one
>>> of the most highly demanded services from the Proton community in our
>>> annual surveys. <https://proton.me/pass/download>
>>
>> X-posting over four groups with a fake identity?
>> Even worse: Using one of the worst Troll-servers.
>> Not really helping your case ...
>
> Well, he's not actually *using* "one of the worst Troll-servers", but
> *faking* that he's using it:
>
>> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
>> Organization: Aioe.org NNTP Server
>
> I.e. using news.eternal-september.org, but faking Aioe.org (which is
> no longer online).

Where in the PATH header is an AIOE node? The injection node is the
first node after which each subsequent peering host gets prepended as a
node in PATH, so the route is read right to left. You mention him
faking using AIOE, but you also show the PATH header in your claim. The
PATH header is not involved in him faking his injection node.

What he did do is use a non-blank Organization header that misleads to
him using AIOE. If the Organization header is absent (the client did
not include it) then the server may optionally add its own. If the
client did specify a non-blank Orgranization header, the server is to
step aside and keep the one the client specified. Why he uses a value
for the Organization header that has anything to do with his choice of
Usenet provider, real or not, is odd. He should pick a value that
relates to his presence.

The same goes for the Message-ID header: if absent from the client
submission then the server adds it, else if present in the client's
submission then the server leaves it. ES uses <token@dont-email-me> for
their server-added MID header; however, since he is faking the
Organization header he could be faking his MID header, too. Yet the
PATH header's injection node does show he submitted to the ES server.

There are some NNTP servers that permit pre-loading the PATH header.
The user can inject their own node into the PATH header, but the Usenet
provider requires that same user to append "!<providernode>" to PATH, so
it still looks like "...!<usernode>!<providernode>". Yet, although the
policy is to append the provider's domain to the user-added node, such
Usenet providers don't actually test submissions to enforce that policy.
Providers that allow pre-loading the PATH header will permit their users
to lie about the injection node. Alt.net was one of these untrustworthy
Usenet providers.

His Content-Language header also looks to be fake. It is for web
documents (pages), not Usenet posts. swiss is not a valid language tag.
For swiss, "CH" (Confoederatio Helvetica) would be somewhere in the
language tag which happens to also be the ccTLD (country code top-level
domain) for Switzerland. The .swiss ccTLD got added in 2014 to
supplement the traditional .ch ccTLD, but .swiss is a TLD, not a
language tag since Switzerland has 4 national languages. For the
Content-Language header to be viable, standard tags must be used, not
some user-specified arbitrary string. In addition, Content-Language is
an entity header added by the server but rarely used by clients, in
contrast to the Accept-Language header issued by web clients expresses
their language preference. In an HTML document to specify the language
for the page, use the lang attribute.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
https://en.wikipedia.org/wiki/Language_code

While he presents a fake Organization header, he also chose to hide
which NNTP client he uses by not including the User-Agent header. Guess
he wants that to be a secret. Or, he used a web-based Usenet client,
like those many web-based (HTTP) forums that leech from Usenet to
pretend they have larger groups, and the HTTP-to-NNTP proxy doesn't
identify itself, and also adds the Content-Language header (with
incorrect value) which is inappropriate to Usenet.

While Proton Pass (https://proton.me/pass) is free, it only comes as a
web browser extension on desktop PCs. Available as Android or iOS app
for smartphones. While this has Proton Pass focused on passwords
entered via web browser, the Web is not the only only place you may use
passwords.

In article <uaki8n$1kiac$1@dont-email.me>
Proton Manager <Proton@invalid.invalid> wrote:
>
>
> Proton Pass is now available for everyone.
> As the name suggests, Proton Pass is an encrypted password manager, one
> of the most highly demanded services from the Proton community in our
> annual surveys. <https://proton.me/pass/download>

I don't trust password managers. I put all my passwords into a text
file and then encrypt it with PGP.

I think his multi x-posting of this link is fine. There are jerkos
who x-post a lot worse useless crap.

In alt.comp.os.windows-11 VanguardLH <V@nguard.lh> wrote:
> Frank Slootweg <this@ddress.is.invalid> wrote:
>
> > Jörg Lorenz <hugybear@gmx.ch> wrote:
> >> Am 05.08.23 um 06:00 schrieb Proton Manager:
> >>>
> >>> Proton Pass is now available for everyone.
> >>> As the name suggests, Proton Pass is an encrypted password manager, one
> >>> of the most highly demanded services from the Proton community in our
> >>> annual surveys. <https://proton.me/pass/download>
> >>
> >> X-posting over four groups with a fake identity?
> >> Even worse: Using one of the worst Troll-servers.
> >> Not really helping your case ...
> >
> > Well, he's not actually *using* "one of the worst Troll-servers", but
> > *faking* that he's using it:
> >
> >> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
> >> Organization: Aioe.org NNTP Server
> >
> > I.e. using news.eternal-september.org, but faking Aioe.org (which is
> > no longer online).
>
> Where in the PATH header is an AIOE node? The injection node is the
> first node after which each subsequent peering host gets prepended as a
> node in PATH, so the route is read right to left. You mention him
> faking using AIOE, but you also show the PATH header in your claim. The
> PATH header is not involved in him faking his injection node.

Sigh! Try to read for comprehension! And please don't try to 'teach'
*me* about NetNews headers (or NetNews in general).

I didn't say he's faking the Path: or/and the injection node. I said
"he's not actually *using* "one of the worst Troll-servers" [FS:
Aioe.org], but *faking* that he's using it:". *Obviously* the faking is
done in the (*also* quoted) Organization: header.

[What we Dutch call 'kicking in an open door' episode deleted.]

Am 05.08.23 um 17:31 schrieb Frank Slootweg:
> In alt.comp.os.windows-11 VanguardLH <V@nguard.lh> wrote:
>> Where in the PATH header is an AIOE node? The injection node is the
>> first node after which each subsequent peering host gets prepended as a
>> node in PATH, so the route is read right to left. You mention him
>> faking using AIOE, but you also show the PATH header in your claim. The
>> PATH header is not involved in him faking his injection node.
>
> Sigh! Try to read for comprehension! And please don't try to 'teach'
> *me* about NetNews headers (or NetNews in general).

VanguardLH. That says it all. And it takes almost half a DIN A4 page to
say so little.

FUP2 adn

--
Manus manum lavat

On 8/5/2023 11:31 AM, Frank Slootweg wrote:

> "he's not actually *using* "one of the worst Troll-servers"

If you are trying to promote a piece of software that
relies on "trust", this is not a particularly good way to do it.

I presume the individual is a "de-moter" rather than a "pro-moter".

I guess my PostIt notes with the passwords written on it, is
safe for another year :-/

Paul

Am 05.08.23 um 18:03 schrieb Paul:
> On 8/5/2023 11:31 AM, Frank Slootweg wrote:
>
>> "he's not actually *using* "one of the worst Troll-servers"
>
> If you are trying to promote a piece of software that
> relies on "trust", this is not a particularly good way to do it.
>
> I presume the individual is a "de-moter" rather than a "pro-moter".
>
> I guess my PostIt notes with the passwords written on it, is
> safe for another year :-/

;-)

--
Manus manum lavat

I've cut down the off-topic groups in the crosspost.

VanguardLH <V@nguard.LH> wrote:
>Frank Slootweg <this@ddress.is.invalid> wrote:
>>Jorg Lorenz <hugybear@gmx.ch> wrote:
>>>Am 05.08.23 um 06:00 schrieb Proton Manager:

>>>>Proton Pass is now available for everyone.
>>>>As the name suggests, Proton Pass is an encrypted password manager, one
>>>>of the most highly demanded services from the Proton community in our
>>>>annual surveys. <https://proton.me/pass/download>

>>>X-posting over four groups with a fake identity?
>>>Even worse: Using one of the worst Troll-servers.
>>>Not really helping your case ...

>>Well, he's not actually *using* "one of the worst Troll-servers", but
>>*faking* that he's using it:

>>>Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
>>>Organization: Aioe.org NNTP Server

>>I.e. using news.eternal-september.org, but faking Aioe.org (which is
>>no longer online).

>Where in the PATH header is an AIOE node?

Oh for gawd's sake. He preloaded the header

Organization: Aioe.org NNTP Server

which the genuine AIOE would have appended if the user didn't otherwise
have an Organization header.

Preloading headers that had been automatically added by other News sites
is a trolling technique. There is one user who regularly preloads
Injection headers (which his News site MUST prohibit but doesn't), but
that didn't happen here.

He also declared

Content-language: swiss

>The injection node is the first node after which each subsequent peering
>host gets prepended as a node in PATH, so the route is read right to left.
>You mention him faking using AIOE, but you also show the PATH header
>in your claim. The PATH header is not involved in him faking his
>injection node.

Yes, VanguardLH. Falsely claiming an assocation with an organization
would be "fake".

>What he did do is use a non-blank Organization header that misleads to
>him using AIOE.

Gee. Even you acknowledge this.

>If the Organization header is absent (the client did not include it) then
>the server may optionally add its own.

fwiw, I don't agree that using Organization for advertising was ever the
purpose of the header. I don't think it should ever be added by the News
site unless the organization itself provides the News site for its own
employees or volunteers.

>. . .

>The same goes for the Message-ID header:

Wrong. That's a false analogy. Message-ID is a REQUIRED header;
Organization is not. It's never used for advertising purposes.

>. . .

On 8/5/2023 12:03 PM, Paul wrote:
> On 8/5/2023 11:31 AM, Frank Slootweg wrote:
>
>> "he's not actually *using* "one of the worst Troll-servers"
>
> If you are trying to promote a piece of software that
> relies on "trust", this is not a particularly good way to do it.
>
> I presume the individual is a "de-moter" rather than a "pro-moter".
>
> I guess my PostIt notes with the passwords written on it, is
> safe for another year :-/
>
> Paul

As is my Rolodex :-)

"Adam H. Kerman" <ahk@chinet.com> wrote:

> VanguardLH <V@nguard.LH> wrote:
>
>> The same goes for the Message-ID header:
>
> Wrong. That's a false analogy. Message-ID is a REQUIRED header;
> Organization is not. It's never used for advertising purposes.

Required or optional was not part of my analogy. *WHO* adds the header
was my analogy.

Client adds Organization header. Server will not add its own.
Client does not add an Organization header. Server /may/ add its own.

Client adds MID header. Server will not add its own. (*)
Client does not add a MID header. Server must add one.
(*) Unless a conflict occurs.

Some clients have the option to let the user decide if the client adds
the MID header in their submission or not. Some don't. Who adds the
MID header depends on whether or not the client already added it.

https://www.rfc-editor.org/rfc/rfc2822
Section 3.6
Message-ID header can appear zero or 1 time.
Section 3.6.4
Though optional, every message SHOULD have a "Message-ID:" field.

The client can add its own MID, but this is not mandatory for
submission. Or it can omit it whereupon the server should add it. It
is the SHOULD condition that has the server add a MID if missing in the
client's submission.

As for the Organization header not being used for advertizing purpose,
why prevents the client from specifying a value that is advertizing?
Why can't a server, when this header is missing from the client
submission, put whatever they want in that header? As you note, it is
an optional header, and ANYTHING can be its value.

Organization: AT&T Bell Laboratories, Murray Hill

That is Murry Hill advertizing his affiliation or employment at AT&T.

https://www.rfc-editor.org/rfc/rfc1036
2.2.8. Organization
The text of this line is a short phrase describing the organization
to which the sender belongs, or to which the machine belongs. The
intent of this line is to help identify the person posting the
message, since host names are often cryptic enough to make it hard
to recognize the organization by the electronic address.

Okay, there is intent, but there is no *enforcement*. There are no MUST
or even SHOULD in the definition of that header. Hell, even ES puts in
"A noiseless patient Spider" which obviously not an identification of
the sender. Frank, in this subthread uses "NOYB" (presumably meaning
None Of Your Business), but just how is that supposed to identify the
sender or whomever they used as their Usenet provider? It doesn't.

I use 40tude Dialog. It does allow me to specify both the Organization
(optional) and Message-ID header values. I have my client specify the
value for both. You use trn. That client doesn't give you the option
of specifying the values for those headers?

In your posts, apparently you do not have trn configured (or the option
is not available) to specify the Organization header which is, yes,
optional regardless of who might specify it. The result is ES adds
their own Organization header at the server. If your trn did let you
specify the Organization header, that's what would appear in your posts,
not ES' cutsy string. You also have not configured trn (or it's not an
available option) the MID header's value, so you get the value that ES
assigns to your submission. If trn had let you specify the MID value,
THAT is what we would see in your posts barring conflict (collision)
with MIDs in existing articles.

In article <14k3mqnvrrkqc.dlg@v.nguard.lh>
VanguardLH <V@nguard.LH> wrote:
>
> Frank Slootweg <this@ddress.is.invalid> wrote:
>
> > J�rg Lorenz <hugybear@gmx.ch> wrote:
> >> Am 05.08.23 um 06:00 schrieb Proton Manager:
> >>>
> >>> Proton Pass is now available for everyone.
> >>> As the name suggests, Proton Pass is an encrypted password manager, one
> >>> of the most highly demanded services from the Proton community in our
> >>> annual surveys. <https://proton.me/pass/download>
> >>
> >> X-posting over four groups with a fake identity?
> >> Even worse: Using one of the worst Troll-servers.
> >> Not really helping your case ...
> >
> > Well, he's not actually *using* "one of the worst Troll-servers", but
> > *faking* that he's using it:
> >
> >> Path: news.solani.org!!weretis.net!reader5.news.weretis.net!feeder8.news.weretis.net!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
> >> Organization: Aioe.org NNTP Server
> >
> > I.e. using news.eternal-september.org, but faking Aioe.org (which is
> > no longer online).
>
> Where in the PATH header is an AIOE node? The injection node is the
> first node after which each subsequent peering host gets prepended as a
> node in PATH, so the route is read right to left. You mention him
> faking using AIOE, but you also show the PATH header in your claim. The
> PATH header is not involved in him faking his injection node.
>
> What he did do is use a non-blank Organization header that misleads to
> him using AIOE. If the Organization header is absent (the client did
> not include it) then the server may optionally add its own. If the
> client did specify a non-blank Orgranization header, the server is to
> step aside and keep the one the client specified. Why he uses a value
> for the Organization header that has anything to do with his choice of
> Usenet provider, real or not, is odd. He should pick a value that
> relates to his presence.
>
> The same goes for the Message-ID header: if absent from the client
> submission then the server adds it, else if present in the client's
> submission then the server leaves it. ES uses <token@dont-email-me> for
> their server-added MID header; however, since he is faking the
> Organization header he could be faking his MID header, too. Yet the
> PATH header's injection node does show he submitted to the ES server.
>
> There are some NNTP servers that permit pre-loading the PATH header.
> The user can inject their own node into the PATH header, but the Usenet
> provider requires that same user to append "!<providernode>" to PATH, so
> it still looks like "...!<usernode>!<providernode>". Yet, although the
> policy is to append the provider's domain to the user-added node, such
> Usenet providers don't actually test submissions to enforce that policy.
> Providers that allow pre-loading the PATH header will permit their users
> to lie about the injection node. Alt.net was one of these untrustworthy
> Usenet providers.
>
> His Content-Language header also looks to be fake. It is for web
> documents (pages), not Usenet posts. swiss is not a valid language tag.
> For swiss, "CH" (Confoederatio Helvetica) would be somewhere in the
> language tag which happens to also be the ccTLD (country code top-level
> domain) for Switzerland. The .swiss ccTLD got added in 2014 to
> supplement the traditional .ch ccTLD, but .swiss is a TLD, not a
> language tag since Switzerland has 4 national languages. For the
> Content-Language header to be viable, standard tags must be used, not
> some user-specified arbitrary string. In addition, Content-Language is
> an entity header added by the server but rarely used by clients, in
> contrast to the Accept-Language header issued by web clients expresses
> their language preference. In an HTML document to specify the language
> for the page, use the lang attribute.
>
> https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Language
> https://en.wikipedia.org/wiki/Language_code
>
> While he presents a fake Organization header, he also chose to hide
> which NNTP client he uses by not including the User-Agent header. Guess
> he wants that to be a secret. Or, he used a web-based Usenet client,
> like those many web-based (HTTP) forums that leech from Usenet to
> pretend they have larger groups, and the HTTP-to-NNTP proxy doesn't
> identify itself, and also adds the Content-Language header (with
> incorrect value) which is inappropriate to Usenet.
>
> While Proton Pass (https://proton.me/pass) is free, it only comes as a
> web browser extension on desktop PCs. Available as Android or iOS app
> for smartphones. While this has Proton Pass focused on passwords
> entered via web browser, the Web is not the only only place you may use
> passwords.

Jesu Christo!

Who gives a damn 'bout all that crap?

VanguardLH <V@nguard.LH> wrote:
>"Adam H. Kerman" <ahk@chinet.com> wrote:
>>VanguardLH <V@nguard.LH> wrote:

>>>The same goes for the Message-ID header:

>>Wrong. That's a false analogy. Message-ID is a REQUIRED header;
>>Organization is not. It's never used for advertising purposes.

>Required or optional was not part of my analogy. *WHO* adds the header
>was my analogy.

>Client adds Organization header. Server will not add its own.
>Client does not add an Organization header. Server /may/ add its own.

bonk

That it's not a required header is what makes it not analogous.

I had to look it up. The Organization header isn't defined for email
messages. It's defined for Usenet articles in the current USEFOR, RFC
5536.

3.2.9. Organization

The Organization header field is a short phrase identifying
the poster's organization.

It's not defined for advertising purposes, which is what it's used for
when the commercial or noncommercial NNTP server adds it. It's
unconventional but not nonstandard to use it for advertising purposes.

In the O.P.'s case, he used it as a troll to preload false information
about how the article had been injected into Usenet. The header is clearly
not defined for a trolling purpose but it's not nonstandard.

Your analogy sucks, Vanguard. You got it wrong.

>. . .

>As for the Organization header not being used for advertizing purpose,
>why prevents the client from specifying a value that is advertizing?

Nice strawman there. I never so stated it was nonstandard.

>Why can't a server, when this header is missing from the client
>submission, put whatever they want in that header? As you note, it is
>an optional header, and ANYTHING can be its value.

If the user didn't add the header, it's not MISSING for the purpose of
providing information about the poster's affiliation. The poster CHOSE
not to use it. If the NNTP adds it to advertise its services, it has
overridden the user's choice.

>. . .

"Adam H. Kerman" <ahk@chinet.com> wrote:

> VanguardLH <V@nguard.LH> wrote:
>
>>"Adam H. Kerman" <ahk@chinet.com> wrote:
>>
>>>VanguardLH <V@nguard.LH> wrote:
>
>>>>The same goes for the Message-ID header:
>
>>>Wrong. That's a false analogy. Message-ID is a REQUIRED header;
>>>Organization is not. It's never used for advertising purposes.
>
>>Required or optional was not part of my analogy. *WHO* adds the header
>>was my analogy.
>
>>Client adds Organization header. Server will not add its own.
>>Client does not add an Organization header. Server /may/ add its own.
>
> bonk
>
> That it's not a required header is what makes it not analogous.

And you snipped where I made the equivalence in describing who adds the
Message-ID header. Uh huh, break the analogy to claim it doesn't apply.

> I had to look it up. The Organization header isn't defined for email
> messages. It's defined for Usenet articles in the current USEFOR, RFC
> 5536.

So, you found another RFC noting the purpose of the Organization header
rather than read the description I already gave in another RFC.

> 3.2.9. Organization
>
> The Organization header field is a short phrase identifying
> the poster's organization.

Wow, such a major difference from the definition I showed in RFC 1036
.... not!

>> As for the Organization header not being used for advertizing
>> purpose, why prevents the client from specifying a value that is
>> advertizing?
>
> Nice strawman there. I never so stated it was nonstandard.

Ah, avoiding the issue for when the Organization header does NOT
identify an organization. The converse of an argument is not a strawman
argument. I proposed a scenario. I did not say you said that. Go look
up the definition of strawman argument.

It's not just the server that can optionally add the Organization
header. User clients can, too. And to what "organization" do the users
belong? Whatever they want.

>>Why can't a server, when this header is missing from the client
>>submission, put whatever they want in that header? As you note, it is
>>an optional header, and ANYTHING can be its value.
>
> If the user didn't add the header, it's not MISSING for the purpose of
> providing information about the poster's affiliation. The poster CHOSE
> not to use it. If the NNTP adds it to advertise its services, it has
> overridden the user's choice.

I've yet to see any NNTP server delete the Organization header specified
by the client to override with the server's choice of header.

Perhaps you should look at more Usenet articles to notice the
Organization header is *NOT* used to define an organization for the
sender or the Usenet provider.

Even ES that you use as your Usenet provider is not compliant with the
RFC claiming the purpose of the Organization. "A noiseless patient
Spider" does not identify ES.

In many RFCs, "SHOULD" and "RECOMMENDED" are not always visible as they
enforce nothing, just relay intention. The RFC you and I referenced do
not state "MUST".

VanguardLH <V@nguard.LH> wrote:
>"Adam H. Kerman" <ahk@chinet.com> wrote:
>>VanguardLH <V@nguard.LH> wrote:
>>>"Adam H. Kerman" <ahk@chinet.com> wrote:
>>>>VanguardLH <V@nguard.LH> wrote:
>>>>>The same goes for the Message-ID header:
>>>>Wrong. That's a false analogy. Message-ID is a REQUIRED header;
>>>>Organization is not. It's never used for advertising purposes.

>>>Required or optional was not part of my analogy. *WHO* adds the header
>>>was my analogy.

>>>Client adds Organization header. Server will not add its own.
>>>Client does not add an Organization header. Server /may/ add its own.

>>bonk
>>That it's not a required header is what makes it not analogous.

>And you snipped where I made the equivalence in describing who adds the
>Message-ID header. Uh huh, break the analogy to claim it doesn't apply.

It's not equivalent. It's being done for a purpose other than standards
compliance.

>>I had to look it up. The Organization header isn't defined for email
>>messages. It's defined for Usenet articles in the current USEFOR, RFC
>>5536.

>So, you found another RFC noting the purpose of the Organization header
>rather than read the description I already gave in another RFC.

I decided to look it up rather than blathering on in ignorance. Seemed
like the better choice. The RFC I went with was the current one.

>> 3.2.9. Organization

>> The Organization header field is a short phrase identifying
>> the poster's organization.

>Wow, such a major difference from the definition I showed in RFC 1036
>... not!

I have no idea what point you're making.

2.2.8. Organization

The text of this line is a short phrase describing the
organization to which the sender belongs, or to which the
machine belongs. The intent of this line is to help identify
the person posting the message, since host names are often
cryptic enough to make it hard to recognize the organization
by the electronic address.

Happy now?

I don't interpret advertising the Usenet server as the standard nor
intended purpose of the header.

>>>As for the Organization header not being used for advertizing
>>>purpose, why prevents the client from specifying a value that is
>>>advertizing?

>>Nice strawman there. I never so stated it was nonstandard.

>Ah, avoiding the issue for when the Organization header does NOT
>identify an organization. The converse of an argument is not a strawman
>argument. I proposed a scenario. I did not say you said that. Go look
>up the definition of strawman argument.

The Organization header is used to help identify the poster, according
to the definition you prefer from RFC 1036. If a poster claims a false
association with some organization, then that's not helpful in
identifying the poster and is not the intended use of the header.

>It's not just the server that can optionally add the Organization
>header.

I don't think the server should override the user's deliberate choice in
this instance, unless the server is operated by the user's organization.

Doesn's the server already identify itself with Injection headers and
Abuse contact headers and Path?

>User clients can, too. And to what "organization" do the users
>belong? Whatever they want.

Ok.

>>>Why can't a server, when this header is missing from the client
>>>submission, put whatever they want in that header? As you note, it is
>>>an optional header, and ANYTHING can be its value.

>>If the user didn't add the header, it's not MISSING for the purpose of
>>providing information about the poster's affiliation. The poster CHOSE
>>not to use it. If the NNTP adds it to advertise its services, it has
>>overridden the user's choice.

>I've yet to see any NNTP server delete the Organization header specified
>by the client to override with the server's choice of header.

That's a strawman.

It's the user's choice whether to use Organization. If the server (not
part of the user's organization) adds it, it has overridden the user's
choice not to use it. I just wrote that.

>Perhaps you should look at more Usenet articles to notice the
>Organization header is *NOT* used to define an organization for the
>sender or the Usenet provider.

No shit.

>Even ES that you use as your Usenet provider is not compliant with the
>RFC claiming the purpose of the Organization. "A noiseless patient
>Spider" does not identify ES.

Eternal-September is Ray's organization, not mine. I'm a user but not
part of the organization.

>In many RFCs, "SHOULD" and "RECOMMENDED" are not always visible as they
>enforce nothing, just relay intention. The RFC you and I referenced do
>not state "MUST".

For the 23rd time, I never stated that it was a nonstandard use. You're
repeating yourself.

On 8/4/23 23:00, Proton Manager wrote:
>
> Proton Pass is now available for everyone.
> As the name suggests, Proton Pass is an encrypted password manager, one
> of the most highly demanded services from the Proton community in our

Does it store the decryption keys on the server with your passwords,
like proton's ``secure'' mail does?

On 2023-08-08 10:27 a.m., rdh wrote:
> On 8/4/23 23:00, Proton Manager wrote:
>>
>> Proton Pass is now available for everyone.
>> As the name suggests, Proton Pass is an encrypted password manager, one
>> of the most highly demanded services from the Proton community in our
>
> Does it store the decryption keys on the server with your passwords,
> like proton's ``secure'' mail does?

ProtonMail is a fraud, use Posteo.de.

--
RabidPedagog
TG: @RabidPedagog
Galatians 6:7

<snipped the pissing contest>

My analogy only mentioned *who* added the Message-ID and Organization
headers. Then you decided to argue by mentioning the MID is required
and Organization is optional. YOU started the strawman subthread by
arguing on an issue I did not state. REquired or optional does not
affect /who/ adds the headers.

https://en.wikipedia.org/wiki/Straw_man
A straw man fallacy (sometimes written as strawman) is the informal
fallacy of refuting an argument different from the one actually under
discussion, while not recognizing or acknowledging the distinction.

Yep, that was YOU in your reply to me. Instead of discussing WHO adds
the headers, you changed to whether the headers are optional or
mandatory. Yes, a valid point, but not germaine to my analogy.

As to your mention the MID is required, reread the RFCs which state the
MID header can appear zero or 1 time. That means it is optional unless
specified whereupon it can appear only once.

https://www.rfc-editor.org/rfc/rfc5322
Section 3.6
Look at the table where it notes:
message-id: min number = 0*, max number = 1
note: SHOULD be present - see 3.6.4

In RFC's "SHOULD" is a strong suggestion, and does not equate to "MUST".

3.6.4. Identification Fields
Though listed as optional in the table in section 3.6, every message
SHOULD have a "Message-ID:" field.

Again, "SHOULD", not "MUST". The MID header is not needed in e-mails.
It is also not required in Usenet. At submission, the post gets
assigned an article number in the NNTP server's Articles and Overview
databases. The submission is tracked by article number, not MID. When
peered to another NNTP server, again the MID is not used at either end.

Where MID is highly useful is in threading several articles in a thread.
The server does not do threading. I just returns articles to the
client. It is the client that may attempt to thread articles together
using the References header which lists the MIDs. MIDs are meaningless
to the server. They have use in clients -- but are NOT required per
RFC. Without MIDs, clients couldn't thread articles together into
threads. They also allow referencing different articles by their
article number across different NNTP servers. NNTP servers do not
synchronize their article numbers: articles at one NNTP server will be
enumerated different and independently of articles are a peering NNTP
server.

A lot of handy features would cease without MIDs, but MIDs are *not*
required. This is a fallacy assumed by many Usenetizens because they've
always seen MIDs added to articles either by the clients or by the
servers. MIDs are required for convenience features in clients.

The Message-ID header was not defined until RFC 733 ratified in 1977
where the header was noted as optional in Appendix C. This RFC
obsoletes RFC 680 which states "A message may have at most one
MESSAGE-ID item." That does not preclude zero instances, just at most 1
is allowed. A lot of handy client-side features would be lost without
MIDs, but NNTP doesn't /require/ MIDs. Those have been added for
decades, but talk to someone who operates an NNTP server, and they'll
tell you articles are assigned article numbers, not MIDs in their
ARTICLES database.

<Matt@WhoCares.org> wrote:

<snipped the header discussion Matt doesn't give a gnat's fart about>

> Jesu Christo!
> Who gives a damn 'bout all that crap?

Learn to have fun. Never play a trivia game? If so, did you bitch
about wee bits of info that you deem crap? You're no fun at parties.

VanguardLH wrote:
> "A noiseless patient Spider" does not identify ES.

I just considered that to be a Ray Banana/ Wolfgang Weyand 'tribute' to
Walt Whitman and his poetry.

And regarding the OP:

- it seemed 'spammy' to me; I don't like that kind of cross-posting
- I do appreciate Proton's efforts, email, VPN, and 'other' incl this
pw manager
- Proton's 'business' model is making stuff available free as an
'introduction' to better stuff if you buy their pay product; that's OK
w/ me too, I've used Proton's free VPN 'experimentally'
- as far as I know, there is a pay v for every one of the products
that has a free v, mail, vpn, drive, pw manager, calendar - also
'business' & enterprise vs personal

--
Mike Easter

rdh <rdh@tilde.institute> wrote:

> Proton Manager wrote:
>
>> Proton Pass is now available for everyone.
>> As the name suggests, Proton Pass is an encrypted password manager, one
>> of the most highly demanded services from the Proton community in our
>
> Does it store the decryption keys on the server with your passwords,
> like proton's ``secure'' mail does?

For Proton Mail:

https://proton.me/support/how-is-the-private-key-stored
https://proton.me/support/download-public-private-key

You can add a password to your account, or even to a particular mailbox.
They would have to brute force key regeneration since they wouldn't have
your password used to create the private key. No encryption is 100%
protected. It just makes it tough to find the right one (which could be
on the 1st try, or never in millions of tries which should generate an
alert to Proton about excessive super-rapid login attempts that would
get your account locked or suspended).

My guess is Proton already has a scheme setup for Proton Mail, and
likely reuses it for their Proton Pass. In addition, they added 2FA to
help better protect against hacking into your account. Even Proton
won't have your phone or security key.

https://proton.me/support/pass-2fa

No such thing as 100% security in electronics. Even a bunker can be
destroyed with a non-nuke bunker buster bomb. You're just creating
higher hurdles for hackers to jump.

Proton attempts to secure your data. What do you use now you think is
more secure? Please elaborate. I'm curious to know.

On 8/8/23 19:34, Mike Easter wrote:
> <snip />
>
>  - Proton's 'business' model is making stuff available free as an
> 'introduction' to better stuff if you buy their pay product; that's OK
> w/ me too, I've used Proton's free VPN 'experimentally'
>
> <snip />
>
​Free trials and demos are a hostile business tactic that discourage the
creation of quality products.
--
⚗︎ | /blu.mɛin.dʰak/ | shortens to "Hawk" | he/him/his/himself/Mr.
bluemanedhawk.github.io
Bitches stole my whole ass ␔🭖᷿᪳𝼗᷍⏧𒒫𐻾ࣛ↉�⃣ quoted-printable, can't
have shit in Thunderbird 😩