Re: Hiding originating IP when posting through CLOSED news servers

From: Russ Allbery (rra_at_stanford.edu)
Date: 02/22/04 

Date: Sun, 22 Feb 2004 11:18:00 -0800

In news.software.nntp, Leythos <void@nowhere.com> writes:

> Once you connect to the usenet server, via some means (even 100 hops),
> it can be tracked back to your source.

In theory, yes, going forward, once you know what you're watching for.
Retroactively is another question entirely, depending on the logging
policy of that news server and how soon you get in touch with the
originating server. Even with legal subpoenas, logs get rotated and
deleted and then they're gone.

(Furthermore, not that Mike would do this, there are various illegitimate
ways of posting to Usenet that make it highly unlikely anyone will ever be
able to find usable logs that would track down the actual source. Using
open proxies on compromised PCs that don't *keep* any logs, for example.) 

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>
          Please post questions rather than mailing me directly.
     <http://www.eyrie.org/~eagle/faqs/questions.html> explains why.

Relevant Pages