Subject: Cancel Messages: Frequently Asked Questions, Part 1/3 (v1.1)
Supersedes: <4i2705$kdt@vixen.cso.uiuc.edu>
Date: 25 Mar 1996 18:17:21 GMT
Summary: This is a list of Frequently Asked Question about cancel messages
. on Usenet.  It mainly discusses how cancels work, who issues 
. them, their history, and what to do about them.  It is more of
. a general purpose FAQ than anything else; it's not required 
. reading anywhere, just more of a reference.

Posting-Frequency: monthly
Last-modified: 1996/03/18
Version: 1.1
URL: http://www.uiuc.edu/ph/www/tskirvin/cancel.html

Cancel Messages 
Frequently Asked Questions
Part 1/3

This document contains information about cancel messages on Usenet, such
as who is allowed to use them, how they operate, what to do if your
message is cancelled, and the like.  It does not contain detailed 
instructions on how to cancel a third party's posts.  It is not intended 
to be a fully technical document; its audience is the average Usenet user, 
up to a mid-level administrator.

This document is not meant to be a comprehensive explanation of Usenet
protocols, or of Usenet itself, but a basic knowledge of these concepts
is assumed.  Please refer to news.announce.newusers, RFC1036, and/or
RFC1036bis if you wish to learn them.

Disclaimers: The information contained within is potentially hazardous;
applying it without the permission of your news administrator may cause
the revocation of your account, civil action against you, and even the
possibility of criminal lawsuits.  The author of this document is in no 
way liable for misuse of the information contained within, nor is he in
any way responsible for damages related to the use or accuracy of the
information.  Proceed at your own risk.


Table of Contents..> = In other parts of the FAQ
=================
I. What are cancel messages?
   A. What are cancel messages?
   B. Are cancel messages the only way to delete a message?
   C. Where can I find cancel messages?
   D. Who is generally allowed to issue cancels?
   E. Why are cancel messages allowed?
   F. How are they issued?
   G. How do I cancel my own post?
   H. Who decided on these rules?
II. How do cancels work?
   A. What is control?  control.cancel?  How do I receive them?
   B. What standards are there for cancelling posts?
   C. What is the format of a cancel message?
   D. Do all news sites accept all forms of cancels?
   E. How do I alias out a pseudosite?
III. So your post was cancelled...
   A. Why was my post cancelled?
   B. I have the cancel message right in front of me.  Why was it cancelled?
   C. But I wasn't doing anything wrong!  Why was it cancelled?
   D. Look, pal, I said I wasn't doing anything wrong, and I meant it.  I
    didn't break any rules that I can see.  *Why was my post cancelled?*
   E. *sigh* Then what do I do about it?
>IV. What does it take to cancel messages?
>V. That idiot forge-cancelled my posts!
>VI. What moral issues are involved with cancel messages?
>VII. What's going to happen to cancels in the future?
>VIII. What about these other things?

>Changes
>To Do
>Contributors
>Pointers



I. What are cancel messages?
============================
 A. What are cancel messages?

.Cancel messages are a specialized form of message to Usenet
that, when they arrive at a server, request that the post bearing the 
Message-ID contained within be deleted.  In essence, a cancel message,
if heeded, cancels another post.  Hence the name.  


 B. Are cancel messages the only way to delete a message?

.No.  Usenet is transitory; not every message will be on all news
servers at all times.  In fact, cancels are fairly rare; the cause of a
missing message is very rarely a cancel.

.First of all, it takes some period of time for a message to
propagate to all news servers that wish to carry the message.  This is
inherent in the Usenet system; messages take time to arrive.  In some
cases, they do not arrive at all.  

.More commonly, messages are deleted after a certain period of
time, in order to save on hard drive space.  This period of time varies
depending on a variety of issues, including the newsgroups the message
was posted to, the size of the article, the author of the article, and
so forth.  This is the most common cause for missing posts, as it
happens on all news servers, and is not consistent.

.As time goes on, the software has been begun to be changed.  A
current trend is to have the news transport software automatically drop
all messages with more than a certain number of groups in the headers,
ranging from five to fifteen or more; this varies by site, and you
should ask your news administrators for details.

.Finally, there are more specific causes for missing messages.
Your message may have been replaced by another post using a Supersedes:
header; your news administrators may be running NoCeM, which selectively
deletes posts when used on a server level; etc.  Ask your administrators
for more information about your system's policies, expirations times, and
so forth.

.If your post is missing, do not instantly assume that your
message was cancelled.  A good rule of thumb is "no cancel message, no
cancel"; if you can find the cancel, then your post was probably
cancelled.  


 C. Where can I find cancel messages?

.As you must have a cancel message to show that your message was
cancelled, it is a good idea to know where to look for them.  The best
answer, in the short term, is to search control for the cancel (see
section II.A. for details); if you are unable to find them there, the
Usenet search engines may be able to help.  Using Dejanews (http://www.
dejanews.com) or AltaVista (http://www.altavista.digital.com), a search
for your email address and the string 'cancel' will turn up most cancel
messages issued for your posts.


 D. Who is generally allowed to issue cancels?

.In general terms, the only people that are always authorized to
issue cancels for a message are the original author of the message and
the postmaster at the site the message was posted from.  However, there
are rules that allow third-party cancels in specific circumstances, such
as group moderation, spam and spew cancellations, article forgeries, and
a few other limited circumstances; those people in charge of these
duties are generally authorized to issue cancels directly relating to
the job.


 E. Why are cancel messages allowed?

.When Usenet was created, cancels were meant to be only issued by
the original poster of a message.  They were implemented so that someone
could take back their words, remove information that was no longer
accurate, replace inaccurate information, and other, similar purposes.

.As time went on, more uses for cancel messages have been found.
Third party cancellations are now generally allowed if they are not
content-based; posting private mail is often more than frowned upon, and
newsgroup voting fraud can be stopped with a forged cancel; in the more
extreme cases, ads to inappropriate groups are cancelled, threads that
are crossposted to too many groups go away, and some even cancel in
order to just disrupt a newsgroup.  This is not to say that this is
accepted; on the contrary, cancelling based on a new criterion is more
than hotly contested.

.RFC1036bis, section 7.1, is the most authoritative list of valid
reasons for cancel messages; the following reasons, however, are
considered valid by virtually all news administrators:

 1. First person cancels are explicitly allowed by the news system.  A
user is *always* authorized to cancel anything that he or she posts, for
any reason.  This includes if they wrote the message on another system.

 2. Second person cancels are performed by those people officially in
charge of a user, ie the person's news administrator.  These, too, are
officially authorized in all circumstances, as are cancellations by a
third-party explicitly authorized by the poster's news admin.

 3. Third person cancels are generally frowned upon, unless they are
found using the following criteria:

  a. Moderator cancels
.The moderator of a newsgroup has absolute authority over that
group.  This includes the issuing of cancels for posts that he or she
did not authorize.  Retro-moderation is a subset of this, in which the
group is moderated only by the issuing of cancel messages; private 
hierarchies are generally considered retro-moderated by the owner of the
group, while the legitimacy of the cancels in more public hierarchies is 
up for debate.  For more information on creating moderated groups, see 
news.groups or news.groups.questions.

  b. Spam/EMP cancels
.Spam or EMP, a message posted to Usenet separately multiple times, 
is generally accepted as a major threat to Usenet.  Therefore, anything
posted too many times is automatically cancelled, with no regard to
the content of the post.  Currently, the threshold is 20 posts.  For 
more information, see the news.admin.net-abuse FAQ.

  c. Spew cancels
.Spews are cases where a malfunctioning program either reposts
old messages or posts one message bunches of times; these are virtually
universally accepted as a good use for cancel messages, as they are
fixing a problem caused by some other system.

  d. ECP cancels 
.ECP, or Excessive Cross-Posting, is when a message is posted to
too many groups at the same time.  Much the same as spam cancellations,
if a message is crossposted to too many groups, it will be cancelled
without regard to content.  Currently, the threshold is a BI of 20 (the
BI is "the sum of the square roots of the number of newsgroups in which 
each of the postings appears"); as with information on spam/EMP cancels, 
see the news.admin.net-abuse FAQ for details.

  e. Binaries in a non-binary group
.Much of Usenet does not want binary messages, usually for space
reasons.  To accommodate those that do, the alt.binaries.* and
comp.binaries.* hierarchies were created.  However, there are still some
binary messages posted to various Usenet groups; these are often cancelled 
without regard to content, based on the size of the binary.  For more
information, see news.admin.net-abuse.misc, where the specifics are
being debated.

  f. Forgeries in the user's name
.It has become more and more common for people to post messages
with false attribution lines.  If a message is attributed to a person,
even if they did not post it, they may cancel it.


 F. How are they issued?
.
.Cancel messages are sent out as a standard Usenet post, except
they contain a "Control: cancel <message-ID>" header.  If a system that
accepts cancels receives the message, the post with the specified
message ID is deleted from that system.

.Most major newsreaders allow readers to cancel their own posts
with a key press.  Third-party cancels are more complicated, and must
follow several conventions; please refer to section II.B for details.


 G. How do I cancel my own post?

.Most major newsreaders allow you to cancel your message with a
few keypresses.  To cancel your own post, press the following key
(depending on your newsreader) while reading your message:

Unix 
rn/trn:..'C'... tin:..'D'
gnus-emacs:.'C'... nn:..'C'
pine:..none

Unix/X
xrn:..'Cancel' button
knews:..Post/Cancel Article

PC/WinSock 
Free Agent: .Article/Cancel..
News Xpress:.Article/Cancel Post

PC/OS/2
NR/2:..Article/Cancel

Macintosh
Nuntius:.Articles/Cancel Article
most browsers:.Special/Cancel Message


Web Browsers
Netscape:.Edit/Cancel This Message (version 2.0+ only)
Mosaic:..none
Lynx:..none

.If you know of any new readers that allow cancels, have
corrections to any of the above, or whatever, please mail
tskirvin@uiuc.edu with the information.


 H. Who decided on these rules?

.Usenet is a cooperative venture of many thousands of sites
world-wide.  It was designed with the principle of everyone
communicating together in mind; not much thought was put into security
and the like.

.Each site owns its own machines; that's the fundamental concept
behind the rules.  Each site can decide whether they want to accept
cancels, what sites to accept messages from, and the like.  On this
principle, Usenet can be called a cooperative anarchy.

.In other words, the people that decided on these rules are your
system administrators, and those people that they listen to.  



II. How do cancels work?
========================
 A. What is control?  control.cancel?  How do I receive them?

.control is a pseudo-newsgroup made up of all posts on a news 
system containing the Control: header, which is used to create or delete
newsgroups, perform internal systems checks, cancel posts, and so forth.
It is mostly an administrative convenience.

.On many systems, control is broken up into several components
automatically by the software.  If this is true, there are several
newsgroups: control.newgroup (for the creation of new groups),
control.rmgroup (for the removal thereof), control.cancel (for cancel
messages), and so forth.  If the software is configured this way, cancel
messages will appear in control.cancel.

.All cancels are either recorded in control or in control.cancel,
depending on the software used by your news server.  If a post was 
cancelled recently, a record of the cancel *will* be in here; if there 
is no cancel in this group, there was no cancel.  In addition, if
necessary, there are news systems that keep logs of virtually everything
on Usenet, such as DejaNews (http://www.dejanews.com) and Alta Vista
(http://www.altavista.digital.com).

.If you cannot read control or control.cancel, ask your news
administrator.


 B. What standards are there for cancelling posts?

.When cancelling your own post, the only standards are the
software requirements.  Third-party cancels, however, have certain
standards that should be followed.

.There are three main reasons for following these standards when
using third-party cancels.  First is to identify the canceller, which
gives the practice accountability.  The second is to make sure that a 
particular message is only cancelled once.  Finally, some news 
administrators would rather not accept certain cancels, and a standard 
will allow them to opt out of the system.

.The first standard is simple to fulfill; all legitimate third-
party cancels include an "X-Cancelled-By:" header, containing the email
address of the canceller.  

.The second problem is solved much more creatively.  The $alz
convention (named after Richard Salz, the creator of INN), specifies 
that the message ID for a cancel message prepend the message ID of the 
original message with the string "cancel.".  For example:

Original Message ID:..<48u6e8$lqi@vixen.cso.uiuc.edu>
  Cancel Message ID:..<cancel.48u6e8$lqi@vixen.cso.uiuc.edu>

.The third problem, that of sites wanting to opt out certain
types of cancels, can be solved by adding certain "pseudo-sites" to the
path of the cancel; if a particular site wishes to not accept cancels
of that type, they can alias out that pseudo-site.  For information on
how to do this, see section II.E.

.The commonly accepted pseudo-sites are as follows:

cyberspam!usenet.Spam/EMP cancels (universal)
spewcancel!usenet.Spew cancels
mmfcancel!usenet.Make.Money.Fast cancels
bincancel!usenet.Binary (in a non-Binary group) cancels
adcancel!usenet..Ad cancels (for the biz.* hierarchy only)
retromod!usenet..Retro-Moderation cancels

.The !usenet part denotes that something must come after that
part of the path; it is not strictly necessary.  Multiple pseudo-sites
can be used in one message.


 C. What is the format of a cancel message?
.
.Here's an example, a spam cancel by Chris Lewis, that follows
all of the standard conventions (reformatted to fit the screen):
--
Path: vixen.cso.uiuc.edu!newsfeed.internetmci.com!in1.uu.net!corpgate!
  crchh327.rich.bnr.ca!nrchh45.rich.nt.com!bcarh8ac.bnr.ca!ferret.ocunix.
  on.ca!cyberspam!not-for-mail
Date: 22 Jan 1996 09:35:33 EST
From: pspoole@hiwaay.net (Patrick Poole)
Newsgroups: soc.culture.african
Message-ID: <cancel.4dsl4o$lm4@parlor.hiwaay.net>
Control: cancel <4dsl4o$lm4@parlor.hiwaay.net>
Subject: cmsg cancel <4dsl4o$lm4@parlor.hiwaay.net>
Approved: clewis@ferret.ocunix.on.ca
X-Cancelled-By: clewis@ferret.ocunix.on.ca
Lines: 3

EMP/ECP (aka SPAM) cancelled by clewis@ferret.ocunix.on.ca.

See news.admin.net-abuse.announce, report 19960122.06 for further details
--


 D. Do all news sites accept cancels?

.No.  Many news sites have decided that, for whatever reason,
they do not want cancels; others merely do not want certain types of
cancels.  

.(When/if Dave Hayes ever gets a web page up for dropping cancels
and such, I'll include it here.)


 E. How do I alias out a pseudosite?

.Under garden-variety INN, it is difficult to alias out a site.
Dave Barr, however, maintains the unofficial releases of INN; INNunoff3
and beyond (availible at http://www.math.psu.edu/barr/INN.html) include 
a "shun" patch, which aliases out individual sites.
.
.*The following information is untested!  Try at your own risk!*

.Under CNews, edit your sysfile at the following line:

ME/cyberspam,spewcancel:  [standard acceptance groups/distributions]

.This should make the system believe that the pseudosiutes
'cyberspam' and 'spewcancel' are you, and it will not take messages with
them in the path.

.(If anyone's got information for other systems, I'd love to 
include it.)



III. So your post was cancelled...
==================================
 A. Why was my post cancelled?

.It probably wasn't.

.It's very, *very* likely that you post was not cancelled.  If you 
can't find a copy of the cancel in control, it probably wasn't cancelled.  
Check the expiry times on your site, check whether your newsreader junks 
read posts, and check control.cancel before complaining about somebody 
forging a cancel for your post.


 B. I have the cancel message right in front of me.  Why was it cancelled?

.Most cancels nowadays are for cleanup of various forms of
net-abuse.  If you posted your message to too many places, or too many
times, it will generally be cancelled, regardless of the content of the
post.

.For details about what is cancelled and why, read news.admin.
net-abuse.misc, or check the news.admin.net-abuse FAQ.  Also, if you
received a mail on the subject from a spam cancellers, read it
carefully; it should probably explain why your message was cancelled.


 C. But I wasn't doing anything wrong!  Why was it cancelled?

.There's still legitimate reasons beyond official net-abuse to
cancel posts.  The moderator of a moderated newsgroup is permitted to
cancel messages in his newsgroup that he did not approve.  Individual 
newsgroups and hierarchies may have rules permitting them to cancel 
messages posted there; this applies especially to local hierarchies 
and non-Big 8/alt.* hierarchies.  Your post may have unintentionally 
met the searching criteria for the auto-cancel of a continuing spam;
contact the canceller in this case.  Your postmaster may have decided 
that they didn't like your post; if this is really a problem, I 
recommend that you get a new service provider.  


 D. Look, pal, I said I wasn't doing anything wrong, and I meant it.  I
  didn't break any rules that I can see.  *Why was my post cancelled?*

.I don't know.


 E. *sigh* Then what do I do about it?

.Post about it to news.admin.net-abuse.misc.  Make sure to
include the full headers and text of the cancel, an explanation of what
the article was about, and any possible motives for the cancelling that 
you can think of.  The administrators there will, if you're polite, try 
to help.

.For more information, read section V.

--
Copyright 1996, Tim Skirvin.  All rights reserved.
http://www.uiuc.edu/ph/www/tskirvin/cancel.html
