re the secret source of that announcement in article c uxgv dv panix com habs panix com harry shapiro writes in r om c m slab mtholyoke edu jbotz mtholyoke edu jurgen botz writes even more interesting the smtp server at csrc ncsl nist gov no longer recognizes the expn and vrfy commands telnet csrc ncsl nist gov smtp trying connected to csrc ncsl nist gov escape character is first org sendmail nist ready at tue apr edt expn clipper command unrecognized seems like sombody didn t like your snooping around marc then it is a good thing we already have this the csspub mailing list csspab mail gw ncsl nist gov and address on rest of names deleted sigh my version of rn asked me whether i really want to send this posting you may as well know that all this stuff about the secret source of the clipper announcement is because of a silly mistake i am the administrator of csrc ncsl nist gov alias first org it s a system set up to help out the needs of first a forum of incident response and security teams which includes a number of world wide incident response teams such as cert cc and other places in europe as to the vrfy and expn commands they are normally disabled since early on we didn t want crackers to find out the names of incident response folks on our mailing lists we had a disk crash several months ago which required completely rebuilding the o s files same old story our backups weren t especially helpful as you can guess i didn t remember to re disable vrfy and expn until i saw people on the net trying to find out who was behind clipper csrc when i saw people s names posted here i felt it was time to clear things up so expn and vrfy on csrc have always been disabled in the past for reasons having nothing to do with clipper i posted the white house announcements at the request of policy folks here because csrc also provides usenet service i posted them from an account called clipper i also created an alias called clipper that contains the addresses of members of the nist computer security privacy and advisory board set up under law of the computer security act of and addresses of other individuals not affiliated with nist but involved in cryptography security and privacy i believe that these individuals were included on this list because nist felt it important to get them the clipper information first hand the clipper alias is there for the benefit of those named above it is not a source for information it was set up solely to monitor any initial traffic individuals on the list have requested that they continue to get traffic that is not already duplicated on usenet while you can rightfully say we were a bit disorganized in handling this i would ask that people stop speculating about any hidden agendas or motives of the individuals on the clipper alias i ve already apologized to them for what s happened disabling expn and vrfy is an increasingly common practice albeit unfriendly to some and any effect of disabling it again was unintentional john wack
