Experimental Physics and
Industrial Control System

"J. Lewis Muir via Tech-talk" <tech-talk at aps.anl.gov> · Mon, 4 Mar 2024 12:24:03 -0600

On 03/04, Johnson, Andrew N. wrote:
> The uldefense URL wrappers are now being added to all messages sent to the tech-talk at aps.anl.gov list from outside of Argonne. I have no control over them, that's due to a recent DOE mandate and not something that the Argonne security people are at liberty to remove AFAIK. Messages from inside Argonne may not have the wrapper added though, thus I am able to post the canonical URLs from my @anl.gov account without them being "decorated". I don't like that discrimination either, but can't easily do anything about it:
> 
>   *   https://urldefense.us/v3/__https://github.com/epics-modules/sequencer/__;!!G_uCfscf7eWS!aqDA6zvmQZ5CErsAB-GS-40Ax46iG6Vq5XVnpAsOxu07S06x2oK6smS7fXUchoM3HOsxBpKHwCQpebKjpb1zTg$ 
>   *   https://urldefense.us/v3/__https://epics-modules.github.io/sequencer/__;!!G_uCfscf7eWS!aqDA6zvmQZ5CErsAB-GS-40Ax46iG6Vq5XVnpAsOxu07S06x2oK6smS7fXUchoM3HOsxBpKHwCQpebLZYP91zA$ 

Hi, Andrew!

Wow, so ridiculous.  It seems to me that the intention of whatever DOE
mandate would be to try to protect DOE employees who receive emails,
in which case, the change to the email should be made before being
delivered to each employee's email *inbox*, not before being resent by a
mailing list.  Mailing lists should clearly be excluded.

In the case of Tech-Talk and other EPICS-related mailing lists, the
recipients are from, or affiliated with organizations from, all
over the world, or not affiliated at all.  And who knows what each
recipient's relationship is with urldefense.us.  Maybe they don't trust
urldefense.us, in which case, maybe they'll block emails containing
urldefense.us URLs, or perhaps wrap them in a different URL so that then
they have two layers of wrappers.

And on top of that, you still have all these recipients likely visiting
urldefense.us, which if anything, could be considered a privacy
concern.  And who pays for hosting urldefense.us and the accesses to it?
Presumably it's a vendor with whom ANL has a contract.  But does the
vendor know that they're now "protecting" non-DOE employees around the
world?  This is just brain-dead.

> The only way to avoid this would be to move the tech-talk list outside of the anl.gov domain, i.e. change the list address and set up replacement infrastructure to manage the list and its archive.

If the change can't be restricted to messages delivered to individual
employee's email inboxes, then sadly, I'd vote for moving outside of
anl.gov...not that my vote counts for much.

Thanks!

Lewis

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System