Subject: [Asrg] RE: claims about law

From: "Tom Thomson" <[email-masked]>
Date: Fri, 7 Mar 2003 11:12:15 -0000

>   3.4. The likely endgame for this behaviour is to force senders of
>   unwanted bulk e-mail to stop lying about who they are, which is
>   illegal in meatspace anyway

Why spoil what might otherwise be a fairly decent piece of work with a
blatantly nonsensical claim like this?  In the UK, the only time I am
required to identify myself as the publisher of something is when I publish
election literature for a local, national, or European government election
(plus cases where an identity of the publisher is inherently part of the
publication, such as certain legal notices).  Apart from that I am permitted
to publish what I like anonymously (provided I can find the
technical/financial/physical means to do so, of course). Do you think the UK
is not part of meatspace? How about the other common-law countries where the
law on identity is much the same as in the UK (including most if not all
states of the US, I believe)?  Are they also not part of meatspace?

As long as you make nonsense claims like that I for one may well be unable
to take you seriously and may simply disregard any statement you make that I
can't check from personal knowledge; after all you have demonstrated to me
that you are happy to make clearly counter-factual statements in support of
your case.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Tom Thomson" <[email-masked]>
Date: Fri, 7 Mar 2003 11:47:47 -0000

> > On top of that DNSSEC presumes a PKI, which as we've seen over the
> > last 5 years is a hard thing to deploy in and of itself.
>
> Also untrue.
>
>
> 		Phill

Well, we all already knew Phill believed that PKI is easily deployable and
he knows that a lot of people disagree with him about it.  This isn't really
the place to restart the wars about PKI models and methods of deployment and
models of business/trust.  But couldn't the company of which Phill is so
prominent an employee make PKI deployment a lot easier (i) by voluntarily
accepting some liability to third parties who rely on keys which it
certifies and (ii) by publishing repudiation lists in a far more public
manner?  I realise that (i) is a commercial rather than a technical issue so
it's not really proper to address that to Phill, but surely (ii) falls
within his remit?

Personally, I wish DNSSEC were fully deployed out there.  I suspect there
are two reasons it isn't:  laziness and vested interests.  The latter we can
probably overcome, but laziness will delay deployment for a very long time.

However, using some DNS capability to get better validation of the Mail From
component of a DMTP envelope doesn't require full deployment of DNSSEC, or
of PKI.  We can get some gain without that, and we need to determine whether
the gain is big enough in relation to the cost.

The questions we have to ask for reducing spam with something involving DNS
changes are (a) what proportion of DNSs will implement it and (b) what
proportion of spam is produced by people technically competent to bypass it.
The answers depend on whether you are using DNS as a key server or to serve
RMX records.

If you use it for RMX records, my answer to (a) is "close to zero, at least
in the short to medium term" and my answer to (b) is "it will kill off the
idiot amateurs and cause the professional spammers some minor inconvenience
in the short term until they build a work-around".  If you use DNS to
provide keys, my answer for (a) remains the same and my answer to (b) is
only marginally better than for the RMX case (because the answer to (a)
pretty well forces the answer to (b)).

My answers could be wrong, of course - and unlike some contributors to this
debate I am not going to accuse people who think they are wrong of
attempting to destroy this rg.  Certainly if DNSSEC were already fully
deployed that would change both my answers (wide deployment of DNSSEC would
indicate that the general laziness of sysadmins had somehow evaporated, and
would reduce the scope for spoofng DNS enormously).

---

From: Hadmut Danisch <[email-masked]>
Date: Fri, 7 Mar 2003 12:56:08 +0100

On Fri, Mar 07, 2003 at 11:12:15AM -0000, Tom Thomson wrote:
> 
> In the UK, the only time I am

Brrrr, in the UK you don't need to identify yourself anymore at all,
because whereever you go every step is observated by at least 5 
video cameras and your face ist automatically identified. So no 
need to bother yourself with an additional and redundant identification...

</sarcasm>

Hadmut

---

From: Troy Rollo <[email-masked]>
Date: Sat, 08 Mar 2003 08:08:58 +1100

At 11:12 7/03/03 +0000, Tom Thomson wrote:
>publication, such as certain legal notices).

There is a difference between mere anonymity and actual misrepresentation 
as to identity. Misrepresentation as to identity may constitute the torts 
of deceit (if it causes damage to a person who relies on the 
misrepresentation to their detriment), passing off (if it causes a person 
to believe the product is being offered by an unrelated business), or 
defamation (if it represents that another person or business is the 
spammer). If done in trade or commerce, any misrepresentation, even an 
inadvertent one, may be illegal without more under fair trading statutes. 
If an intentional misrepresentation (that is, a deception) is made with the 
intention of making a financial gain by that misrepresentation, it may be a 
criminal offence under statutes supplementing the law of larceny. The use 
of the domain name of another where the domain name reflects the holder's 
trademark may be illegal under trademark statutes.

Some of these have even been successfully tested in relation to fraudulent 
misidentification by spammers.

--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE