Subject: [Asrg] Re: 3b. SMTP Verification - Reputation Systems and their Problems (Modified by Anne P. Mitchell, Esq.)

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Thu, 4 Mar 2004 11:01:44 -0800

Oops...1000 apologies - resent with proper subject line:

>> why would any proposed=20
>> reputation or accrediation systems of the future be any different?

We're getting a great deal of positive response to our IADB (ISIPP 
Accreditation Database) even though we haven't publicly announced it 
yet (if you are not familiar with it you can read about it at 
http://www.isipp.com/iadb.php).  What are the problems you feel are 
innate to DNS blocklists which you feel are also ported to DNSWLs or 
other non-block DNS lists?

Anne

Anne P. Mitchell, Esq.
President/CEO
Institute for Spam and Internet Public Policy
Professor of Law, Lincoln Law School of SJ

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 4 Mar 2004 21:30:54 +0100

On Thu, Mar 04, 2004 at 11:01:44AM -0800, Anne P. Mitchell, Esq. wrote:
> Accreditation Database)

I'm sure you get them especially for
    C. FEES ASSOCIATED WITH LISTING IN IADB
and about
    PLEASE NOTE THAT IADB IS A PRIVATE SYSTEM, AND APPROVAL IS NOT
    GUARANTEED. FINAL DECISION FOR INCLUSION IN IADB IS AT THE
    DISCRETION OF ISIPP.

How about:
   where the definition of "spam" is that generally understood in the
   email sending and receiving industries, and includes unsolicited
   commercial and bulk email.
if this RG has revealed one thing very clearly than that there is no
such thing as a 'generally understood definition of "spam"'.

We don't need another company that tries to centralize a service, take
money for it and then tries to play god with fluky rules.

Thanks, but no thanks.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Thu, 4 Mar 2004 12:38:19 -0800

>     GUARANTEED. FINAL DECISION FOR INCLUSION IN IADB IS AT THE

To what are you objecting here (if anything?)  If we are going to do 
things like background checks, reference checks, confirming 
bricks-and-mortar address, maintain the list, keep vigilent as to 
listees, are you saying we should do that for free?  And further, 
should it *not* be the people listed therein, the senders, who provide 
those fees?

I'm just not sure to what you are objecting.

The reservation of decision is *terribly* important, so that we don't 
get a big fat spammer who techinically can say that they meet the other 
requirements, so that therefore we *have* to list them (you wouldn't 
want that, would you?)

> such thing as a 'generally understood definition of "spam"'.

Right, which is why we cover it *both* ways - we spell out "unsolicited 
commercial and bulk email", but we *also* have wiggle room so, again, a 
big ole' spammer can't come along and say "hey, this isn't *really* 
unsolicited" - but if there are legitimate spam complaints, well, that 
sure falls within the "generally understood definition of "spam"".   If 
it walks, smells, and quacks like spam, it's likely spam, and this goes 
directly back to our reservation of rights.

> money for it and then tries to play god with fluky rules.

Clearly you're thinking of my *previous* employer. :-b

Anne

Anne P. Mitchell, Esq.
President/CEO

---

From: Daniel Feenberg <[email-masked]>
Date: Fri, 5 Mar 2004 07:20:59 -0500 (EST)

> money for it and then tries to play god with fluky rules.

There is a difference between "centralized" and "cooperative". There is
nothing in the plan that I can see that suggests that they should be the
only service of this type, nor do I see any liklihood that any reciepient
would want to reject mail simply because the sender is not on the list. We
have many lists of bad hosts maintained cooperatively and used by multiple
mail systems. It is hardly surprising or improper for lists of
well-behaved systems to be offered in a similar manner. 

NSI had their monopoly handed to them by an inattentive government agency.
These guys will have to earn their market share - a completely different
matter.

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 5 Mar 2004 18:54:36 +0100

> I'm just not sure to what you are objecting.

I am objecting that "FINAL DECISION FOR INCLUSION IN IADB IS AT THE
DISCRETION OF ISIPP" and not whether it depends on successful passing
of the criteria. With the above sentence, even if I am the honest
man in the whole Internet it is up to your good will to be added to
the database or not.

> requirements, so that therefore we *have* to list them (you wouldn't 

If you can't find any definitive term to nail him down and separate him
from the "good guys" than this is a problem with the terms.
I will NEVER trust any system that depends on the good will of some
people and that backs up goodwill decisions with their terms of service.

> directly back to our reservation of rights.

Our abuse department receives spam complaints even for double opt-in
announcement/newsletter mailinglists of our customers for which *I
guarantee* that the only way to get an address on that list is with
double opt-in (with crypto support -> ezmlm).
Our abuse department receives spam complaints where people use a "service"
to get added to Internet lotteries and receive double opt-in confirmations
because the "service" always checks the "send me your newsletter" flag.
They claim that this is spam and unwanted.

How much time and money per complaint are you willing to spend to
investigate these cases? Are you going to hire interpreters if I am your
client (we're located in Germany) and you get complaints about "spam"
in German? Or are you making simple decisions based on your reservation
of rights?

> Clearly you're thinking of my *previous* employer. :-b

No, I only said we don't need another company with the above ambitions.

	\Maex

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 05 Mar 2004 14:39:35 -0500

> Oops...1000 apologies - resent with proper subject line:

NP :)

>>> why would any proposed
> Accreditation Database) even though we haven't publicly announced it yet 
> (if you are not familiar with it you can read about it at 

Allow me to explain. There are multiple problems with reputation and 
accreditation systems, virtually all of which are non-technical in 
nature. There are a few technical problems as well: suspectibility to 
DDOS attacks unless the database is distributed and not centralized, 
whether automatic testing for things like open relays is foolproof, 
problems with protocols, etc. However I want to concentrate on the 
non-technical issues.

There are multiple types of reputation and accreditation systems (please 
feel free to correct anything). At the most basic, a reputation system 
provides information about a given organization, MTA, IP, ISP, etc. such 
as how long has this system been an MTA, average amount of outgoing 
email per day, etc. This information is not biased towards or away from 
blacklisting, but rather is provided as simply a source of statistical 
data to be used. This is similar to the statistical data provided by a 
credit agency on a credit report in the US about the accounts a person 
has, amount of credit, average balance, etc. The closest example of this 
today is SenderBase.

Then we have the various blacklist reputation systems which provide 
negative information such as this IP is an open relay, this IP is a 
spammer, this ISP hosts spammers, etc. This is the most prevalent type 
today, examples abound (SPEWS, MAPS, etc.). A real world example of this 
would be a credir agency reporting negative data about a person such as 
bankruptcy, bad credit, collections, etc. Human or community-based 
systems such as SpamCop or CloudMark would fall into this category as well.

Now we also have whitelist systems which are not reputation systems per 
se, but rather are accreditation systems. They allow parties with 
otherwise bad or unknown reputation such as new providers, IP blocks 
reassigned from spammers, email that would otherwise be caught by a 
filter, etc. to be accredited as good guys. Examples of this are 
BondedSender and your IADB. An example of this in the real world would 
be a person with bad or unknown credit coming to get a loan, and 
bringing along a letter of reference or a letter vouching for him from a 
trusted third party.

I am not saying that they are used specifically by bad guys or people 
with bad prior reputation, but the main purpose of accreditation systems 
is whitelisting email that might not get through otherwise.

There are also differences how different types of systems are managed - 
some are based on automated testing of open relays and such (SpamHaus's 
XBL, MAPS RSS and OPS, etc.), others are based on spam reports from 
people or community (SpamCop, Cloudmark, etc.), yet many are also based 
specifically on human reports and decisions by operators (SpamHaus 
ROKSO, SPEWS, etc.). The SMTP VERIFY subgroup has also discussed other 
posibilities such as reputation based on "web of trust".

The major problem with all of these is management rather than the 
technical details. Let me go through these:

1. Statistical systems - for these there are several problems. First 
problem is accuracy - the data collected by the system must be accurate 
and in order to assure that the collection process needs to be done in a 
  statistically sound matter. In particular, such system needs to cover 
a statistically significant percentage of email traffic to be accurate. 
Second, problem with statistical systems is lack of openness - the 
collection process and internal management practices must be open for 
public scrutiny and preferablly audited on a regular basis by an 
independent third party. This will preclude the operators from skewing 
the data based on their own motives. Third problem, is the "tyranny by 
the mob" - a statistical system must be able to account for the 
possibility of multiple reporting systems ganging up together and 
reporting false data in order to destroy someone's reputation. The 
fourth problem is legal, which I am not sure if it would apply. Anne, as 
a lawyer is more qualified to answer whether such statistical systems 
are likely to get sued. The fifth problem is whether such systems raise 
the bar for new MTAs on the Internet.

2. Blacklist reputation services - there are multiple problems which 
vary depending on how the list is managed. The main problem common to 
all of these is lack of open procedures about how things get added to 
the list, how long they stay on and how they can be taken off. Another 
big problem is lack of review or any kind of appeal process unlike the 
credit agencies in the US which was my real world example. There are 
also subtle differences between management types - human and community 
based systems are suspectible to the "tyranny by the mob" problem 
described above, automated systems need to deal with dynamic IPs and 
clarify the length of time spend on list and re-testing intervals (AOL 
retests once a day, not all BLs do), some BL operators tend to list 
others on the same block or ISP causing collateral damage, etc. Legal 
issues very much apply here as we saw from the various lawsuits 
surrounding blacklists. Also, in many cases blacklist operators are 
making a decision based on their beliefs which might not the same as the 
beliefs of their users. Many ISPs would rather make the decision 
themselves if they had access to the raw data that the BL operators had. 
That raw data in many cases is not exposed, or cannot be provided in an 
automated form. Lack of any appeal process, especially with SPEWS is a 
big problem as well. Lack of openness in BL operations is an issue. No 
third party audit or review to let us know that the BL operators are 
following their guidelines.

3. Whitelist and Accreditation services - less problems than others and 
more subtle. The main issue is one of a gatekeeper - if a small set of 
whitelists or one is choosen by many large ISPs, that whitelist 
effectively becomes the gatekeeper for the email system - "power 
corrupts, absolute power corrups absolutely". In order to counteract 
that, whitelists need to be very open and auditable by third parties. Of 
course, currently since we do not have too many of those, it's pretty 
earlier to say that, but the issue is important to keep in mind. DDOS 
issues come to mind as well.

In practice it is impossible for an average spam filter to utilize data 
from too many reputation systems, and therefore it is expected that only 
a few will be choosen. That would mean we must be careful with whitelist 
services to make sure that they do not raise the barrier of entry to the 
Internet community.

Yakov

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Fri, 5 Mar 2004 11:50:59 -0800

On Mar 5, 2004, at 11:39 AM, Yakov Shafranovich wrote:

> with bad prior reputation, but the main purpose of accreditation 
> systems is whitelisting email that might not get through otherwise.

I'm going to excise this out and answer this specifically, because so 
much of the rest of your reply is predicated on this premise.

That is not what an accreditation system (necessarily) is, and it's not 
what IADB is.  IADB is very specifically _not_ a whitelist (nor a 
blocklist) - it is, if you will, a colour-neutral list, whicih provides 
you with very specific datapoints.  It's a companion to a 
sender-authentication check.  Taking an accreditation check (such as to 
IADB) along with a sender identity check you know:

a)  who the sender is
b)  that they really are who they say they are
c)  that the source IP address is consistent with whom they say they 
are, and
c)  that they have been found to meet a certain set of standards

The real world example of an accreditation is Underwriters Labs, or the 
Good Housekeeping Seal of Approval.  Or that certificate in an elevator 
saying it has been inspected on such-and-such a date.
Or a school being accredited.

All of these, like a listing in IADB, say "the product bearing this 
accreditation has been proven to meet a certain set of standards as 
determined by the accrediting body."

It's your choice to determine what that means to you;  I know very few 
people who would accept any of the above, *alone*, as the reason to 
choose the particular product, or accept the particular email.  There 
are plenty of schools which are accredited to which I would not send my 
dog, let alone my child.  Likewise plenty of products bearing the UL 
label which I would not take if you paid me, let alone spend money on.

But taken as a datapoint, matched up with other datapoints (in this 
case sender i.d., lack of presence in a blocklist - whatever criteria 
*you* choose), it's very useful.

It is, if you will, reputation once removed.  If you trust Underwriters 
Lab then you take their seal at face value to mean "this product passes 
UL's requirements to bear this seal".  If you trust ISIPP, then you 
take a listing in the IADB at face value to mean "this sender meets the 
ISIPP criteria".

Anne

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 05 Mar 2004 15:30:46 -0500

> much of the rest of your reply is predicated on this premise.

Thank you for the clarifications.

....
> But taken as a datapoint, matched up with other datapoints (in this case 
> sender i.d., lack of presence in a blocklist - whatever criteria *you* 
> choose), it's very useful.
> 
> UL's requirements to bear this seal".  If you trust ISIPP, then you take 
> a listing in the IADB at face value to mean "this sender meets the ISIPP 
> criteria".

Thank you very much for the clarifications. In my example, I used a 
letter of reference from a third party as a real world example which 
goes well with the example you are giving here of "reputation once removed".

I guess I would say that my concern is not with the accreditation 
concept itself but rather with how it is used. I agree with you that 
accreditation by itself is not bad if it is used properly, but what 
concerns me is a parallel to blacklists. Many blacklists say that you 
should not use them as the only source of information, but many ISPs 
ignore that and do it anyway. What I am afraid of is the same happening 
with with accreditation.

But I must say that I do not see this problem as significant with as it 
is with blacklists, especially in light of your comment about schools 
above. People will err on the side of caution in the anti-spam world, 
and they will never trust anyone fully for whitelisting, even you (of 
course it depends on how the major ISPs use it - if the big ISPs 
suddenly start using IADB as a single criteria for whitelisting, it 
changes things but that's not your problem). So, the likehood of a 
single whitelist system becoming trusted by a large percentage of the 
Internet is less likely than a blacklist.

Having said that, my original question is more relevant to blacklists 
and statistical systems - with any form of identity and reputation 
system, how can we prevent the same problems that haunt today's blacklists?

Yakov

---

From: Markus Stumpf <[email-masked]>
Date: Sat, 6 Mar 2004 02:35:15 +0100

> nothing in the plan that I can see that suggests that they should be the

Where on the web site do you find the word "cooperative"?
All I can detect has the "centralized" direction, like in
    ADDITIONAL REQUIREMENTS FOR LISTING OF ORGANIZATIONS NOT PERSONALLY
    KNOWN TO ISIPP (NON-VOUCHED LISTINGS)

And I surely don't want a service that has worldwide operating ambitions
and that is dependant on US law (I wouldn't like to have one that solely
is dependant on German law, either, no antiamericanism here).

> These guys will have to earn their market share - a completely different

And as soon as you have 4 or 5 of them you'd have to register with all
of them.
Just like with new TLDs which you have to register your trademark with,
if you don't want to loose it (in some countries) or want to risk that
some nerd registers e.g. ibm.biz and puts up a "homepage" with "you all
suck" on it.

In June we had this mega thread about "Mark McCarron" and his "solution
to spam" which was pretty close and a bit more strictly than the ISIPP
Accreditation Database and IIRC not one on this list thought it was a
good idea. Such a database has to be neutral with unemotional terms.

And it has to be free of political influences of one country.
And what will happen, if that country decides that each and everyone from
another country is suddenly untrusted, because the whole other country
is a big danger for the security of the homeland and politically or
through legislation forces the database to remove all the entries
of entities from this specific bad country from their database? Is the
reputation these entities have bought from an organisation like the
ISIPP then suddenly non existant? Do they get their money back? Will the
organisation immediately shut down their service because they (IMHO)
failed? And if not, what is then the worth of such a service?

This is nothing personal against ISIPP, but I think databases like 
IADB are inappropriate and they trick users into a trust situation that
they can't provide.
It's a bit like the "Thawte Secure Site" seal. They encourage https sites
to put it on their pages (and of course make advertising for them).
But the drawback is that people start to think as they see the seal
that the site is a "good" one. So if you are a "bad" one you can add
the seal and people will think they're save.
So basically with the seal Thawte - surely without deliberateness -
tricks the people in a trust feeling they can't control and into
(wrong) trust situations they can't provide.
	
	\Maex

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 5 Mar 2004 21:06:44 -0500 (EST)

> of the criteria.

Who is supposed to determine that "successful passing of the
criteria"?  Do you want whoever that is to be sued by some spammer who
thinks he found a loophole?

> With the above sentence, even if I am the honest man in the whole
> Internet it is up to your good will to be added to the database or
> not.

That's absolutely right.  If mailserver admins don't think they're
doing a good enough job, then mailservers won't be configured to care
about what they say, and they'll be irrelevant.  If mailserver admins
think they (the admins) get benefit by using ISIPP's list, then
they'll use it.

If you think you can provide a better list, go ahead.  Nobody is
claiming to own the concept of a list.

> from the "good guys" than this is a problem with the terms.

If you think you can find the most clever person in the world (so that
nobody else can ever find loopholes in her terms), I wish you luck in
the search.

> people and that backs up goodwill decisions with their terms of

So don't trust it.  Your toys, your rules.  If your users don't like
the way you run your mailserver, including your decisions about who to
trust, they'll become your ex-users.  I see no problem either way.

> investigate these cases?

As much as they feel is warranted.  Again, if you think you can do a
better job, go ahead and do it.  If the mailadmins agree that yours is
better, nobody will use theirs.

[another message]

>    KNOWN TO ISIPP (NON-VOUCHED LISTINGS)

What makes you think there's anything centralized?  It's _one_
organization.  There should be as many such as people care to create.

> And I surely don't want a service that has worldwide operating
> ambitions and that is dependant on US law (I wouldn't like to have
> one that solely is dependant on German law, either, no
> antiamericanism here).

Any service is dependent on its local law.  If you don't want to use
it, then don't.  Nobody says you have to.

> And as soon as you have 4 or 5 of them you'd have to register with all

Why?  You're making assumptions about the way mailserver admins will
operate, which are completely unwarranted.  We have no way of knowing
how they'll act.

> Just like with new TLDs which you have to register your trademark
> with, if you don't want to loose it (in some countries) or want to
> risk that some nerd registers e.g. ibm.biz and puts up a "homepage"
> with "you all suck" on it.

I suppose you need to buy accounts with every ISP in the world so you
can have the Markus.Stumpf@<every ISP> just in case somebody else
might get that userid and say silly things from it, too.

> And it has to be free of political influences of one country.

I don't mind if you run yours from Mars.

> And what will happen, if that country decides that each and everyone
> from another country is suddenly untrusted, because the whole other
> country is a big danger for the security of the homeland and
> politically or through legislation forces the database to remove all
> the entries of entities from this specific bad country from their
> database?

Then the services running from that country will lose a lot of
credibility elsewhere in the world, and their competitors in other
countries will gain (relative) credibility.

> Is the reputation these entities have bought from an organisation
> like the ISIPP then suddenly non existant? Do they get their money
> back?

Depends on the contract (as voluntarily agreed to by both sides).

> Will the organisation immediately shut down their service because
> they (IMHO) failed?

I don't see any organization other than your shutting down because in
_your_ opinion they failed.  I have seen organizations
(e.g. anon.penet.fi) shut down because in the opinions of _their
operator_ they failed.

> And if not, what is then the worth of such a service?

That's up to the users.

> IADB are inappropriate and they trick users into a trust situation
> that they can't provide.

Then don't trust them.

Seth

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 08 Mar 2004 11:42:09 -0500

"Anne P. Mitchell, Esq." <[email-masked]> wrote:
> you with very specific datapoints. 

  From reading your web pages about how it works, I disagree.  You
have a particular agenda, and your "accreditation" system is designed
to enforce that agenda.

  This is not to say the agenda is bad, but it's not neutral.

  If you wanted your list to be neutral, you would also list spammers.
If they claim to send large volumes of spam, and they can be verified
to do so, then they should be listed on a "colour-neutral" list.  You
won't list spammers, so your service isn't neutral.

  The point is not to stop spammers by publishing accreditation
information for non-spammers.  That just won't work.  The point is to
enforce consistency between claims and actions, no matter what those
claims and actions are.  By instead enforcing an agenda, you bias the
service, and make it less useful for everyone.

> Or a school being accredited.

  UL will accredit electronic devices that are useless, so long as
they are safe.  This is the model which has permitted them to be
consistently percieved to be unbiased.  You can by garbage with a UL
seal, and know that it may not do anything, but it won't burn down
your house.

> determined by the accrediting body."

  Your standards are clear.  You are not publishing accredication, you
are attempting to enforce compliance with your agenda.  That's OK, but
it's not an accreditation service.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 08 Mar 2004 11:51:29 -0500

> double opt-in (with crypto support -> ezmlm).

  Exactly.  Even for your own double opt-in customers, a percentage of
your messages are viewed as spam.  This means you are a spammer, at
least so far as they're concerned.  This isn't necessarily a bad
thing, as it shows us what we've been missing in the design of most
anti-spam systems.

  Any anti-spam system that lists you as a spammer because of such
customer reports, and refuses to allow you to participate in it
because of that label, is WRONG.  It's design is wrong, it's
implementation is wrong, and it's intent is wrong.  Such a system
cannot be trusted.  Witness the cross-listing of blacklists, due to
political weener-size arguments.  Those blacklists lost HUGE
credibility when they listed people that most did not view as
spammers.

  If we are to win the war against spam, we must co-opt the spammers.

  To put it another way, if we DON'T include the spammers in a system,
they *you* won't be included, either, because of your customers
issues.  I don't think you would like that.

  Alan DeKok.

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 8 Mar 2004 18:59:50 +0100

On Fri, Mar 05, 2004 at 09:06:44PM -0500, Seth Breidbart wrote:
> criteria"?

The process of being added to the list is indepedent of successfully
passing the terms listed.
It is "if we don't like your face we might not add you".

> claiming to own the concept of a list.

I didn't say it is a bad list.
I said such kind of lists are a bad thing in general. So why do you
think I'd be interested in operating "a better one"?

> nobody else can ever find loopholes in her terms), I wish you luck in

Isn't that a funny thing?
They're going to give reputation for something they can't define? 
Isn't it like "company XYZ is one of the good guys, whatever they might
be doing".

> As much as they feel is warranted.

No, they claim giving reputation. So if they want someone to believe them
they have to post rules they'll abide to. Just like VeriSign, Thawte,
Geotrust and all the other are giving some kind of reputation: they have
checked a list of facts and they certify that these facts are correct
according to their revision.
At the moment the IADB warrants nothing.

> Again, if you think you can do a

Look, I feel like in a sandbox.
If I say something critical I get from you "nae nae nae ... do it better".
But there is nothing to be done better, because, as I said, IMHO such
kind of lists are an error in general. And I am writing this to share my
opinions with other people and to make them think about it.
So I am not interested in your "nae nae nae ... do it better" whatever.

> Any service is dependent on its local law.

No it is not.

> If you don't want to use

If you want to use it do it, where is your problem? But tell us why you
want to use it?

> operate, which are completely unwarranted.  We have no way of knowing

Don't say "we" if you mean "I". The experience of block lists gave
enough examples, so for /me/ I am knowing enough. And I know enough
so called "mailserver admins" to know how they operate.

> might get that userid and say silly things from it, too.

No, because Markus.Stumpf@<any ISP> does not have the same legal implications
trademarks (and not using them) have. And Joe Luser will not
try to reach me just by typing "Markus.Stumpf@<any ISP>" as an email
address, but zillions of clueless journalists have told the Joe Lusers
out there for nearly ten years now that the DNS is a search engine and
Joe Luser is naive enough to think that using  porsche.biz  (or
porsche.ctld) will really get him where he thinks.

> countries will gain (relative) credibility.

Most Joe Luser Mailadmins will not even notice. I see the DNS queries
of a lot of mailservers run by customers. Monkeys.com DNSBLs are out of
order for some months now, but queries for them continue and that is
really an easy thing to recognize that they don't work any more.
Changes in the operation of a reputation database are hard to recognize
without tracking the terms of service all the time.
Oh and you really think they'll run around and tell everyone what some
secret service guys told them they have to do?

> (e.g. anon.penet.fi) shut down because in the opinions of _their

So what? I am asking what their opinions would be in such a case and
whether they'll think they have failed.

> Then don't trust them.

I don't. So what's your problem?
I am simply listing pitfalls that arise from trusting in those kind of
lists.

With all that contra arguments of yours where is your argument "pro"
such a list? That's what I am missing all the way through your email.

	\Maex

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 8 Mar 2004 13:15:56 -0500 (EST)

> passing the terms listed.

So what is the list supposed to list?  Everybody who asks?  What use
would that be?

Or would it have a notation as to whether or not the list entry
actually passed the criteria?  If so, how would that differ from not
even listing those who didn't (other than it being less likely to be
sued for not mentioning X than for saying "X didn't pass the
criteria")?

> think I'd be interested in operating "a better one"?

Why do you think such lists are bad?  Many people find them useful.

> Isn't it like "company XYZ is one of the good guys, whatever they might

Isn't that exactly how reputation works in the real world?

When X tells me "Y has characteristic A" I filter that through (my
belief in) X's credibility, X's ability to judge characteristic A, and
other knowledge or beliefs I have about Y.

> they have to post rules they'll abide to.

They did.  You're objecting to their rules because you don't feel
they're explicit enough.

> Just like VeriSign, Thawte, Geotrust and all the other are giving
> some kind of reputation: they have checked a list of facts and they
> certify that these facts are correct according to their revision.

Given that several of those are _known_ to lie, of what value is their
certification?

> At the moment the IADB warrants nothing.

If you don't find their list _useful to you_ then don't use it.

If you want the ability to sue them should they be wrong about a
listing, too bad.

> But there is nothing to be done better, because, as I said, IMHO
> such kind of lists are an error in general.

What makes them "an error in general"?  Once again, to some people,
they're _useful_.

>> Any service is dependent on its local law.

Really?  There's some service in some location that can ignore its
local law?  Can you give some examples?

> If you want to use it do it, where is your problem? But tell us why you

I might find that there is a correlation (probably negative) between
their listings and spammers.

> so called "mailserver admins" to know how they operate.

If they all act the same way you clearly don't know very many of them.

> porsche.ctld) will really get him where he thinks.

Zillions of clueless journalists and other idiots who believe them do
not make for intelligent policies.

> Most Joe Luser Mailadmins will not even notice.

Then their customers lose out.  Not my problem.

> such a list?

It might be useful.  I don't know yet; it isn't fully operating, and
I'm not using it.

Seth

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 8 Mar 2004 20:41:20 +0100

> So what is the list supposed to list?  Everybody who asks?  What use

Everybody who asks and conforms to the terms. Yeah I know this terms
are the problems, because "I don't like your face" should not be one
of the terms. The terms should be clear and the decisions should be
possible for everyone to reproduce.

E.g. DNSBLs that have examples of relayed emails are more trustworthy
(at first glance) than those who don't. I am fully aware that these
can be faked, but the records make it reproducible and if I cannot
reproduce the behaviour either the problem is fixed or they might
be telling lies. DNS /blacklists/ also give reputation, even if it is
negative.

> sued for not mentioning X than for saying "X didn't pass the

The problem is that if someone is not listed, they either
a) did not try
b) failed the listed terms
c) had an ugly face
and my problems are that c) is a possibility at all.

> Why do you think such lists are bad?  Many people find them useful.

Because they are not neutral, they have stale entries and the terms
are unclear.
There are days were I receive from mail.<bigisp>.com as much (an more)
spam mails as I receive from mail.<some spammer>.com.
I have never seen mail.<bigisp>.com listed in any spam block lists. Why?
I have never gotten an answer to spam complaints and I don't notice
something is changing.
They are not listed probably because that would cause a lot of
"innocent" users to be punished by false positives. But where is the
difference to mail.<small isp>.com that gets added to the list, just
because one customer had a hacked proxy?

> other knowledge or beliefs I have about Y.

No, not in my experience. I don't believe in "wildcard credibility".
If someone brings a letter as reputation for a job as a programmer and
that letter says "I know he can look at monitors as he worked in a TV
shop and he has a nice face" all I can do is laugh about that but I'll
surely not take that into account for the decision to give him that job.

> They did.  You're objecting to their rules because you don't feel

Agreed ;-)

> Given that several of those are _known_ to lie, of what value is their

It's a matter of trust. But if I really want to I can check it myself.

> If you want the ability to sue them should they be wrong about a

I think it is ridiculous to sue someone because of expressing their
opinion if it is based on facts (like with most RBLs, that's why records
are important).
However if someone expresses their opinion as a public service (and IIRC
is the intent of IADB) then their process of decision should be
reproducible.

> What makes them "an error in general"?  Once again, to some people,

To some people it is useful to drink a whole bottle of Vodka in a few
gulps. To some people it is useful to smoke crack.

> local law?  Can you give some examples?

Sure, services run by the UNO. /If/ there needs to be such a list
it should not depend on the law and influence of one country. We've
seen what happend/happens with IANA and especially ICANN.
There have to be terms of service and as e.g. ICANN is operating for
all countries connected to the Internet and it is ridiculous that
ICANN is subject to the laws of one country pr even state, just because
of the fact that the headquarter is there.

> their listings and spammers.

Ok. And I think they are tricking people into thinking that and that
their terms would also allow a spammer to be added if they like to.
    FINAL DECISION FOR INCLUSION IN IADB IS AT THE DISCRETION OF ISIPP.
without any limitation.

> If they all act the same way you clearly don't know very many of them.

I didn't say I know all ... I said I know enough of them and I didn't
say they all operate the same way.

> not make for intelligent policies.

Right. But they show how easy it is to trick people.

    "All over the place, from the popular culture to the propaganda
     system, there is constant pressure to make people feel that they
     are helpless, that the only role they can have is to ratify decisions
     and to consume."     -- Noam Chomsky

> Then their customers lose out.  Not my problem.

Sure. That's a valid point.
But wasn't our goal to design a system that works for all? Not only
for the 1% (is it that much) of clueful admins who know what they are doing?
It's easy to have (nearly) zero spam: don't accept email from MTAs whose
admins you don't know personally and whom you do not trust to correctly
operate a mailserver. The problem is that as an ISP you will /very/
quickly loose all your customers.

	\Maex