Subject: Re: [Asrg] Assume perfect knowledge by domain registry provisioners, so what?

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 08 May 2003 23:09:19 -0400

>From: David Walker <[email-masked]>
>
>Well I hate to use this as an argument in favor of RMX but it is true (at
>least theoretically).
>
>Assuming a wide implementation of RMX by DNS admins ticked that their domains
>were used as return addresses on spams, the spammers would have to register
>their own junk domains.  If mail admins started rejecting mail from these
>junk domains the spammers would have to register more junk domains.  More
>domains registered = more profit for a domain name registry operator.

Would registering more junk domains mean that the spammer will be spending 
more money on sending spam? Wouldn't eventually that create a big enough 
expense for the spammer which would be comparable with the cost of postage 
for sending a regular letter? That would lead to higher cost of sending 
spam thus reducing the incentive and the overall spam problem. (I cannot 
work out the mathematics in my head right now but I don't think this cost 
will ever get high enough.)

Also, if the ICANN rule about having correct WHOIS information would 
actually be enforced with some kind of fines or penalties, wouldn't that 
force the registrars to have better ID procedures on who actually registers 
domain names thus reducing the overall number of junk domains? This is part 
of the overall economic aspect to spam which needs to be discussed further.

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 09 May 2003 11:31:39 -0400

Yakov Shafranovich <[email-masked]> wrote:
> more money on sending spam?

  When they make millions off of spam, that doesn't matter.

> force the registrars to have better ID procedures ...

  Yes.

  Right now, spammers are traceable to dial-ups, open relays, or
spam-friendly ISP's.  That means in some cases, it's extremely
difficult to track down who's responsible for allowing the spammer to
operate.

  That is, there are fewer domain name registrars than ISP's.  There
are fewer domain name registrars than open proxies, or dial-up users.

  Forcing spammers to register new domains in order to spam means that
the registrars are a central point of control on spammers activities.
This allows registrars to be made accountable to the rest of the
network, for permitting spammers to operate.

  In the extreme case, we could have spammer-only registrars.  People
who don't want to send spam would see that the sender was associated
with a registrar they didn't like, and could refuse the SMTP
transaction.

  Alan DeKok.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 12:03:10 -0400

Mr. DeKok,

I know that our knowledge-bases for registry, and registrar
operational art differs, significantly.

I also know that conveying knowledge or belief of error of fact
or conclusion from me to you is not effective. For instance, a
registrar always seeks to be paid, and is always billed by a
registry, and current payment mechanisms are capable of trace.

Perhaps there is some other activity you could undertake that is
more important to this list than my small little query about the
role of provisioning systems for domain names and non-persistent
emitters, a subset of this problem domain.

Your inattention will be appreciated.

Eric

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 09 May 2003 13:45:24 -0400

> operational art differs, significantly.

  I agree.  I also know that our opinions as to the contents of
technical discussions differ.  You appeal to authority, without using
the evidence by which those authorities gained their reputation.  I
refer to facts and evidence, and base my opinions on those.

> registry, and current payment mechanisms are capable of trace.

  I fail to see how this contradicts, or adds anything to, what I said
in the message you're responding to.

> emitters, a subset of this problem domain.

  I would suggest that you take your "holier than thou" attitude, fold
it until it's all corners, and ingest it an inappropriate manner.

> Your inattention will be appreciated.

  Too bad.  You'll have to suffer through my opinions, until such time
as either I unsubscribe from ASRG, or you choose to install blinders,
and filter any messages I send to the list out of your personal inbox.

  Alan DeKok.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 14:06:03 -0400

> refer to facts and evidence, and base my opinions on those.

Message-Id: <[email-masked]> contains what appears
to be an expression of belief in the utility of "WHOIS rules".

IN the past three years I've talked to ccTLD whois operators, RIR whois
operators, RRP whois operators, EPP whois operators, whois users in the
DMA, my former co-workers at SRI, authors of the series of documents that
end in 954, whois server implementors, whacking big chunks of the entire
ICANN and CDT policy crowds, and it sometimes seems even God herself.

I don't consider whois:43 to be any part of the solution-space. I'll add,
I don't consider CRISP, uwho, and other 954-incompatible :43 mechanisms
to be part of the solution-space. Solutions to, or causes of, some other
problems? Yes. Spam? No.

Maybe you are right. Maybe I am wrong.

> in the message you're responding to.

Message-Id: <[email-masked]> contains the theory
that registrars can be motivated by second-order effects (from the point
of view of a registrar), viz:

	"... registrars to be made accountable to the rest of the
	 network, for permitting spammers to operate."

This appears to overlook the possibility that registrars are motivated
by first-order effects (again, from the point of view of a registrar),
to wit -- non-payment by spammers, non-voidable charges by registries,
and charge-back policies by credit card operators.

Is that clearer? Do you see now that not knowing something impairs your
ability to reason about registrars? I wasn't born knowing what little I
know about registrars, and I'm still making what in hindsight are basic
operational errors (fortunately, so are my peers).

> it until it's all corners, and ingest it an inappropriate manner.

OK.

> and filter any messages I send to the list out of your personal inbox.

The possibility exists that you'll write something useful and intelligent
on how RADIUS can, or cannot, be applied to this problem domain. You may
have other qualities I'm simply unaware of, which are relevent to this
list.

Eric

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 09 May 2003 14:50:22 -0400

> to be part of the solution-space. Solutions to, or causes of, some other

  I never said that I believed them to be part of the solution space.
I insinuated that we may *choose* to make them part of the solution
space.  If there are good reasons for not making that choice, I am
prepared to accept those reasons, and to accept that whois:43 is not
part of the solution space.

  Before posting my comments on ASRG, I had seen few reasons given on
the list as to why whois:43 could not be part of the solution space.
Please understand that I'm not an expert in all possible domains which
intersect the spam problem, and that I've never claimed to be an
all-knowing expert.

  However, please also understand that any post to the list which
rules out a particular solution MUST ALWAYS be backed up with
evidence.  Simply saying "I'm an expert, you're wrong" is a system
solely designed to waste everyone's time.

> 	 network, for permitting spammers to operate."

  Which is a very careful misquote:

https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg04540.html

  "Forcing spammers to register new domains in order to spam means
   that the registrars are a central point of control on spammers
   activities.  This allows registrars to be made accountable ... "
                     ^^^^^^

  Forgive me for not adding an explicit "if we so choose" to the end
of that statement.  The key word, which you carefully quoted around is
"allows".  I did NOT say "requires", or "demands", as you appear to
have taken it to say.

  I'm sorry that you are interested in deliberately misconstruing what
I say, and are deliberately putting the most negative possible
interpretation on my statements.

> and charge-back policies by credit card operators.

  Ah.  So when I fail to mention all possible motivations, and all
possible effects of spammer-registrar interaction, I'm "overlooking"
things.

  No thanks.  My statements are meant to be interpreted exactly as
they are written.  No more, no less.

> ability to reason about registrars?

  That much is obvious, and I agree.

  What I'm disappointed in is your negative spin of my statements.
Deliberately misquoting, misconstruing, and misinterpreting what other
people say is a recipe for disaster.

> have other qualities I'm simply unaware of, which are relevent to this

  As for RADIUS, you can be guaranteed that if you, or anyone else
posts dumb ideas about RADIUS to the lists I'm on, that my responses
will be based on references to RFC's, explanations, and other reality
based evidence.  The only time I fall back to appealing to authority
is when people refuse to be educated about a topic, and my response is
"I control the software.  I will do what I believe to be right."

  Alan DeKok.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 17:32:03 -0400

This detour into the inerrancy is a bore.

The question I posed concerned provisioning. Publication is a possible,
but not inevitable consequence of shared registry system provisioning,
whether publication is via 1034/35 or 954 or bulk transfer or ...

I anticipated there would be some Baldrick-responses ("I have a clever
plan") or other non-implementor/non-operator utterences about some bits
of the existing registry systems. Responses that failed to respond to a
technical query -- if all (or most, or some) of the parties involved in
provisioning had a different RRP-or-EPP (possibly a "better" RRP-orEPP),
and had consequently had the ability to collectively "know" about some
spam emitter contemporanious with its discovery (by means tbd), what then?

The point of your note, whether I've very carefully misquoted you or not,
is that you are about 30 days late. Some node has changed state, and is
as of T0 a source, making some references to namespaces. At some time, T1,
it ceases to be a source. The transactions that created the namespaces it
accessed (registry provisioning) took place at some point prior to T0, and
depending on the risk-adversity of the registrar to charge-back costs, as
much as 30 to 45 days prior, or the registrar is out $6+overhead on the
transaction regardless of whether or not anyone gets spammed.

Overlooking the minor problem of time, you claimed that Barry knows, after
operating world since, jeeze how long's it been Barry?, no more than you
do with your few doamin names, and what I know as the (former) chief
propeller-head for .biz, .us (post-IANA), and (currently) IANA RegID 439,
is just idle authority-figure prop-wash. Kwel.

>   "I control the software.  I will do what I believe to be right."

Now that's inspiring.

Eric

---

From: Barry Shein <[email-masked]>
Date: Fri, 9 May 2003 20:53:02 -0400

On May 9, 2003 at 17:32 [email-masked] (Eric Brunner-Williams in Portland Maine) wrote:
 > operating world since, jeeze how long's it been Barry?

See RFC 2235, tho in fact it was several weeks previous.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 09 May 2003 22:18:47 -0400

> See RFC 2235, tho in fact it was several weeks previous.

Dilettant.

I spent _that_ winter in Levanworth. Cold place. Limited opportunities
for recreation. Not much UCE either. San Diego was the only place with
a temperature above freezing (USENIX '89).

Eric

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 10 May 2003 10:39:20 -0400

I thought I had responded before, but the message apparently hasn't
made it to the list.

Eric Brunner-Williams in Portland Maine <[email-masked]> wrote:
> do with your few doamin names,

  I have never claimed that, and I've denied that characterization of
my position both in public and in private.  Yet you still feel it
necessary to repeat the lie.

  I freely admit I do not have as much knowledge as some people about
some topics.  But I also believe that I have just as much right as
they do to participate in a discussion.

  It's apparently that second belief which has you upset, and you're
relying on appeals to authority in an attempt to shut me up.  That's
inappropriate.

  Alan DeKok.

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 10 May 2003 14:38:19 -0400

> But I also believe that I have just as much right as

I think the word you are looking for is contribute, not participate.
There is a means test. After all, the nominal purpose of this list
is something other than personal gratification.

So, on the rather narrow question I've posed, do you have anything to
contribute?

Silence is a contribution, it isn't self-evident that a perfect provisioning
system (overlay of a mesh on the existing star topologies, extension of the
event model from asymetric to symmetric, extension of the connection model
from synchronous stream to asychronous streams) -- which has other use cases,
has a use case arising from any aspect of this problem domain.

Eric

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 9 May 2003 04:16:32 -0400

At 11:09 PM -0400 5/8/03, Yakov Shafranovich wrote:
>Would registering more junk domains mean that the spammer will be 
>spending more money on sending spam? Wouldn't eventually that create 
>a big enough expense for the spammer which would be comparable with 
>the cost of postage for sending a regular letter? That would lead to 
>higher cost of sending spam thus

Given that some spammers already work this way, I would say not. 
Assuming that you post several million (at least) messages per 
domain, and domains cost about $10, I don't think it qualifies as a 
significant expense.

>actually be enforced with some kind of fines or penalties, wouldn't 
>that force the registrars to have better ID procedures on who 
>actually registers domain names thus reducing the overall number of 
>junk domains? This is part of the overall

The question is (as with any identification system), what would you 
do with the information?  Would you block based on physical address? 
And is it really possible for a registrar to validate an address when 
it comes from another part of the world?

There are also some practical considerations.  Unfortunately you 
can't do a whois query on every incoming domain.  The registrars have 
some limit on the number and type of automated queries you can do 
from a single IP address (in part to keep out spammers, but there are 
also general scalability issues).  You could try round-robinning your 
requests, but it turns out the different registrars return different 
formats.  The only real solution is to purchase the entire database 
and do periodic downloads (Network Solutions supposedly sells 
it--although they never responded to our queries--but other 
registrars do).  So while it's a good solution for a spam filtering 
service, it's not really useful as a generic tool.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 10 May 2003 19:48:45 -0400

> domain, and domains cost about $10, I don't think it qualifies as a 

I wouldn't hold overly firmly to a 10^^6 messages per domain, but the principle
is correct. It is 10^^3 cents per domain, assuming we (registrars) are paid at
all. If we are of course, the payment is subject to trace.

> >junk domains? This is part of the overall

Don't expect registrars to seek to absorb someone else's cost of business.

> do with the information?  Would you block based on physical address? 
...

I assume this relates to whois:43 mining abatement. 

> requests, but it turns out the different registrars return different 

For RRP provisioned registries, this is true.

> registrars do).

We are trying to get this removed from the ICANN registrar contract. I'm
happy to provide it -- in hex or binary form, on paper. 

Anyway, let me repeat, this isn't the line of inquery I hoped people would
mull over, this is actually unrelated to the question posed.

Please use another subject line, e.g., "speculating about registrars", than
as a registrar, I can ignore it ;-).

Eric