Subject: RE: [Asrg] RE: 2a. Blacklists, collateral damage and anonymity

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 5 May 2004 13:24:06 -0700

> Let us say I block mail from certain network blocks, depending ov
> criteria of my choosing.
> This step is definitely not illegal.
> 
> I choose to share this information with the world via a DNS based
> mechanism. Not illegal.

If you do so for the purpose of interferring with a contract or
legitimate commerce you just crossed the line here.

The fact you publish means that you expect the information to 
be read and acted on.

> It is not a question of what *you* wish to believe in. Just 
> to clarify a
> point, I would trust the anonymous maintainer(s) of SPEWS 
> before I trust
> Verisign (ref: the false certificates issued to people claiming to be 
> Microsoft). As yet, SPEWS has not given me justification to 
> withdraw my
> trust. Verisign has.

Lets see, that was one incident out of about 400,000 certs issued each year.

The error was picked up by VeriSign and the certificate was immediately
revoked. It was VeriSign who reported the issue to Microsoft. The cert
expired several years ago and has not actually been used as far as anyone is
aware.

You can't stop people from making mistakes. You can develop processes that
detect them and correct them. In the case of the CA center procedures a
check that was believed to have been interlocked was not. That coding error
has since been corrected. But even if the error had not been corrected the
error rate of the CA center would be better than five nines which is
exceptional for a process that is human operated.

I don't think you can seriously claim that your comparison to SPEWS is
anything other than partisan.

> 
> > If blacklists are going to demand accountability they must accept
> > accountability - from all parties they affect, not just the 
> ones they
> > choose.
> Given that the service is optional and free, I doubt that 
> accountability to anyone else is even a question.

If you affect someone the courts may decide to hold you accountable
to them.

> > I do not believe that it should be legal for a public service ISP to
> > use any anonymous blacklist service to filter customer's mail.

> Is there a contract guarantee that email will be delivered? 

There is an expctation. I suspect that it is currently legal to use
an anonymous blacklist, but I don't think it should be legal for anyone
other than the mailbox owner to do so. 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 5 May 2004 16:49:34 -0400 (EDT)

> legitimate commerce you just crossed the line here.

It can't possibly be my _purpose_ to interfere with a contract I don't
even know exists.

Nor would I be attempting to "interfere with legitimate commerce" (who
gets to define "legitimate" anyway?)  Only the mx-server owner has the
ability to choose whether to accept or reject email.

> The fact you publish means that you expect the information to 

Even I don't think there's anybody actually stupid enough to act on my
(still hypothetical) noprimes blacklist.  I intend to publish it just
because I feel like publishing it, to prove the point that I can
publish it.

> Lets see, that was one incident out of about 400,000 certs issued

How many domains have been hijacked because your company screwed up?

What happened to the domain after the screwup was revealed?

It was Verisign who paid lots of lawyers to beat up small companies
with a contract that says "We're not responsible if we screw up."

> If you affect someone the courts may decide to hold you accountable

What puts Verisign above the law, then?

> There is an expctation.

When somebody bought running.com, he had an _expectation_ that it
would be registered to him.  Verisign screwed up.  How much did it pay
to compensate him for violating his expectation?

> I suspect that it is currently legal to use an anonymous blacklist,
> but I don't think it should be legal for anyone other than the
> mailbox owner to do so.

Then you should move to a country that doesn't have the US
Constitution's freedom to contract.

Seth

---

From: Devdas Bhagat <[email-masked]>
Date: Thu, 6 May 2004 02:51:04 +0530

> legitimate commerce you just crossed the line here.
Uh? How different is it if I publish a list of IP addresses from which I
do not accept email?
I run more than one server, using DNS is a convinient way for me to
ensure that all these see the same readonly data.

> The fact you publish means that you expect the information to 
Read, possibly. Acted on, not in my expectations. I only claim the right
to speech. I do not claim the right to make anyone else hear my speech,
or to act on it.

<snip>
> anything other than partisan.
Not really. I do not trust Verisign. I trust SPEWS *until* such time as
they betray my trust.
 
> If you affect someone the courts may decide to hold you accountable
Is a DNSBL affecting anyone? Not in any way that I see it.

> other than the mailbox owner to do so. 
Actually, unless specified otherwise, I would say it is for the MX onwer
to do so.

Devdas Bhagat