Subject: RE: [Asrg] draft-irtf-asrg-bcp-blacklists-00

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 4 May 2004 13:35:36 -0700

> Looking at the BCP draft makes me feel like I'm watching a bunch of
> cub scouts propose how to deal with Al Qaeda.

It is not clear to me whether you mean that the cub scouts are
the blacklists and the spammers Al Qaeda or the cub scouts are
the ASRG and the blacklists are Al Qaeda. Hyperbole asside,
either could be justified.

One of the most depressing things about the current situation 
is the posturing of people who think that their macho attitudes 
make them hawks.

The point about 'collateral damage' is not that it serves any
strategic purpose, it does not, all it does is to feed the egos
of the people who engage in it. It fails in the spam context
for the same reason that it failled in the military context.
Collateral damage forces parties who are natural allies to treat
you as the enemy.

There is a utility in certain very narrowly tailored blacklists.
But they should never attempt to list any address for any other 
reason than it is a source of spam.

		Phill 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter Bowyer" <[email-masked]>
Date: Tue, 4 May 2004 22:03:41 +0100

> reason than it is a source of spam.

No - there's room for blacklists with differing policies. What's important
is for those policies to be published and adhered to, so that users can
choose which ones they want to use. Which is where we came in, I think.....

Peter

--
Peter Bowyer - Freelance Technical Architect and Writer
peter <at> bowyer.org

---

From: Devdas Bhagat <[email-masked]>
Date: Wed, 5 May 2004 02:39:00 +0530

On 04/05/04 13:35 -0700, Hallam-Baker, Phillip wrote:
<snip>
> Collateral damage forces parties who are natural allies to treat
Collateral damage is a bad choice of terms. DNSBLs are *passive*
systems. Choosing to block mail from any system based on a random
criterion is the choice of the administrator of the blocking system.

Rather than trying to stop the spammer, people using the escalated
blocks are trying to stop the spam supporting ISP from sending them
email. Rather than allowing the ISP to keep the spammers money as well
as that of the legitimate users, the people using escalated listings are
forcing a choice of what customers the ISP wishes to keep. 

"We aren't blocking you, we are blocking your spammer supporting ISP" is
a rather frequent refrain among SPEWS users (to take an extreme
example), or among users of blackholes.us (yet another extreme example).

By funding the spammer supporting ISP, those people being termed as
collateral damage are showing an opinion in favour of the ISPs
behaviour. Other administrators choose to disapprove of this and boycott
those email originators until they fix their problems.

> reason than it is a source of spam.
What happens when the ISP in question refuses to remove the spammer(s)
and you keep getting hit by their traffic?
Think of it as a trade embargo, and it makes a lot more sense.

Devdas Bhagat

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Tue, 04 May 2004 16:54:10 -0400

>reason than it is a source of spam.

This is perfectly stated if "address" is replaced by "address range of a spam-enabler".

The record clearly shows that many, even most, internet participants voluntarily 
cooperate in preventing pollution.  However there are some operators who
profit from pollution and will only be moved by being hurt.  See
<http://www.camblab.com/nugget/spam_03.pdf>

Jeffrey Race

---

From: Barry Shein <[email-masked]>
Date: Tue, 4 May 2004 18:10:19 -0400

Well, Phillip, you're fine until you mistake moral confusion for moral
superiority; tolerating the intolerant is not noble.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Barry Shein <[email-masked]>
Date: Tue, 4 May 2004 18:48:00 -0400

The more I think about it the more I consider any codification of
blacklists into an IETF-blessed document as questionable.

I think of blacklists more like random, desparate acts by desparate
people than a technology.

There's just something so institutionalizing about producing a best
common practices document around blacklists.

Ok let's back up a bit.

If we think of them as reputation systems, like credit agencies, then
there's a lot of liability implied by codifying them. Suddenly there's
a checklist to compare against for acceptable behavior.

If we think of them as a kind of centrally administered boycott then
it's practically a grassroots political kind of activity. Is that kind
of thing often codified in IETF docs? Would the IETF produce, e.g.,
BCPs for running Wikis or Blogs?

But more to the first point, is there any opportunity to run something
like this BCP past a knowledgeable lawyer for some reaction in the
context I'm raising?

I dunno, what happens when one of these spambags does sue and then
uses this BCP document to argue that the blacklist operator harmed
him/her/it by their egregiously unprofessional behavior as defined by
the IETF? Is this document really meant to be used like that? Isn't
that a potential use of any BCP?

Does anyone worry about this kind of thing? I do.

In the same vein, I'm having a lot of trouble understanding what good
it does anyone (other than perhaps a plaintiff against a blacklist
operator) since it mostly just codifies "be excellent to each other!"
in a sort of idealistic way.

-- 
        -Barry Shein

---

From: Daniel Feenberg <[email-masked]>
Date: Tue, 4 May 2004 19:22:33 -0400 (EDT)

Essentially everyting in the BCP is a quality issue addressing concerns of
senders that mail might be blocked. There are few/no issues of
interoperability/protocol addressed which might require a standards
document beyond the description of host name formation, and IP address
flags returned. 

It isn't clear to me why sender concerns are the only quality issues
addressed. If the BCP states that listings "MUST" be removed promptly,
shouldn't it also state that spammers "MUST" be added to the list
promptly? That is a similar issue with respect to the quality of a
blacklist, yet it goes unmentioned. Or perhaps quality issues should be
left to users to evaluate with respect to their own needs.

If the document is to be used as evidence of trade practice in court, it
might be nice if it included rationales for common practices such as
failure to consult the sender, or give him time to respond, to blocking
nearby addresses, to skepticism about claims of "opt-in" or "opt-out". If
the document does not mention, explain and endorse those procedures
necessary to run an effective blocklist, it plays into the hands of the
spammer population.

Daniel Feenberg

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 04 May 2004 19:36:55 -0400

> BCPs for running Wikis or Blogs?

I am not addressing the political aspect of your question, only the 
blogs/wikis one. Blacklists are used on an Internet-wide scale between 
multiple systems, and can be within the scope of the IETF. Blogs and 
Wikis generally do not interoperate with other systems and are not 
necessarly in scope. However, the inter-system parts of the blogs such 
as RSS may be within IETF scope as demonstrated by the existance of the 
ATOM list at IMC.

HOWEVER, in any case this document is not at IETF level at this point. 
Right now it is a research activity of the IRTF, and appears to be well 
within the charter of this group. Whether this document actually makes 
it to the IETF, and gets approved by the IESG is an entirely different 
story. At this time, it fits within the charter of the ASRG.

Yakov
--
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)

---

From: Bill Cole <[email-masked]>
Date: Wed, 5 May 2004 22:20:23 -0400

At 1:35 PM -0700 5/4/04, Hallam-Baker, Phillip wrote:
[...]
>Collateral damage forces parties who are natural allies to treat

Unfortunately, there is some evidence to the contrary. Lurk in 
news.admin.net-abuse.blocklisting for a bit and note the Verio and 
ev1.net behavior (among others). It seems that some providers have 
decided that the collateral damage (a bad term actually, as the 
original refers to *unintentional* destruction) is more than they 
will tolerate, and so they react as soon as there is any.

>reason than it is a source of spam.

Speaking from the point of view of actually working with some 
heavily-spammed mail systems, I think that is wrong unless you 
include  a very loose definition of 'is a source of spam' that 
encompasses 'is a member of a logical set of addresses far more 
likely to sources of spam than to ever offer a single piece of 
legitimate mail to unacquainted networks.'  Generally speaking, I'm 
thinking of the lists that have evolved from the original concept of 
a dialup list, still generally referred to as 'dynamic address' lists 
but that's a misleading name. The real unifying element is not 
whether addresses move from user to user in those ranges, but that 
the providers (RoadRunner, SBC, Cox, Telefonica, Wanadoo, UPC, 
Comcast etc) are selling service at such a low price that they 
attract customers incapable of securing their own machines while the 
providers cannot afford to enforce security of any meaningful sort on 
their own networks. In short: networks where there is no competent 
authority. In some cases (e.g. the many ranges of SBC DSL space that 
they they SWIP with 'PPPoX Pool' in the CustName field) it is rather 
easy to identify likely sources of spam and other sorts of bad 
behavior, and blacklisting such blocks before each individual address 
has been abused is a very useful tactic with negative side effects 
that most sites will never encounter.

Another example: AOL is rather open about the fact that they try to 
prevent direct SMTP connections to the outside from their customer IP 
space. At times that has been accomplished imperfectly. A blacklist 
with all of that space would mostly have addresses that have never 
sent any spam at all directly to the world at large, and would be 
100% made up of addresses whose legitimate authority says they should 
never be offering anyone mail of any sort.

-- 
Bill Cole
[email-masked]