Subject: RE: [Asrg] draft-irtf-asrg-bcp-blacklists-00

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 5 May 2004 06:16:50 -0700

> FWIW I never bought the idea that blacklists were passive and
> therefore completely the act of the person using them. I think that's
> facile and disingenuous.
> 
> Consider other reputation systems, such as credit agencies.
> 
> Sure, a lender chooses to use information provided by a credit agency
> so why blame the credit agency in any case?

How many credit agencies would list every customer of Verizon 
because one customer of Verizon defaulted on a loan?

How many credit agencies would list half the population of spain?
Would a credit agency list Texas because of Enron?

I think it is utterly ludicrous to expect that any document is
going to make it through IESG review on this topic.

Barry is right about plaintifs using the BCP in littigation,
I would also expect to see the IETF drawn into littigation if
it published a BCP that endorsed collateral damage or keeping
the identity of a blacklist secret to avoid littigation.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 05 May 2004 09:50:17 -0400

> the identity of a blacklist secret to avoid littigation.

Can you give an example of any other IETF BCP or any other IETF document 
used in litigation? For example was any ISP ever sued for not following 
guidelines in RFC 3013 (BCP 46) - "Recommended Internet Service Provider 
Security Services and Procedures"?

In any case, at this time this is a research document within the scope 
of the ASRG's charter.

Yakov
--
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Wed, 05 May 2004 09:14:44 -0400

See inline comments

>because one customer of Verizon defaulted on a loan?

The analogy is inapt.  As for loans, Verizon is not an enabler of
the damages caused by its customers'  loan defaults.   It IS an
enabler of their spamming.

>Would a credit agency list Texas because of Enron?

This type of wholesale response is valid and often done even
by government agencies in order to bring pressure on a jurisdiction
to clean up its act.  For example, stringent visa requirements for
nationals of countries lax against terror--essentially a form of
whitelisting.

Indeed your examples seem to support rather than oppose 
blacklisting.

Jeffrey Race

---

From: Matt Sergeant <[email-masked]>
Date: Wed, 5 May 2004 15:35:18 +0100

> Would a credit agency list Texas because of Enron?

Can we (as a group - I don't intend to single Phillip out) stop with 
the bad analogies? We seem to keep filling this list with awful 
analogies to the real world that make no sense whatsoever. The internet 
email system is different.

Examples of bad analogies seen here:

  - SMTP compared to the postal system
  - The internet email system compared to the telephone network
  - Sender-pays compared to cars that run on water
  - Blacklists compared to credit agencies
  - Blacklists compared to restaurant critics

I could probably go on...

Analogies have ceased to be a useful tool, especially on this list. Can 
we stick to reality?

Matt.

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Wed, 05 May 2004 09:53:35 -0400

>Security Services and Procedures"?

It is to desireable and to be expected that courts will in due course rely
on industry practices and standards in adjudicating acceptable
behavior.    We should not be shy of it but instead encourage it.
Approved and deprecated practices are what we need to encourage
and eventually get into the judicial system.  Every industry does this
and it is long past time for ours.   It is nothing to fear.

Regarding 'collateral damage': while the reality of its usefulness is
clear, this discussion usefully points to the possible injurious emotive
overtones.    A more useful phraseology might be that employed
(with a long legal history) in the environmental pollution field.   
Stringent measures against polluters (which is what spam-enablers
are) are well received in public and legally sanctioned.  (See 
some possible wording at <http://www.camblab.com/misc/univ_std.txt>).

Please let everyone be clear that a blacklist does not prevent anyone 
from receiving service.    A blacklist USER prevents service.   A
blacklist author is not injuring anyone.   This extremely important
legal point may have to be highlighted in our documentation.  It
is one reason (among others) why the author of a blacklist
standard is not vulnerable to a claim for damages.

Jeffrey Race

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 5 May 2004 12:27:41 -0400 (EDT)

> because one customer of Verizon defaulted on a loan?

Credit agencies don't "list", they provide information.

If the correlation between "customer of Verizon" and "defaulted" were
high enough, they'd all mention being such a customer.  If it were
considered irrelevant, they wouldn't.

> How many credit agencies would list half the population of spain?

How many insurance companies charge different amounts based on
neighborhood?

> Would a credit agency list Texas because of Enron?

Credit for companies depends on the sovereign, not subdivision.

> going to make it through IESG review on this topic.

Then why are you wasting your time trying to stop it?

> Barry is right about plaintifs using the BCP in littigation,

How about defendants using it?

> the identity of a blacklist secret to avoid littigation.

There's a difference between "not mentioning" and "endorsing".

Seth