Subject: [Asrg] Blacklisted from posting to asrg

From: [email-masked]
Date: Mon, 6 Jun 2005 05:58:18 -0700 (PDT)

Apparently the ASRG chair has decided to blacklist me from posting on my 
primary address as constructive technical critique of his own proposal
and its security weaknesses is not something he can deal with and is good 
enough reason to blacklist one of the largest contributors to ASRG who has 
been here from the beginning (and of course he also failed to mention to 
me or on the list that I was blacklisted from posting to the list).

You're more then welcome to comment now how appropriate this was on or
off the list. But in the mean time I'm going to contact IRTF Chair to get 
this ban removed and request that different list moderorator be assigned.

P.S. Probably would mean you'd have to wait a bit longer to hear about
my paper, which is quite good and likely of interest to many here.
The delay is not my fault obviously.

---
William Leibzon, Elan Networks:
  mailto: [email-masked]
Anti-Spam and Email Security Research Worksite:
  http://www.elan.net/~william/emailsecurity/

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 6 Jun 2005 14:22:22 -0000

Complaints about list adminstration, even if they were correct, are not
appropriate for this or any other IETF/IRTF list.  Please stop.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com

---

From: Bill Cole <[email-masked]>
Date: Mon, 6 Jun 2005 10:44:03 -0400

At 5:58 AM -0700 6/6/05, [email-masked] wrote:
>Apparently the ASRG chair has decided to blacklist me from posting 
>on my primary address as constructive technical critique of his own 
>proposal
>and its security weaknesses is not something he can deal with and is 
>good enough reason to blacklist one of the largest contributors to 
>ASRG who has been here from the beginning (and of course he also 
>failed to mention to me or on the list that I was blacklisted from 
>posting to the list).

On what basis do you believe this?

I see a post from you about BATV on the list yesterday with these headers:

Date: Sat, 4 Jun 2005 11:39:13 -0700 (PDT)
From: "william(at)elan.net" <[email-masked]>
To: John Levine <[email-masked]>
Subject: Re: [Asrg] Re: BATV and SES - was forged bounces
In-Reply-To: <[email-masked]>
Message-ID: <[email-masked]>
References: <[email-masked]>

I also see 2 tests, one from [email-masked]:

Date: Sun, 5 Jun 2005 17:58:57 -0700 (PDT)
From: "william(at)elan.net" <[email-masked]>
To: [email-masked]
Message-ID: <[email-masked]>

  and one from [email-masked], apparently with no From header until it 
was added by the list server:

From: [email-masked]
Date: Mon, 6 Jun 2005 05:54:15 -0700 (PDT)
To: [email-masked]

>off the list. But in the mean time I'm going to contact IRTF Chair 
>to get this ban removed and request that different list moderorator 
>be assigned.

You might want to be sure that there is a 'ban' before you go off 
complaini9ng to anyone about one.

>The delay is not my fault obviously.

Not so obvious from here, given that you've not apparently had any 
problem getting 5 messages delivered to the list from your supposedly 
banned address in the past 60 hours, but might well be having some 
sort of problem knowing that you've had such success in delivery.

-- 
Bill Cole                                  
[email-masked]

---

From: Gadi Evron <[email-masked]>
Date: Mon, 06 Jun 2005 17:48:58 +0200

[email-masked] wrote:
> good enough reason to blacklist one of the largest contributors to ASRG
> who has been here from the beginning (and of course he also failed to
> mention to me or on the list that I was blacklisted from posting to the
> list).

Even if you are right and John is wrong and is an all around bad person,
evading bans is a no-no and you probably earned an entry in a few
people's KILL files. That's a shame.

	Gadi.

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 6 Jun 2005 08:25:29 -0700 (PDT)

On Mon, 6 Jun 2005, Bill Cole wrote:

>> been here from the beginning (and of course he also failed to mention to me 
>> or on the list that I was blacklisted from posting to the list).
>

There was another post made on Saturday that did not reach the list
(der Mouse can verify as it was addressed to him with cc to the list)

I subsequently let John Levine know that there might be a problem
with mail list system when the post did not show up in any of my
accounts, there was no response received. At some point on Sunday
I made a test post to see if it would reach the list, it did not.

On Monday I used another account to see if mail list server is working 
(keep in mind I'm also signed up with yet another account but its
separate system and I wanted to test is in particular for the elan mail 
server to verify it was issue with server or not). That test post reached 
the list immediately. Based on that I had to conclude that the issue is 
specific to posting from [email-masked] account that was banned from 
posting, my view is that there was no inappropriate conduct that would 
have let to it.

In about 5 minutes after posting account was probably unblocked and
my test post reached the list. The other post still did not.

> I see a post from you about BATV on the list yesterday with these headers:

Yesterday is Sunday. The post you cited did reach the list, the other one
did not. I checked archives as well.

> and one from [email-masked], apparently with no From header until it was added 
> by the list server:

That is not true, actually [email-masked] is separate account and it sends
emails with "From: [email-masked]" and no "pretty name", that is how it is 
setup. There are people who would remember that [email-masked] was for 
long time setup the same way (in fact its default way it works on
my mail system, unless name is added as part of MUA preference).

I'll not comment on this issue any more until I get some more info from 
ASRG or IRTF Chairs, but I'd like to note that in his response John Levine 
did not state that my complain that messages from me were being blocked 
is not true. He stated that making such complaints is not appropriate, 
but I seem to recall it happening number of times on other ietf lists.

According to guidelines at thttp://www.ietf.org/maillist.html

  Inappropriate postings to discussion lists include:
   1 Unsolicited bulk e-mail
   2 Discussion of subjects unrelated to IETF policy, meetings, activities,
     or technical concerns
   3 Unprofessional commentary, regardless of the general subject

Mail list administration issues would not fall under 1 or 2 (this is 
related to ietf/irtf activities), it might fall under 3 depending on
how the complaint is written, but I do not see directly where it says
that discussions of list administration problems are not appropriate.
If it is not I apologize if I made wrong judgment about it based on 
apparently bad conduct of people on other ietf lists.

In any case if John wants to explain what happened, he can go ahead
and do it privately to me and I'll withdraw the complaint, but I'd
remind him to keep in mind listed above rule #3 for private as well
as public communication.

P.S. For Gadi Evron - I was not evading. I really did post from
different account that was signed up to the list, using multiple
accounts on the same list is not unusual for me and folks at
ASRG know that.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: der Mouse <[email-masked]>
Date: Mon, 6 Jun 2005 14:00:39 -0400 (EDT)

> (der Mouse can verify as it was addressed to him with cc to the list)

Well, if I'm cited as evidence, I suppose I should squeak up. :-)

This appears to be true.  I see

Message-ID: <[email-masked]>

which came to me direct from elan.net, and as far as I can tell I never
got a copy of it through the list.

*Why* I never got a list copy, I am not in a position to comment on; I
do not have anything to say on that aspect.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 07 Jun 2005 00:01:53 +0200

der Mouse wrote:
 
> I see Message-ID:
> <[email-masked]>

> which came to me direct from elan.net, and as far as I can
> tell I never got a copy of it through the list.

Nor GMaNe, so could somebody who got it (like you ;-) or sent
it (like William) please repost it ?  Desperately trying to
say something on topic:

<http://mid.gmane.org/[email-masked]>

One day after that article I deleted my BATV copy, but if it's
still relevant that was a bad idea.  What's the actual title ?

                          Bye, Frank

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 6 Jun 2005 15:51:02 -0700 (PDT)

On Tue, 7 Jun 2005, Frank Ellermann wrote:

> it (like William) please repost it ?

-------------------------------------------------------------------------

>From [email-masked] Sat Jun  4 13:40:12 2005
Date: Sat, 4 Jun 2005 13:40:12 -0700 (PDT)
From: "william(at)elan.net" <[email-masked]>
To: der Mouse <[email-masked]>
Cc: [email-masked]
Subject: Re: [Asrg] Re: BATV and SES - was forged bounces

On Sat, 4 Jun 2005, der Mouse wrote:

>>> There's two reasons for that.  One is that replay isn't a problem
>>> and isn't likely to be.
>> You don't know it.
>
> "Isn't a problem" - John apparently has experience as a high-profile
> forgery target that says it *isn't* a problem.  Do you have countering
> experience to give?
>
> "Isn't likely to be" - that's a judgement call, but, tentatively, I'd
> certainly be inclined to believe him.  Do you have evidence to the
> contrary?

For both I suspect that John (being the only user of BATV) does not have 
good "generic" data as his operations are very unique in that bounces come
to domain that has substantially no users that directly email from it. 
There is simply no potential for anyone to find data for replay attack!
(nor would anyone try if he's the only one doing BATV)

But I believe that in real-life domains have 95% legitimate bounce rate
and 5% or less might be false with a LOT of users posting a lot more often 
then number of bounces received and MAILFROM would often get exposed and 
will be easy to find and use for replay attack.

>>> It is exceedingly rare to see a deliberately forged bounce, and it
>>> is hard to see a plausible scenario in which bad guys would want to
>>> forge them
>> After being a victim of half a dozen joe-jobs, I disagree.
>
> Forged bounce != bounce of forgery.

Perhaps you do not see that main problem is that its still possible
to forge bounces both just randomly (finding any MAILFROM with
full signature from trace data) and deliberately (looking for such
data for specific person to cause him to receive bounces).

So without replay attack solution, BATV is of limited use, be it
private key or public key based. Same BTW goes for SES.

Unfortunately the very solutions that could stop replay are the ones
that all require database on the sender side (and then using crypto
does not make sense any more) which makes such solution not easily 
scalable. So we're back to the drawing board.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: David Wilson <[email-masked]>
Date: Tue, 07 Jun 2005 13:00:09 +0100

william(at)elan.net wrote:

> server to verify it was issue with server or not). That test post 
> reached the list immediately. Based on that I had to conclude that the 
> issue is specific to posting from [email-masked] account that was 
> banned from posting,

This is an excellent conclusion to make coming from an e-mail 
administrator. I mean, it's not like *anything else* could have caused 
what you describe. I strongly suggest you review the situation and take 
some paranoia tablets. ;)

David.

---

From: David Maxwell <[email-masked]>
Date: Tue, 7 Jun 2005 11:23:24 -0400

> some paranoia tablets. ;)

That would be a fine conclusion normally, but John Levine already has a
history of silently banning people from the ASRG list, without warning
to them, or notice to the list.  c.f. Alan DeKok

It's very disappointing that the leader for an open standards group for
such an important issue doesn't believe in transparency.

-- 
David Maxwell, [email-masked][email-masked] -->
If you don't spend energy getting what you want,
	You'll have to spend it dealing with what you get.
					      - Unknown

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 07 Jun 2005 22:28:30 +0200

David Maxwell wrote:

> a history of silently banning people from the ASRG list,
> without warning to them, or notice to the list

RfC 3934 was published in October last year and adopted by
the SPF-discuss list a.s.a.p.

> c.f. Alan DeKok

The author of the famous LMAP proposal.  Before the evil
empire [meep] its way into IESG and MARID, which was
also the time when the former ASRG cochair Yakov resigned.

What happened with Alan here ?

> It's very disappointing that the leader for an open
> standards group for such an important issue doesn't
> believe in transparency.

List management can be a very difficult business.  And the
traditional style before RfC 3934 was "my list - my rules".

                         Bye, Frank

---

From: David Maxwell <[email-masked]>
Date: Wed, 8 Jun 2005 00:50:42 -0400

> the SPF-discuss list a.s.a.p.

It looks like a reasonable document. The historical events predate it,
however.

> What happened with Alan here ?

I don't intend to rehash it in full here. I'll send you private mail if
you really want to know.

The short version is that one of the few people who was willing to put
some energy into document authoring and implementation consolidation was
rather shamefully treated and then silently banned from this list. The
justifcation for which John claimed to me privately was clearly more
eggregious on the other side of the thread that brought it to a head.

When I pointed this out to John and tried to explain what I was seeing
in private mail, he resorted to calling me a troll. I've felt very
little inclination to post to ASRG since - and have hoped that a
productive forum would arise elsewhere.

> traditional style before RfC 3934 was "my list - my rules".

That's fair enough - however the rules should be public, to the extent
they can be, and consistently applied. Of course extreme measures may be
required - and to maintain order, that's appropriate. However I've seen
the chair apply arbitrary malice, and not even admit that he has done
so when it's pointed out to him.

My original post was all I intended it to be. A confirmation that the
described action might be more likely than it seemed to some, since it
has happened before.

-- 
David Maxwell, [email-masked][email-masked] -->
Net Musing #5: Redundancy in a network doesn't mean two of everything and
half the staff to run it.
					      - Tomas T. Peiser, CET

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 08 Jun 2005 10:14:59 +0200

David Maxwell wrote:

> The short version

Thanks, no bloody details.  Somehow I missed this part of the
history.  In early 2004 I heard about the AOL experiment, came
to the (wrong) conclusion that somebody implemented RMX, joined
this list (at this time it was already almost dead), found the
SPF list later, and when Yakov resigned I could manage simple
tasks like adding 1 and 1, or understand why RMX and SPF are
not precisely identical.

The complex stuff like the "zone cut" took me much longer, and
when I finally got it, it was removed from SPF... ;-)  But if
they ever wanted to invent a DNS crash course only for me then
it was a success story.  Now I can even admire the cute way how
CSV steers clear of the namedroppers (AFAIK invented by John).

> I've felt very little inclination to post to ASRG since - and
> have hoped that a productive forum would arise elsewhere.

All "spam fighters" celebrate the "Life of Brian" - who's our
worst enemy, spammers ?  No, PRA / SPF / CSV / patents / grey-
listing / port 25 blocks / bounces-to / crypto / DKIM / DUL /
SPEWS / RFCI / SURBL / MAPS / SORBS / pick whatever you like,
but not all.
               Tnx for info, bye, Frank
-- 
http://www.ietf.org/internet-drafts/draft-schlitt-spf-classic-02