Subject: [Asrg] UCEPROTECT's comment on draft-irtf-asrg-bcp-blacklists-07

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 07:14:50 +0100 (CET)

This is the official statement from the maintainers of the
UCEPROTECT-Network
about this section of your RFC - Draft:

2.2.5.  Conflict of Interest

   Some DNSBLs used for blocking/negative reputation have had a practise
   of requiring fees or donations to charities from the listee for
   delisting.

   It is generally considered entirely appropriate for a DNSBL to charge
   for access to it by its users - the definition of a commercial DNSBL.

   However, the practise of requiring a listee to pay for delisting from
   a negative connotation DNSBL steers perilously close to notions of
   extortion, blackmail or a "protection racket".  Even if such
   accusations are entirely unjustified the practise causes uproar and
   damage to the DNSBLs reputation, if not the entire DNSBL mechanism as
   a whole.  Colloquially, "it smells bad".

   Therefore, negative-connotation DNSBLs MUST not charge fees or
   require donations for delisting or "faster handling", and it is
   RECOMMENDED that such DNSBLs that do charge fees or require donations
   not be used.

We recommend that you remove the complete last sentence, because it reflects

only your personal opinion, how a DNSBL should be operated.

Since you claim the document would be intended to provide guidance to
DNSBL operators so that they may be able to identify what features users 
would be interested in seeing as a part of a high-quality, well-managed
DNSBL,
it is not your business to tell the operators they "MUST NOT" charge 
delisting or "faster handling" fees.
The recommendation that such DNSBLs which are charging for removals
should not be used is a personal opinion and as such it has also no place 
in a guidance which is addressed to DNSBL operators.

The main purpose of a DNSBL is to prevent spam to get delivered to the
users of said DNSBL.

Delistings at UCEPROTECT-Network are free of charge and they happen 
fully automatic 7 days after we have seen the last abuse originating from
listed IPs.
For those that want a manual intervention (expedited express delisting) 
a fee is charged here.

People tend to ignore their faults and most are unwillig to learn from their

faults if it has no or only minor consequences.

This can be shown by checking the histories of many listees at blocklist
that allow free self-removals like the PSBL.

It is not a big deal to find IPs that were removed 40 to 50 times per year
and got relisted at PSBL after 2 or 3 days again.

We at UCEPROTECT-Network made the expirience that people which did
not care about the security of their systems and got abused by spammers
learned an unforgettable lesson by dealing with our removal procedures:

NEVER GO ONLINE AGAIN WITH AN UNSECURE SYSTEM.

They would not have learned that lesson if they would have been able to 
escape from ourlists immediatley free of charge like they did from others.

New listings of formerly listed static IPs are really rare at UCEPROTECT.

So UCEPROTECT was able to educate those former listees to take care
of their systems next time, which clearly prevents futher spam form those
systems.

That is a really important point, which is often not seen by people which
had
never run a public DNSBL.

Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network
http://www.uceprotect.net

---

From: Jose-Marcio Martins da Cruz <[email-masked]>
Date: Sun, 27 Feb 2011 12:22:37 +0100

Claus,

> only your personal opinion, how a DNSBL should be operated.

The same way as all you've said is only a personal opinion coming from a company who is part of the 
"racket protection" community.

Just to counter your arguments, there are many alternative ways to "educate people" without 
"racketing them" : you can make harder and harder to be whitelisted people being frequently 
blacklisted. You could accept to remove immediately people being blacklisted for the first time or 
people who wasn't blacklisted in the last one or two year period...

Otheway, your phrase : "That is a really important point, which is often not seen by people which 
had never run a public DNSBL." and mainly "often not seen by people which had never run a public 
DNSBL.". Well, you surely missed a point as you surely don't know who are all people in this list. I 
consider this a sign of useless arrogance against all of us.

Either way, discussion about this draft took a very long time. You could be there while this was 
discussed. Where were you ? You are free and welcome to participate on all discussions in this list.

Cheers,

José-Marcio

> That is a really important point, which is often not seen by people
> which had
> _______________________________________________
> Asrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/asrg

--

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 16:54:45 +0100 (CET)

Dear Jose-Marcio,

You wrote:

The same way as all you've said is only a personal opinion coming from a
company who is part of the "racket protection" community.

I strongly recommend that you avoid insulting words as "company who is part
of the racket protection community", if you want to be taken serious by me.

Sure my posting also just reflects an opinion, but it is an opinion that is
backed up by UCEPROTECT's broad userbase.
There is IMHO no reason for a discussion about how DNSBL's handle delistings
as long as that is explicit stated into the DNSBL's policy.
We are known to have the most transparent policies and our users exactly
know what they are doing and why they are doing it.
If our users would not agree to our policies, then ourlists would simply not
be used and then we would not have this discussion.

The standard procedure at UCEPROTECT-Blocklists is that a listing
automatically expires free of charge 7 days after we have seen the last
abusive action originating from a listed IP.
Different to that, the optional immediate expedited express delisting
requires manual work to be done, which is not offered free of charge by us. 

In our jurisdication one is free to charge for services offered, so it is
neither racketeering nor extortion if we are charging listees for freely
chosen optional services.
No one is forcing listees to order an expedited express delisting. They
could simply fix their problem and wait for the free automatic expiration.

Just to counter your arguments, there are many alternative ways to "educate
people" without "racketing them" : you can make harder and harder to be
whitelisted people being frequently blacklisted. You could accept to remove
immediately people being blacklisted for the first time or people who wasn't
blacklisted in the last one or two year period...

You seem to defend people that were too negligent / incompetent / lazy /
whatever to secure their systems in first place.
Those that get listed in a DNSBL missed to do so and therefore they are
guilty for supporting spammers. It is their own fault, even if most of them
blame others afterwards.

I don't know of any jurisdiction where first-time offenders are explicit 
not subject to prosecution" by the law.
So why should a DNSBL handle first-time offenders like they would be
innocent people? 
Anyway you made a point: It might be a good idea if we would punish
second-time offenders harder than first-time offenders.
I would have no problem to increase listing period by a factor 100 for
second-time offenders, but this was probably not what you wanted me to do
:-)

Otheway, your phrase : "That is a really important point, which is often not
seen by people which had never run a public DNSBL." and mainly "often not
seen by people which had never run a public DNSBL.". Well, you surely missed
a point as you surely don't know who are all people in this list. I consider
this a sign of useless arrogance against all of us.

It is not necessary to know all the people in this list because logic told
me that there can't be many DNSBL-Operators here or they are really inhonest

Otherwise they would have seen and mentioned also a big "Conflict of
interests" at "commercial DNSBLs" in the "draft-irtf-asrg-bcp-blacklists-07
: 
Commercial DNSBLs which charge for usage have real problems to list their
paying customers in situations where a big ISP which is customer of their 
commercial DNSBL" is also a big spammer hoster. 
It was really interesting for me to see that this really big "Conflict of
interests" was not also published in the draft.

Either way, discussion about this draft took a very long time. You could be
there while this was discussed. Where were you ? You are free and welcome to
participate on all discussions in this list.

I found the January changes to the  draft yesterday as our search algorithm
found an article from January 2011 on the listserver which mentioned
UCEPROTECT.
Earlier versions of this draft (V6 and older) were known to me and they didn
t contain such personal biased opinions like the new version.
I did therfore not see any reason to participate in this group earlier.
Drafts of "best practices" and also eventually resulting RFC's MUST ALWAYS
contain pure technical information only and if opinions are mentioned in
them, then they MUST BE neutral.
For this Draft this means it MUST either mention  "Conflicts of interests"
for any kind of DNSBLs or it MUST NOT mention any at all.

Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: Jose-Marcio Martins da Cruz <[email-masked]>
Date: Sun, 27 Feb 2011 17:48:38 +0100

Dear Claus,

Just a small answer...

Claus v. Wolfhausen wrote:
> Dear Jose-Marcio,
> You wrote:
> /The same way as all you've said is only a personal opinion coming from
> a company who is part of the "racket protection" community./
> I strongly recommend that you avoid insulting words as "company who is
> part of the racket protection community", if you want to be taken
> serious by me.

Your post just suggested people here doesn't know what they're talking about... So you looked for 
the same kind of answer. So, let's talk about...

First, I'm not defending lazy/incompetent/... people. I'm just telling that people shall have a 
chance. Accidents may happen, and if it's quite rare...

Also, I'd like just to talk the reasons your mail server rejected my message and how serious they 
are. I suppose my message was rejected by your blacklist...

The rejection message, based on my domain name, points to two lists :

   http://www.blacklistalert.org/?q=[email-masked]

* list.anonwhois.net - well - they say our domain is using anonymous whois. Not sure, but either 
way, how is this related to sending spam ???

Our domain isn't anonymous. Check our website and you'll see what we do. Do a "whois 
mines-paristech.fr" and you'll get all information, name, telephone numbers, ... We're not anonymous.

* apews.org - welll. One MX of our domain (so, in ingoing only mail server) in a site different of 
my one, is in the network 193.49.0.0/19, and all this is blacklisted as it seems it's a dynamic 
range of IP addresses. But... we own the 193.49.22.0/24 subnet. And ALL addresses there have reverse 
DNS declarations and NONE are dynamically assigned.

Either way, none of these reasons are related to sending spam.

I tried to go to your web site and, sure, you ask me to pay to be delisted. !!! No technical reason 
can justify your list to reject our messages.

Now, I'm asking you : do you have any evidence of any of our networks sending spam ?

Surely not !!! And ther's no reason for us to pay you even a single cent to be whitelisted.

No, people at our domain aren't negligent/lazy/incompetent/... (as you said). Your technical staff, 
probably yes.

Sorry, but I can't take you seriously...

Best,

JM

> Sure my posting also just reflects an opinion, but it is an opinion that
> is backed up by UCEPROTECT's broad userbase.
> There is IMHO no reason for a discussion about how DNSBL's handle
> delistings as long as that is explicit stated into the DNSBL's policy.
> If our users would not agree to our policies, then ourlists would simply
> not be used and then we would not have this discussion.
> In our jurisdication one is free to charge for services offered, so it
> is neither racketeering nor extortion if we are charging listees for
> freely chosen optional services.
> /Just to counter your arguments, there are many alternative ways to
> "educate people" without "racketing them" : you can make harder and
> harder to be whitelisted people being frequently blacklisted. You could
> accept to remove immediately people being blacklisted for the first time
> or people who wasn't blacklisted in the last one or two year period.../
> guilty for supporting spammers. It is their own fault, even if most of
> them blame others afterwards.
> "not subject to prosecution" by the law.
> second-time offenders, but this was probably not what you wanted me to
> do :-)
> /Otheway, your phrase : "That is a really important point, which is
> often not seen by people which had never run a public DNSBL." and mainly
> "often not seen by people which had never run a public DNSBL.". Well,
> you surely missed a point as you surely don't know who are all people in
> this list. I consider this a sign of useless arrogance against all of us./
> //
> It is not necessary to know all the people in this list because logic
> told me that there can't be many DNSBL-Operators here or they are really
> inhonest.
> interests" at "commercial DNSBLs" in the
> "draft-irtf-asrg-bcp-blacklists-07":
> Commercial DNSBLs which charge for usage have real problems to list
> their paying customers in situations where a big ISP which is customer
> of their "commercial DNSBL" is also a big spammer hoster.
> It was really interesting for me to see that this really big "Conflict
> of interests" was not also published in the draft.
> /Either way, discussion about this draft took a very long time. You
> could be there while this was discussed. Where were you ? You are free
> and welcome to participate on all discussions in this list./
> I found the January changes to the draft yesterday as our search
> algorithm found an article from January 2011 on the listserver which
> mentioned UCEPROTECT.
> Earlier versions of this draft (V6 and older) were known to me and they
> didn't contain such personal biased opinions like the new version.
> Drafts of "best practices" and also eventually resulting RFC's MUST
> ALWAYS contain pure technical information only and if opinions are
> mentioned in them, then they MUST BE neutral.
> For this Draft this means it MUST either mention "Conflicts of
> interests" for any kind of DNSBLs or it MUST NOT mention any at all.
> Regards
> Claus von Wolfhausen
> Technical Director
> UCEPROTECT-Network

--

---

From: Joe Sniderman <[email-masked]>
Date: Sun, 27 Feb 2011 12:08:01 -0500

> only your personal opinion, how a DNSBL should be operated.

Charging to remove a negative reputation is also more or less equiv to
charging to add a positive reputation (such as a commercial whitelist or
vouching service).  Both have merits, both sometimes smell bad or leave
a bad taste, both are sometimes *incorrectly* termed as "extortion" or
similar.  -1 * -1 == +1 * +1  its the identical adjustment, merely
expressed differently.

If one expression of this type of adjustment is discouraged (ie pay to
delist) so should the equivalent expressions (paid whitelistings,
vouching services, accreditations etc) be discouraged.

That said, it is a business policy decision more than a technical policy
decision, and it does not make sense to recommend one way or the other.

> delisting or "faster handling" fees.

I would tend to agree with you on this.  Particularly, this usage seems
to go against RFC 2119 (section 6) which in relation to key words such
as MUST, MUST NOT, etc, states:

|> 6. Guidance in the use of these Imperatives
|>
|>
|>    Imperatives of the type defined in this memo must be used with care
|>    and sparingly.  In particular, they MUST only be used where it is
|>    actually required for interoperation or to limit behavior which has
|>    potential for causing harm (e.g., limiting retransmisssions)  For
|>    example, they must not be used to try to impose a particular method
|>    on implementors where the method is not required for
|>    interoperability.

Charging for listing/delisting is not an interoperability issue per se,
and "it smells bad" is on not the same type of harm as retransmissions
or similar.

OTOH, the draft does not source BCP 14 / RFC 2119, so perhaps changing
the "MUST" to lowercase "must" or even a lowercase "should" for the sake
of clarity would be an equally good option.

> in a guidance which is addressed to DNSBL operators.

Under the heading of conflict of interest it does make sense to at least
recommend disclosure of such policies, if in place.

Any opportunity for the subject of reputation data to alter that
reputation data by means of payment, could pose a conflict of interest,
and is therefore something of which a DNSxL's users or potential users
should be aware.  As long as users of a DNSxL are fully informed of the
potential conflict of interest, they can make informed decisions as to
the trustworthiness and usefulness (or lack thereof) of the data provided.

-- 
Joe Sniderman <[email-masked]>

---

From: Steve Atkins <[email-masked]>
Date: Sun, 27 Feb 2011 09:15:02 -0800

> similar.  -1 * -1 == +1 * +1  its the identical adjustment, merely

No. Not even a little.

One difference is that in the case of charging to remove a negative
reputation, you have a business incentive to add negative listings
for reasons that are dubious or even entirely false. Look at those
blacklists that charge for removal, and look at the quality of the data.

Another difference is that paying for a positive listing gives you that
positive listing for a well-defined period of time, unless you do something
pretty egregious. Paying for removal of a negative listing doesn't
mean that you won't be relisted a couple of days later (just the opposite,
in some cases - if you pay off $BLACKLIST once they're clear that you're
likely to pay them off again, so repeated relistings can be profitable).

There are many other differences between the two, both philosophical
and operational.

Cheers,
  Steve

---

From: Joe Sniderman <[email-masked]>
Date: Sun, 27 Feb 2011 12:39:14 -0500

On 02/27/2011 12:15 PM, Steve Atkins wrote:
> for reasons that are dubious or even entirely false.

That could equally be applied to whitelists: one could have an incentive
to create bogus reasons for de-whitelisting. Of course doing so would
destroy the credibility of the whitelist. A blacklist doing the same
would destroy its own credibility as well.  Both have the same potential
problems, and potential merits.

More importantly, both provide a business incentive to ignore negative
behavior from a paying customer.  However, that potential conflict of
interest, in both cases is just that: potential.  Disclosure rather than
a "MUST NOT" places that in the open.

> Look at those

AFAIK the only at all major DNSBL that charges for removals charges for
expedited removals only, and thats UCEPROTECT. (am I forgetting one?)
Regardless of what one thinks of their policies, philosophies or
whatever, its quality is pretty decent.  Even their default 7 day wait
is shorter than some free-delist commercial DNSBLs take to reply to a
ticket.

> pretty egregious.

Assuming an honest whitelist, yes.

> Paying for removal of a negative listing doesn't

The assumption there is that the blacklist is likely to be less honest
than the whitelist. As long as both are honest, then the paid removal or
whitelisting is a good thing.  If dishonest, it leads to repeated
listings or alternatively de-whitelistings. It also creates a bias
toward the paying customer, the listee or ex-listee.

> There are many other differences between the two, both philosophical

Yes, the paid-delist blacklist variety tends to focus more on protecting
recipients, the paid-list whitelist variety tends to focus on protecting
senders.

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 20:45:02 +0100 (CET)

Dear Jose-Marcio,
 
>the same kind of answer. So, let's talk about...

It is obvious that *YOU* don't know what you are talking about...:-)
 
>chance. Accidents may happen, and if it's quite rare...

Really?
Hmmm lets think about that and see our actal numbers:

http://stats.uceprotect.net/?page=su

Looks like there were 1,7 Million such "rare" Accidents within the last 7
days?

Sure Accidents can happen but you can also provoke them if you are negligent
/ incompetent / lazy ....
If you are parking your car in front of your house, leaving it unlocked and
let the keys inside,
yes then it is very like that childrens will play with your car and
accidentally manage to kill 
someone with your car... 

But: That would have not been happened if you would have locked your car and
you would 
have taken the keys with you. 

The analogy with the accidently spamming server is the same.
What do you think: How many "Wannabe Admins" are too stupid / lazy /
whatever to lock outgoing
traffic to port 25 universe except the own mailrelay in their firewalls?
These losers don't have to wonder if one of their clients inside get
infected, starts spamming
and is subscribing the Companies natted Mailserver IP into the blocklists of
the world.
They could have prevented it with a single rule in their firewall....

 
 
> way, how is this related to sending spam ???

It is not related to spam, it is related to my decision to not accept emails
from domains listed at anonwhois.org
Hey my server - my rules ....
I reject email form many reasons and that is my personal decision.
 
> mines-paristech.fr" and you'll get all information, name, telephone
numbers, ... We're not anonymous.

I had no reason to mistrust the guys at anonwhois.org until today.
Having a lookup at http://anonwhois.org/lookup.html?check=mines-paristech
fr&submit=submit#
You will find that they say: Protected by takebackprivacy.net 
If you do no longer match their listing criterias then feel free to request
them to remove your domain.
 
>DNS declarations and NONE are dynamically assigned.

APEWS is NOT a criterium on my server.

>Either way, none of these reasons are related to sending spam.

Again: I make the rules on my system - I can reject because of today is
Sunday if that would be my wish ....
A rejection does not necessarily have anything to do with spam.
 
>can justify your list to reject our messages.

Your simply a liar.
I checked the Range http://www.uceprotect.net/en/rblcheck.php?ipr=193.49.22
0
and found it is not listed at UCEPROTECT-Network.
That logically means YOU WERE NOT ASKED for a paid delisting.

That proofs you are a Liar - shame on you.

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: Steve Atkins <[email-masked]>
Date: Sun, 27 Feb 2011 11:49:05 -0800

> That proofs you are a Liar - shame on you.

Please either behave professionally - which includes avoiding libelous accusations, as well as other inflammatory, unprofessional language - or take your conversation to somewhere other than an IRTF mailing list.

Cheers,
  Steve

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 21:02:24 +0100 (CET)

Dear Steve,

You wrote:
>Please either behave professionally - which includes avoiding libelous
accusations, as well as other inflammatory, unprofessional language - or
take your conversation to somewhere other than an IRTF mailing list.

So that means: I have to tolerate being badmouthed? The truth can never be
libel. 
I don't think it was polite nor professional from Jose-Marcio to wrongly
claim that our website would have asked him for a paid expressdelisting,
because he is obviously not even listed.
I don't know where you live, but right here we would call such accusations 
lying".

Regards
Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 21:42:57 +0100 (CET)

Dear Joe,

>problems, and potential merits.

That is absolut correct. 

>a "MUST NOT" places that in the open.

As told before: Also commercial blacklists that charge for usage 
have that potential conflict of interest:
If they take money from an ISP for usage of their blacklist then such a 
blacklist is *VERY* unlike to list that ISP, even if said ISP is harboring
lots
of spammers.

Therefore that complete section 2.2.5.  Conflict of Interest should be 
removed from the draft IMHO.
 
>Expedited removals only, and thats UCEPROTECT. (am I forgetting one?)

That is an *EXCELLENT* point, which those that disagree with our 
policies mostly don't want to see.

And for the accuracy of our lists...
... I guess these numbers measured by an independent company are 
speaking for themselves:

UCEPROTECT-Level 1:
http://www.intra2net.com/en/support/antispam/blacklist
php_dnsbl=RCVD_IN_UCEPROTECT1.html

UCEPROTECT-Level 2:
http://www.intra2net.com/en/support/antispam/blacklist
php_dnsbl=RCVD_IN_UCEPROTECT2.html

UCEPROTECT-Level 3:
http://www.intra2net.com/en/support/antispam/blacklist
php_dnsbl=RCVD_IN_UCEPROTECT3.html

Best Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network