Subject: Re: [Asrg] UCEPROTECT's comment on draft-irtf-asrg-bcp-blacklists-07

From: TRBL Support <[email-masked]>
Date: Sun, 27 Feb 2011 09:46:43 -0600

Claus v. Wolfhausen wrote:

> We at UCEPROTECT-Network made the expirience that people which did
> not care about the security of their systems and got abused by spammers
> learned an unforgettable lesson by dealing with our removal procedures:
>
> NEVER GO ONLINE AGAIN WITH AN UNSECURE SYSTEM.
>
> They would not have learned that lesson if they would have been able to
> escape from ourlists immediatley free of charge like they did from others.
>
> New listings of formerly listed static IPs are really rare at UCEPROTECT.
>
> So UCEPROTECT was able to educate those former listees to take care
> of their systems next time, which clearly prevents futher spam form those
> systems.
>
> That is a really important point, which is often not seen by people which had
> never run a public DNSBL.

As a counterpoint, I run a public DNSBL and I agree with the choice of
wording used in the BCP draft. Watching the history of blacklists over
the years, few things have caused more angst and accusations than
requiring a delisting fee. Even SORBS has stopped requiring such a
fee.

I think there are many instances where, when you require a delisting
fee, you set yourself up for accusations that this was a trap you have
led listees into. You signed up for my list just so you can blacklist
me! I think it is wise to avoid this line of discussion and not charge
a fee.

-- 
trblspamtrap dnsbl: http://www.trblspam.com
simple, spamtrap driven, easy on, easy off

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 20:00:35 +0100 (CET)

>requiring a delisting fee. Even SORBS has stopped requiring such a

I never heard of the TRBLSPAM so it is very like to be not widely known. As
a consequence there will not be many users and not many removal requests.
If we at UCEPROTECT would have to handle up to 50 removal request per day,
then we could offer that free of charge, of course.
Unfortunateley we would have to handle between 40000 to 50000 requests per
day, if we would offer immediate removals free of charge.

In UCEPROTECT's early days (August 2001) the project was run on a sub domain
of admins.ws and the blocklists had public "remove me" Buttons, where
listees could remove them self.

As Spammers were beginning to abuse that with automated scripts we did
secure it with a captcha. Then Spammers did hire persons in India and China
to remove their listings manually.

That was the point where UCEPROTECT has chosen to no longer allow "self
removals" and then everyone was required to contact us to get removed before
expiration.

Anyone that has ever run a heavily used public blocklist, has a clue what
this means:
In 2003 we had to read 40000 to 50000 removal request per day, and all these
guys are claiming to be completely innocent, and they all are claiming that
they would have fixed their problems.
Not necessary to say that 90% of them did find their way back into the list
within minutes, because they had indeed NOT fixed their problems.

Some month later we moved the project to its own domain and got rid of
removing all those losers every day just to see their system continue
spamming 5 minutes later again.
There were more removal-requests than we could handle ourselves in time and
we have high standards: Every request for a manual removal has to be done
within 90 minutes.
We tried to find trustworthy people that would do the manual delistings free
of charge on a 24/7 basis, but no one wanted to have this job without being
paid.

So we had chosen that the only way to get out would be automatic expiration
after 7 days.

We had only 165 trapservers out there that time and that means you have
better chances to win the jackpot in your local lottery than to hit a
spamtrap here, unless you are sending tons of spams.

It happens very often that Spammers send 30.000.000 spammails and we see
just 1 of them. It is impossible for us to know whether or not a formerly
spam spewing system has been cleaned up or not.

Not getting reports for 1 or 2 days says nothing about the listed system. It
could still spew spam but just miss our traps.

Not getting reports for 7 days is of course not a proof, but at least an
indicator that the problem might have been fixed.

You know what happened next, do you?

Some listees claimed that it would cost them lots of money to be listed for
a week, but they would have fixed their problem and they are so sure that
their problem is now fixed that THEY WOULD EVEN PAY FOR IT TO GET OUT
IMMEDIATLEY. 

So expedited express delisting was not our invention - It was implemented
because listees were begging us to create that option.

Logic says: One would not waste money if he would not have fixed the
problems.
That is the reason why expedited express delistings exist at
UCEPROTECT-Networks.

It was necessary to contract external persons to run the hotline and the
express delistings, which wouldn't have needed on automatic expirations only

Logically these people (mostly students) do not work for free, and neither
we nor our users have any intention to pay for the faults of our listees.

We also think we have found a good balance between what is acceptable for
someone who has really fixed his problems and needs his email back and also
expensive enough that Spammers would not pay for.

And as told before another important fact is: Most of those who paid have
really fixed their problems and learned an unforgettable lesson: 

NEVER GO ONLINE AGAIN WITH AN INSECURE SYSTEM.

Our users fully agree to that policy because we did never try to make a
secret out of it.
I know it is hard to believe for all those that do not agree with our
policy:
Many of our users have chosen to use ourlist *BECAUSE* we are running an
hard and unforgiving course against the owners of spamming systems, no
matter they are spamming intentionally or because they got hacked.

Since also no one here from this group offered to do the 24/7 Job removing
the losers free of charge for us, nothing will change at UCEPROTECT-Network
for the moment.

Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network
http://www.uceprotect.net

---

From: Kelly Molloy <[email-masked]>
Date: Sun, 27 Feb 2011 12:30:15 -0800

> a consequence there will not be many users and not many removal requests.

I used to run the MAPS RBL and now I run the Spamcop BL. Perhaps you've
heard of those?

Neither the Spamcop BL nor the MAPS RBL have ever charged for delisting. I
would never support a charge for delisting because it leaves the list open
to the accusation of false listings in order to generate revenue. SCBL
currently allows delisting on demand for a first listing and then an
increasing interval before successive self-delistings are permitted. (All
listing still expire after 24 hours with no new spam, but one can not
request delisting if an IP is delisted on demand and then relisted). To be
perfectly honest, I was really nervous about this when we implemented it,
and we were prepared to revert the change if it hurt our efficacy or
accuracy. It hasn't. It also decreased our support burden significantly.

Also, the CBL uses a similar model (although theirs was first) and is one of
the most accurate and useful blocklists in the world.

Based on my experience, I strongly disagree that pay-for-delisting is ever
necessary.

--kelly

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 22:45:50 +0100 (CET)

Dear Kelly,

heard of those? 

Of course and if you did ever read NANAE then you would know that I did
always recommend the Spamcop BL because it is a good DNSBL with a low false
positive rate.

would never support a charge for delisting because it leaves the list open
to the accusation of false listings in order to generate revenue. 
>SCBL currently allows delisting on demand for a first listing and then an
increasing interval before successive self-delistings are permitted. (All
listing still expire after 24 hours with no new spam, but one can not
request delisting if an IP >is delisted on demand and then relisted). To be
perfectly honest, I was really nervous about this when we implemented it,
and we were prepared to revert the change if it hurt our efficacy or
accuracy. It hasn't. It also decreased our >support burden significantly. 

>Also, the CBL uses a similar model (although theirs was first) and is one
of the most accurate and useful blocklists in the world. 

necessary.

You can't compare the SCBL or the CBL to UCEPROTECT.
Both (SCBL and CBL) have a much broader listing source as UCEPROTECT, so
that they will probably see more impacts per infected system than we see.
Logically it will have no big impact in efficiency for your list if you are
automatic delisting after 24 hours with no impacts.
We did a similar test also in 2007 shortly after I took over the project and
lost about 15% efficiency by automatically delisting after 24 hours. Since
that was inacceptable, we did stick at 7 days.

You may not believe me, but really: I guess the SCBL might be much more
effective if they would list for 7 days instead.

I grabbed some links to independent stats to backup my claim:

http://www.sdsc.edu/~jeff/spam/cbc.html

At SDSC.EDU our UCEPROTECT-Level 1 had blocked 51583 spammails compared to
SPAMCOP which had blocked 16429 spammails last week.
That means our Level 1 did outperform your list by a factor 3 + 

Your numbers in Europe are much better but even there dnsbl-1.uceprotect.net
outperforms bl.spamcop.net by more than 5% without having more false
positives.

SPAMCOP:
http://www.intra2net.com/de/support/antispam/blacklist
php_dnsbl=RCVD_IN_BL_SPAMCOP_NET.html

UCEPROTECT-Level 1:
http://www.intra2net.com/de/support/antispam/blacklist
php_dnsbl=RCVD_IN_UCEPROTECT1.html

Last not least (and since we have nothing to hide) also we measure
statistics for different DNSBL's:
http://stats.uceprotect.net/

By clicking on the graphics you will also be able to see the last 30 days
for each list efficiency and inaccuracy

As you can see we had never any problems to admitt that CBL is one of the
best lists around (I would really like to know their secret)  and also that
ourlists are far away from being perfect.

I really recommend you to measure efficiency of your list by using internal
and external datas.
I had to learn that lesson by myself as Al Iverson presented his numbers to
me in 2007.
If you look on your own numbers only, then you will mostly not see the
complete picture.

Best Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: Joe Sniderman <[email-masked]>
Date: Sun, 27 Feb 2011 17:03:42 -0500

On 02/27/2011 02:00 PM, Claus v. Wolfhausen wrote:
> I never heard of the TRBLSPAM so it is very like to be not widely known.

Its rather new from what I understand. I've been using their blacklist
in spamassassin since shortly after they opened up their operation; I
have been highly pleased with the result.

[snip]

> because listees were begging us to create that option.

Look, my honest opinion is probably better (from a practical and public
relations standpoint only) not to even offer it, ie make every listee
wait the full 7 days.

That said, listing and delisting criteria in general varies so much in
general, and your practical and public relations concerns impact you alone.

[snip]

> matter they are spamming intentionally or because they got hacked.

Exactly. Regardless of how practical or impractical an approach it may
be, it only has the potential to cause lost mail for those who already
decided they want a hardline approach.

> the losers free of charge for us, nothing will change at UCEPROTECT-Network

Good. If all blacklists held the same definitions, same policies, same
delisting procedures etc, there would be far fewer options for folks to
choose from.  Those criteria do not lend themselves well to
standardization, or even to a best practice.  The disclosures, and
technical aspects are another story of course. (OT: You would lose at
least one satisfied user if you softened up your delisting procedures.)

-- 
Joe Sniderman <[email-masked]>

---

From: Al Iverson <[email-masked]>
Date: Sun, 27 Feb 2011 16:35:25 -0600

On Sun, Feb 27, 2011 at 2:30 PM, Kelly Molloy <[email-masked]> wrote:
>
> On Sun, Feb 27, 2011 at 11:00 AM, Claus v. Wolfhausen <[email-masked]> wrote:
>>
>> TRBL Support wrote:
>>
>> I never heard of the TRBLSPAM so it is very like to be not widely known. As a consequence there will not be many users and not many removal requests.
>
> I used to run the MAPS RBL and now I run the Spamcop BL. Perhaps you've heard of those?
> Neither the Spamcop BL nor the MAPS RBL have ever charged for delisting. I would never support a charge for delisting because it leaves the list open to the accusation of false listings in order to generate revenue. SCBL currently allows delisting on demand for a first listing and then an increasing interval before successive self-delistings are permitted. (All listing still expire after 24 hours with no new spam, but one can not request delisting if an IP is delisted on demand and then relisted). To be perfectly honest, I was really nervous about this when we implemented it, and we were prepared to revert the change if it hurt our efficacy or accuracy. It hasn't. It also decreased our support burden significantly.
> Also, the CBL uses a similar model (although theirs was first) and is one of the most accurate and useful blocklists in the world.
> Based on my experience, I strongly disagree that pay-for-delisting is ever necessary.

In response to the implication that it is necessary to charge a
penalty fee in some cases being an "important point not often seen by
those who never have run a public DNSBL" I would like to add my
agreement to Kelly's comments above. I created and ran the MAPS RSS,
the VISI.com RSL, and have been involved in numerous other public
DNSBLs, and I think, in 2011, that charging a fee for delisting is far
from a best practice.

Regards,
Al Iverson

---

From: TRBL Support <[email-masked]>
Date: Sun, 27 Feb 2011 16:50:07 -0600

On Sun, Feb 27, 2011 at 1:00 PM, Claus v. Wolfhausen
<[email-masked]> wrote:
> If we at UCEPROTECT would have to handle up to 50 removal request per day, then we could offer that free of charge, of course.
> Unfortunateley we would have to handle between 40000 to 50000 requests per day, if we would offer immediate removals free of charge.
>
> In UCEPROTECT's early days (August 2001) the project was run on a sub domain of admins.ws and the blocklists had public "remove me" Buttons, where listees could remove them self.
>
> As Spammers were beginning to abuse that with automated scripts we did secure it with a captcha. Then Spammers did hire persons in India and China to remove their listings manually.
>
> That was the point where UCEPROTECT has chosen to no longer allow "self removals" and then everyone was required to contact us to get removed before expiration.

Here's a thought: Your business model is broken. You are charging
listees, when instead you should be charging your blacklist users
enough to cover your operating expenses. This is like giving away an
automobile for free, but then charging people after the driver hits
them. It does not make sense to me.

I think if you are charging people to get removed, you are taking
advantage of misfortune. I understand what you mean about CAPTCHAs
being defeated and so forth, but charging listees a fee is not the
only way to address this issue, nor is this a fair methodology to
those who are not bad guys.

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Mon, 28 Feb 2011 01:39:32 +0100 (CET)

>them. It does not make sense to me.

Really?

UCEPROTECT-Network is not a business model.
It is a free project run and sponsored in total by the UCEPROTECT-Orga.
That means we are really independent and our lists can be used by anyone
for any purpose free of charge.

Your comparison with cars is not correct and lacks simple logic.
What you are sugessting is comparable to following situation:
A city or a district authority would charge all car-owners with the fines
for 
speeding because speeding accidentally can happen to anyone sometimes.
(So at least did the excuse for losers that get hacked sound to me).

What we are doing is comparable to real world examples.
We are the city or district authority and we allow usage of our roads
free of charge for all.
Those that are caught speeding get fined.

That's more real than you can imagine, because most members of the
UCEPROTECT-Orga are indeed Cities and district authorities in Germany,
Austria and Switzerland.

The fact that we are listing Spammers for 7 days can be compared 
to a drivers license suspension for speeders.

If the speeder pays a fee for speeding then the ban on the license is lifted
earlier.
That is also a real life situation and it's exactly what we are doing with
Spammers..
They can pay a fee for expedited express delisting.
 
>Advantage of misfortune. I understand what you mean about CAPTCHAs
>Being defeated and so forth, but charging listees a fee is not the
>Those who are not bad guys.

I explained it multiple times that self-removals are not a choice for us,
because Spammers will always find a way to break them.
They did it with captchas, they hired cheap persons in India and China
to delist complete ranges for them and if we would take the approach that
one can only delist the IP which one is using right now, then spammers
will program their bots to do the selfremovals.

Since no one wants to do manual delistings 24/7 free of charge and 
neither we nor our users want to spend additional resources because 
it doesn't matter to us, if the listee stays listed for a week, we have 
chosen to let those that need an immediate removal pay for their faults.

Q.E.D. For UCEPROTECT there is no way besides the automatic and 
free expiration than charging for expedited removal and letting external 
persons doing that job.

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: Kelly Molloy <[email-masked]>
Date: Sun, 27 Feb 2011 16:57:39 -0800

> because Spammers will always find a way to break them.

Except that's not an issue for Spamcop. I can't say for sure because I'm on
the outside looking in, but it seems like many other lists don't have an
issue with it either.

> chosen to let those that need an immediate removal pay for their faults.

Many (volunteer, even!) lists handle delistings free of charge. 24/7
coverage is a lot to ask of any list, and I don't see that anyone is arguing
for that as a standard.

> free expiration than charging for expedited removal and letting external

There's always another way. You just don't want to consider those, which is
your prerogative. But other ways do exist and are doable.

Also, just FTR: SORBS no longer charges for delisting. From
http://www.sorbs.net/overview.shtml:

*>Note:* Use of this service is currently free of charge. There is no charge
for removal from the proxy, vulnerability, relay, zombie, spam or DUHL
databases.

--kelly

---

From: Andrew Kirch <[email-masked]>
Date: Sun, 27 Feb 2011 20:07:45 -0500

On 2/27/2011 7:57 PM, Kelly Molloy wrote:
> coverage is a lot to ask of any list, and I don't see that anyone is
> arguing for that as a standard. 
>
That's fine, but as long as some are, the BCP should not use language
like "MUST NOT"

---

From: Kelly Molloy <[email-masked]>
Date: Sun, 27 Feb 2011 17:14:01 -0800

On Sun, Feb 27, 2011 at 5:07 PM, Andrew Kirch <[email-masked]> wrote:

That's fine, but as long as some are, the BCP should not use language like
> "MUST NOT"

Why not? I'm really not following. Saying that pay-to-delist is not BCP
doesn't require that Claus change the behavior of his list. If you want to
adhere to consensus BCP, you must not charge to delist. Claus doesn't care
if his lists adhere to BCP, and that's fine.

--kelly

---

From: Steve Atkins <[email-masked]>
Date: Sun, 27 Feb 2011 17:22:15 -0800

On Feb 27, 2011, at 5:07 PM, Andrew Kirch wrote:

>> Many (volunteer, even!) lists handle delistings free of charge. 24/7 coverage is a lot to ask of any list, and I don't see that anyone is arguing for that as a standard. 
>> 
> That's fine, but as long as some are, the BCP should not use language like "MUST NOT"

Just because one blacklist does something doesn't mean that a BCP document is required to consider that behaviour a "best common practice" and describe it as such[1].

"MUST NOT" is absolutely an acceptable term for a BCP document to use to say that a behaviour is clearly outside "best practice".

Cheers,
  Steve

[1] Heck, I respond with public ridicule and spite listings to people who complain about being wrongly listed on one of my blacklists[2]. Also to users of the list who contact me when it fails to meet their expectations. I'm perfectly happy with that behavior to be covered by a "MUST NOT" in a blacklist BCP.

[2] It's the all-of-ipv4-bl, admittedly, but that's still a blacklist, just as useful and valid as UCEPROTECT when it comes to constraining BCP language.

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Mon, 28 Feb 2011 04:30:54 +0100 (CET)

Steve wrote: 
 
>Just because one blacklist does something doesn't mean that a BCP document
is required to consider that behaviour a "best common practice" and describe
it as such[1].

Really? I start to believe that many people in this group have no clue what
BCP stand for.

Now see: http://en.wikipedia.org/wiki/Best_Current_Practice
 
A Best Current Practice (BCP) means that a certain manner of proceeding is
in general the most logical choice -- a de facto standard of sorts
 
Now let's analyze that:
 
In every civilization that I have seen, those that fail to behave correctly,
will have to live with the sanctions.
If you break a law, then you will be punished.
If you break a law accidently or willfully does not matter in most
civilizations.
 
If you are speeding and you get caught, then you will be charged / your
license will be suspended.
I do not know of any civilization that handles such cases different.

Those which do damage to others are responsible for that and have to pay for
the damage.
That is a worldwide valid accepted proceeding , you can say it is de facto
WORLD STANDARD.

Now try to think logic:
What will be the most logical choice to deal with offenders on the Internet?

Yes - You guess it - They should be punished.

Who should therfore pay for the damage done by a system on the internet?
You guess it - The person that is responsible for said system.

Exactly that is what UCEPROTECT's listing / delisting policy does.
It does not matter if UCEPROTECT is the only DNSBL left that has chosen the
most logical way - SORBS (no matter we (tinw) like it or not) and UCEPROTECT
have set the de facto standard for DNSBL's in 2003
when we (tinw) begun charging listees.  Furthermore the Backscatterer-DNSBL
is also charging for expedited delisting since 2007 and there is also
another public DNSBL that is charging for expedited delisting,
which has no relationship with the UCEPROTECT-Network, namely the INPS-DNSBL

See: http://dnsbl.inps.de/index.cgi?lang=en&site=00011

So we know of at least 3 DNSBL's that are charging listees with removal or 
expedited removal fees.

I have given public proof to the audience that UCEPROTECT's policies are in
fact a best current practice.

Logically that also means that charging users of DNSBL's instead of listees
is the most unlogic way to run a DNSBL (One could also claim it to be the
worst practice)
So to have wordings in it like:
 
  Therefore, negative-connotation DNSBLs MUST not charge fees or
  Require donations for delisting or "faster handling", and it is
  RECOMMENDED that such DNSBLs that do charge fees or require donations
  Not be used
 
clearly smells like an attempt to rule independent DNSBL's because the
author of the BCP did not like 
the current best practice for whatever reason and has managed to sell the
worst possible practice as best current practice to this big parts of this
group..

Q.E.D. Since in fact the "draft-irtf-asrg-bcp-blacklists-07" does not
represent a Best Current Practice it has to be replaced with one that doe no
longer contain the complete section 2.2.5.

Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: Kelly Molloy <[email-masked]>
Date: Sun, 27 Feb 2011 19:55:28 -0800

On Sun, Feb 27, 2011 at 7:30 PM, Claus v. Wolfhausen <
[email-masked]> wrote:

>     Steve wrote:
>
>  >Just because one blacklist does something doesn't mean that a BCP
> document is required to consider that behaviour a "best common practice" and
> describe it as such[1].
>
> *A Best Current Practice (BCP) means that a certain manner of proceeding is in general the most logical choice -- a **de facto* <http://en.wikipedia.org/wiki/De_facto>* standard of sorts*
>
> **
>
> Now let's analyze that:
>
>
>
> In every civilization that I have seen, those that fail to behave correctly, will have to live with the sanctions.
>
> If you break a law accidently or willfully does not matter in most civilizations.
>
>
That's probably where you and the rest of DNSBLs differ; I think most DNSBLs
publish listings in order to protect our users, not to punish listees.

--kelly

---

From: John Levine <[email-masked]>
Date: 28 Feb 2011 04:17:44 -0000

>Really? I start to believe that many people in this group have no clue what

It's a standard term familiar to everyone who's participated in IETF
mailing lists for more than a few days.  I don't understand what point
you're trying to make here.

I also have to agree that the most widely used DNSBLs are the ones
whose goal is to stop spam, not to wreak vengeance on supposed
spammers.

R's,
John

---

From: "Larry M. Smith" <[email-masked]>
Date: Sun, 27 Feb 2011 22:30:05 -0600

On 2/27/11 9:30 PM, Claus v. Wolfhausen wrote:
> document is required to consider that behaviour a "best common practice"
> and describe it as such[1].
> Really? I start to believe that many people in this group have no clue
> what BCP stand for.
>
> Now see:http://en.wikipedia.org/wiki/Best_Current_Practice
>
>
>
> /*A  Best Current Practice  (BCP) means that a certain manner of proceeding is in general the most logical choice -- a  *//*de facto*/  <http://en.wikipedia.org/wiki/De_facto>/*  standard of sorts*/
>

Please compare "de facto" with "de jure"

> //

A BCP is not a law.

(snip)
> It does not matter if UCEPROTECT is the only DNSBL left that has chosen the most logical way - SORBS (no matter we (tinw) like it or not) and UCEPROTECT have set the de facto standard for DNSBL's in 2003
>

Two DNSBLs going against what many have already advised them not to do, 
does not make a "standard" of any sort.

> when we (tinw) begun charging listees.  Furthermore the Backscatterer-DNSBL is also charging for expedited delisting since 2007 and there is also another public DNSBL that is charging for expedited delisting,
>

Many people don't see Backscatterer's policies as a separate iteration 
from UCEprotect's policies.  They are being run by the same people.

> which has no relationship with the UCEPROTECT-Network, namely the INPS-DNSBL.
>
>
>
> See:http://dnsbl.inps.de/index.cgi?lang=en&site=00011  <http://dnsbl.inps.de/index.cgi?lang=en&site=00011>
>
>
>
> So we know of at least 3 DNSBL's that are charging listees with removal or  expedited removal fees.
>
>
>
> I have given public proof to the audience that UCEPROTECT's policies are in fact a best current practice.
>

Three, well really two DNSBLs, out of *hundreds* of DNSBLs past and 
present doesn't make a best current practice.

>
>
> Logically that also means that charging users of DNSBL's instead of
> listees is the most unlogic way to run a DNSBL (One could also claim it
> to be the worst practice)
>    /Therefore, negative-connotation DNSBLs MUST not charge fees or
>    Not be used/

At this point, with statements like this, I have to wonder what your 
purpose is here.  Showing two DNSBLs that do something one way, while 
ignoring countless others that do it the other way, and using those two 
as your proof that things should be done the way that you want them to 
be done, doesn't strengthen your argument.

>
>
> clearly smells like an attempt to rule independent DNSBL's because the author of the BCP did not like
>

Discussion of this BCP goes all the way back to at least 2004 and has 
had many, many people put their input into it.  My view of the list-serv 
traffic only goes back to 2008, so I'll let someone else count how many 
people may have helped to shape the current document.

SgtChains

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 28 Feb 2011 01:12:40 -0500

> be done, doesn't strengthen your argument.

As a FYI: it's one now.  Those who were on this list back when this 
change went in will remember I spoke with the operator of the other, and 
she was okay with making it a MUST NOT.  She had been seen in at least 
one list to opine that she was never comfortable with it, but at the 
time felt she had no option.  It doesn't do it anymore.

> people may have helped to shape the current document.

Matt and I got together on the BCP in April of 2003 in the aftermath of 
the FTC Spam Panel.  Which probably sets a record for the 
longest-worked-on draft of all time.  It's had commentary from many 
small and large DNSBL operators, MAAWG, and a host of other individuals, 
  organizations and mailing lists.  Much of the intervening years were 
spent in conversations at MAAWG, where it helped kill a number of 
perfectly hideous alternate documents[+].

My personal opinion or not, this is one shared by almost everyone in 
every aspect of the industry.  Including DNSBL operators.

[+] Many predicated on the notion that it was a good idea to enumerate 
exactly what listing criteria should be allowed.

---

From: Esa Laitinen <[email-masked]>
Date: Mon, 28 Feb 2011 08:41:17 +0100

> coverage is a lot to ask of any list, and I don't see that anyone is arguing
But uceprotect delists for free!

-- 
Mr. Esa Laitinen
Tel. +41 76 200 2870
skype/yahoo: reunaesa
Blog: http://happiloppuuahistaa.blogspot.com

---

From: Dotzero <[email-masked]>
Date: Mon, 28 Feb 2011 12:50:19 -0500

I was on the fence about this one and somewhat conflicted. After
reading all of the various postings I find myself solidly on the side
of "MUST NOT".

What has convinced me are Two groups of postings:

1) The postings pointing out the difference between protecting users
from SPAM vs punishing senders;
2) The postings pointing out that charging for "pay to play" is the
exception rather than the rule and that various BLs which had used
"pay to play" have moved away from this approach.

Despite Claus claiming that "pay to play" as implemented by UCEPROTECT
is a Current Best Practice, I find nothing in his posts to support
that it is indeed a best practice (other than his unsubstantiated
assertion).

Having said the above, I believe that it is possible for "pay to play"
to potentially be an acceptable practice if properly implemented. This
does NOT make such a paractice a "Best Practice".

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 28 Feb 2011 20:19:56 +0100

On 28/Feb/11 01:39, Claus v. Wolfhausen wrote:
> What you are sugessting is comparable to following situation: A
> city or a district authority would charge all car-owners with the 
> fines for speeding because speeding accidentally can happen to
> anyone sometimes. (So at least did the excuse for losers that get
> hacked sound to me).
>  
> What we are doing is comparable to real world examples. We are the
> city or district authority and we allow usage of our roads free of
> charge for all. Those that are caught speeding get fined.

And that's unfair!  I recall a local case of town administrators
trying to fine drivers for revenue[*].  Actually, being fined is only
tolerated when done by public officers, who supposedly act in the
interest of the community.  Self-appointed officers who'd keep the
money to cover their expenses would be shot on sight.

-- 
[*] http://www.banthecams.org/20100503178/Italy-Prosecution-Advances-in-Red-Light-Camera-Fraud-Scandal-Newspaper.com.html

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Mon, 28 Feb 2011 20:33:52 +0100 (CET)

Dear Allessandro,
You wrote:
 
>And that's unfair!  I recall a local case of town Administrators
>tolerated when done by Public officers, who supposedly act in the
>interest of the community.  Self-appointed officers who'd Keep the
>money to cover their expenses would Be shot on sight.

Really?

As I explained often enough:
If your Server tries to hack our Systems OR if your Server is sending spam
to our Traps then
and that makes the difference you enter our jurisdiction.

Our Systems -> Our rules.

I also recommend that you get a clue who the UCEPROTECT-Orga is.
Hint: Most of our listees got listed for spamming local government agencies
in South Bavaria.

Regards
Claus von Wolfhausen
Technical Director
UCEPROTECT-Networks

---

From: Graeme Fowler <[email-masked]>
Date: Mon, 28 Feb 2011 20:08:38 +0000

> Our Systems -> Our rules.

And that, Claus, is the nub of this discussion, as enlightening as it
is.

BCP38 is a very well established BCP document for network operations. It
is ignored by many, either because they choose to or are unaware of the
existence of it.

It strikes me that the consensus here is that MUST NOT is the current
BCP, and you're choosing to do something different. That's your choice;
it does not make your choice a BCP.

I have neither run, nor ever want to run, a DNSBL - but I have made
informed choices over many clauses in BCPs, guidance notes,
interoperability specs and so on over the years. That did not make my
choices the BCP, it made them my choice.

Your network, your rules. That's very important - and it's why BCP
documents don't mandate standards like Standards documents do.

Personally I believe the "offending" clause COULD be rewritten to make
it a little less "offensive". But I do not believe that it MUST be.

Graeme

---

From: Steve Linford <[email-masked]>
Date: Mon, 28 Feb 2011 20:48:38 +0000

Gentlemen,

The argument in favour of charging fees to blacklisted entities to remove them from blacklists is clutching at straws. Punishing "lusers" for getting their PCs trojanned is an extremely poor practice and one that can not even remotely be described as a "good practice".

There's no question in my mind that if the BCP purpose is to define the *best* practice then the correct wording is "MUST" and not "SHOULD".

  Steve Linford
  The Spamhaus Project
  http://www.spamhaus.org

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Mon, 28 Feb 2011 22:21:41 +0100 (CET)

Ahhhhh Mr. Linefeed of SPAMHAUS....
I asked myself a full day how long it would take for you to show up on the
scene and blow into that "MUST" horn of Section 2.2.5....

Your vote for a "MUST" here has clearly shown that your evening prayer is:
"Oh lord, let spammers be also active by tomorrow, so that I can stay in the
Anti-Spam-Business".

You have seen that more and more ISPs are blocking port 25 thanks to the
bastards that are blocking based on hardlinerlists like our Level 3 and spam
decreased dramatically over the last year.
This will be interesting for the audience that is not reading NANAE:

It is not in the commercial interests of SPAMHAUS that endusers are educated
to secure their systems, so that spammers can't abuse them.
Why? Because it would obsolete the Spamhaus PBL (BAHHHHHHHHHHHHH) 

While we try to force providers to install port 25 blockers, what is Mr.
Linefeed doing?
How many people here are aware that shitlists as the PBL (Bahhhhhhhhhh) can
not be a solution?
The PBL is there for nothing else than to allow providers to cheat their
customers and to pay Mr Linefeed... 
How unethical and stinking is it that providers sell "unlimited" internet
access to their customers, but nominating their dynamics into the SPAMHAUS
PBL? 
Now see what we are doing: 
We are the only lists that tries to enforce providers to block port 25 on
their dynamics / homeusers per default as recommended by the MAAWG since
2005.... 
We are doing that by escalating the complete ASN into Level 3 if the
provider is not limiting the abuse which originates from their botnets... 

Exactly there is the difference between  PBL and our Level 3: 
Our approach is to disable spammers ability to use botnets by tomorrow... 
Mr. Linefeeds approach is to protect his paying customers against spammers
while avoiding to hurt spammers too badly, so that he can stay in the 
Anti-Spam-Business" with his commercial SPAMHAUS DNSBL.
Therfore the SPAMHAUS is listing some of the little and unimportant spammers
like SPAMDREW (NANAE readers know whom I'm talking about) but one should not
expect the real bad guys to get listed in the SPAMHAUS DNSBL.
We (tinw) have also very often seen that Mr.Linefeed has serious issues to
see (and list) spam even from long-term spamming locations, if the ISP that
harbors said spammers is a commercial customer of SPAMHAUS.
That can of course be a coincidence, but I don't believe in such things.

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network
Phone: +41-32-5120855

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 28 Feb 2011 16:32:06 -0500

> There's no question in my mind that if the BCP purpose is to define the *best* practice then the correct wording is "MUST" and not "SHOULD".

To bring people up to date of the level of debate that Claus has 
descended to.

Imagine my surprise at starting to get UCEProtect delisting requests at 
my corporate mailbox.  CC'd to the co-author of the BCP.

Go take a gander at http://www.uceprotect.net/en/contact.php.

Which says (straight cut-and-paste):

Warning strike, no manual removals and no tickets at this time, sorry !

The employees of UCEPROTECT strike at present. The system runs on 
autopilot and there is currently no one available to manually unlist 
your IP.

At 04 January 2011 the ASRG decided BCP07 for DNSBLs, which prohibits in 
paragraph 2.2.5 blacklists to offer paid immediate removals.
Should this BCP obtain the status of an RCF, then it is possible that 
expedited express delistings wold no longer be available and thus 
endanger our jobs.

If you would like to thank the authors of BCP07 for DNSBLs and the guys 
at ASRG for, that your IP will now stay blacklisted up to the automatic 
expiration date, please contact following addresses:

Authors of BCP07 for DNSBLs:

Chris Lewis
Nortel Networks
Email: [email-masked]

and

Matt Sergeant
MessageLabs, Inc
Email: [email-masked]

We also recommend to subscribe yourself to the ASRG mailing list, and 
then to demand that the paragraph 2.2.5 has to be deleted form BCP07 for 
DNSBLs.  The ASRG should no longer presume to interfere in the policies 
of independent DNSBLs.

Alternativley, you can send an email to [email-masked].

Thank you very much for your support in the fight for our jobs.

The team of UCEPROTECT Network

---

From: Seth <[email-masked]>
Date: Mon, 28 Feb 2011 16:50:44 -0500 (EST)

Steve Linford <[email-masked]> wrote:

> The argument in favour of charging fees to blacklisted entities to
> remove them from blacklists is clutching at straws. Punishing
> "lusers" for getting their PCs trojanned is an extremely poor
> practice and one that can not even remotely be described as a "good
> practice".

I'd think that case typically just waits a week to get unlisted for
free.

> There's no question in my mind that if the BCP purpose is to define
> the *best* practice then the correct wording is "MUST" and not
> "SHOULD".

Does MUST NOT mean "that isn't the best practice" or "that isn't an
acceptable practice"?

I'll also note that the fee isn't for removal, which will happen
automatically for free anyway.  It's for expediting the removal.

Seth

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Mon, 28 Feb 2011 23:19:55 +0100 (CET)

>Go take a gander at http://www.uceprotect.net/en/contact.php.

Damned, see what you have done with this BCP, you got my removal crew
striking.
Hey I'm at home and I didn't know that they would do this tonight.
We had a meeting and discussion today in the afternoon and our CEO said:
"Ok, if that becomes an RFC we might stop manual delistings, who cares."

It looks like that this has scared the removal crew and they try to keep
their jobs.
I have a deep understanding for them, but I would have done the texts very
differently.

Anyway what they are doing is basicly nothing else than what Steve Lindford
is doing by voting for "MUST" here. They want to stay in business.
I really hope that you'll enjoy the spirits that you called.

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: "Larry M. Smith" <[email-masked]>
Date: Mon, 28 Feb 2011 17:02:18 -0600

Claus v. Wolfhausen wrote:
> I have a deep understanding for them, but I would have done the texts
> very differently.
>  
> Anyway what they are doing is basicly nothing else than what Steve
> Lindford is doing by voting for "MUST" here. They want to stay in business.
> I really hope thatyou'll enjoy the spirits that you called.

I have to say that this is an "interesting" way to state your case
before an IRTF research group;  Harass the authors of the document that
you disagree with, attempt strong arm them by having your listees
possibly flood their inboxes with removal requests for your DNSBL, and
hold your listees hostage until you get your way.

I guess the only question that I have is; Is any of this latest
discussion from Claus v. Wolfhausen "[making] progress towards realizing
the Research Group's goals and objectives"

SgtChains

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Tue, 1 Mar 2011 00:40:15 +0100 (CET)

>hold your listees hostage until you get your way.

Please get your facts straight.
You know me from NANAE, and you should know that the text on the page 
is neither my wordings nor is it my style to behave so.

The guys that should run the night-shift simply created a reason page and 
logged their accounts off the system.
The system gets aware no one operator is logged in and that means no one 
will process orders and reads tickets.
It goes to autopilot mode and therefore refuses to accept tickets and
payments 
for expedited delistings and displays the reason page.

If no reason page would exist, then it would simply show:
"Tickets and expedited express delistings are temporary not available."

Anyway the system is online and automatic removals and listings are
done by the system as usual.
So the listtes are not hold hostage, they get right now the expirience
that they would also have if we would not offer expedited expressdelistings
at all.

Sure I could log in and the system would immediatley end the autopilot mode,
but that would mean I would have to do all delistings tonight and I would
have
to answer the tickets because the system would all those things forward to
me.

I'm not a strike-breaker and I will also have to deal with the other
employees
in the future. So you can be sure that I will under no circumstances log in
to
the system at this time.

>the Research Group's goals and objectives"

You want to get my personal opinion, really? 
I am the one that now looks like an asshole, no matter what I do or say...
That really feels great ... trust me ....

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: Franck Martin <[email-masked]>
Date: Tue, 1 Mar 2011 12:53:19 +1200 (FJT)

Stand by your company and employees 

----- Original Message ----- 
From: "Claus v. Wolfhausen" <[email-masked]> 
To: [email-masked] 
Sent: Monday, 28 February, 2011 3:40:15 PM 
Subject: Re: [Asrg] UCEPROTECT's comment on draft-irtf-asrg-bcp-blacklists-07 

It goes to autopilot mode and therefore refuses to accept tickets and payments 

Sure I could log in and the system would immediatley end the autopilot mode, 
but that would mean I would have to do all delistings tonight and I would have 
to answer the tickets because the system would all those things forward to me. 

I'm not a strike-breaker and I will also have to deal with the other employees 
in the future. So you can be sure that I will under no circumstances log in to 
the system at this time. 

Claus von Wolfhausen 
Technical Director 
UCEPROTECT-Network

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 28 Feb 2011 20:24:02 -0500

> that they would also have if we would not offer expedited expressdelistings

You really don't know anything at all about me or what I do do you? 
What your buddies (if they actually exist) have accomplished so far is 
inconsequential.

Three complaints.  Wow.

Plus one who has read the BCP and is urging us to stick by our guns. 
It's quite amusing and I'll see if I can get permission to copy it here.

Ordinarily, I'd just ignore it - far far less than either Matt or I are 
used to handling on a routine basis (for me well over a decade, Matt 
almost as long).  Matt and I aren't exactly newbies at this after all.

However, UCEProtect's actions have brought both of our employers into 
it.  I am required to report threats against my company, and I have.  It 
will very rapidly escalate past a point where I can control let alone 
stop their reaction.

You, your CEO, and whomever else actually exists over there have some 
serious thinking to do.

This stunt of UCEProtect's has backfired as should be pretty obvious by now.

For your sake, when the head of corporate security phones me tomorrow, I 
hope I can tell them that this is over and they can forget about it.

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Tue, 1 Mar 2011 02:24:52 +0100 (CET)

>Stand by your company and employees

You can bet on that.
I did send an email to the CEO immediatley after I got knowlege of the
strike (3 hours ago) but didn't get a reponse yet (It's actually 2 am in the
morning in my timezone).
It is impossible for me to do the work of 4 people that are now striking
this night and I have to be back into the company in 12 hours, so I will
have some sleep now.
It's up to the other team that should do the morning-shift which begins in 4
hours and the CEO which will be there in about 7 hours to deal with that
issue.

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: John Levine <[email-masked]>
Date: 1 Mar 2011 02:56:38 -0000

aRFC 3934 describes the management of IETF Mailing Lists.  It gives the
group chair the authority in unusual situations to suspend, after
suitable warnings, the posting privileges of people who engage in
disruptive behavior.

This is a public warning to the person who posts as "Claus
v. Wolfhausen" that personal attacks and ridicule, such as the excerpt
quoted below, have no place in the ASRG or any other IETF/IRTF mailing
list.  If they do not cease immediately, suspension of posting
privileges or other appropriate action may follow.

Regards,
John Levine, ASRG Chair