Subject: [Asrg] Rough consensus on pay to delist

From: John Levine <[email-masked]>
Date: 27 Feb 2011 21:01:18 -0000

I'm seeing no support at all for "Claus'" contention that we should
change the language about pay to delist in DNSBL practices draft.

If anyone else agrees that we should change it, please say so now,
otherwise I think we will consider the discussion over.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Joe Sniderman <[email-masked]>
Date: Sun, 27 Feb 2011 16:33:10 -0500

> otherwise I think we will consider the discussion over.

I agree that it should be changed but not removed entirely. Change it
from a "MUST NOT" to a "SHOULD NOT" perhaps.

-- 
Joe Sniderman <[email-masked]>

---

From: Andrew Kirch <[email-masked]>
Date: Sun, 27 Feb 2011 16:38:36 -0500

> from a "MUST NOT" to a "SHOULD NOT" perhaps.
Concur here.  I think Claus makes a valid point in that expedited
service might require expedited cost.  I am also concerned that this is
in direct contradiction of existing DNSBL practices, such as SORBS.  I
further question as to why we would deny a DNSBL a revenue model derived
from those causing the problem.

Andrew

---

From: "Larry M. Smith" <[email-masked]>
Date: Sun, 27 Feb 2011 16:44:14 -0500

> from a "MUST NOT" to a "SHOULD NOT" perhaps.

I disagree with this and believe that the wording should stand as is.

If independent operators chose to not follow this BCP, then they can opt
to point out that it is only a BCP.

SgtChains

---

From: Kelly Molloy <[email-masked]>
Date: Sun, 27 Feb 2011 13:46:30 -0800

On Sun, Feb 27, 2011 at 1:38 PM, Andrew Kirch <[email-masked]> wrote:
> service might require expedited cost.

But it eliminates the operator's ability to act in the best interest
of its customers--the sites who USE it. If someone pays me $50 and my
data tells me that IP is still spamming but I have to either return
the money or delist the IP anyway, who benefits? Not my users. It's
selfish and ineffective.

>I am also concerned that this is
> in direct contradiction of existing DNSBL practices, such as SORBS.

Some people also also HELO as "localhost". Just because some people do
it doesn't mean it's a good idea.

>I

Because it's the wrong thing to do.

--kelly

---

From: Joe Sniderman <[email-masked]>
Date: Sun, 27 Feb 2011 16:53:44 -0500

> the money or delist the IP anyway, who benefits? Not my users. It's

Perhaps, depends on the implementation. In any event, that *potential*
conflict applies to whitelists equally (if the IP starts spamming, but
the listee paid for a year... etc) and should be disclosed to users in
both cases.

---

From: Andrew Kirch <[email-masked]>
Date: Sun, 27 Feb 2011 16:55:27 -0500

> it doesn't mean it's a good idea.
"Stupid people exist" is a bad notional method of determining what
should be in a BCP.  This BCP would not reflect the listing policies of
SORBS, and UCEPROTECT, both of which have a high userbase.  With regard
to ethics on funding/delisting, that would be up to the individual DNSBL
and their legal team to determine.  I would suggest though that DNSBL's
MUST make those policies public.

Andrew

---

From: Steve Atkins <[email-masked]>
Date: Sun, 27 Feb 2011 13:55:30 -0800

> I disagree with this and believe that the wording should stand as is.

+1

> to point out that it is only a BCP.

Yup. There's no requirement to follow a BCP. Just some social pressure to
justify the points where you choose not to. (If this were instead, legislation,
it'd be quite a different situation.)

Cheers,
  Steve

---

From: Andrew Kirch <[email-masked]>
Date: Sun, 27 Feb 2011 16:57:28 -0500

> it'd be quite a different situation.)
I disagree here and note that legislators may look to this BCP later if
they intended to write such legislation. 

Andrew

---

From: Joe Sniderman <[email-masked]>
Date: Sun, 27 Feb 2011 17:01:00 -0500

+1

Additionally, even though one can go against the BCP, it still makes
sense to be as thorough as possible in drafting it.

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Sun, 27 Feb 2011 23:34:55 +0100 (CET)

Dear John,

>change the language about pay to delist in DNSBL practices draft.

The point which I see is not just the argumentation contra DNSBLs
that offer an optional paid expedited express delisting,
my point was also the argumentation pro commercial DNSBLs
without showing that there exists a conflict of interests also.

So if 2.2.5 Conflict of intersts is not completeley removed,
then it should also not claim that it would be generally considered 
apropriate to charge for a DNSBL, without mentioning the potential 
conflict where a possibly important customer of the commercial 
DNSBL is also willfully hosting spammers. 

Logic says that chances are much higher that a DNSBL-Operator
might be blind to the spam coming from his customers ranges
or that he might at maximum list some actually not used ranges 
as "Alibi-Listings" because a commercial DNSBL is a business
that wants to make profit.
If the commercial DNSBL-Operator would cheat here, this would 
be hard to proof, because he can always claim, that he didn't 
receive any spam from a spammy IP.

Different to that it is unlike that a DNSBL-Operator of a free DNSBL
that has an express delisting option will list innocent IP's, because 
he would risk to get exposed by the ISP in cases where he would list
IP's that did clearly not send any spam.
The ISP of any listee might have additional logs that could clearly proof
if the DNSBL-Operator would be cheating in that situation.

So the complete passage 2.2.5 is (sorry for the wording) pure paranoid
kookoil.

In fact it is *ALWAYS* a question if the DNSBL-Operator is honest or not.
But this is a question which the DNSBL-Users has to ask himself while
reading the DNSBL-Policies.

Assuming any DNSBL-Operator could run a blocklist in bad faith is 
something that should not be in any DRAFT nor in any RFC IMHO.

Therefore the complete passage 2.2.5 should be removed IMHO:

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network
http://www.uceprotect.net

---

From: TRBL Support <[email-masked]>
Date: Sun, 27 Feb 2011 16:43:34 -0600

On Sun, Feb 27, 2011 at 3:55 PM, Andrew Kirch <[email-masked]> wrote:
> SORBS

How so? SORBS stopped charging a fee.

Allow me to add my voice to the chorus of those saying, "I think
charging a fee for delisting in any circumstance is a bad idea."

-- 
trblspamtrap dnsbl: http://www.trblspam.com
simple, spamtrap driven, easy on, easy off

---

From: "Claus v. Wolfhausen" <[email-masked]>
Date: Mon, 28 Feb 2011 01:55:09 +0100 (CET)

>How so? SORBS stopped charging a fee.

The SORBS was never something comparable to UCEPROTECT,
It's FP-rate is exorbitant, Michelle just started spamming NANAE
with daily automated postings of useless stats.
That list could be continued ....

So whatever SORBS is doing, is the SORBS issue, not ours.
 
>charging a fee for delisting in any circumstance is a bad idea."
 
The question was not if it is a bad choice, the question was if that
has to be subject in an BCP or even an RFC as "MUST NOT".

Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network

---

From: John Leslie <[email-masked]>
Date: Sun, 27 Feb 2011 20:10:28 -0500

> change the language about pay to delist in DNSBL practices draft.

   I'm afraid I must disagree with John Levine's call of consensus. :^(

> otherwise I think we will consider the discussion over.

   I do see rough consensus that charging for de-listing is a bad idea;
but that's not what the current text says.

   I have previously expressed discomfort with the language, because
even if I think the UCEPROTECT practice is a bad idea, it would not
follow that charging for a manual operation is always bad, nor would
it follow that manual operations should be discouraged.

   With Claus now claiming that this business model actually works,
I am even more uncomfortable saying it MUST NOT be used.

   It seems to me that, although the flame-content is higher than I
would wish, useful information _is_ being exchanged here, and further
discussion is warranted.

--
John Leslie <[email-masked]>

---

From: John Levine <[email-masked]>
Date: 28 Feb 2011 01:26:52 -0000

>I disagree here and note that legislators may look to this BCP later
>if they intended to write such legislation.

Having helped some actual legislators write actual legislation, I
find it utterly implausible that anyone would ever legislate the
practices of DNSBLs in other than the most general terms.

Note that in the US they're protected by 47 US 230 which says they can
do anything they want so long as there's a plausible good faith basis
for doing so.  Case law confirms that making mistakes does not mean
you weren't acting in good faith.

R's,
John

---

From: Seth <[email-masked]>
Date: Sun, 27 Feb 2011 23:55:08 -0500 (EST)

Kelly Molloy <[email-masked]> wrote:

> of its customers--the sites who USE it. If someone pays me $50 and
> my data tells me that IP is still spamming but I have to either
> return the money or delist the IP anyway, who benefits?

Delist it.  It gets auto-relisted 3 seconds later.  Who gets hurt?
The spam-emitter, who paid for 3 seconds of deliverability.  If the
spam-emitter is legitimate but ineffective, the cost gives him an
incentive to do better next time.

> Not my users. It's selfish and ineffective.

Klaus seems to believe it's effective because it provides the
legitimate accidental spam-emitters more incentive to ensure that
their problem is fixed.

In any case, there's no inter-operability issue, so MUST or even
SHOULD is too strong.

>> I further question as to why we would deny a DNSBL a revenue model
>> derived from those causing the problem.
>

That's what we're arguing about.

It is probably sub-optimal in most cases.  I don't agree that it's
always wrong.

Seth