Subject: Sarcarm and intimidation

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 20 Jul 2005 09:35:01 -0700

> the Internet is composed of Autonomous Systems, and they take the 
> first word of the name very seriously. I suspect ISP accountability 
> in China, for example, may be as successful as copyright enforcement 
> in that region.

Everyone has a common interest in keeping the Internet.

Thus far law enforcement outside the US have arrested and prosecuted
considerably more suspected Internet criminals than the US.

Most countries are anxious to avoid becoming the next Nigeria. Those 419
scams do not help the country attract foreign investment.

> Maybe we would all be happier if you decided to not waste your time 
> arguing with the folks in "this forum," since we are so out of touch 
> and irrelevant to the future of network security, at least as defined 
> by the practitioners who appear to emphasize the appearance of 
> security over security per se.

You appear to assume that nobody is interested in trying any approach
other than those that have thus far failed to gain widespread adoption
and use.

I am sure the majority of the people in this forum would prefer to look
at ways of securing the Internet to protect against the real internet
criminals stealing pensioners' life savings rather than continuing to
pursue deployment of IPSEC which in its current form would not have the
slightest effect on the crimes that are being perpetrated.

The end-to-end absolutist approach to Internet security has been
attempted in this forum for 20 years. The results do little to recommend
the theory. There is not one example of successful deployment of system
built to that architecture. By deployment here I mean used, not simply
shelfware.

It is time to consider the possibility that alternative approaches might
be valid at the very least. 

If someone with a thinner skin than myself made that sugestion they
might actually act on your advice. I really do not think that is
something that Brian wants to see.

There would probably be a lot more people working in the IETF who share
my views if they did not meet with sarcasm, patronising remarks and
intimidation. My views are no longer considered to be either radical or
out of the mainstream in the security practitioner field.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 20 Jul 2005 19:06:03 +0200

> considerably more suspected Internet criminals than the US.

This may come as a surprise to you, but the rest of the world is  
actually larger than the US. (Oh wait, there I go with that dreaded  
sarcasm. Sorry.)

> criminals stealing pensioners' life savings

???

How can you secure a communication channel against crime in general?

If you expect the IETF to stop pensioner savings stealing, you're  
setting yourself up for a big disappointment.

> built to that architecture. By deployment here I mean used, not simply

SSL is far from perfect, but I wouldn't say it's shelfware. It allows  
consenting hosts to secure themselves against men in the middle and  
eavesdroppers without aid from the network. E2e in its purest form,  
I'd say.

> be valid at the very least.

Such as?

---

From: Dean Anderson <[email-masked]>
Date: Thu, 21 Jul 2005 12:03:04 -0400 (EDT)

Hallam-Baker is active in anti-spam issues.  More inline.

On Wed, 20 Jul 2005, Iljitsch van Beijnum wrote:

> > I am sure the majority of the people in this forum would prefer to
> > look at ways of securing the Internet to protect against the real
> > internet criminals stealing pensioners' life savings
> 
> ???
>

They can't. Information Theory (covert channels et al) shows its
impossible.  This fact does not deter anti-spammers in anyway from saying
they can and will "if only they'd get cooperation".  They've known about
the theoretical impossibility since 2003 from me, at least, not counting
the actual experience of failure of every scheme conceived over a ten+
year period.  Anti-spam is a whackamole game, and information theory shows
it will always be a whackamole game.

Hallam-Baker responded to this question and offered "proof" the internet
can be so secured:

  >Accountability.
  >
  >They did it for the telephone system in the 1920s....
  >
  >We can do it for the Intetnet.

Another innaccuracy. We still have telephone fraud today. Catching
telephone fraud is also still (similarly) a "whackamole" game.  They only
thing they did was start looking for fraud and trying to catch and
prosecute it. That process still continues. Telephone fraud is not
__prevented__. It is merely detered by penalties, like most crimes against
civil society.  Indeed, the telephone system is mostly "open relay", with
relatively little user pre-authentication (calling cards).  Fraud is
detected post-use, from call detail records (ie logs), just like open
relay and other kinds of abuse. [And I think you can read "telephone
fraud" in my statements here as meaning either "unauthorized calls", or as
"scams conducted over the telephone", or just about anything else that
would qualify as a crime the telephone system is somehow supposedly secure
against.]

> setting yourself up for a big disappointment.

Right.  Exactly.  Yet we still have IETF people promisng they are going to
stop spam through expensive, patented email authentication systems.  
That's just complete nonsense.  If only it were a simple mistake on their
part, but it isn't simply a mistake.  A great deal of money is involved.  
And lies, defamation, and intimidation against anyone who speaks against
it.

However, there is certainly intimidation by the IETF. I've experienced it
from former IESG members Dave Crocker and Noel Chiappa just recently.  
And public hostility from Harald Alvestrand (former IETF chair).  I've
experienced retribution in the form that IETF leaders who refuse to
chastise plainly ad hominem attacks on people with unpopular views. I've
experienced undeclared conflicts of interest by working group chairs. I've
even experienced the Sergeant of Arms using his official role to argue
merits of an Internet Draft [message: don't disagree on the draft or else]
in front of the current chair, who did nothing, even after I commented on
the irrelevance of the I-D argument made by the Sergeant at Arms Ted T'so.  
Carpenter (IETF Chair) told Nick Staff his views were a waste of time.

There are many people on several sides of the spam argument: Those who
agree with me (no technical solution), and those who agree with
Hallam-Baker (technical solutions) (not that either of us are speakers for
the respective sides), and the pro-spam viewpoint is entirely
unrepresented. But I haven't seen any intimidation of Hallam-Baker's side
at the IETF.  If it is there on working groups, it hasn't been
specifically brought to the attention of the ietf list.  Hallam-Baker's
posts on the current thread seems more to do with facts of disagreement
rather than evidence of misbehavior in communicating those facts.  If
there is intimidation of Hallam-Baker, I'm against the intimidation. His
side has a right to make their case. My side has a right to show why its
wrong.

But there is some evidence of misbehavior against myself and my views, and
others who share those views, as I outlined above.

It is most interesting that Crocker and Alvestrand want to have a new AUP.  
They are among the intimidators. The leaderhip can't fairly enforce the
current rules without bias against unpopular viewpoints or "irritating"
people. An additional AUP is just more for them to abuse.

		--Dean

[it is an interesting asside that "irritating" is often used agains those
who are correct, but their information is unwanted. For example, a crowd
catches a known criminal, and wants to lynch the criminal, but one person
stands up and says he should be tried in court. That person is
"irritating".  But engineering isn't a popularity contest. "Irritating" is
a fact one may have to simply accept.]

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000