Subject: RE: [Asrg] draft-irtf-asrg-dnsbl-02.txt

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 7 Dec 2005 07:01:20 -0800

> Behalf Of Douglas Otis

> Black-holing is exactly how the BGP version of the list 
> works.  All traffic is "black-holed" for that IP address.  
> The term blacklist  
> also has other legal meanings that should be avoided if possible.   

IANAL but I have little respect for legal strategies that disrespect the
intelligence of the court.

A black-hole list is clearly maintained for the same purposes as a
blacklist. You do not avoid legal liability by changing the name.

The terms 'black-hole' or 'block-list' are arguably indicative of the
intended use of the list. If anything they make the legal situation
worse.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 7 Dec 2005 12:34:52 -0500 (EST)

"Hallam-Baker, Phillip" <[email-masked]> wrote:

> The terms 'black-hole' or 'block-list' are arguably indicative of
> the intended use of the list. If anything they make the legal
> situation worse.

I use the <whatever you want to call it> list as an input, one of
many, to a scoring algorithm.  It's a _review_ list.

Suppose someone implemented a list which for any IP address returned
127.0.x.y, where x.y mapped into how spammy the list maintainer
thought the IP address was.  It could be used as both a whitelist ("if
the score is low, accept") and blocklist ("if the score is high,
reject") as well as for other purposes ("if the score is low but not
low enough for auto-accept, subtract 2 from the SpamAssassin score; if
it's high but not too high, add 2; if the list says the IP emits much
but not all spam, run these extra checks").

What do you call _that_ list?

Seth

---

From: Douglas Otis <[email-masked]>
Date: Wed, 7 Dec 2005 09:46:09 -0800

On Dec 7, 2005, at 7:01 AM, Hallam-Baker, Phillip wrote:

>
>> Behalf Of Douglas Otis
>
>> Black-holing is exactly how the BGP version of the list works.   
>> All traffic is "black-holed" for that IP address.  The term  
>> blacklist also has other legal meanings that should be avoided if  
>> possible.
>
> IANAL but I have little respect for legal strategies that  
> disrespect the intelligence of the court.
>

This is not about just another protocol, but represents an activity  
that offers opinions that may result in litigation.  Avoiding the  
entrenched terminology "blacklist" has been helpful in our  
experience, and the advice obtained for moving forward.  The intent  
of most lists is to offer an opinion that traffic should be _blocked_  
or _black-holed_ based upon a network identifier.  This intent would  
not be related to the legally encumbered "blacklist" as found in many  
Federal and state laws pertaining to individuals.  Clarifying this  
detail may prove an otherwise needless legal expense, well before  
being heard in court.  It is not a matter of court intelligence, but  
rather strategies used by bad-actors.  The intelligent strategy would  
avoid loaded terminology that _will_ be used to invoke additional  
regulations.

-Doug

---

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 7 Dec 2005 09:51:13 -0800 (PST)

> but not all spam, run these extra checks").

Do please pick a name. I've been working on prototype (actually two of 
them) for system similar to described above ('spamness' determined based 
on presense of ips in ipblock in multiple blacklists).

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: [email-masked] (Justin Mason)
Date: Wed, 07 Dec 2005 10:20:00 -0800

> on presense of ips in ipblock in multiple blacklists).

Many commercial firms seem to call them "reputation services".  That's
a very nebulous PR name though, a better technically-descriptive name
would be welcome.

for what it's worth, IADB is another one along those lines -- quite
long-standing at this stage.

  http://www.isipp.com/iadb.php

- --j.

---

From: John Levine <[email-masked]>
Date: 7 Dec 2005 18:41:57 -0000

>127.0.x.y, ...

>What do you call _that_ list?

Fortunately, we still have 24 unassigned values of x in DNSxL.

R's,
John

---

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 7 Dec 2005 10:45:59 -0800 (PST)

> a very nebulous PR name though, a better technically-descriptive name

Correct and I'll just note that any blacklist or whitelist is a reputation 
service.

>  http://www.isipp.com/iadb.php

Well, I'll not reveal the details right now (and there are still some
tough algorithm problems I'm trying to resolve on the concept I'm
working on), but let's just say that it is going to be nothing like iadb.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: "william(at)elan.net" <[email-masked]>
Date: Wed, 7 Dec 2005 11:01:05 -0800 (PST)

> Fortunately, we still have 24 unassigned values of x in DNSxL.

As a matter of fact I've used the term RBL to mean "Reputation block list" 
at http://www.completewhois.com/rbl_lookup.htm which begs for use of
DNSRL as DNS Reputation List (a general term for everything). Then again 
I've also already used it used in one docuent to mean DNS Revocation List 
(i.e. Doug Otis's concept).

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Douglas Otis <[email-masked]>
Date: Wed, 7 Dec 2005 12:11:27 -0800

> Fortunately, we still have 24 unassigned values of x in DNSxL.

The term "block list" is already used in this draft as well.  Drop  
the terms block, black and white, but instead refer to the nature of  
the opinion offered, where recipient action is determined individually.

Rather than Black and White, perhaps Negative, Positive, or Rated?

This could mean DNS-PL, DNS-NL, or DNS-RL.

-Doug

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 7 Dec 2005 15:52:56 -0500 (EST)

> a very nebulous PR name though, a better technically-descriptive name

I like "review".  That emphasizes the parallelism with a restaurant,
movie, book, Health Department, or kashruth certification review.

Seth

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 7 Dec 2005 15:59:41 -0500 (EST)

> Fortunately, we still have 24 unassigned values of x in DNSxL.

I dibs "DNSRL" (for "review" or "rating").

Putting that into the URL (w.z.y.x.dnsrl.hoster.tld) couldn't hurt.

Seth

---

From: Barry Shein <[email-masked]>
Date: Thu, 8 Dec 2005 18:03:57 -0500

A) I think that draft is very misguided in several ways, much like
others have mentioned here.

B) Instead of assuming we're trying to come up with a term that might
slide by dumb joe/jane sixpacks, particularly if you get to argue them
to death should they doubt you, instead assume you're trying to come
up with a terminology which would be reasonable to a smart
lawyer/judge/engineer with experience in the field who isn't being
actively evil or hostile tho is possibly advocating a contrary
viewpoint (e.g., his/her client feels s/he/it has been damaged.)

You're not going to just win with some tricky or vague term, but we
can at least shoot for honest and forthright. And if not then back off
because you're going to be laid bare.

THAT SAID...

I'd suggest an analogy with something more like a credit database or
these lists landlords share of deadbeat tenants or casinos keep of
people they believe (and by their definition) cheat (forget the fancy
hard case card counters etc I mean people who will get caught palming
cards, stealing chips from tables, various slight-of-hand tricks to
make it seem like they bet on the winner or didn't on a loser, hustle
patrons, etc.)  Ok, the latter isn't usually a third-party function
but there's some analogy there.

No one forces anyone to make a particular decision based on a credit
rating. In fact, some firms seek out customers with poor credit or at
any rate (hah) welcome them albeit with less than optimal terms.

Anyhow you're not going to entirely escape the the liability for
potential errors and/or maliciousness (it's happened to me) except
perhaps by being able to assert that the information was gathered and
reported in a responsible and reasonable best effort kind of way.

The point being: Go for honest and forthright.

These blacklists gather and redistribute information on certain
negative aspects of email sources, and by omission imply neutrality.
That's what people use them for, when they use them.

Much like a credit reporting agency, if an analogy is
needed. Including an admittedly variable ability to contest inclusion
and clear their inclusion.

-- 
        -Barry Shein

The World              | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 800-THE-WRLD        | Login: Nationwide
Software Tool & Die    | Public Access Internet     | SINCE 1989     *oo*

---

From: John Levine <[email-masked]>
Date: 9 Dec 2005 01:35:39 -0000

>others have mentioned here.

Now I'm completely confused.  Are we sure we're talking about the same
document?  The one under discussion describes the technical way that
DNSBLs and DNSWLs work.  It most definitely absolutely does not
address policy questions of what addresses should or should not be in
any particular list other than the trivial suggestion that there be a
test entry for 127.0.0.2.  The policy advice will be in the BCP, a
separate document which someone else is working on.

As far as the names go, for people who've forgotten, here's what it
says:

   The standard term is now DNS Blacklist or Blocklist, or DNSBL.
   Some people also publish DNS-based whitelists or DNSWLs.

R's,
John

---

From: Barry Shein <[email-masked]>
Date: Sun, 11 Dec 2005 18:45:03 -0500

On December 9, 2005 at 01:35 [email-masked] (John Levine) wrote:
 > document?

Sorry, I still had that previous document about how the concept of
(non-individual) BLs are bad for the net on my mind and hadn't
double-checked the referenced URL.

    -b