Subject: Categorization of TCP/IP service provision types (was: Re: The right to refuse, was: Re: Principles of Spam-abatement) (FWD: I-D ACTION:draft-klensin-ip-service-terms-00.txt)

From: John C Klensin <[email-masked]>
Date: Thu, 18 Mar 2004 14:26:31 -0500

Last week's version of the spam discussions, led to an 
interesting (to me) side-discussion about what was, and was not, 
an "Internet connection" service.  There have been discussions 
on and off for years (since before the User Services area was 
inactivated) about doing such a set of definitions.   On my 
general theory that it is better to try to actually do something 
than it is to discuss forever how desirable it might be, I've 
hacked a preliminary document together and posted it as 
draft-klensin-ip-service-terms-00.txt.

This clearly isn't finished, indeed, it is not much more than a 
skeleton with a few examples.  It needs more work, probably 
additional categories, and more clarity about the categories 
that are there.  If there is real interest in the subject, I'd 
like to see someone else take over the writing and editing.   If 
there isn't any real, perhaps we can stop spending time 
discussing the subject.

I-D announcement attached.

    john

Subject: I-D ACTION:draft-klensin-ip-service-terms-00.txt
From: [email-masked]
To: IETF-Announce: ;
Date: Thu, 18 Mar 2004 09:49:10 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: Terminology for Describing Internet Connectivivy
	Author(s)	: J. Klensin
	Filename	: draft-klensin-ip-service-terms-00.txt
	Pages		: 6
	Date		: 2004-3-17
	
As the Internet has evolved, many types of arrangements have been
   advertised and sold as 'Internet connectivity'.  Because these may
   differ significantly in the capabilities they offer, the range of
   options, and the lack of any standard terminology, has cause
   considerable consumer confusion.  This document provides a list of
   terms and definitions that may be helpful to providers, consumers,
   and, potentially, regulators in clarifying the type and character of
   services being offered.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-klensin-ip-service-terms-00.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-klensin-ip-service-terms-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-klensin-ip-service-terms-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 19 Mar 2004 18:34:55 -0700 (MST)

> From: John C Klensin 

> an "Internet connection" service.  ...

> that are there. 

I think it is about as clear as it should be.  Much more clearity
would require sample contracts or risk getting bogged down in
nitpicking on whether it is practical to run an SMTP server on a
dynamic IP address, whether an IP address that changes once a year
is really dynamic, and so forth.

What I see missing are hints why "dynamic addresses" are widely
blacklisted.  There need to be words about the first three classes
usually being priced so low that providers cannot afford to keep records
of who was using a given address when it was used to send spam, denial
of service attacks, or other naughtiness, or cannot afford to have
abuse department to consult any records there might be.

>                  If there is real interest in the subject, I'd 

The subject is not going to do away as long as people think they have
a fundamental human right to do the equivalent of moving to a cardboard
box under a bridge and then demanding banks and creditcard companies
to see them as creditworthy as their bourgeois neighbors.

If no one else will take the job and if there is any hope of getting it
past the IESG, I'll happily be your editor, elaborator, or whatever.  My
strengths don't include writing intelligible English, but it needs doing.

Vernon Schryver    [email-masked]

---

From: "Spencer Dawkins" <[email-masked]>
Date: Fri, 19 Mar 2004 21:40:08 -0600

Hi, John,

I like the idea, and your draft is more than a skeleton plus examples.

There are a couple of concepts that could be added if you could come
up with non-perjorative names...

- "Filtered" actually splits into a few possibilities - the service
provider may actually be "filtering" known services, or may be using
NAT+ALG so that "unknown" services aren't available - not because the
service provider said "no", but because the service provider has to
actually do something to accommodate a new service.

- The client/server orientation doesn't explicitly handle peer-to-peer
connectivity (unless all the SIP clients have to be servers so they
can receive incoming phone calls). Saying "I want incoming phone
calls" is different from saying "I'm running my own mail server".

Spencer

----- Original Message ----- 
From: "John C Klensin" <[email-masked]>
To: <[email-masked]>; "Vernon Schryver" <[email-masked]>
Sent: Thursday, March 18, 2004 1:26 PM
Subject: Categorization of TCP/IP service provision types (was: Re:
The right to refuse, was: Re: Principles of Spam-abatement) (FWD: I-D
ACTION:draft-klensin-ip-service-terms-00.txt)

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 19 Mar 2004 21:07:11 -0700 (MST)

> From: "Spencer Dawkins" 

> I like the idea, and your draft is more than a skeleton plus examples.

quite true.

> ...

So you say now, but wait until the ROKSO spammers discover the bonaza
in VoIP.  Instead of "owned" proxies pumping email, they'll use the
same boxes to push pre-recorded voice messages.

For mail, the filtering at issue here has not been against incoming mail
to local SMTP servers but outgoing mail from local SMTP clients.

An ISP might want to filter against incoming port 80 so customers can't
use lots of the ISP's bandwidth on their HTTP servers, but against
outgoing port 25 to minimize the ISP's abuse handling costs.
The DUL DNS blacklist filtering that non-spammers whine about would
be that if it existed but currently is entirely at third party ISPs
and mail targets.  It is entirely orthogonal to and independent of the
filtering John wrote about.  It is a reaction to the lack of filtering
done by the low priced ISPs.

Of course, none of those words belong in John's document.

Of course, I'm not serious about VoIP spam.  To start, the bandwidth
needed for 10,000,000 5KByte spam is less than the bandwidth needed
for 10,000,000 60 second phone calls.

---

From: John C Klensin <[email-masked]>
Date: Mon, 22 Mar 2004 13:19:12 -0500

--On Friday, 19 March, 2004 18:34 -0700 Vernon Schryver 
<[email-masked]> wrote:

>> interesting (to me) side-discussion about what was, and was
>> not,  an "Internet connection" service.  ...
>
>> This clearly isn't finished, indeed, it is not much more than
>> a  skeleton with a few examples.  It needs more work,
>> probably  additional categories, and more clarity about the
>> categories  that are there.
>
> I think it is about as clear as it should be.  Much more
> clearity would require sample contracts or risk getting bogged
> down in nitpicking on whether it is practical to run an SMTP
> server on a dynamic IP address, whether an IP address that
> changes once a year is really dynamic, and so forth.

Those are the places where I clearly don't think we should go. 
To do so rapidly gets us, I think, to a function matrix.   That 
would be conceptually useful, but would not be extremely 
unlikely to be adopted by vendors and hence would not help at 
all with the "promote truth in advertising" theme that started 
the attempt.

> blacklisted.  There need to be words about the first three
> classes usually being priced so low that providers cannot
> afford to keep records of who was using a given address when
> it was used to send spam, denial of service attacks, or other
> naughtiness, or cannot afford to have abuse department to
> consult any records there might be.

Text would be welcome, but it seems to me that this addresses a 
different theme.  One could say that quality of customer service 
usually improves with categories, but that isn't universally 
true until one starts making categories of customer service 
efforts.  From my experience, I would even question your 
description above, although we don't disagree about the 
consequences: my impression is that a number of the "broadband" 
operators offering low-end services actually have fairly good 
logs.  What they don't have are abuse departments with the will 
and resources to dig through those logs and identify specific 
offenders.  Hand that same provider a subpoena associated with, 
e.g., some clearly criminal behavior, and records seem to turn 
up in a lot of cases.

What I've done in response to several comments is to add text to 
the beginning of the terminology section that tries to make it 
clear that these definitions are about what the provider intends 
to offer.  Whether the restrictions are imposed by AUP (or 
contractual terms and conditions) and whether technical means to 
enforce particular restrictions are effective on a particular 
day seems less important.

The "dynamic address" issue is, from that point of view, just a 
"technical means" to enforce (or just consistent with) an AUP or 
Ts and Cs.  I.e., if one believes that blacklisting dynamic 
addresses is rational, then part of the reason for that isn't 
"too cheap" or the addresses themselves, it is that these 
dynamic addresses tend to show up only in "server prohibited" 
environments.   Maybe it is equally rational to blacklist an 
address range on the theory that anything coming from that range 
is in violation of provider conditions of service and that one 
bad deed (violating AUPs or Ts and Cs) is as bad as another 
(demonstrated spamming).   But I don't see a reasonable way to 
incorporate any of that reasoning (whether one agrees with it or 
not) into the document without generally weakening it.  If you 
do, please suggest text.

>> like to see someone else take over the writing and editing.
>> If  there isn't any real, perhaps we can stop spending time
>> discussing the subject.
>
> The subject is not going to do away as long as people think
> they have a fundamental human right to do the equivalent of
> moving to a cardboard box under a bridge and then demanding
> banks and creditcard companies to see them as creditworthy as
> their bourgeois neighbors.

Of course, that belief is not limited to the Internet... for 
better or worse.

> If no one else will take the job and if there is any hope of
> getting it past the IESG, I'll happily be your editor,
> elaborator, or whatever.  My strengths don't include writing
> intelligible English, but it needs doing.

Thanks.  I've started a discussion with some selected ADs about 
what they want to do with this, if anything.  My intent is to 
wait to see what they have to say.  If they aren't interested, 
and interested in moving toward BCP, then the effort is, as far 
as I'm concerned, dead.  If they want a WG, then the next real 
task is "charter".  Otherwise... well, let's how they want to 
proceed.

And, as far as I can tell, you do intelligible English very well.

    john

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 23 Mar 2004 08:48:02 -0700 (MST)

> e.g., some clearly criminal behavior, and records seem to turn 

That's all true.  The details of the reasons and excuses for not
dealing with abuse except when coerced by lawyers or badges vary
and are not germane.

> day seems less important.

exactly.

> not) into the document without generally weakening it.  If you 

No, the rational reason to blacklist "dynamic" addresses is that
blocking them stops a lot of abuse while affecting very little legitimate
traffic.  Whether the high true positive and low false positive rates
are because providers choose to ignore complaints or some other reason
is, or needs to be irrelevant in this document.

Perhaps it would be enough to say just that, along the lines of

  ... mail directly from the IP addresses of customers of X instead of
  via MTAs run by service providers is rejected by much of the rest
  of the Internet because it is almost certainly "spam" or otherwise
  objectionable.  The terms of service of X usually require the use
  of MTAs operated by the service provider and prohibit the operation
  of MTAs at the customers' IP addresses.  Practically all legitimate
  mail from users of X use their service providers' MTAs.  Some service
  providers use technical mechanisms such as "port 25 filtering" to
  enforce their terms of service that require that their customers'
  mail use the providers' MTAs.

   ("X" because I'm not sure about factoring that text into each
   of the 1st three descriptions or having it one place.)

> task is "charter".  Otherwise... well, let's how they want to 

That sounds right to me.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 23 Mar 2004 09:27:26 -0700 (MST)

> ...
> However, the above statement just isn't true unless the 
> collection of terms and conditions I've seen are a very odd 
> subset.   "You will not run a server" is typical.  "You are 
> required to use ours" is much less common, and is often 
> associated with a commercial motive, e.g., "you are required to 
> use ours, and our domain on your outgoing mail, unless you pay 
> us more money".

I agree my words are wrong.  I'd forgotten port 587.

When they say "you will not run a server" they are also implicitly
saying "you will use someone else's MTA instead of your own."  You're
right that they don't prohibit the use of SUBMIT, POP3, or perhaps
even port 25 SMTP to reach an allowed MTA.  However, when they say
"you will not run a server," they do not mean "you will not run an
SMTP server" in the sense I undestand "SMTP server."  Most people think
"mail server" is any MTA and not only a system that answers port 25
to receive mail.

As I think you've said elsewhere, it is best to ignore service providers'
motives.  That allowing customers to run "servers" increases provider
costs for bandwidth, technical support, and abuse handling is irrelevant.
The document should not spell out business models any more than it
should have a matrix of all possible combinations of offerings or
technical details of how the limitations of the various types of
services are implemented.

---

From: John C Klensin <[email-masked]>
Date: Tue, 23 Mar 2004 11:04:39 -0500

--On Tuesday, 23 March, 2004 08:48 -0700 Vernon Schryver 
<[email-masked]> wrote:

>   ... mail directly from the IP addresses of customers of X
> instead of   via MTAs run by service providers is rejected by
> much of the rest   of the Internet because it is almost
> certainly "spam" or otherwise   objectionable.  The terms of
> service of X usually require the use   of MTAs operated by the
> service provider and prohibit the operation   of MTAs at the
> customers' IP addresses.  Practically all legitimate   mail
> from users of X use their service providers' MTAs.  Some
> service   providers use technical mechanisms such as "port 25
> filtering" to   enforce their terms of service that require
> that their customers'   mail use the providers' MTAs.
>
>    ("X" because I'm not sure about factoring that text into
> each    of the 1st three descriptions or having it one place.)

     john

---

From: jfcm <[email-masked]>
Date: Tue, 23 Mar 2004 23:29:31 +0100

when will we come back to catenet, so we can put the ISP in real competition?

At 17:04 23/03/04, John C Klensin wrote:
>However, the above statement just isn't true unless the collection of 
>terms and conditions I've seen are a very odd subset.   "You will not run 
>a server" is typical.  "You are required to use ours" is much less common, 
>and is often associated with a commercial motive, e.g., "you are required 
>to use ours, and our domain on your outgoing mail, unless you pay us more 
>money".

---

From: jfcm <[email-masked]>
Date: Tue, 23 Mar 2004 23:27:08 +0100

At 19:19 22/03/04, John C Klensin wrote:
>>The subject is not going to do away as long as people think they have a 
>>fundamental human right to do the equivalent of moving to a cardboard box 
>>under a bridge and then demanding banks and creditcard companies to see 
>>them as creditworthy as their bourgeois neighbors.
>
>Of course, that belief is not limited to the Internet... for better or worse.

Actually it could be a way of describing mobiles. And it also works for 5 
years old kids.
jfc