Subject: Re: The Accountable Web RE: not listening

From: Nathaniel Borenstein <[email-masked]>
Date: Wed, 12 Jul 2006 10:43:48 -0400

On Jun 28, 2006, at 5:51 AM, Harald Alvestrand wrote:

> Shouting "pedophile" or "terrorist" tends to shut down reasoned debate 
> in most public spaces, and reduce the respect for facts to a level 
> that is far below any level I'm willing to enter into debate on.

I agree.  But the fact that people are hysterical doesn't necessarily 
mean there isn't a problem at all, either.  Statistically, parents 
should be more worried about their kids not getting vaccinated than 
about them being abused by a stranger.  But when such horrors actually 
happen, statistical arguments are no comfort to the unlucky parents, 
and neither the media nor politicians can resist using their suffering 
to increase ratings or garner votes.

As engineers and scientists we have to be more rational about these 
topics than the general public, but we still have to take them 
seriously.  If the Internet has caused even one additional case of 
child abuse, then all of us who have helped build the Internet bear 
some responsibility to confront the problem.

It would be good if we had a clear, non-technical statement showing how 
the IETF is working on technologies which, in the long run, can help 
with tracing and apprehending the bad guys while preserving privacy.  
We need to make it clear to the rest of the world that we as an 
institution are opposed to child abuse (and terrorism, for that matter) 
and are making a sincere effort to find effective and appropriate 
countermeasures.  Otherwise, I predict that ineffective and 
inappropriate countermeasures will eventually be forced upon us.

None of the above should be construed as meaning that I think these 
problems are solvable.  But if anyone is going to be worrying about 
these things and looking for solutions, it should be us, because anyone 
else is likely to do far worse.  -- Nathaniel

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Keith Moore <[email-masked]>
Date: Thu, 13 Jul 2006 08:45:47 +0200

> with tracing and apprehending the bad guys while preserving privacy. 

As far as I can tell, the threats to individuals that result from 
traceable network transactions are at least as great as the threats that 
result from anonymity. We need to be thinking in terms of balancing the 
risk from those two kinds of threats.  This is hard because the 
relationship between the two kinds of threat varies from one place to 
another and from one time to another.

So while we can make a non-technical statement that protecting kids and 
privacy are both good things, as engineers we should realize that things 
aren't nearly so simple.

Keith

es a call" based perhaps on somebody's request with some modest effort to demonstrate that a spec is ready for the next step, I think that actually would be a fine two-step approach.

Eliot

---

From: Keith Moore <[email-masked]>
Date: Thu, 13 Jul 2006 08:45:47 +0200

Keith

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 17 Jul 2006 22:02:43 +0200

Keith Moore wrote:
 
> As far as I can tell, the threats to individuals that result
> from traceable network transactions are at least as great as
> the threats that result from anonymity. We need to be
> thinking in terms of balancing the risk from those two kinds
> of threats.  This is hard because the relationship between
> the two kinds of threat varies from one place to another and
> from one time to another.

ACK.  Nevertheless I want to be able to protect "my" mail from
addresses as specified in RFCs 4408 and 4409, and if others
prefer DKIM for slightly different purposes that's also fine,
it only doesn't solve my problem.

Of course I also do want to be able to send "from" unprotected
addresses, e.g. to sort out technical issues, or if I'd want to
send (pseudo-) anonymous mails.

If receivers decide to reject all (pseudo-) anonymous mails it
might be a dubious idea, but it doesn't justify to "forbid" or
"block" the tested (SPF) / proposed (DKIM) protection schemes.  

If such schemes simply _cannot_ work as designed for technical
reasons it's a different issue.  The IAB decided that this is
no reason to fix another proposal (SID), but at least it's very
clear that it won't fly as proposed standard.  And the authors
are free to tackle the real problems in RFCs 2822 and 4409.

Frank