Digital Island sponsors DoS attempt?

Mailman List Mirror (Read Only)
1

i'd written:

> well, be careful with your acl's, because if you accidently disrupt
> nonabusive traffic as a side effect of protecting your network from
> abuse, you'll shortly be hearing complaints from EFF about how you've
> disenfranchised said nonabusers.

someone answered:

You've got to be kidding me.

no i am not. in http://www.eff.org/effector/HTML/effect14.31.html#II we see:

The focus of efforts to stop spam should include protecting end users and
should not only consider stopping spammers at all costs. Specifically, any
measure for stopping spam must ensure that all non-spam messages reach
their intended recipients. Proposed solutions that do not fulfill these
minimal goals are themselves a form of Internet abuse and are a direct
assault on the health, growth, openness and liberty of the Internet.

Email is protected speech. There is a fundamental free speech right to be
able to send and receive messages, regardless of medium. Unless that right
is being abused by a particular individual, that individual must not be
restricted. It is unacceptable, then, for anti-spam policies to limit
legitimate rights to send or receive email. To the extent that an anti-spam
proposal, whether legal or technical, results in such casualties, that
proposal is unacceptable.

i never thought i'd feel a need to lecture shari or john on the nature of the
protection in "protected speech", so, i have not even tried.

2

Don't pretty much all methods of spam reduction block some legit mail? So
the question is, do you want spam redcuction with some potential risk, or
do you want all email intended for you. I bet those who pay for
additional bandwidth usage don't share in the opinion of the article
below.

Brian "Sonic" Whalen
Success = Preparation + Opportunity

3

Don't pretty much all methods of spam reduction block some legit mail? So
the question is, do you want spam redcuction with some potential risk, or
do you want all email intended for you. I bet those who pay for
additional bandwidth usage don't share in the opinion of the article
below.

There are several interesting points to consider:

+-Spam extreme

+-You get all spam, because it's ok. You also get all your normal mail.

+-You get a small amount of spam, but all your normal mail. This is the

best we can do and let you get all your normal mail. This is the EFF's
position.

+-You get no spam, and all your normal mail. This a utopia that will

likely never be reached.

+-You get no spam, and get most, but not all of your normal e-mail. In

general this is where I would say MAPS and ORBS and other black lists
try to be, that is they want to remove all spam, but do sometimes catch
legitimate e-mail.

+-You get no e-mail, because it might be spam.

+-No spam extreme.

Most anything inbetween these points is irreverent, as the methods
employed should be able to approach one of these points if implemented
correctly.

Philosophically I think the EFF is right. Blocking a single
legitimate e-mail is very bad, and should be avoided at all costs.
Practically I think that the tactics of MAPS and ORBS and other
blacklists are necessary right now. I'd like nothing better than
to see them go away because better technology has come along.

Legally (eg, if congress were going to pass a new law) I'm very
much on the side of the EFF, because the law must be pure and true,
because anything less impinges on our civil liberties.

4

Philosophically I think the EFF is right. Blocking a single
legitimate e-mail is very bad, and should be avoided at all costs.

Bad for whom? Only for the sender? Does this sender have rights
which should supercede the property rights of recipients and of
infrastructure owners? If so then who gets to decide whether mail
is legitimate or not? The sender again? If so then why should
anyone ever be allowed to filter out "spam", either as a recipient,
or as an infrastructure owner?

That way lies madness. Senders have no such rights, and the
determination of a message's legitimacy lies with recipients (and
perhaps infrastructure owners) NOT senders. A sender's rights are
determined by their contract with their ISP, and an ISP's rights
are determined by their contracts with their peers and transit
providers.

Practically I think that the tactics of MAPS and ORBS and other
blacklists are necessary right now. I'd like nothing better than
to see them go away because better technology has come along.

Agreed. (And note that I no longer have an operational role at MAPS.)

Legally (eg, if congress were going to pass a new law) I'm very
much on the side of the EFF, because the law must be pure and true,
because anything less impinges on our civil liberties.

I also want the law to be pure and true, but there is no civil liberty
involving the transmission of e-mail or any other traffic whose cost
of delivery is paid in any way by anyone other than that sender.

5

> Philosophically I think the EFF is right. Blocking a single
> legitimate e-mail is very bad, and should be avoided at all costs.

Bad for whom? Only for the sender? Does this sender have rights
which should supercede the property rights of recipients and of
infrastructure owners? If so then who gets to decide whether mail
is legitimate or not? The sender again? If so then why should
anyone ever be allowed to filter out "spam", either as a recipient,
or as an infrastructure owner?

I was using legitimate in the sense of 'e-mail that the receiver
wanted to receive'. That could extend to other services as well.
Consider when MAPS blocks a web site because someone is wack-a-mole
spamming directing people to the web site. It may be the case that
there are users out there that never received spam, but wanted to
view the web site and are prevented. On a philosophical level I
have a real problem with that. It's easy to take this to an extreme
as well, if your network ever generates a single spam it should be
disconnected from the Internet.

Legitimate also takes on other forms. If I choose online billing
for phone service, and then don't pay I may not _want_ a message
from the phone company saying 'pay up or else', nor do I think most
people would defend blocking such a message as blocking "spam".

To more precisely define it, UCE is what I care about, those three
words, Unsolicited Commercial E-mail fairly precisely define the
bad type of e-mail. If the methods employed to block UCE block
solicited commercial e-mail, or any form of non-commercial e-mail
then we need to find better methods. (Note, this leaves a small
potential problem, in that people promoting religious beliefs and
the like might attempt to bulk e-mail under the guise of it being
non-commercial. For now I will assume any interesting entity must
have real $$'s invested, and therefor fits a broad definition of
commercial. If it believed this would be a real problem I'll think
about it and form an opinion.)

I also want the law to be pure and true, but there is no civil liberty
involving the transmission of e-mail or any other traffic whose cost
of delivery is paid in any way by anyone other than that sender.

Witness ORBS, who had a judgment against them for doing bad things.
In a way, all those who used and supported ORBS were guilty as
well. I also don't want to see anti-spam provisions in laws that
make us give up rights, like governmental ability to wiretap all
communications without a warrant to scan for spam. That would be
bad, as they would be scanning many non-spam communications. The
spill over from fighting spam can have some dangerous consequences.

I also think it's very important to get past the 'who pays' argument.
It's a good argument from a technology point of view, or from the
individual's point of view, but it doesn't work in the abstract.
Worst case is someone will develop and popularize (or legislate)
a settlement system where the sender can pay for the entire
transaction. If we assume the sender and receiver are expending
equal resources we just doubled the cost to spammers. I suspect
that would be a non-issue to the spammers. It's still orders of
magnitude cheaper than direct mail, or TV or any of the alternatives.
I don't think any of us want to 'rewire' the net to provide a
settlement system that in the end would only legitimize spam, and
likely increase the amount most users receive.

6

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Vixie said:

That way lies madness. Senders have no such rights, and the
determination of a message's legitimacy lies with recipients (and
perhaps infrastructure owners) NOT senders.

How is the recipient of a message that has been blocked before he sees it to
decide whether it was legitimate?

Since most of what MAPS is about is reducing complaints from customers to
their ISP, and thereby reducing support costs, I guess the question is
answered. If no one complains, there is no problem. Since no one can
complain about unseen messages, that means that collateral damage is not
really a problem, since it does not increase support costs.

A sender's rights are
determined by their contract with their ISP, and an ISP's rights
are determined by their contracts with their peers and transit
providers.

And with their customers, who are the ones that are sending and receiving
all
this email in the first place.

- ---
"The avalanche has already begun. It is too late for the pebbles to vote" -
Kosh

7

I was using legitimate in the sense of 'e-mail that the receiver
wanted to receive'. ...

So this now boils down to "if the sender and receiver of a packet/session/etc
are both interested in having it take place, then noone in the middle shall be
allowed to deliberately prevent this from occuring."

What would you mean by "deliberate" in this case? If "e-mail between
consenting adults" was blocked because some NOC person was trying to stop
a DDoS attack that happened to use the same source or destination address
as the "consenting" e-mail was coming from or going to? Should that be
illegal? If not, then why wouldn't a mailserver operator trying to block
spam be allowed to do the same thing?

I also think it's very important to get past the 'who pays' argument.
It's a good argument from a technology point of view, or from the
individual's point of view, but it doesn't work in the abstract.

On the contrary this argument is at its best in the abstract.

Worst case is someone will develop and popularize (or legislate) a
settlement system where the sender can pay for the entire transaction.

A law allowing someone to make micropayments to the telco I get my T1 from,
and to the vendor I buy replacement drives for my RAID box from, and so on,
and which further _required_ me to have my costs offset in this manner, is
beyond rational consideration and I refuse to even discuss it.

Requiring that my inbox have a determinate bank account attached to it so
that these micropayments can be made to me without any explicit contract
between myself and potential senders is on the borderline of irrationality:
we could discuss it but I don't think we'd get anywhere in finite time.

This leaves the requirement that I enter into an agreement before costs are
shifted in my direction. That's where we are right now.

And that's why the "who pays" argument is at its _best_ in the abstract.

8

> That way lies madness. Senders have no such rights, and the
> determination of a message's legitimacy lies with recipients (and
> perhaps infrastructure owners) NOT senders.

How is the recipient of a message that has been blocked before he sees it to
decide whether it was legitimate?

Why would you care, unless you are the receiver? If I decide that all ICMP
traffic from IP addresses that have an odd number of "1" bits in it is not
legitimate and shall not be allowed to reach my web server, then that seems
to be a matter between me and my psychotherapist. I'm not sure why it would
matter to anyone else, including rebuffed senders or NANOG's philosophers.

What this all begs for is a reference standard for "presumed legitimacy" so
that senders can know without waiting for complaints nor seeking explicit
permission, just what kind of traffic they ought or ought not send. As I
said in another note here, such a standard would have to be written in terms
of assertions rather than negations. A peering or transit agreement is quite
explicit since the parties and their specific concerns are known: it can
therefore be of the form "All is permitted except X, Y, and Z." Presumptive
traffic legitimacy or "implicit welcome" is between unspecified parties who
can by definition have no specific concerns and so the standard must take the
form "All is prohibited, except A, B, and C."

9

So this now boils down to "if the sender and receiver of a packet/session/etc
are both interested in having it take place, then noone in the middle shall be
allowed to deliberately prevent this from occuring."

Yes, i would think so. If both parties want it, and both pay for
their part, no one should interfear in the middle.

What would you mean by "deliberate" in this case? If "e-mail between
consenting adults" was blocked because some NOC person was trying to stop
a DDoS attack that happened to use the same source or destination address
as the "consenting" e-mail was coming from or going to? Should that be
illegal? If not, then why wouldn't a mailserver operator trying to block
spam be allowed to do the same thing?

I'll defer the illegal question for the moment, and merely say that
yes, I believe it is wrong. I'll accept him potentially delaying
the e-mail, but tossing it due some other problem is very much a bad
idea.

To borrow a current analogy. Consider if the postal service announced
today that to stop the spread of anthrax they were just going to burn
all of the mail currently in the system. After all, it's for the
greater good.

A law allowing someone to make micropayments to the telco I get my T1 from,
and to the vendor I buy replacement drives for my RAID box from, and so on,
and which further _required_ me to have my costs offset in this manner, is
beyond rational consideration and I refuse to even discuss it.

Requiring that my inbox have a determinate bank account attached to it so
that these micropayments can be made to me without any explicit contract
between myself and potential senders is on the borderline of irrationality:
we could discuss it but I don't think we'd get anywhere in finite time.

Oh, I think the bean counters and legislators could get somewhere
quickly. Do the settlements payed between RBOC's and CLEC's have
anything to do with costs? Nope. Someone has decided it costs
$0.06 (or whatever it is) to terminate a call. If it costs you
less, good for you, if it costs you more tough luck.

They could easily legislate that mail servers must be registered,
and each e-mail results in a $0.06 fee transfered from sender to
receiver. If it costs you more tough, and if it costs you less
good for you. You'd need a license to run a mail server, in which
case you'd have to have the clearing house infrastructure, or you
could contract the mail server service to your ISP. You'd have an
open account, and your balance would go up or down with your ratio
of e-mail.

It "works" in the telco world. It could be argued it's not much
more complicated for ISP's than managing BGP relationships and
billing customers. Most importantly I can see accounting people
and legislators being all for it.

I think this is about the worst thing that can happen. But, if
you argue to capitol hill that you're eating someone else's costs
I'll bet they find a way to compensate you before they find a way
to just prevent it, since most of them think business is good, in
any form.

Note, I'm waiting for this to happen with cell phones. As people
move from land lines to cell phones which can't be tele-solicited
today I can see a cell provider offering a value add service where
the telemarketer can pay an additional fee to cover the costs of
the call. It's 1-800 in reverse, billing the sender. More $$$'s
for cell providers, and if telemarketers find it's the only way to
reach people I'm sure they will pay to do it. Once the receiver
isn't being charged for the calls I doubt and legislative body
would block it.

10

The customer has a choice of providers and can choose a provider that
doesn't use MAPS.

When I used to run an ISP, we had two different mail systems.
1 for those that wanted everything, and 1 for those that wanted
things filtered.

Providers should inform their customers that they are using some
level of filtering.

Seems most of them are, and that most customers want it. Just driving
around the Bay Area one can see signs that promote Spam Free Email from
various providers..

11

> So this now boils down to "if the sender and receiver of a packet/session/etc
> are both interested in having it take place, then noone in the middle shall be
> allowed to deliberately prevent this from occuring."

Yes, i would think so. If both parties want it, and both pay for
their part, no one should interfear in the middle.

Sure, but the sender of a SPAM message selling kiddie porn, VIAGRA, Gas Masks
and a discount on Viagra, etc hasn't asked me if I want it.

And if I tell him, NO I don't want it, they will send it anyway. Or at the very
least tag my address as valid, sell it to someone else who will send me stuff
I don't want.

To borrow a current analogy. Consider if the postal service announced
today that to stop the spread of anthrax they were just going to burn
all of the mail currently in the system. After all, it's for the
greater good.

Don't confuse gov abilities with those of private entities.
Private companies can refuse to accept traffic from those that they wish.

(ramble about how recep comp works in the telco world)

It "works" in the telco world. It could be argued it's not much
more complicated for ISP's than managing BGP relationships and
billing customers. Most importantly I can see accounting people
and legislators being all for it.

Really, the CLECs are now being paid by the ILECS for call termination.
Wow, I must really be out of the loop now.......

12

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> > That way lies madness. Senders have no such rights, and the
> > determination of a message's legitimacy lies with recipients (and
> > perhaps infrastructure owners) NOT senders.
>
> How is the recipient of a message that has been blocked before
he sees it to
> decide whether it was legitimate?

Why would you care, unless you are the receiver?

Funny you should ask, since that's exactly my point. The ISP running the
mail server is not the recipient. The customer to whom the message was
addressed is the recipient. So with that in mind, I re-state my question:

How is the recipient of a message that has been blocked before he sees it to
decide whether it was legitimate?

If I decide
that all ICMP
traffic from IP addresses that have an odd number of "1" bits in it is not
legitimate and shall not be allowed to reach my web server, then
that seems
to be a matter between me and my psychotherapist. I'm not sure
why it would
matter to anyone else, including rebuffed senders or NANOG's philosophers.

Why do you keep changing the subject? This is about email and spam, and
whether the recipient or sender has the right to determine what is a
legitimate communication. You alleged that it was the recipient. I
countered that the recipient cannot determine legitimacy if he cannot see
the
message.

What this all begs for is a reference standard for "presumed
legitimacy" so

No, it begs for the ISP to just deliver the mail that was addressed to the
recipient and stop making up stories about ICMP packets with odd numbers of
1
bits to justify why his support department is so understaffed.

I know what MAPS is about, it is about reducing support costs by reducing
customer complaints of spam. This is why collateral damage is untroubling
to
the MAPS boosters. Collateral damage does little to increase support costs.
Educating users how to filter their own mail costs more money. Bottom line.
Note that I did not say this was good or bad, the world revolves around
money, and this is no different. I just wish MAPS boosters would be honest.
It would move the debate along more quickly to a productive conclusion.

- ---
"The avalanche has already begun. It is too late for the pebbles to vote" -
Kosh

13

I am trying to be good :slight_smile: If you change one word in your definition...
you cover the "small potential problem" (which has been seen already)
without losing anything.

Unsolicited Bulk E-mail.

I don't care if its Commercial, Religious, Charity or other, if its
bulk and unsolicited, its wrong.

The example that immediately jumps to mind was (if memory serves)
May or June 2000... a little girl Sarah Payne was abducted in the UK.
After a few days, people all over the world started getting spammed
asking for help. There was no evidence that she left the country,
yet a mass mailing went out with no regards to geography.

Did I feel bad for Sarah's family? Yes, especially as I had driven
up and down the road she was abducted near several times around the
time she went missing. Were the spammers well meaning? Yes.
My problem with it? "It does not scale". How many kids go missing
every week from somewhere in the world?

14

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Vixie said:
>> That way lies madness. Senders have no such rights, and the
>> determination of a message's legitimacy lies with recipients (and
>> perhaps infrastructure owners) NOT senders.
>
>How is the recipient of a message that has been blocked before he sees it to
>decide whether it was legitimate?

What business is it of yours what procedures other people might take to block email they don't want delivered into their inbox?

>Since most of what MAPS is about is reducing complaints from customers to
>their ISP, and thereby reducing support costs, I guess the question is
>answered. If no one complains, there is no problem. Since no one can
>complain about unseen messages, that means that collateral damage is not
>really a problem, since it does not increase support costs.

Hi, Bob? This is Susan. I haven't received a reply from you regarding the email I sent yesterday, did you get it? You didn't? Hmmm. Let me try resending it.

Hi Bob? This is Susan again. Did you get that second email yet? No?! Maybe you should call your ISP to find out why! Yes, I already called mine, they don't have any info, they say the mail server logs show that both the messages were delivered to your ISP.

Hi, Mr. ISP support guy? This is Bob. It seems that I'm not getting all of my email....

......................

Collateral damage IS a problem, but that's part of why it works to reduce spam.

jc

15

You're assuming that the filterer is silently discarding the message and not
bouncing it. If a site is blocked from sending mail via MAPS or any other
method, the receiver must send a bounce message to the sender to avoid
breaking SMTP.

Assuming the filterer is not breaking SMTP by silently discarding messages,
Bob will receive a message saying that his message couldn't be delivered,
with an explanation.

--Adam

16

I'm not sure I like the use of the word bulk. The reason is that
it is not precise. Is 10 bulk? 50? Is it only bulk if I use a
"spam tool"?

Unsolicited, Commercial, and E-mail all have precise definitions.
particularly if we're going to get something (eventually) into a
useful law I think we need to make sure it is entirely defined of
precise terms.

You do cite a good example of my "small potential problem". Nothing
immediately comes to mind as a good way to catch it without causing
good things to get caught up as well. I'm going to think about it.

17

I see some serious issues here. Cell phones are not
geographically linked as land-lines are. There is a variable cost
in delivering the call to the phone. If I take my at&t cell
phone, get them to send me the GSM card so while I'm traveling
in europe/africa/wherever I can get calls the last thing
I want is to be +/- 6 hours and be woken up. In the same vein
it's illegal for them to make unsolicated calls unless they are
during the hours of 9am-9pm.

  If I live in Eastern time and am traveling and in Hawaii
and they call me at 9am Eastern and i'm just getting to sleep
that would open them up to litigation. (the problem is that even though
calls to cell-phones are illegal by telemarketers they must call more
than 2 times in a year).

  I've also had friends that have moved from one coast to
the other and kept the same cell phone# as there is no difference
in their costs either way and want to keep their friends/family
on the other coast as a local call.

  I'd rather see a solution whereby they are forced to
deliver caller-id of their marketing firm or company name. This way
I can continue to decide to take the call. Unless i'm expecting your
call and know you don't show up on caller-id you are not likely to be
answered unless i'm feeling like entertaining myself.

  It would be not too complicated to add-in sending the name
along with the numerical caller-id info.

  - Jared

(this is getting very off-topic, setting reply-to:)

18

Hi, Mr. ISP support guy? This is Bob. It seems that I'm not getting all
of my email....

You obviously didn't start out in a support position, did you?

Talk about not scaling well...

Charles

19

"550 Mail from open relay " $&{client_addr} " refused - see http://www.orbs.org/verify.php3?address="$&{client_addr}

Where $&{client_addr} is replaced with a dotted-quad IP.

You'd be amazed how many support people at ISPs can't figure that out.
Even *after* they visit the page. I know this because I've gotten
my share of mail "I got this message, and my ISP people dont understand".

Of course, to quote Douglas Adams, that sort of ISP should be "first up against
the wall when the revolution comes" :wink:

        Valdis Kletnieks
        Operating Systems Analyst
        Virginia Tech

20

> I am trying to be good :slight_smile: If you change one word in your definition...
> you cover the "small potential problem" (which has been seen already)
> without losing anything.
>
> Unsolicited Bulk E-mail.

I'm not sure I like the use of the word bulk. The reason is that
it is not precise. Is 10 bulk? 50? Is it only bulk if I use a
"spam tool"?

Bulk is more than 1 copy. How do I know if something is bulk?
A simple test. Is this something that could have been sent to someone
else with either no modification, or a trivial "mailmerge" operation.
It then becomes up to the spammer to prove otherwise to his abuse desk,
who will probably have received multiple complaints anyway.

Unsolicited, Commercial, and E-mail all have precise definitions.
particularly if we're going to get something (eventually) into a
useful law I think we need to make sure it is entirely defined of
precise terms.

Sure... but focusing on commercial is dangerous.

You do cite a good example of my "small potential problem". Nothing
immediately comes to mind as a good way to catch it without causing
good things to get caught up as well. I'm going to think about it.

My feelings are if its unsolicited and bulk, then it ain't good.

SPAM-L is one mailbox over that way ---->