August 2002 - NANOG - lists.nanog.org

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at smtpng.org)
by Jim Hickstein 28 Aug '02

28 Aug '02

--On Tuesday, August 27, 2002 9:01 PM -0700 David Schwartz <davids(a)webmaster.com> wrote: >> Your secure mail server (i.e. me) just has to be named in a MAIL-FROM MX >> record. We do DNS for some of our customers, and can add this trivially; >> the others control their own zones. Works for me. > > How would this stop the destination mailservers from rejecting the mail > forwarded by the secure server? Remember, the situation is that I don't > trust my ISP to see my outbound mail (because that's where warrants are > likely to be served or interception hardware would likely be > surreptitiously inserted). So I don't want my outbound mail passing > through my ISP unencrypted. Given this extraordinary requirement, either you wouldn't be my customer, or you'd better encrypt at the endpoint (though pipes leak best out the ends). Or you can pony up the money for your own host on a dedicated circuit so _it_ can be in the MAIL-FROM MX for your domain (of course you'll need your own domain), and then you and your ISP can argue about traffic analysis and acceptable use. Still doesn't fundamentally break the proposal in hand, it seems to me. You always get to not publish the repudating information if you don't want people to use it.

1 0

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at smtpng.org)
by Jim Hickstein 28 Aug '02

28 Aug '02

--On Tuesday, August 27, 2002 6:13 PM -0700 David Schwartz <davids(a)webmaster.com> wrote: > I'm afraid the technology to rapidly sift through large volumes of > information to search for specific areas of interest is widely available. > It is totally reasonable to not want to send mail through your ISP's > mail servers and perhaps directly to a trusted mail distributor over an > encrypted link. Of course, you can easily use a port other than 25 for > this purpose. The problem comes when the recipient tries to validate > your origin address against your secure mail server. Your secure mail server (i.e. me) just has to be named in a MAIL-FROM MX record. We do DNS for some of our customers, and can add this trivially; the others control their own zones. Works for me.

2 1

Will Canada's Internet providers become spies?
by Joe Baptista 28 Aug '02

28 Aug '02

enjoy ... and i'm curious if there are any small or large system admins in canada here that this affects and their opinions. regards joe baptista ----- Original Message ----- From: "Declan McCullagh" <declan(a)well.com> To: <politech(a)politechbot.com> Sent: Tuesday, August 27, 2002 6:43 PM Subject: FC: Will Canada's Internet providers become spies? http://news.com.com/2100-1023-955595.html?tag=politech Will Canada's ISPs become spies? By Declan McCullagh August 27, 2002, 12:56 PM PT WASHINGTON--The Canadian government is considering a proposal that would force Internet providers to rewire their networks for easy surveillance by police and spy agencies. A discussion draft released Sunday also contemplates creating a national database of every Canadian with an Internet account, a plan that could sharply curtail the right to be anonymous online. [...] --- From: David Akin <dakin(a)ctv.ca> To: "'declan(a)well.com'" <declan(a)well.com> Subject: Canada to review electronic surveillance laws Hey Declan -- May be a bit too 'Canadian' for Politech but here you are . ... David Akin CTV News The Globe and Mail Office: 416.313.2503 Mobile: 416.528.3819 > -----Original Message----- > From: > IMCEANOTES-industry-industrie+40ic+2Egc+2Eca+40ICGC(a)ic.gc.ca > [mailto:IMCEANOTES-industry-industrie+40ic+2Egc+2Eca+40ICGC@ic.gc.ca] > Sent: Monday, August 26, 2002 7:13 AM > Subject: Government of Canada to Review Lawful Access Laws > > > Date: 2002/08/25 > > QUEBEC, August 25, 2002 -- The Honourable Martin Cauchon, > Minister of Justice and Attorney General of Canada, the > Honourable Lawrence MacAulay, Solicitor General of Canada, > and the Honourable Allan Rock, Minister of Industry, today > announced that the Government of Canada will consult with > Canadians concerning lawful access to information and > communications. The consultation was launched by Minister > MacAulay, on behalf of his colleagues, at the annual meeting > of the Canadian Association of Chiefs of Police (CACP). > > "Lawful access legislation must protect the privacy of > Canadians and reflect their values. The Government of Canada > will be examining current laws to ensure crimes and other > threats to public safety can continue to be investigated > effectively," said Minister Cauchon. > > "Legislation governing lawful access was originally designed > for rotary telephones -- not e-mail or the Internet," said > Minister MacAulay. "Dated laws allow criminals and > terrorists to use technology to hide their illicit > activities. This initiative is about keeping our laws current > so that the police can do their job and keep Canadians safe." > > "Technology is a great enabler for Canadians, but also > presents challenges for law enforcement," said Minister Rock. > "Through this process, we are seeking ideas from law > enforcement, industry and all Canadians to find a solution > that supports public safety and privacy, and how to achieve > this without inhibiting industry's ability to innovate and compete." > > Lawful access is the lawful interception of communications, > and the search and seizure of information by law enforcement > and national security agencies. Updating lawful access > legislation is essential to a broad range of investigative > bodies, in their continued efforts to fight crimes such as > terrorism, child pornography, drug trafficking, smuggling, > Internet and telemarketing fraud, price fixing and money > laundering. Lawful access can only be exercised with a lawful > authority, and is well entrenched in laws such as the > Criminal Code, the Canadian Security Intelligence Act, the > Competition Act and other Acts of Parliament. Lawful access > legislation also recognizes the privacy rights of all people > in Canada and their rights under the Canadian Charter of > Rights and Freedoms. > > This consultation process will involve key stakeholders > including law enforcement, telecommunications companies, > civil liberties and privacy organizations. The public will > also be given the opportunity to consider lawful access > issues and options for change by obtaining a consultation > paper, which is available at > www.canada.justice.gc.ca/en/cons/la_al. Those wishing to > respond may send their submissions to la-al(a)justice.gc.ca > before November 15, 2002. > > In the January 2001 Speech from the Throne, the Government of > Canada pledged to provide modern tools to safeguard Canadians > from emerging threats such as cyber-crime. The lawful access > consultation will contribute to the Government's ongoing > commitments, both nationally and internationally, to ensure a > balanced and effective approach to addressing threats to > public safety and national security. > > References: > > Media Relations Office > Department of Justice > (613) 957-4207 > > Suzanne Th�barge > Director of Communications > Minister's Office > (613) 992-4621 > Communications > Solicitor General Canada > (613) 991-2800 > > Dan Brien > Press Secretary > Minister MacAulay's Office > (613) 991-2874 > Media Relations > Industry Canada > (613) 947-1970 > > Selena Beattie > Press Secretary > Minister Rock's Office > (613) 995-9001 > > ________________________ > > Backgrounder > Review of Lawful Access Legal Framework > > What is Lawful Access? > > Lawful access is the interception of communications and the > search and seizure of information, which law enforcement and > national security agencies > use to conduct investigations. Lawful access can only be > exercised with a > lawful authority and is well entrenched in laws such as the > Criminal Code, the Canadian Security Intelligence Service > Act, the Competition Act and other Acts of Parliament. Lawful > access legislation also recognizes the privacy rights of all > people in Canada and their rights under the Canadian Charter > of Rights and Freedoms. > > A Changing Environment > > Rapid developments in information and communication > technologies have offered Canadians a wide range of > e-commerce and information sharing opportunities. While > these technologies provide many advantages to our society, > they can also be used to conduct and shield illicit > activities such as drug trafficking, murder, child > pornography, smuggling, Internet and telemarketing fraud, > price fixing, and terrorism. Consumers have become the > targets of fraud and businesses are affected by malicious > acts that undermine their ability to compete in the > electronic marketplace. With globally connected networks, > the consequences of these crimes have become more far-reaching. > > These new technologies are posing challenges to conventional > lawful access methods. Law enforcement and national security > agencies must often overcome a variety of technical hurdles > before they can access the communication or information that > they are legally authorized to collect. These include: > > Wireline communications: Law enforcement and national > security agencies have conducted lawful investigations with > wireline services for many years. However, more advanced > service options and calling features have created new obstacles. > > Wireless communications: The rapid expansion in the use of > wireless communications tools including cellular telephones, > wireless e-mail and Internet devices and satellite > communications can pose a significant challenge for law > enforcement and national security agencies, which must now > deal with a variety of companies and a diversified > combination of network infrastructures. > > The Internet: The Internet is a collection of thousands of > networks around the world, that exchange and share > information but the Internet has no centralized physical > location or control. The complex technology of Internet > communications, the need for sophisticated equipment to > investigate Internet communications, and the lack of > provisions that would require Internet Service Providers > (ISPs) to implement procedures for lawful intercept > capabilities have created difficulties for investigators. > > International commitments > > The global nature of new technology has increased the need > for international cooperation in developing effective > solutions. Several of Canada's international partners have > updated their legislation to ensure that their law > enforcement and national security agencies maintain their > lawful access capabilities. Canada is currently involved in > discussions with the G8 and other countries on issues such as > cross-border search and seizure; tracing the source and > destination of computer communications; and cooperation > between law enforcement and national security agencies and industry. > > On November 23, 2001, Canada signed the Council of Europe > Convention on Cyber-Crime, which requires states to > criminalize certain forms of abuse of computer systems and > certain crimes when they are committed using computer > systems. The Convention also supports international > cooperation to detect, investigate and prosecute these > criminal offences, as well as to collect electronic evidence > of any criminal offence, including organized crime and > terrorist acts. Canada played an important role in the > drafting and negotiation of the Convention and is one of over > 30 signatories to it. > > At the G8 Justice and Interior Ministers' meeting held at > Mont Tremblant in May 2002, the Ministers of Justice and > Interior of the G8 states endorsed recommendations to trace > networked communications across national borders in order to > combat terrorist and criminal organizations, as well as a > number of other documents that would help governments to > combat high tech crime. > > By implementing the provisions outlined in the consultation > paper, Canada will be in a position to ratify the Convention. > It will also contribute to our G8 and other global obligations. > > Consultations > > The Government of Canada is committed to maintaining public > safety and national security, protecting the rights and > privacy of all people in Canada, encouraging the growth of > electronic commerce and a competitive electronic marketplace > and safeguarding computer systems. At the same time, the > Government recognizes that new information and communication > technologies are challenging the investigative abilities of > law enforcement and national security agencies. > > The Government of Canada will be holding consultations to > provide a broad range of stakeholders, including the > provinces and territories, law enforcement and national > security agencies, telecommunications and related industry > representatives, civil liberties and privacy organizations > and the legal community, with an opportunity to consider > lawful access issues and options for policy and legislative changes. > > To facilitate these consultations and public input, a > consultation document on lawful access is available at > www.canada.justice.gc.ca/en/cons/la_al. > Submissions may be > sent to > la-al(a)justice.gc.ca before November 15, 2002. > > The consultation document outlines legislative, regulatory > and policy options that would ensure that law enforcement and > national security agencies maintain their lawful access > capability, while taking into account legal, technical, > privacy and economic considerations. > > A central element of these proposed options would require all > wireless, wireline and Internet service providers to have the > technical capability to provide access to communications and > information, under legal authority, to law enforcement and > national security agencies. Proposed Criminal Code amendments > include the creation of production and preservation orders > for data as well as other amendments to modernize the law to > deal with new technologies. > > These consultations are a part of the Government of Canada's > commitment, made in the January 2001 Speech from the Throne, > to provide modern tools to safeguard Canadians from emerging > threats such as cyber-crime. The lawful access consultations > will also contribute to Canada's ratification of the Council > of Europe Convention on Cyber-Crime, the implementation of G8 > recommendations and to Canada's ongoing commitment to work > with international partners and ensure a balanced and > effective approach to addressing threats to public safety and > national security. The proposals outlined in the consultation > paper parallel measures that have been taken by other countries. > > Federal government partners involved in the lawful access > consultations include the Department of Justice Canada, > Solicitor General Canada, Industry Canada, the RCMP, the > Canadian Security Intelligence Service, the Department of > Foreign Affairs and International Trade and the Competition Bureau. ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ Declan McCullagh's photographs are at http://www.mccullagh.org/ ------------------------------------------------------------------------- Like Politech? Make a donation here: http://www.politechbot.com/donate/ Recent CNET News.com articles: http://news.search.com/search?q�clan CNET Radio 9:40 am ET weekdays: http://cnet.com/broadband/0-7227152.html -------------------------------------------------------------------------

2 1

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at smtpng.org)
by Lyndon Nerenberg 28 Aug '02

28 Aug '02

> So what's so bad about forwarding all tcp/25 traffic over that relay and > letting that relay decide if the MAIL FROM: is allowed to be relayed? Because I want to send mail through my own SMTP server that speaks STARTTLS and uses certificates that are under my control. Maybe I don't want my email sitting around in your MTA queue for your sysadmins to read. Or maybe you just don't have a clue about how to configure and run an MTA, therefore any mail I send through your enforced gateway gets silently black-holed. > And if a client wants to mail from another domain which isn't relayed by > it's upstream ISP, he/she could ask it's ISP to do so. > Yes this will add an administrative hassle, but doesn't spam imply that > also? Do you *honestly* believe what you wrote above? Do you have any experience trying to actually get these sort of changes made? Can you provide statistically valid numbers showing this is a realistic solution in the real world? (Frankly, this proposal is so absurd I have to wonder if you've even dealt with *an* ISP ...) The Internet is a peer-to-peer network, whether you like it or not. --lyndon Lizzie Borden took an axe, And plunged it deep into the VAX; Don't you envy people who Do all the things YOU want to do?

3 2

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at smtpng.org)
by Brad Knowles 28 Aug '02

28 Aug '02

At 7:37 PM -0400 2002/08/27, Dean Anderson wrote: > You worked at AOL? This happens quite often. I've known of several admins > who started reading email, checking terminal servers, and "disrupting" > users who complained about the admins performance. One admin wrote a > script that reset the session of a "PITA" user every half hour. I've heard of cases like this. I also know that the people I heard about were terminated with extreme prejudice, as soon as management got even a single whiff as to what they were doing. They took a really, really hard line against this kind of administrative abuse. Before I left, they had started seriously cracking down on removing any additional access or permissions that someone may have had, if they couldn't prove that they needed it during the course of their job. I basically lost all access to the Stratus mainframes, because I didn't need it in order to perform my duties as the Sr. Internet Mail System Administrator. No, I have a lot of my own bitches about AOL, mostly due to extremely questionable business practices that I saw while I was there. But this is an area where I don't think that much criticism can be rightly levelled at them. > That is the number one problem, and its why consumer groups think they > need tougher privacy laws. I definitely support tougher privacy laws. But I don't think AOL would be likely to have much problems meeting or exceeding most enhanced privacy laws that I can think of. -- Brad Knowles, <brad.knowles(a)skynet.be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

1 0

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at
by Paul Vixie 27 Aug '02

27 Aug '02

> > ... (http://dcc.rhyolite.com/) ... > > Indeed, that is a cool idea. I definitely want to look into > that a lot more closely. Perhaps we can combine this with deep > blacklist checking (beyond just the first hop), tagging, and Bayesian > content filtering. Perhaps then we will have a temporary pass at a > semi-decent anti-spam filter. be careful when you gang things together. spamassassin seems to be a considered approach, but that doesn't mean more is always better. as has oft been said of PRNG's, adding complexity usually subtracts from the quality. if you combine too many kinds of spam filtering together then you'll have that much more trouble figuring out what to tune when you get a false positive.

1 0

60 Hudson peering
by Ralph Doncaster 27 Aug '02

27 Aug '02

I have a POP in 60 Hudson, 19th floor. The only peering exchange I'm aware of in the building is Stealth's IPV6 exchange in Tel-X (23rd floor). If there's any interest in IPV4 peering from any networks with a presence on the 19th, I'd be willing to provide free 100baseTx ports on a peering switch in 1904. I'm aware of MetroIX, but that's on the 15th floor and its unreasonably expensive to get fiber cross-connects between floors in 60 Hudson, and cat5 cross-connects aren't even available between the 19th and 15th floors. Ralph Doncaster principal, IStop.com

2 2

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at smtpng.org)
by Brad Knowles 27 Aug '02

27 Aug '02

At 12:58 PM +0100 2002/08/27, michael.dillon(a)radianz.com wrote: > It might be possible to make filters that don't need to be updated that > often if > you apply AI techniques to recognizing SPAM. For instance, check out this > new approach: > http://www.paulgraham.com/paulgraham/spam.html Bayesian techniques are neither AI nor new. See <http://citeseer.nj.nec.com/sahami98bayesian.html> and <http://citeseer.nj.nec.com/androutsopoulos00learning.html>, among others. Moreover, while there may be client-side programs which implement these techniques, and there may be prototype server-side programs which implement these techniques, I am not aware of any more production-oriented tools which are available to implement these kinds of techniques. -- Brad Knowles, <brad.knowles(a)skynet.be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

1 0

IPv6 Interview Questions and critic
by Joe Baptista 27 Aug '02

27 Aug '02

Hi: I'm doing an article on IPv6 and am looking for comments - here is a portion on IPv6 which relates to the privacy issue ... any comments, crtics or interviews welcomed. -- snip As you know IPv6 is a suite of protocols for the network layer of the Internet which uses IPv4 gateways. It's purpose is to expand address space. At this time IPv6 comes prepackaged with all popular operating systems. This includes all flavours of unix , windows and Mac OS. IPv6 is designed to solve many of the problems of the current version of IPv4 with regard to address depletion. The goal is to use IPv6 to expand the capabilities of the Internet to enable a variety of valuable peer-to-peer and mobile applications. According to many industry pundits it is the future of networking. However IPv6 has many privacy issues. IPv6 address space uses an ID (indentifier) derived from your hardware or phone. "That allows your packets to be traced back to your PC or cell-phone" said <censored>. <censored> fears abuse as a hardware ID wired into the ipv6 protocol can be used to determine the manufacturer, make and model number, and value of the hardware equipment being used by the end user. Ipv6 empowers the business community by providing a means of identifying and tracking users. Under Ipv6 users can be tracked and income demographics determined through hardware identification. Many members of the networking community have addressed concerns that the technology could result in potential abuse and <censored> warns users to think twice before they buy themselves a used Lap-Top computer and inherit all the prior surfing history of the previous user? Ipv6 uses 128 bits to provide addressing, routing and identification information on a computer. The 128-bits are divided into the left-64 and the right-64. Ipv6 uses the right 64 bits to store an IEEE defined global identifier (EUI64). This identifier is composed of company id value assigned to a manufacturer by the IEEE Registration Authority. The 64-bit identifier is a concatenation of the 24-bit company_id value and a 40-bit extension identifier assigned by the organization with that company_id assignment. The 48-bit MAC address of your network interface card is also used to make up the EUI64. -- snip Cheers Joe Baptista -- Planet Communications & Computing Facility a division of The dot.GOD Registry, Limited

10 11

Re: Paul's Mailfrom (Was: IETF SMTP Working Group Proposal at smtpng.org)
by Brad Knowles 27 Aug '02

27 Aug '02

At 7:19 PM -0700 2002/08/26, David Schwartz wrote: > Every ISP I have ever worked for and every ISP I have ever used has > eventually been convinced by me to come around to this policy. Do whatever > you want by default, but let trusted/clueful people opt out of it and just > get their IP datagrams from point A to point B. As someone who has worked at AOL and the largest ISP in Belgium, and advocated policies like this myself, I would agree. But I wouldn't advertise anywhere that people can pay to opt out of the transparent proxy. I would instead require that they contact me on their own initiative. Once they've done that and I've got their signature on a contract that allows me to wield terrible punishment upon them if they violate it, then I'd be willing to move them to another network where they would be allowed unfettered access. Of course, they'd pay for that access, and it would be a different type of account. -- Brad Knowles, <brad.knowles(a)skynet.be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

1 0