- NANOG - lists.nanog.org

RE: luser of the day award!
by Goldstein, William C, MIDMK 19 Nov '98

19 Nov '98

Has anyone started a "Paul Vix Defense Fund?" I'll contribute! (Speaking for myself, not for my company) Bill Goldstein Senior Internet Specialist AT&T wgoldstein(a)att.com TEL:(412)642-7288 > ---------- > From: chrisn@qual.net[SMTP:chrisn@qual.net] > To: nanog(a)merit.edu > Subject: luser of the day award! > > Anyone else get mail from this idiot? > > Alan Bechtold (alanbechtold(a)sysop.com) @ 11/18/1998 12:48 - Original > Problem Detail: > > > Dear sir or madam -- > =20 > It has come to my attention that your company utilizes the MAPS = > BLACKHOLE list to block purported SPAMMERS from sending E-mail to your = > system. While the idea might sound good I am writing to inform you that = > you will be named in a Federal Lawsuit if you do not CEASE AND DESIST = > use of this list IMMEDIATELY. > =20 > Here is why: > =20 > My company, BBS PRESS SERVICE, INC., designs and hosts Web sites. That's = > all we do. We don't sell access to the Internet. We don't sell E-mail = > accounts. Besides some E-mail accounts for our employees to use when = > contacting our customers, and one E-mail account we use to send out a = > weekly newsletter to our customers, we don't generally handle any E-mail = > at all. > =20 > I am anti-SPAM. I advise all of my 5,000+ clients against the use of = > SPAM. Still, two have used it to promote sites we host for them. > =20 > Naturally, this resulted in our receiving the usual barrage of E-mails = > DEMANDING that we remove the Web sites of the offending parties. Our = > attorneys have advised us that it is NOT in our best interest to do so. = > Removing the Web site of anyone for something they did OUTSIDE of our = > system, even if it was indeed PROMOTING a site hosted on our system, = > would in fact expose my company to possible lawsuit from the SPAMMER! > =20 > I understand many Web site design and hosting services stipulate in = > their contracts that they reserve the right to pull any site if evidence = > of SPAMMING is seen -- but my attorneys have also advised me that this = > is completely unenforceable in court and wouldn't stand up to a court = > challenge. > =20 > I don't know about you but I am totally opposed to being REQUIRED to = > take action against anyone for anything they've done outside of my = > control. Do we also want to become liable for pulling Web sites held by = > anyone who is convicted of a crime...any crime? Wouldn't this lead to = > the requirement of background checks, to make sure a Web site customer = > has never indeed beenconvicted of a crime? > =20 > The ramifications are tremendous. > =20 > Anyway -- I write to anyone complaining about SPAM from a client of mine = > (and they do track down the Web site host even if we didn't originate = > the SPAM) and inform them of my position. > =20 > One person apparently forwarded my reply to MAPS. Even though my reply = > states CLEARLY that I am OPPOSED to SPAM, the kind folks at MAPS decided = > to add my company's IP to the list anyway. The problem is -- they won't = > TALK about resolving the problem. Their "volunteer" hung up on me when I = > called, after first being outright surly and rude with me. I tried = > E-mailing Paul Vix to tell him to remove my company's IP from his list = > but -- guess what -- my E-mail got REJECTED by his system because he = > uses the list! I finally got a message through by going through another = > provider. Meanwhile Paul Vix has not returned my urgent calls and hasn't = > been available on the phone when I do call. > =20 > This is causing my company irreparable harm. MAPS' whole attitude and = > the way they create their so-called LIST is, because of my case alone, = > entirely questionable. And he has left me little choice but to file suit = > against Paul, MAPS and anyone associated with the LIST or using it in = > their products or on their services. > =20 > This is where you come in. I am writing to tell you right now -- cease = > and desist from using the MAPS BLACKHOLE list on your service = > IMMEDIATELY. I will be including anyone and everyone still using the = > MAPS list in my lawsuit against MAPS. Period. > =20 > You might also want to contact Paul Vixie and let him know the legal = > jeopardy his methods have placed you in. By comparison, the SPAMMERS are = > starting to look like the "good guys." I know they're not and you know = > they're not but MAPS must end here and now. > =20 > I would appreciate your comments and cooperation. > =20 > > [Mime entry text/html removed] >

3 2

Re: Lawsuit threat against RBL users
by dlr＠bungi.com 19 Nov '98

19 Nov '98

[In the message entitled "Re: Lawsuit threat against RBL users" on Nov 18, 22:37, Chris Williams writes:] > Company S(pam) has a web site, hosted on the servers of > web-presence-provider Company P(rovider). Company S uses the services of > Company X to send out massive loads of SPAM, with referencing the web > site and even e-mail addresses hosted by Company H. Now, if I'm hearing > what's being said on this list correctly, Company H is being expected to > pull the website they host for Company S (or else be blackholed), _even > though no illegal or spam-generating activity is being generated on > their network_. > Am I understanding this correctly?!? You are understanding this correct. Spam support services certainly falls under the charter of the RBL. See http://maps.vix.com/rbl/candidacy.html#ByAssociation -- Dave Rand dlr(a)bungi.com http://www.bungi.com

2 1

Re: Lawsuit threat against RBL users
by Andrew Staples 19 Nov '98

19 Nov '98

>Company S(pam) has a web site, hosted on the servers of >web-presence-provider Company P(rovider). Company S uses the services of >Company X to send out massive loads of SPAM, with referencing the web >site and even e-mail addresses hosted by Company H. Now, if I'm hearing >what's being said on this list correctly, Company H is being expected to >pull the website they host for Company S (or else be blackholed), _even >though no illegal or spam-generating activity is being generated on >their network_. >Am I understanding this correctly?!? I have never seen the RBL work this way. Don't you mean Company P is expected to pull the website, since they host the website, not H? >By this philosophy, it would seem that if I were to host the web pages >of a company which engaged in unwelcome telemarketing (which I >personally find much more offensive than SPAM, and which is no more or >less illegal in most states), I would be under an obligation to cease >providing service to that company! You can do whatever you want with your network. As can other networks. No obligation, really. However, you can't always control the results. >So, given the earlier threads about annoying UUNET marketing folks, >let's blackhole all mail that comes from UUNET. Oh, and also mail that >comes from anyone who peers with them. And of course any mail that has >to be transported over those evil people's networks.....wait a sec, >why's my inbox suddenly empty, where'd the internet go??? Recalling an American hamburger commercial some time back, "Where's the spam?" ;-) Did you read the thread about the NSI spam? Do you know how effective the RBL was against the mighty microsoft (tm)? >Maybe I'm misinterpeting the policies here, but I didn't hear anyone >disputing the actual complaints of this guy, which can only lead me to >believe that either A) This guy was actually treated unfairly, and has a >valid complaint, or B) Nobody cares enough to say "hey, wait a minute, >there's been a failure in communication, let's see if we can work this >out." Talk to the volunteers at the RBL, and read the web site regarding those questions. I'm confident that you will see both A and B will be answered to your satisfaction. It's actually quite difficult to get into the rbl, and quite easy to get out of.

1 0

Re: Lawsuit threat against RBL users
by Tim Salo 19 Nov '98

19 Nov '98

> Date: Wed, 18 Nov 1998 22:37:39 -0500 > From: Chris Williams <psion(a)geekspace.com> > To: "nanog(a)merit.edu" <nanog(a)merit.edu> > Subject: Re: Lawsuit threat against RBL users > [...] > Company S(pam) has a web site, hosted on the servers of > web-presence-provider Company P(rovider). Company S uses the services of > Company X to send out massive loads of SPAM, with referencing the web > site and even e-mail addresses hosted by Company H. Now, if I'm hearing > what's being said on this list correctly, Company H is being expected to > pull the website they host for Company S (or else be blackholed), _even > though no illegal or spam-generating activity is being generated on > their network_. > [...] An interesting denial of service attach enabled by the RBL... -tjs

1 0

Best Practices for Being Permanently Added to the RBL
by Ben Black 19 Nov '98

19 Nov '98

RBL Working Group Ben Black INTERNET DRAFT Layer 8 Networks Obsoletes: draft-ietf-rbl-selfdefense-00.txt November 1998 Expires May 1999 Best Practices for Being Permanently Added to the RBL <draft-ietf-rbl-permanent-00.txt> Status of this memo This document is an Internet-Draft. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as ``work in progress.'' To view the entire list of current Internet-Drafts, please check the ``1id-abstracts.txt'' listing contained in the Internet-Drafts Shadow Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe), munnari.oz.au (Pacific Rim), or ftp.isi.edu (US West Coast). Abstract The Realtime Blackhole List (RBL) service from the Mail Abuse Protection System (MAPS) is a completely free and voluntary system for creating intentional network outages to limit the propogation of unwanted, unsolicited, mass e-mail (SPAM). Many purveyors of SPAM and SPAM-related services have had little trouble in getting themselves added to the MAPS RBL, but certain providers of web hosting services whose customers engage in SPAMMING have expressed concern that at some point in the future they may be removed from the MAPS RBL, exposing millions of innocent e-mail users to a barrage of SPAM. This document offers a description of the best current practices for guaranteeing that your company stays on the MAPS RBL. 1. Terminology Throughout this document, the words that are used to define the significance of particular requirements are capitalized. These words are: - "MUST" This word or the adjective "REQUIRED" means that the item is an absolute requirement of this specification. - "MUST NOT" This phrase means that the item is an absolute prohibition of this specification. - "SHOULD" This word or the adjective "RECOMMENDED" means that there may exist valid reasons in particular circumstances to ignore this item, but the full implications should be understood and the case carefully weighed before choosing a different course. - "SHOULD NOT" This phrase means that there may exist valid reasons in particular circumstances when the listed behavior is acceptable or even useful, but the full implications should be understood and the case carefully weighed before implementing any behavior described with this label. - "MAY" This word or the adjective "OPTIONAL" means that this item is truly optional. One vendor may choose to include the item because a particular marketplace requires it or because it enhances the product, for example; another vendor may omit the same item. 2. Best Practices Although there are many successful methods for achieving a lifetime membership in the RBL, the following have proven the simplest and most expedient. 2.1 Verbally Harassing the Maintainers of the RBL The maintainers of the MAPS RBL are all volunteers with an interest in making the Internet less of a haven for nefarious SPAM merchants. This is a fundamental technique which SHOULD be attempted by ALL service providers wishing to burn all possible bridges. 2.2 Sending SPAM Demanding Removal from the RBL Nothing says "Blackhole me!" like sending an unwanted mass mailing to potential subscribers of the MAPS RBL service. Service providers in the market for a new line of work unrelated to the Internet MUST SPAM as MANY other service providers as possible to maximize their chances at a coveted RBL Blackhole Lifetime Membership. 2.3 Threatening Lawsuits Even the most stalwart RBL maintainer may later have mercy later if only the suggestions in Sections 2.1 and 2.2 are followed. To avoid this eventuality, service providers SHOULD threaten to sue not only the RBL maintainers, but also all RBL subscribers. When responding to queries regarding the upcoming legal action, providers MUST NOT resort to the use of logic and common sense. Hard work definitely pays off in this area. 2.4 Proper CAPITALIZATION One of the keys to a successful SPAM demand or threat is proper capitalization. Unlike normal English usage, providers MUST randomly capitalize ENTIRE words for no APPARENT REASON. E-mail which follows this rule is certain to have a major impact on all readers. 3. Example of Advanced Techniques This outstanding example illustrates a complete mastery of all the tecniques listed above. The sender of this message is obviously highly motivated in his quest to remain on the RBL until the end of time. -- start -- From: "Alan R. Bechtold" <alanbechtold(a)sysop.com> Subject: Using MAPS will get you SUED!!! Date: Wed, 18 Nov 1998 11:48:11 -0800 It has come to my attention that your company utilizes the MAPS BLACKHOLE list to block purported SPAMMERS from sending E-mail to your system. While the idea might sound good I am writing to inform you that you will be named in a Federal Lawsuit if you do not CEASE AND DESIST use of this list IMMEDIATELY. Here is why: My company, BBS PRESS SERVICE, INC., designs and hosts Web sites. That's all we do. We don't sell access to the Internet. We don't sell E-mail accounts. Besides some E-mail accounts for our employees to use when contacting our customers, and one E-mail account we use to send out a weekly newsletter to our customers, we don't generally handle any E-mail at all. I am anti-SPAM. I advise all of my 5,000+ clients against the use of SPAM. Still, two have used it to promote sites we host for them. Naturally, this resulted in our receiving the usual barrage of E-mails DEMANDING that we remove the Web sites of the offending parties. Our attorneys have advised us that it is NOT in our best interest to do so. Removing the Web site of anyone for something they did OUTSIDE of our system, even if it was indeed PROMOTING a site hosted on our system, would in fact expose my company to possible lawsuit from the SPAMMER! I understand many Web site design and hosting services stipulate in their contracts that they reserve the right to pull any site if evidence of SPAMMING is seen -- but my attorneys have also advised me that this is completely unenforceable in court and wouldn't stand up to a court challenge. I don't know about you but I am totally opposed to being REQUIRED to take action against anyone for anything they've done outside of my control. Do we also want to become liable for pulling Web sites held by anyone who is convicted of a crime...any crime? Wouldn't this lead to the requirement of background checks, to make sure a Web site customer has never indeed beenconvicted of a crime? The ramifications are tremendous. Anyway -- I write to anyone complaining about SPAM from a client of mine (and they do track down the Web site host even if we didn't originate the SPAM) and inform them of my position. One person apparently forwarded my reply to MAPS. Even though my reply states CLEARLY that I am OPPOSED to SPAM, the kind folks at MAPS decided to add my company's IP to the list anyway. The problem is -- they won't TALK about resolving the problem. Their "volunteer" hung up on me when I called, after first being outright surly and rude with me. I tried E-mailing Paul Vix to tell him to remove my company's IP from his list but -- guess what -- my E-mail got REJECTED by his system because he uses the list! I finally got a message through by going through another provider. Meanwhile Paul Vix has not returned my urgent calls and hasn't been available on the phone when I do call. This is causing my company irreparable harm. MAPS' whole attitude and the way they create their so-called LIST is, because of my case alone, entirely questionable. And he has left me little choice but to file suit against Paul, MAPS and anyone associated with the LIST or using it in their products or on their services. This is where you come in. I am writing to tell you right now -- cease and desist from using the MAPS BLACKHOLE list on your service IMMEDIATELY. I will be including anyone and everyone still using the MAPS list in my lawsuit against MAPS. Period. You might also want to contact Paul Vixie and let him know the legal jeopardy his methods have placed you in. By comparison, the SPAMMERS are starting to look like the "good guys." I know they're not and you know they're not but MAPS must end here and now. I would appreciate your comments and cooperation. -- end -- 4. Author Information Ben Black Layer 8 Networks email: black(a)layer8.net

6 6

Re: luser of the day award!
by Sean M. Doran 19 Nov '98

19 Nov '98

This seems like good incentive for anyone who does not use the RBL to sign up. -:) Sean.

2 1

Oh no... someone had a bright idea!
by Robert Boyle 19 Nov '98

19 Nov '98

This was forwarded to me by a friend. I was interested in exactly what they meant. This is pretty bad. I think these people don't understand that this affects US more than it affects the people who they are targeting. I suppose this is a strong case for transparent caching. Any thoughts? -Robert ---------- Forwarded message ---------- Date: Tue, 17 Nov 1998 19:57:32 -0500 Subject: EDT Virtual Sit In November 18th 1998 Protest, ELECTRONIC DISTURBANCE THEATER EVERYWHERE: ELECTRONIC DISTURBANCE THEATER, Emergency Bulletin: Clinton: Do Not Bomb Iraq! - Join Ongoing Virtual Sit-In On White House Web Site Now, - The Electronic Disturbance Theater, opposes U.S. plans to bomb Iraq and urges like-minded people to join an emergency FloodNet action to send a message of peace to world leaders. EDT encourages people who oppose a U.S. military strike against Iraq to participate in an ongoing virtual sit-in on the web site of the White House by clicking on http://www.thing.net/~rdom/zapsPublic/ddkfoyer.htm and following the instructions and leaving your browser on. Garden Networks - Quality Internet Nationwide Access, Co-location, Development & Consulting http://www.garden.net (973)300-9211 Ext.103 It's not Area 51 I'm worried about... ...it's Areas 1 through 50.

1 0

Re: Best Practices for Being Permanently Added to the RBL
by Paul Vixie 19 Nov '98

19 Nov '98

black(a)layer8.net (Ben Black) writes: > RBL Working Group Ben Black > INTERNET DRAFT Layer 8 Networks > Obsoletes: draft-ietf-rbl-selfdefense-00.txt this draft is now available online at http://maps.vix.com/rbl/draft-ietf-rbl-selfdefense-00.txt and yes, it has a link from http://maps.vix.com/rbl/ -- Paul Vixie <paul(a)vix.com>

1 0

Exodus Customer Security
by Adam Rothschild 19 Nov '98

19 Nov '98

FYI- "There was something with one of our customers, however it was a customer machine, and as such, we aren't at liberty to discuss the issue unless they specifically allow us to." - quoth Exodus So, in other words, they can't discuss abuse issues with the victim, unless the *offender* (client) gives them permission to? I'll sleep much better tonight knowing this.

11 16

Re: luser of the day award!
by Paul Vixie 19 Nov '98

19 Nov '98

> >> I wonder how he's going to find out just who is using RBL and who isn't? > > > >Wouldn't it be easy enough to ping each suspect network from a machine > >that he knows has been RBL'd? Or (in the stealth scenario) send a message > >to an autoresponder on each suspected network? identifying suspect networks would be hard, though. > >I wonder if he could subpeona the list of RBL subscribers in the interests > >of naming them in a law suit. Not that I think he has the financial > >backing to actually carry the suit out, but it is a curiosity. yes, he could do that. > Look at the RBL site, a DNS subsciber it not tracked anywhere, except maybe > Vixie's XFER log files. Even the MAPs crew doesn't know how many > subscribers they have. slight correction here: the subscribers number in the two hundred and twenties, and we know exactly who they are. noone AXFR's the zone without registering, or gets a BGP feed without registering. the thing we don't know how many we have of, is unsubscribed users who just add FEATURE(rbl) to their sendmail.mc files and never register at all. we've estimated this to be in the thousands or tens of thousands just based on the splay shown among query source addresses on the RBL.MAPS.VIX.COM nameservers, but a that's pretty rough way to estimate this quantity. -- Paul Vixie <paul(a)vix.com>

1 0