- NANOG - lists.nanog.org

Spam Control Considered Harmful
by Daniel Karrenberg 01 Nov '97

01 Nov '97

I am worried about the tools we are developing and deploying to control spam. Some of them are esentially centralsied methods of controlling Internet content. Paul's anti-spam feed for instance prevents users of some providers from seeing spam. The user has no choice; they cannot opt to receive spam other than by switching to another provider. Even worse: they may not even be aware that they are "missing" some content. Combatting spam is considered a Good Thing(TM) by almost everybody here, including myself. However the same technology could just as easily be used to do Bad Things(TM). Even worse: if it works it demonstrates that *centralised control* of the content of Internet services like e-mail is *feasible*. This will give some people ideas we may not like, and sometime in the future we may ask ourselves why we have done this. The end does not always justify the means. I hope that methods like the anti-spam feed will not be taken up widely. Please consider the consequences before you use them. I stress that I do not question the morality or good intentions of those involved. I am just concerned about the almost ubiquitous and apparently unreflected zeal that spam seems to evoke and the danger of it making us accept methods we would otherwise despise. I would prefer to see more work in technology that is less centralised and gives the users a choice of the content they wish to see. Yes this may be harder to do, but the consequences of deploying the easier methods may be just too severe. Waehret den Anfaengen (beware of the beginnings) Daniel PS: I hope this is more coherent than my contribution at the meeting yesterday when my brain failed due to jet-lag while my mouth was still working perfectly ;-).

19 33

Re: Problems with specific routing policies for each exchange point
by Danny McPherson 31 Oct '97

31 Oct '97

> I was not questioning the function, only the requirement. It seems > that if the problem exist between NAPNET and GENUITY, it might exist > elsewhere and changing to the specific ASes would be a simple fix. > > Are there cases where an AS macro would be really beneficial in the > inet-rtr.rs-(in|out) statements? Well, assuming you use as-macros as they were intended (to simply objects) .. it shouldn't be a problem. The code is obviously broken and Jake is fixing it. I assume that we could create another 2 macros listing every AS individually, but then that'd be more changes that'd we'd have to make every time we pick-up or drop an AS. I've removed AS-NAPNET from the AS-GENUITY macro until the problem is corrected.. -danny > Frankly, it's paranoia that causes me to only put specific ASes in the > statements. While I'm willing to let an ISP tell me what ASes they are > carrying, I want to know exactly with whom I'm exchanging routes. > > I always thought of Randy as the conservative type, but maybe not as > much as I. > -- > R. Kevin Oberman, Network Engineer > Energy Sciences Network (ESnet) > Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) > E-mail: oberman(a)es.net Phone: +1 510 486-8634

3 2

The Cidr Report
by Tony Bates 31 Oct '97

31 Oct '97

1 0

potentially profitable spam countermeasures
by Erik E. Fair 31 Oct '97

31 Oct '97

Those of you who operate ISPs that accept credit-card, dial-up customers (and therefore have a problem with spammers abusing your services) might find this item of interest. Earthlink's Acceptable Use Policy has a $200 penalty for spamming in it. I am told that with the advent of this policy, there was a dramatic drop in abuse of their service. See http://www.earthlink.net/company/aupolicy.html for the details. The key section is 2.3.1.3. Member specifically agrees that he/she/it will not utilize the EarthLink Network service, EarthLink Network's equipment or any EarthLink Network electronic mail address in connection with the transmission of the same or substantially similar unsolicited message to 50 or more recipients or 15 or more newsgroups in a single day. For each day upon which this provision is violated, Member agrees to pay EarthLink Network $10.00 per day for an unintentional violation of this provision, but where warranted, such as in the case of an accidental transmission, EarthLink Network may waive all or part of the applicable charge. In cases of willful violations of this provision, Member agrees to pay EarthLink Network $200.00 per day. EarthLink Network at its sole discretion shall determine whether such a violation was unintentional or willful. Payment by member under this provision shall not prevent EarthLink Network from seeking to obtain other legal remedies against member, including other damages or an injunction. So, set the agreement up right, find the spammers abusing your service, and whack them with a fine, per the agreement. Recover your cost, plus lost goodwill. This will not eradicate spam. However, if everyone does this, the effect should be to sharply curtail the penny-ante players who abuse the relative anonymity of dial-up Internet access. We would be left with the "big" spammers who have their own connections, which should be easier to effectively deal with. FYI, Erik E. Fair fair(a)clock.org

3 2

Re: potentially profitable spam countermeasures
by Eric Germann 31 Oct '97

31 Oct '97

In the early days of the US Postal System, the recipient paid for letter received, because the delivery mechanisms were unreliable and subject to failure due to Indians, bears, wolves, etc. Is SMTP mail delivery the Pony Express of the late 20th century? Eric At 10:47 AM 10/31/97 -0500, Peter E. Giza wrote: >My bucks worth. The *real* issue is that spam steals bandwidth by using >more >than an "average" users worth of bandwidth. Postal systems the world >over >have a simple solution, one must buy a stamp first. I am not advocating >an >email "pay before you use policy", however if one were to look at the >number >of out-going messages that a "typical" email user generates on any given >day >it likely on the order of <100. Given this, if everyone's AUP stated >that unless >negotiated by said user and ISP previously, that all out-going email >exceeding ><some number> would be subject to a bulk mail charge of $X.X per message. > >This still will not fix the dial-up hit and run artists that plague our >networks >today. The only way to truly solve the spam issue is through >re-architecting >the email systems that are in use today to use some of the features to >prevent >this abuse. I know this sounds like a global peace pitch, but if there >were >a standard by which all mailers would follow that contained the feature >sets >needed to eradicate spamming then and only then may it be possible to >stop >spending valuable time and money fighting this issue. Even the threat of >federal >penalty is not enough to stop spammers, just look how hard it is for the >postal >service to track and prosecute clever mail fraud houses. > >I guess what I am saying is that we and the developers of email and >other systems >that use these networks need to work together to solve these issues at >the product >layer. Waiting for legislation may turn out to be very frustrating and >in the mean >time the theft continues. Black holing while effective carries with it >other distasteful >side-effects/concerns as we have witnessed. We can toss around all the >legalese >we want to and will continue to be ineffective at significantly reducing >the problem. >This is just like CB radio, "who is gonna catch me?!" is what spammers >are saying >and they are right. When you have thousands of people abusing the system >it is >really difficult to prosecute them, so the system turns into a pestilent >pile of garbage. >I submit that is an engineering problem, waiting for lawyers and senators >will bring >the system down. > >-pete > >Erik E. Fair (Timekeeper) wrote: > >> Those of you who operate ISPs that accept credit-card, dial-up >> customers (and therefore have a problem with spammers abusing your >> services) might find this item of interest. >> >> Earthlink's Acceptable Use Policy has a $200 penalty for spamming >> in it. I am told that with the advent of this policy, there was a >> dramatic drop in abuse of their service. >> >> See http://www.earthlink.net/company/aupolicy.html for the details. >> The key section is >> >> 2.3.1.3. Member specifically agrees that he/she/it will >> not utilize the EarthLink Network service, EarthLink >> Network's equipment or any EarthLink Network electronic >> mail address in connection with the transmission of the >> same or substantially similar unsolicited message to 50 or >> more recipients or 15 or more newsgroups in a single day. >> For each day upon which this provision is violated, Member >> agrees to pay EarthLink Network $10.00 per day for an >> unintentional violation of this provision, but where >> warranted, such as in the case of an accidental transmission, >> EarthLink Network may waive all or part of the applicable >> charge. In cases of willful violations of this provision, >> Member agrees to pay EarthLink Network $200.00 per day. >> EarthLink Network at its sole discretion shall determine >> whether such a violation was unintentional or willful. >> Payment by member under this provision shall not prevent >> EarthLink Network from seeking to obtain other legal remedies >> against member, including other damages or an injunction. >> >> So, set the agreement up right, find the spammers abusing your >> service, and whack them with a fine, per the agreement. Recover >> your cost, plus lost goodwill. >> >> This will not eradicate spam. However, if everyone does this, the >> effect should be to sharply curtail the penny-ante players who >> abuse the relative anonymity of dial-up Internet access. We would >> be left with the "big" spammers who have their own connections, >> which should be easier to effectively deal with. >> >> FYI, >> >> Erik E. Fair fair(a)clock.org > > > > > ============================================================================ ==== Eric Germann Computer and Communications Technologies ekgermann(a)cctec.com Van Wert, OH 45891 Phone: 419 968 2640 http://www.cctec.com Fax: 419 968 2641 Network Design, Connectivity & System Integration Services A Microsoft Solution Provider

1 0

Re: Spam Control Considered Harmful
by Bill Unsworth 31 Oct '97

31 Oct '97

At 23:16 30/10/97 -0000, you wrote: >>> And what will the FBI do when spammers leave the US... > >This is really a red herring -- any spam control law, even one of the >bad ones like the Murkowski bill applies to any resident of the U.S., >even if he hires someone in Moldova to send out his spam. To escape >U.S. law the spammer has to move his entire business offshore. In >practice we're unlike to see much offshore spam because the goal of >spammers is to collect money from suckers, and it's a whole lot harder >to do so if you don't have a domestic mailing address and bank >account. > >Also, as others have pointed out, there aren't a lot of other >countries with low cost unmetered Internet connections and, other than >Canada, even those are connected to the U.S. by long, thin, expensive >undersea cables whose proprietors aren't likely to enjoy having them >filled with spam and angry responses. You mean like now when spam sent to .com's outside the USA ends up hitting us! Yep it would be great if the USA isps did something about Spam cos it sure dont come from anywhere else in any quantity. :-)) > > >-- >John R. Levine, IECC, POB 640 Trumansburg NY 14886 +1 607 387 6869 >johnl(a)iecc.com, Village Trustee and Sewer Commissioner, http://iecc.com/johnl, >Finger for PGP key, f'print = 3A 5B D0 3F D9 A0 6A A4 2D AC 1E 9E A6 36 A3 47 > > U-NET Limited - Global Transit Division mailto:world@u-net.net http://world.u-net.net Tel 44 1925 484444 Fax 44 1925 484466

1 0

(forw) Re: Spam Control Considered Harmful
by Patrick Lynch 31 Oct '97

31 Oct '97

Well, according to your post, this person is probably distributing copyrighted material in his package and doesn't care about proper licensing. This is just a theory, no proof. Sometimes the easiest way to get rid of spam kings like this is by measures already in place. -----Forwarded message from Art Houle <houle(a)zeppo.acns.fsu.edu>----- So what do we do about this enterprising businessperson? ---------- Forwarded message ---------- JUST RELEASED... 27,000,000 Email Addresses! Plus 12 Bonuses... Including FREE bulk e.mail software. SNIP! -----End of forwarded message----- -- Patrick Lynch -- INDnet Network Engineer E-mail -- plynch(a)ind.net, noc(a)ind.net Phone: 317.263.8966 FAX: 317.263.8831

1 0

Kashpureff in custody.
by Marc Hurst 31 Oct '97

31 Oct '97

Eugene Kashpureff, known for his redirect of the NSI web page, was apprehended this morning in Toronto by undercover RCMP detectives. Pending a deportation hearing, he will be returned to New York to face Felony Wire Fraud charges that were sworn out against him after he had settled out of court with NSI in regard to their civil suit. Early in the week Eugene relinquished control of the Alternic to an adhoc industry group and that group will be making an announcement in the next few days. A this time I have no further information to volunteer. Sincerely Marc Hurst

1 0

Re: Spam Control Considered Harmful
by Justin W. Newton 31 Oct '97

31 Oct '97

At 02:37 PM 10/29/97 -0600, John A. Tamplin wrote: >outgoing messages, block connections to third-party MTAs, etc) in the ISP, I would like to point out, after much thought and discussion, I believe that completely blocking outgoing SMTP to be a bad idea. Here's the reasoning. I may be foo.com, a mail hosting service. My customers send and receive mail via me, but do not connect via me. I set up a system whereby only my users can send mail via me (magic elves or something, thats not important). In this instance, it makes sense to allow your users to send mail via me, if they are also my users. By blocking outgoing SMTP you are disallowing the possibility for someone to use my service, and not necessarily getting the gain that you wanted anyway. Its that nose face thing (watch what you cut off). Justin "No, I don't do mail" Newton ************************************************************** Justin W. Newton voice: +1-650-482-2840 Senior Network Architect fax: +1-650-482-2844 PRIORI NETWORKS, INC. http://www.priori.net Legislative and Policy Director, ISP/C http://www.ispc.org "The People You Know. The People You Trust." **************************************************************

2 1

RE: Operational: MAE-WEST
by Chris Fairbanks 31 Oct '97

31 Oct '97

Has anyone heard anything more from MFS/Worldcom about the problems at MAE-WEST? Chris > -----Original Message----- > From: Justin W. Newton [SMTP:justin@priori.net] > Sent: Wednesday, October 29, 1997 5:47 PM > To: dlr(a)bungi.com; nanog(a)merit.edu > Subject: Re: Operational: MAE-WEST > > At 11:37 AM 10/27/97 PST, Dave Rand wrote: > >Despite the (small) improvement last week, apparently achieved by > adding > >another FDDI between giga1 and gigis2, MAE-WEST loss continues. > > > >I'm currently seeing up to 40% loss between giga1 and giga2, and > about 30% > >between giga2 and giga3. > > > >I've contatacted Steve, but no word back, yet. > > Apparently DEC was making some CoolNewSoftware(TM) available today > which is > going to solve world hunger as well as packet loss between AMES and > MFS. > Anyone official care to comment? > > ************************************************************** > Justin W. Newton voice: +1-650-482-2840 > Senior Network Architect fax: +1-650-482-2844 > PRIORI NETWORKS, INC. http://www.priori.net > Legislative and Policy Director, ISP/C http://www.ispc.org > "The People You Know. The People You Trust." > **************************************************************

2 1