- NANOG - lists.nanog.org

Re: Motion for a new POST NSF AUP
by Jeff.Ogden＠um.cc.umich.edu 16 Oct '95

16 Oct '95

I think that AUPs issued by each ISP, but with some common elements are very important. If we can agree on the common elements that would be a start. The next step would be for the big providers to include these common elements in their contracts. My lawyer tells me that the best way for me to avoid being in the middle is to pass these contractual responsibilities along in the form of our AUP. We do that. I suspect that others would too. I'm not too worried about enforcability at this point. I think there are two issues here. One is more or less a code of good conduct. The other is what to do when people don't follow the code. At this stage I'd be happy if we could just inform people what acceptable conduct is. We can figure out what to do about people who don't play along later. -Jeff Ogden Merit/MichNet

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF
by Robert Raisch, The Internet Company 16 Oct '95

16 Oct '95

On 16 Oct 95 at 10:19, bmanning(a)ISI.EDU wrote: > Me thinks that this is yet one more short sighted view of the Internet. Bill, all very good points, indeed. But while the US-centric issues are not lost on me, it certainly seems that the majority of spammage originates from US ISPs. Perhaps this is based in some way on the free-wheeling entrepreneurial nature of US commerce or on the increasing tide of social indifference. But I digress... I am talking very specifically about US federal law, applicable to US citizens. The Internet is indeed a global phenomenon but when one leads, others may surely follow. I am not advocating laws which restrict uses of commercial networks. I am advocating restraint over those things that others can do to me which cost me money and thus, are theft. Federal law already (I believe) restricts what use others may enjoy of my resources without my permission. FAX and cellular phones cannot be used for purposes of advertising. Finally, what I am suggesting is perhaps a little more subtle than grotesque legal bludgeoning. Consider the potential impact that highly visible federal law would have on those who would consider this an effective means to market to others using resources for which they do not pay. One argument I have seen is that all we need do is get a single AUP to which all ISPs will adhere. When such a thing comes into existance, I believe it will be far too difficult to read the wonderful news, amid the 5000 spams waiting in my mail queue. I believe the chestnut about herding cats might have originated with the idea that we can get all ISPs to agree on any one thing. </rr> -- The Internet Company - info(a)internet.com We Bring Only Value to the Global Internet

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Jeffrey I. Schiller 16 Oct '95

16 Oct '95

On Oct 16, 12:09pm, Robert Raisch, The Internet Company wrote: > I would like to propose that we seek legislative relief from > this ever-increasing problem. I have spoken with counsel and > now understand what is required to support the enactment of > federal legislation to prohibit the misuse of electronic mail > and Usenet news by unprincipled "spammers." > > There is already law which prohibits marketing via facsimile and > cellular telephone. My position is that e-mail and Usenet news > are similar vehicles in the sense that there is a measurable > cost on the receiver's end. I believe that this has the > potential of being a high-visibility legal issue, and one that > would be a "vote getter" as it speaks directly to an educated, > active voting constituency. How do you propose to deal with off-shore spammers? This isn't an issue for FAXing because an offshore FAX sender would have to pay international phone rates, which act as a natural deterent. However an e-mail message can be as quickly and easily sent from off-shore as it can be sent from within the U.S. Legislative solutions will also not address the ease of which someone can spam using someone else's name, not to mention the ease of routing the spam through other Internet hosts, including those which are offshore. It is bad enough today that when someone sends spam that appears to be from my institution (but is often only forged to appear that way), that I receive many complaints from people across the network. If such spam was against the law, I suspect that I would be visited by law enforcement agents, who will waste my time while I explain (or prove) that the spam did in fact not originate from my institution. Policies (and laws) which are not enforceable are often worse then no laws at all. -Jeff

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF
by Robert Raisch, The Internet Company 16 Oct '95

16 Oct '95

Paul, none of the suggestions I have seen so far (in more than five years) offer something which 1. is an effective solution, 2. is technologically possible, and 3. places the burden of blame on the perpetrator. If you can propose a solution which does not imply: ...imaginary technology to intuit a commercial message from its content (can anyone say "content based routing"? ;) ...making the management of the affected resources more rigorous than current practice ...punishing the ISP for the actions of its customers ...complex or impossible deployment issues ...added administrative cost I and many others would LOVE to hear about it. I am the first to agree with Shakespere on the value of certain members of the legal profession. This time, however, I do not see any recourse. Do you? </rr> On 16 Oct 95 at 9:40, Paul Ferguson wrote: > Eek. Do you _really_ want to get a bunch of shyster lawyers involved? > I would think that there must be any number of more platable courses of > action than this... > > My $.02. > -- The Internet Company - info(a)internet.com We Bring Only Value to the Global Internet

4 4

Re: Motion for a new POST NSF AUP
by William Allen Simpson 16 Oct '95

16 Oct '95

> From: "Theodore Ts'o" <tytso(a)MIT.EDU> > I disagree, strongly. I think anti-spam messages, sent to the > postmasters of the respective ISP's that provide service to the > spammers, is perfectly acceptable. Otherwise, there is no cost to the > ISP's for providing service to the spammers. > Good idea! I've only been sending to the perpetrator (which sometimes bounces). > As a matter of course, whenever I receive a spam, I will generally send > a complaint to postmaster at the originating site, or perhaps to the > ISP, if I can determine it. In fact, I'm thinking about automating this > procedure, to decrease the amount of time that it takes for me to send > the complaint. I also have a template file which I use to save time. How do you automate finding the postmaster and ISP? I cannot seem to figure it out. In the case of the "Janet Dove" spam, the two different months included different headers: Received: (from news@localhost) by ixc.ixc.net (8.6.12/8.6.10) id SAA06849; Fri, 8 Sep 1995 18:27:50 -0400 From: janetdove(a)infosat.com (Janet Dove) Newsgroups: info.ietf.isoc,info.ietf.njm,info.ietf.smtp,info.inet.access,info.isode,info.jethro-tull,info.labmgr,info.mach,info.mh.workers,info.nets,info.nsf.grants,info.nsfnet.cert,info.nsfnet.status,info.nupop,info.nysersnmp,info.osf,info.pem-de Subject: ===>> FREE 1 yr. Magazine Sub sent worldwide- 315+ Popular USA Titles Date: Fri, 08 Sep 1995 18:28:18 -0500 Organization: Association of Overseas Students, Eastern Region Message-ID: <janetdove-0809951828180001(a)pm1-49.ixc.net> NNTP-Posting-Host: pm1-44.ixc.net Received: from [198.70.48.62] (pm1-62.ixc.net [198.70.48.62]) by cornell.edu (8.6.12/8.6.12) with SMTP id EAA02068; Wed, 11 Oct 1995 04:28:53 -0400 X-Sender: For.a.prompter.reply.please.fax(a)If.you.do.not.have.a.fax.smail.is.ok (Unverified) Message-Id: <v0153050baca1267766ab(a)[205.230.67.34]> Date: Wed, 11 Oct 1995 05:03:27 -0500 To: For.a.prompter.reply.please.fax(a)If.you.do.not.have.a.fax.smail.is.ok From: For.a.prompter.reply.please.fax(a)If.you.do.not.have.a.fax.smail.is.ok (You will get a quick reply via email within 1 business day of receipt of the info request form below.) Subject: *new* reply info: ===>> FREE 1 yr. Magazine Sub sent worldwide- 300+ Popular USA Titles As you can see, in the second they were better at hiding! But email to janetdove didn't bounce.... And the Received tells the IP address. As to authentication, the headers indicate "pm-", probably a PortMaster. I _know_ PortMasters have both PAP and CHAP authentication. > Other people have talked about enforcement; as near as I can tell, this > is the only kind of enforcement on the Internet that will really work. > Yes, email reply is a good start. But, I would like to add another kind. And the ISP's had better listen up: The other kind is a lawsuit. It costs about $50 for an individual to file, and $$$ (thousands) for a company to defend. And for that same $50, I can sue _both_ the perpetrator, and an uncooperative ISP. If the ISP fails to authenticate, and/or fails to log and identify the perpetrator, they are clearly negligent! > P.S. Perhaps ISP's should consider writing into their customer's > contracts some legal language saying that if the ISP receives too many > complaints, that the customer is liable for the cost of processing the > complaints caused by that customer --- the ISP can decide to waive the > fee if the complaints are caused by some mail forgery or other > legitimate misunderstanding. > We talked about this last year. If they haven't done it by now, they have only themselves to blame.... Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

3 2

Re: Motion for a new POST NSF AUP
by Henry W. Miller 16 Oct '95

16 Oct '95

> From: MX%"pjnesser(a)rocket.com" 15-OCT-1995 23:24:02.30 > Subj: Re: Motion for a new POST NSF AUP > > A better use for your effort is to develop some hacks into majordomo or > another mailing list manager that can trivially make a list only accept PGP > signed (or whatever your favorite authentication system is) messages that > it can confirm with a public keyserver. At the very least all of the major > mailing lists that get regularly nailed by spams can transition and we can > get some authentication of the culprit. > > ---> Phil > I had a situation several months ago where a member of the list started spamming one of my lists because he was having problems unsubscribing. After contacting his ISP, I initially had problems with them because they flatly denied that the mail was originating from their host. I introduced a minor modification into the SMTP server which logged the IP address as well as the host name. This provided the evidence that the mail was indeed originating from their host, and they took the appropriate action. -HWM

4 3

Funding for NAPs...
by Matt Zimmerman 16 Oct '95

16 Oct '95

Out of curiosity...where does the money come from to keep exchange points like the MAEs alive? Is NSF or other government money involved? If so, what are the terms of the funding? // Matt Zimmerman Chief of System Management NetRail, Inc. // Work..........mdz(a)netrail.net | Play...gemini(a)alcor.netrail.net // (703) 524-4800 [voice] (703) 524-4802 [data] (703) 534-5033 [fax]

8 8

Re: BGP4 peering wiht Sprint, and MCI
by David Whipple 16 Oct '95

16 Oct '95

You should also investigate the MCI Routing Registery. The documentation can be found on http://infopage.mci.net. This will allow you to submit route object/s for your existing address space. ---------- From: Robert Craig <rcraig(a)cisco.com> To: Nathan Stratton <nathan(a)netrail.net> Cc: <nanog(a)merit.edu> Subject: Re: BGP4 peering wiht Sprint, and MCI Date: Saturday, October 14, 1995 5:05PM Hey, Nathan, try using static routes, then exporting them to BGP: static { 204.17.64.0 masklen 24 gateway <gwaddr>; 204.183.0.0 masklen 19 gateway <gwaddr>; 205.215.0.0 masklen 18 gateway <gwaddr>; }; export proto bgp as <asnum> { # connected networks, if necessary proto direct { ALL metric <whatever>; }; # statics, you may want to do less than all, see gated docs ;-) proto static { ALL metric <whatever>; }; }; At 14:34 95/10/14, Nathan Stratton wrote: >We have a 486 DX4 100 with 40 megs of ram running FreeBSD and gated with a >T1 to Sprint and a T1 to MCI. I have a few questions that someone may be >able to answer. > >If my Sprint T1 goes down, how long will it take for route to drop out of >the routing table? Should be pretty quick. > >I have peering going with sprint and MCI and I have about 31,000 routes >in my routing table. When I called up sprint and MCI they said they were >not getting routes form me. How do I advertize my CIDR blocks to sprint >and mci via BGP4? > >I have: > >204.17.64.0/24 >204.183.0.0/19 >205.215.0.0/18 > >Nathan Stratton CEO, NetRail, Inc. Your Gateway to the World! >--------------------------------------------------------------------------- >Phone (703)524-4800 NetRail, Inc. >Fax (703)534-5033 2007 N. 15 St. Suite B-5 >Email sales(a)netrail.net Arlington, Va. 22201 >WWW http://www.netrail.net/ Access: (703) 524-4802 guest >--------------------------------------------------------------------------- Robert.

1 0

Re: Motion for a new POST NSF AUP
by William Allen Simpson 16 Oct '95

16 Oct '95

-----BEGIN PGP SIGNED MESSAGE----- > From: Havard.Eidnes(a)runit.sintef.no > 5.2.8 DATA Command: RFC-821 Section 4.1.1 > ... > * The FROM field SHOULD contain both (1) the name of the > source host as presented in the HELO command and (2) a > domain literal containing the IP address of the source, > determined from the TCP connection. > ... > DISCUSSION: > Including both the source host and the IP source address > in the Received: line may provide enough information for > tracking illicit mail sources and eliminate a need to > explicitly verify the HELO parameter. > > Thus, this is not a new suggestion (RFC 1123 is dated Oct 1989). > You are correct. Good memory! So, how do we enforce a 6 year old RFC? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIIw4GZacKQwIslRAQE/6AQAlLduKbKJVbLKu91zVJhYqXv9WR6sL9QC TYzic48/4AGUElmlpUge4NvTD6R2VLSxeDQ5nXFT7P/3HMxuvtkZkpDtmyADzjSx /SauvnRlhgj5TTckfUr1e6zwNJNhQ25G5Pqe6qKzVkv8K3sFCf9AQCRBhN2qTEpW kQznEBp5raQ= =hAmv -----END PGP SIGNATURE-----

1 0

Re: Motion for a new POST NSF AUP
by Havard.Eidnes＠runit.sintef.no 16 Oct '95

16 Oct '95

> Another suggestion was that SMTP headers always contain the > IP address. I've seen this in quite a few mailers already. > All we need is a slight modification to the SMTP Receipt > standard. This could be a Best Current Practice, quickly > published! Hm, this is already covered. RFC 1123 says: 5.2.8 DATA Command: RFC-821 Section 4.1.1 ... * The FROM field SHOULD contain both (1) the name of the source host as presented in the HELO command and (2) a domain literal containing the IP address of the source, determined from the TCP connection. ... DISCUSSION: Including both the source host and the IP source address in the Received: line may provide enough information for tracking illicit mail sources and eliminate a need to explicitly verify the HELO parameter. Thus, this is not a new suggestion (RFC 1123 is dated Oct 1989). Regards, - Håvard

1 0