- Test - lists.nanog.org

Re: Motion for a new POST NSF AUP
by rboivie＠VNET.IBM.COM 17 Oct '95

17 Oct '95

In discussing spamming problems "William B. Norton" <wbn(a)merit.edu> wrote: > I personally think slightly smarter exploders might go a long way. For > example: > ... > 2) an exploder that "suspends" messages with more than, say 6 lists > and newsgroups, and notifies the sender. If the sender is not a real > address, it automatically is purged. But wouldn't a spammer just defeat this measure by using a shell script, say. Instead of sending one message to n lists, a script could easily send n messages each addressed to a single list. Rick Boivie rboivie(a)vnet.ibm.com

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Walter O. Haas 17 Oct '95

17 Oct '95

My first reaction to this thread was "Yeah! Let's outlaw spam!". But then it occurred to me that the Internet already gives me more control over this stuff than I have now with junk mail and phone calls. Unless the spam situation gets worse (and the only spam I've gotten in a month or more was Nazi propaganda from a forged address) I'm inclined to think legislation would create more problems than it solves. -- Walt

1 0

Re: SECOND CALL FOR AUP MOTION
by Sean Doran 17 Oct '95

17 Oct '95

>Shall we table the motion ... Who's "we"? Sean.

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Jeff.Ogden＠um.cc.umich.edu 17 Oct '95

17 Oct '95

Here are two items from the MichNet Acceptable Use Policy that seem to apply: -- Unsolicited advertising is not acceptable. Advertising is permitted on some mailing lists and news groups if the mailing list or news group explicitly allows advertising. Announcements of new products or services are acceptable. -- To respect the privacy of other users; for example, users shall not intentionally seek information on, obtain copies of, or modify files, other data, or passwords belonging to other users, or represent themselves as another user unless ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ explicitly authorized to do so by that user. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Note that solicited advertising is OK. -Jeff Ogden Merit

1 0

Re: Motion for a new POST NSF AUP
by John Curran 17 Oct '95

17 Oct '95

Tim, Presume that we've all met, decided a policy, figured out who it takes to "officially" make it an Internet policy, and made it happen. Simply amazing progress has occurred, and it's still morning on the Internet... Now, let's talk about the hard part: enforcement. Since the sender of a bulk, unsolicited advertisement may not even be affiliated with the beneficiary of such mail, how do you intend catch the culprit? There is nothing in an email message that provides hard proof of identity, and there is nothing to stop me from sending all of my advertising as "Tim Bass". Since any host connected to the Internet can forge email with very little trail, relying on the purported sender of the message is clearly not possible for enforcement. Of course, one could always look towards the beneficiary of the message (i.e. the firm which gains the business as the result of this "misuse") but that's actually no better than relying on the sender. It doesn't matter whether the enforcement method is loss of Internet service or large fines, it will be very difficult for anyone to actually safely invoke such methods without incurring immense liability. Since anyone can send a bulk, unsolicited advertisement with "The Silk Road Group" as the beneficiary, you've now created the ultimate denial of service attack. Don't like a firm? Send out a massive forged advertisement for their latest product and watch them get disconnected from the net... :-) Despite postings to the contrary, this is an extremely difficult problem to solve in the absence of authentication. While the current ad-hoc methods of managing such bulk advertising are not perfect, they may be far better than the quick fixes being proposed. /John --- At 10:54 AM 10/15/95, Tim Bass wrote: >Ladies and Gentlemen...... > >A couple of interesting points have developed as a result of the latest >'spam event'. The first one is debatable, but I would like to comment, >that my mailbox received 'one spam message' (which I deleted in a few >milliseconds) that generated hundereds of 'anti-spam messages'. Causal >to the 'spam' I would like to refer to the anti-spam messages as >'son-of-spam' :-) > >Second, it is somewhat clear that as long as we have 'spam' we will have >a causal event 'son-of-spam' . Neither 'spam' nor 'son-of-spam' are welcome >e-mail in most in-boxes, and I assume by the responses, many people find >'son-of-spam' just as annoying as 'spam'. Given that both sides of the >coin are correct (in their own perception space) as we have seen, >I would like to put this on the table to the network: > >Should we define an new 'postNSF AUP' that addresses what types of messages >are Acceptable Use of the Internet? Should transit and end user providers >require customers to agree to 'the new "agreed upon someday" commercial AUP'? > >Could we even agree on what a new AUP would look like? Most everyone >agrees that spam and son-on-spam are a waste of precious bandwidth, time, >and energy; and unacceptable messages detract everyone from more important >daily issues and ideas. > >I motion we create a working group to develop a draft POST NSF AUP. >------------------------------------------------------------------ > >We all agree we need to manage what type of messages are acceptable use of >the net..... Can we make POST NSF AUP a reality? > >Any seconds to the motion? > >Tim > >-- >+--------------------------------------------------------------------------+ >| Tim Bass | #include<campfire.h> | >| Principal Network Systems Engineer | for(beer=100;beer>1;beer++){ | >| The Silk Road Group, Ltd. | take_one_down(); | >| | pass_it_around(); | >| http://www.silkroad.com/ | } | >| | back_to_work(); /*never reached */ | >+--------------------------------------------------------------------------+

6 5

Re: Motion for a new POST NSF AUP
by woody＠zocalo.net 16 Oct '95

16 Oct '95

I support the notion of a non-binding AUP, on the grounds that it wouldn't be _that_ much work to do, but would give us (Internet denizens) something to point to when our respective governments give us the "clean up your act before we do it for you" number again. I don't expect such a non-binding AUP to have any short-term or dramatic effect on end-user behaviour, however. Thus, I also support the idea of PGP/listserv and PGP/news-server integration. At present, I can allow or disallow posting on our news servers by IP address or range, and by FQDN or domain name. I think it might be useful to allow PGP-authenticated validated users to post from any location or host. The creation of a user-list based permissions scheme would also clear the way for automatic invalidation of individual users who post to too many newsgroups within too short a period of time, a la deactivating user accounts after too many successive failed logins. I disagree with the proposition that this would place too great a burden on servers... authentication need be done only at the time the posting is introduced into the Usenet system or onto the listserv... If someone wants to go to the trouble of spoofing a whole listserv, perhaps that should be recognized as a whole we don't feel like dealing with in an initial implementation... News servers obviously support a limited number of inter-server connections, which could be easily validated themselves, so they're a more easily closed system. -Bill Woodcock ________________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)applelink.apple.com user(a)host.domain.com

4 3

Re: Motion for a new POST NSF AUP
by Jeff.Ogden＠um.cc.umich.edu 16 Oct '95

16 Oct '95

I think that AUPs issued by each ISP, but with some common elements are very important. If we can agree on the common elements that would be a start. The next step would be for the big providers to include these common elements in their contracts. My lawyer tells me that the best way for me to avoid being in the middle is to pass these contractual responsibilities along in the form of our AUP. We do that. I suspect that others would too. I'm not too worried about enforcability at this point. I think there are two issues here. One is more or less a code of good conduct. The other is what to do when people don't follow the code. At this stage I'd be happy if we could just inform people what acceptable conduct is. We can figure out what to do about people who don't play along later. -Jeff Ogden Merit/MichNet

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF
by Robert Raisch, The Internet Company 16 Oct '95

16 Oct '95

On 16 Oct 95 at 10:19, bmanning(a)ISI.EDU wrote: > Me thinks that this is yet one more short sighted view of the Internet. Bill, all very good points, indeed. But while the US-centric issues are not lost on me, it certainly seems that the majority of spammage originates from US ISPs. Perhaps this is based in some way on the free-wheeling entrepreneurial nature of US commerce or on the increasing tide of social indifference. But I digress... I am talking very specifically about US federal law, applicable to US citizens. The Internet is indeed a global phenomenon but when one leads, others may surely follow. I am not advocating laws which restrict uses of commercial networks. I am advocating restraint over those things that others can do to me which cost me money and thus, are theft. Federal law already (I believe) restricts what use others may enjoy of my resources without my permission. FAX and cellular phones cannot be used for purposes of advertising. Finally, what I am suggesting is perhaps a little more subtle than grotesque legal bludgeoning. Consider the potential impact that highly visible federal law would have on those who would consider this an effective means to market to others using resources for which they do not pay. One argument I have seen is that all we need do is get a single AUP to which all ISPs will adhere. When such a thing comes into existance, I believe it will be far too difficult to read the wonderful news, amid the 5000 spams waiting in my mail queue. I believe the chestnut about herding cats might have originated with the idea that we can get all ISPs to agree on any one thing. </rr> -- The Internet Company - info(a)internet.com We Bring Only Value to the Global Internet

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Jeffrey I. Schiller 16 Oct '95

16 Oct '95

On Oct 16, 12:09pm, Robert Raisch, The Internet Company wrote: > I would like to propose that we seek legislative relief from > this ever-increasing problem. I have spoken with counsel and > now understand what is required to support the enactment of > federal legislation to prohibit the misuse of electronic mail > and Usenet news by unprincipled "spammers." > > There is already law which prohibits marketing via facsimile and > cellular telephone. My position is that e-mail and Usenet news > are similar vehicles in the sense that there is a measurable > cost on the receiver's end. I believe that this has the > potential of being a high-visibility legal issue, and one that > would be a "vote getter" as it speaks directly to an educated, > active voting constituency. How do you propose to deal with off-shore spammers? This isn't an issue for FAXing because an offshore FAX sender would have to pay international phone rates, which act as a natural deterent. However an e-mail message can be as quickly and easily sent from off-shore as it can be sent from within the U.S. Legislative solutions will also not address the ease of which someone can spam using someone else's name, not to mention the ease of routing the spam through other Internet hosts, including those which are offshore. It is bad enough today that when someone sends spam that appears to be from my institution (but is often only forged to appear that way), that I receive many complaints from people across the network. If such spam was against the law, I suspect that I would be visited by law enforcement agents, who will waste my time while I explain (or prove) that the spam did in fact not originate from my institution. Policies (and laws) which are not enforceable are often worse then no laws at all. -Jeff

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF
by Robert Raisch, The Internet Company 16 Oct '95

16 Oct '95

Paul, none of the suggestions I have seen so far (in more than five years) offer something which 1. is an effective solution, 2. is technologically possible, and 3. places the burden of blame on the perpetrator. If you can propose a solution which does not imply: ...imaginary technology to intuit a commercial message from its content (can anyone say "content based routing"? ;) ...making the management of the affected resources more rigorous than current practice ...punishing the ISP for the actions of its customers ...complex or impossible deployment issues ...added administrative cost I and many others would LOVE to hear about it. I am the first to agree with Shakespere on the value of certain members of the legal profession. This time, however, I do not see any recourse. Do you? </rr> On 16 Oct 95 at 9:40, Paul Ferguson wrote: > Eek. Do you _really_ want to get a bunch of shyster lawyers involved? > I would think that there must be any number of more platable courses of > action than this... > > My $.02. > -- The Internet Company - info(a)internet.com We Bring Only Value to the Global Internet

4 4