- Test - lists.nanog.org

Re: Motion for a new POST NSF AUP
by John Curran 17 Oct '95

17 Oct '95

Tim, Presume that we've all met, decided a policy, figured out who it takes to "officially" make it an Internet policy, and made it happen. Simply amazing progress has occurred, and it's still morning on the Internet... Now, let's talk about the hard part: enforcement. Since the sender of a bulk, unsolicited advertisement may not even be affiliated with the beneficiary of such mail, how do you intend catch the culprit? There is nothing in an email message that provides hard proof of identity, and there is nothing to stop me from sending all of my advertising as "Tim Bass". Since any host connected to the Internet can forge email with very little trail, relying on the purported sender of the message is clearly not possible for enforcement. Of course, one could always look towards the beneficiary of the message (i.e. the firm which gains the business as the result of this "misuse") but that's actually no better than relying on the sender. It doesn't matter whether the enforcement method is loss of Internet service or large fines, it will be very difficult for anyone to actually safely invoke such methods without incurring immense liability. Since anyone can send a bulk, unsolicited advertisement with "The Silk Road Group" as the beneficiary, you've now created the ultimate denial of service attack. Don't like a firm? Send out a massive forged advertisement for their latest product and watch them get disconnected from the net... :-) Despite postings to the contrary, this is an extremely difficult problem to solve in the absence of authentication. While the current ad-hoc methods of managing such bulk advertising are not perfect, they may be far better than the quick fixes being proposed. /John --- At 10:54 AM 10/15/95, Tim Bass wrote: >Ladies and Gentlemen...... > >A couple of interesting points have developed as a result of the latest >'spam event'. The first one is debatable, but I would like to comment, >that my mailbox received 'one spam message' (which I deleted in a few >milliseconds) that generated hundereds of 'anti-spam messages'. Causal >to the 'spam' I would like to refer to the anti-spam messages as >'son-of-spam' :-) > >Second, it is somewhat clear that as long as we have 'spam' we will have >a causal event 'son-of-spam' . Neither 'spam' nor 'son-of-spam' are welcome >e-mail in most in-boxes, and I assume by the responses, many people find >'son-of-spam' just as annoying as 'spam'. Given that both sides of the >coin are correct (in their own perception space) as we have seen, >I would like to put this on the table to the network: > >Should we define an new 'postNSF AUP' that addresses what types of messages >are Acceptable Use of the Internet? Should transit and end user providers >require customers to agree to 'the new "agreed upon someday" commercial AUP'? > >Could we even agree on what a new AUP would look like? Most everyone >agrees that spam and son-on-spam are a waste of precious bandwidth, time, >and energy; and unacceptable messages detract everyone from more important >daily issues and ideas. > >I motion we create a working group to develop a draft POST NSF AUP. >------------------------------------------------------------------ > >We all agree we need to manage what type of messages are acceptable use of >the net..... Can we make POST NSF AUP a reality? > >Any seconds to the motion? > >Tim > >-- >+--------------------------------------------------------------------------+ >| Tim Bass | #include<campfire.h> | >| Principal Network Systems Engineer | for(beer=100;beer>1;beer++){ | >| The Silk Road Group, Ltd. | take_one_down(); | >| | pass_it_around(); | >| http://www.silkroad.com/ | } | >| | back_to_work(); /*never reached */ | >+--------------------------------------------------------------------------+

6 5

Re: Motion for a new POST NSF AUP
by woody＠zocalo.net 16 Oct '95

16 Oct '95

I support the notion of a non-binding AUP, on the grounds that it wouldn't be _that_ much work to do, but would give us (Internet denizens) something to point to when our respective governments give us the "clean up your act before we do it for you" number again. I don't expect such a non-binding AUP to have any short-term or dramatic effect on end-user behaviour, however. Thus, I also support the idea of PGP/listserv and PGP/news-server integration. At present, I can allow or disallow posting on our news servers by IP address or range, and by FQDN or domain name. I think it might be useful to allow PGP-authenticated validated users to post from any location or host. The creation of a user-list based permissions scheme would also clear the way for automatic invalidation of individual users who post to too many newsgroups within too short a period of time, a la deactivating user accounts after too many successive failed logins. I disagree with the proposition that this would place too great a burden on servers... authentication need be done only at the time the posting is introduced into the Usenet system or onto the listserv... If someone wants to go to the trouble of spoofing a whole listserv, perhaps that should be recognized as a whole we don't feel like dealing with in an initial implementation... News servers obviously support a limited number of inter-server connections, which could be easily validated themselves, so they're a more easily closed system. -Bill Woodcock ________________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)applelink.apple.com user(a)host.domain.com

4 3

Re: Motion for a new POST NSF AUP
by Jeff.Ogden＠um.cc.umich.edu 16 Oct '95

16 Oct '95

I think that AUPs issued by each ISP, but with some common elements are very important. If we can agree on the common elements that would be a start. The next step would be for the big providers to include these common elements in their contracts. My lawyer tells me that the best way for me to avoid being in the middle is to pass these contractual responsibilities along in the form of our AUP. We do that. I suspect that others would too. I'm not too worried about enforcability at this point. I think there are two issues here. One is more or less a code of good conduct. The other is what to do when people don't follow the code. At this stage I'd be happy if we could just inform people what acceptable conduct is. We can figure out what to do about people who don't play along later. -Jeff Ogden Merit/MichNet

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF
by Robert Raisch, The Internet Company 16 Oct '95

16 Oct '95

On 16 Oct 95 at 10:19, bmanning(a)ISI.EDU wrote: > Me thinks that this is yet one more short sighted view of the Internet. Bill, all very good points, indeed. But while the US-centric issues are not lost on me, it certainly seems that the majority of spammage originates from US ISPs. Perhaps this is based in some way on the free-wheeling entrepreneurial nature of US commerce or on the increasing tide of social indifference. But I digress... I am talking very specifically about US federal law, applicable to US citizens. The Internet is indeed a global phenomenon but when one leads, others may surely follow. I am not advocating laws which restrict uses of commercial networks. I am advocating restraint over those things that others can do to me which cost me money and thus, are theft. Federal law already (I believe) restricts what use others may enjoy of my resources without my permission. FAX and cellular phones cannot be used for purposes of advertising. Finally, what I am suggesting is perhaps a little more subtle than grotesque legal bludgeoning. Consider the potential impact that highly visible federal law would have on those who would consider this an effective means to market to others using resources for which they do not pay. One argument I have seen is that all we need do is get a single AUP to which all ISPs will adhere. When such a thing comes into existance, I believe it will be far too difficult to read the wonderful news, amid the 5000 spams waiting in my mail queue. I believe the chestnut about herding cats might have originated with the idea that we can get all ISPs to agree on any one thing. </rr> -- The Internet Company - info(a)internet.com We Bring Only Value to the Global Internet

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF AUP
by Jeffrey I. Schiller 16 Oct '95

16 Oct '95

On Oct 16, 12:09pm, Robert Raisch, The Internet Company wrote: > I would like to propose that we seek legislative relief from > this ever-increasing problem. I have spoken with counsel and > now understand what is required to support the enactment of > federal legislation to prohibit the misuse of electronic mail > and Usenet news by unprincipled "spammers." > > There is already law which prohibits marketing via facsimile and > cellular telephone. My position is that e-mail and Usenet news > are similar vehicles in the sense that there is a measurable > cost on the receiver's end. I believe that this has the > potential of being a high-visibility legal issue, and one that > would be a "vote getter" as it speaks directly to an educated, > active voting constituency. How do you propose to deal with off-shore spammers? This isn't an issue for FAXing because an offshore FAX sender would have to pay international phone rates, which act as a natural deterent. However an e-mail message can be as quickly and easily sent from off-shore as it can be sent from within the U.S. Legislative solutions will also not address the ease of which someone can spam using someone else's name, not to mention the ease of routing the spam through other Internet hosts, including those which are offshore. It is bad enough today that when someone sends spam that appears to be from my institution (but is often only forged to appear that way), that I receive many complaints from people across the network. If such spam was against the law, I suspect that I would be visited by law enforcement agents, who will waste my time while I explain (or prove) that the spam did in fact not originate from my institution. Policies (and laws) which are not enforceable are often worse then no laws at all. -Jeff

2 1

Re: Legislative Relief - was Re: Motion for a new POST NSF
by Robert Raisch, The Internet Company 16 Oct '95

16 Oct '95

Paul, none of the suggestions I have seen so far (in more than five years) offer something which 1. is an effective solution, 2. is technologically possible, and 3. places the burden of blame on the perpetrator. If you can propose a solution which does not imply: ...imaginary technology to intuit a commercial message from its content (can anyone say "content based routing"? ;) ...making the management of the affected resources more rigorous than current practice ...punishing the ISP for the actions of its customers ...complex or impossible deployment issues ...added administrative cost I and many others would LOVE to hear about it. I am the first to agree with Shakespere on the value of certain members of the legal profession. This time, however, I do not see any recourse. Do you? </rr> On 16 Oct 95 at 9:40, Paul Ferguson wrote: > Eek. Do you _really_ want to get a bunch of shyster lawyers involved? > I would think that there must be any number of more platable courses of > action than this... > > My $.02. > -- The Internet Company - info(a)internet.com We Bring Only Value to the Global Internet

4 4

Re: Motion for a new POST NSF AUP
by William Allen Simpson 16 Oct '95

16 Oct '95

> From: "Theodore Ts'o" <tytso(a)MIT.EDU> > I disagree, strongly. I think anti-spam messages, sent to the > postmasters of the respective ISP's that provide service to the > spammers, is perfectly acceptable. Otherwise, there is no cost to the > ISP's for providing service to the spammers. > Good idea! I've only been sending to the perpetrator (which sometimes bounces). > As a matter of course, whenever I receive a spam, I will generally send > a complaint to postmaster at the originating site, or perhaps to the > ISP, if I can determine it. In fact, I'm thinking about automating this > procedure, to decrease the amount of time that it takes for me to send > the complaint. I also have a template file which I use to save time. How do you automate finding the postmaster and ISP? I cannot seem to figure it out. In the case of the "Janet Dove" spam, the two different months included different headers: Received: (from news@localhost) by ixc.ixc.net (8.6.12/8.6.10) id SAA06849; Fri, 8 Sep 1995 18:27:50 -0400 From: janetdove(a)infosat.com (Janet Dove) Newsgroups: info.ietf.isoc,info.ietf.njm,info.ietf.smtp,info.inet.access,info.isode,info.jethro-tull,info.labmgr,info.mach,info.mh.workers,info.nets,info.nsf.grants,info.nsfnet.cert,info.nsfnet.status,info.nupop,info.nysersnmp,info.osf,info.pem-de Subject: ===>> FREE 1 yr. Magazine Sub sent worldwide- 315+ Popular USA Titles Date: Fri, 08 Sep 1995 18:28:18 -0500 Organization: Association of Overseas Students, Eastern Region Message-ID: <janetdove-0809951828180001(a)pm1-49.ixc.net> NNTP-Posting-Host: pm1-44.ixc.net Received: from [198.70.48.62] (pm1-62.ixc.net [198.70.48.62]) by cornell.edu (8.6.12/8.6.12) with SMTP id EAA02068; Wed, 11 Oct 1995 04:28:53 -0400 X-Sender: For.a.prompter.reply.please.fax(a)If.you.do.not.have.a.fax.smail.is.ok (Unverified) Message-Id: <v0153050baca1267766ab(a)[205.230.67.34]> Date: Wed, 11 Oct 1995 05:03:27 -0500 To: For.a.prompter.reply.please.fax(a)If.you.do.not.have.a.fax.smail.is.ok From: For.a.prompter.reply.please.fax(a)If.you.do.not.have.a.fax.smail.is.ok (You will get a quick reply via email within 1 business day of receipt of the info request form below.) Subject: *new* reply info: ===>> FREE 1 yr. Magazine Sub sent worldwide- 300+ Popular USA Titles As you can see, in the second they were better at hiding! But email to janetdove didn't bounce.... And the Received tells the IP address. As to authentication, the headers indicate "pm-", probably a PortMaster. I _know_ PortMasters have both PAP and CHAP authentication. > Other people have talked about enforcement; as near as I can tell, this > is the only kind of enforcement on the Internet that will really work. > Yes, email reply is a good start. But, I would like to add another kind. And the ISP's had better listen up: The other kind is a lawsuit. It costs about $50 for an individual to file, and $$$ (thousands) for a company to defend. And for that same $50, I can sue _both_ the perpetrator, and an uncooperative ISP. If the ISP fails to authenticate, and/or fails to log and identify the perpetrator, they are clearly negligent! > P.S. Perhaps ISP's should consider writing into their customer's > contracts some legal language saying that if the ISP receives too many > complaints, that the customer is liable for the cost of processing the > complaints caused by that customer --- the ISP can decide to waive the > fee if the complaints are caused by some mail forgery or other > legitimate misunderstanding. > We talked about this last year. If they haven't done it by now, they have only themselves to blame.... Bill.Simpson(a)um.cc.umich.edu Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

3 2

Re: Motion for a new POST NSF AUP
by Henry W. Miller 16 Oct '95

16 Oct '95

> From: MX%"pjnesser(a)rocket.com" 15-OCT-1995 23:24:02.30 > Subj: Re: Motion for a new POST NSF AUP > > A better use for your effort is to develop some hacks into majordomo or > another mailing list manager that can trivially make a list only accept PGP > signed (or whatever your favorite authentication system is) messages that > it can confirm with a public keyserver. At the very least all of the major > mailing lists that get regularly nailed by spams can transition and we can > get some authentication of the culprit. > > ---> Phil > I had a situation several months ago where a member of the list started spamming one of my lists because he was having problems unsubscribing. After contacting his ISP, I initially had problems with them because they flatly denied that the mail was originating from their host. I introduced a minor modification into the SMTP server which logged the IP address as well as the host name. This provided the evidence that the mail was indeed originating from their host, and they took the appropriate action. -HWM

4 3

Funding for NAPs...
by Matt Zimmerman 16 Oct '95

16 Oct '95

Out of curiosity...where does the money come from to keep exchange points like the MAEs alive? Is NSF or other government money involved? If so, what are the terms of the funding? // Matt Zimmerman Chief of System Management NetRail, Inc. // Work..........mdz(a)netrail.net | Play...gemini(a)alcor.netrail.net // (703) 524-4800 [voice] (703) 524-4802 [data] (703) 534-5033 [fax]

8 8

Re: BGP4 peering wiht Sprint, and MCI
by David Whipple 16 Oct '95

16 Oct '95

You should also investigate the MCI Routing Registery. The documentation can be found on http://infopage.mci.net. This will allow you to submit route object/s for your existing address space. ---------- From: Robert Craig <rcraig(a)cisco.com> To: Nathan Stratton <nathan(a)netrail.net> Cc: <nanog(a)merit.edu> Subject: Re: BGP4 peering wiht Sprint, and MCI Date: Saturday, October 14, 1995 5:05PM Hey, Nathan, try using static routes, then exporting them to BGP: static { 204.17.64.0 masklen 24 gateway <gwaddr>; 204.183.0.0 masklen 19 gateway <gwaddr>; 205.215.0.0 masklen 18 gateway <gwaddr>; }; export proto bgp as <asnum> { # connected networks, if necessary proto direct { ALL metric <whatever>; }; # statics, you may want to do less than all, see gated docs ;-) proto static { ALL metric <whatever>; }; }; At 14:34 95/10/14, Nathan Stratton wrote: >We have a 486 DX4 100 with 40 megs of ram running FreeBSD and gated with a >T1 to Sprint and a T1 to MCI. I have a few questions that someone may be >able to answer. > >If my Sprint T1 goes down, how long will it take for route to drop out of >the routing table? Should be pretty quick. > >I have peering going with sprint and MCI and I have about 31,000 routes >in my routing table. When I called up sprint and MCI they said they were >not getting routes form me. How do I advertize my CIDR blocks to sprint >and mci via BGP4? > >I have: > >204.17.64.0/24 >204.183.0.0/19 >205.215.0.0/18 > >Nathan Stratton CEO, NetRail, Inc. Your Gateway to the World! >--------------------------------------------------------------------------- >Phone (703)524-4800 NetRail, Inc. >Fax (703)534-5033 2007 N. 15 St. Suite B-5 >Email sales(a)netrail.net Arlington, Va. 22201 >WWW http://www.netrail.net/ Access: (703) 524-4802 guest >--------------------------------------------------------------------------- Robert.

1 0