Subject: [Asrg] 6. Proposals - Blacklists - Community-based (was RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work)

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 05 Aug 2003 22:12:02 -0400

At 09:43 PM 8/5/2003, Hallam-Baker, Phillip wrote:
>........
>I think that we have to be very carefull when considering the information
>sources a spam solution depends on. All information sources should be
>considered untrustworthy unless there is good reason to think otherwise. If
>there is an auditor the actions of the auditor should themselves be open to
>review.

In a consent system, the developers and administrators of the system have 
full freedom to choose which sources and auditors to trust. The notion of 
all sources being "tainted" is something that should mentioned, but I am 
not sure whether that should be done in the consent framework or as part of 
BCPs.

Yakov 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 06 Aug 2003 09:13:13 -0400

> not sure whether that should be done in the consent framework or as part of 

  The consent system proposed by ASRG MUST NOT depend on information
from third parties to the consent exchange.  However, the parties to
the consent exchange MAY use such information, if they so choose.  If
they do, the MUST still communicate their consent as part of the
consent exchange, even if some of that consent is based on information
from third parties.

  The issue is one of informed consent, and of transparency of
consent.  If the sender is unknowingly unable to achieve informed
consent, then there is no effective consent framework.  

  Participants to the consent exchange can use any information they
wish to make their decisions.  Third parties to the consent exchange
are uninvolved, and therefore should be forbidden from interfering in
that conversation (barring legal matters.)

  e.g. Say I subscribe to a political censorship service, and that
service decides to ban all traffic from Ira{q,n}.  When I get
communication requests from Ira{q,n}, I MUST inform them that I do not
consent to that communication.  The reasons why I do not consent are
personal, and SHOULD NOT be communicated.

  Alan DeKok.