Subject: [Asrg] Round one modifications to DNSBL BCP draft.

From: "Chris Lewis" <[email-masked]>
Date: Mon, 31 Mar 2008 13:04:30 -0400

As a FYI, I'm preparing a revision 2 which I will publish here shortly.

I'm just giving this as a heads-up on what I've changed.

- Trying to remove all occurrences of the word "blacklist", partially 
for, ahem, _those_reasons_ (there already had been a round of this some 
time ago), and to try to make it more universally applicable to 
whitelists too.  Explicitly mentioned other uses (eg: IRC or web).

- Added some verbiage for the admin to describe the intended use (eg: 
peer addr for email, or links, or IRC or ...), and a MUST on the DNSBL 
user to read, understand and implement it according to the DNSBL 
administrator's wishes.

- I've adopted (with minor tweaks) JD's wording changes.

- Dropped the word "solely" ;-)
- Changed the word "devastating" to "major" ;-)

- I've taken Mathias' comments on 3.1 onwards almost verbatim. This 
includes a new section 3.8 on "protect against misconfig".  I've tried 
to downplay what efforts a DNSBL operator should make on individual 
queriers, and introduced a MUST and SHOULD on DNSBL users too (initial 
and periodic DNSBL config test.)

- I've taken Alfred's comments.

When I finish fiddling around with 2.2.1 and 2.2.3 (as a result of the 
points made by many people) I'll publish it here for a quick kick at the 
cat, and then get it reposted thru the IETF.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/asrg

---

From: Douglas Otis <[email-masked]>
Date: Mon, 31 Mar 2008 08:45:09 -1000

> As a FYI, I'm preparing a revision 2 which I will publish here  

Will information be added related to warnings regarding network  
provider associated address space about to be list?  In many cases,  
only the network provider can be identified as being associated with  
the address space in question.  Will there be any recommendation  
regarding the notification of listings?  Will there be any mention of  
interacting with network providers to determine the nature of access  
given their advertised address space?  If not, why not?

-Doug

---

From: "Chris Lewis" <[email-masked]>
Date: Mon, 31 Mar 2008 15:46:37 -0400

Douglas Otis wrote:
> the address space in question.

No:

a) No (or very few) existing DNSBLs do it, the intent is that the BCP 
describes the practise of most DNSBLs to garner the best acceptance of 
the BCP.

b) MUST or even SHOULD prior warning in a general sense, would just 
about cripple most DNSBLs effectiveness (especially automated ones 
related to bots and vulnerabilities) to the point of not being worth 
doing at all.  At best, it can be a MAY, appropriate to a small number 
of DNSBLs.  I wouldn't even RECOMMEND it.

[I can think of several more, but the above two are sufficient.  Other 
than to point out emailing, say, Turkish Telecom, with a few bazillion 
"this IP is hacked" notifications wouldn't be very productive.]

> Will there be any recommendation  
> regarding the notification of listings?

[Assuming post-listing] No - same reason as (a) above and probably more.

> Will there be any mention of  

I don't see this as particularly relevant except to a very narrow set of 
DNSBLs (eg: PBL and some DULs), and as such doesn't seem worth mentioning.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/asrg

---

From: "J D Falk" <[email-masked]>
Date: Mon, 31 Mar 2008 16:48:02 -0400

> provider associated address space about to be list? In many cases,
only
> the network provider can be identified as being associated with the
> address space in question.  Will there be any recommendation regarding
> the notification of listings?  Will there be any mention of
interacting
> with network providers to determine the nature of access given their
> advertised address space?  If not, why not?

These questions do not apply to the majority of lists, now or
historically.  The furthest I'd want the document to go in this
direction might be something like "Policies for attempting to notify IP
address owners (if any) SHOULD be documented on the list's web site."

---

From: Seth <[email-masked]>
Date: Mon, 31 Mar 2008 17:44:13 -0400 (EDT)

Douglas Otis <[email-masked]> wrote:

> provider associated address space about to be list?

I hope not.

Why do you keep assuming that only things that _have_ network
providers can be listed?  Who is the "network provider" for a
"Mailer-agent" header DNSBL?

For that matter, who is the "network provider" for a domain, in a
domain list?  The IP address of the domain might be in the space of
numerous providers, and change rapidly.  Similarly for the DNS server.

>  In many cases, only the network provider can be identified as being
> associated with the address space in question.

In many cases, nobody can be.

> regarding the notification of listings?

The listing is its own notification.

Seth

---

From: Douglas Otis <[email-masked]>
Date: Mon, 31 Mar 2008 14:15:26 -1000

> "Mailer-agent" header DNSBL?

Any IP address used by bad actors for sending UCEs or other types of  
abuse is being routed by a network provider.  Network providers are  
identified by their address space advertisements.  There is no other  
identity related to an IP address that a recipient is able to  
ascertain with certainty.  In addition, the network provider is in the  
unique position of being able to curtail the abuse immediately.  After  
all, only the network provider is paid to provide access, and can  
fully monitor the traffic of a reported bad-actor.  How can a BL  
operator establish relationships with millions of a network providers'  
customers, without expecting network providers to intercede?  Only  
network provider can establish AUPs, and know who might be making  
trouble, and then halt the abuse.

While few black-hole/block list operators are able to coordinate with  
network providers and thereby prevent abuse at the source, _no_ other  
approach is as effective or as robust.  The current draft is promoting  
the concept of automation with a significant amount of hand-waving  
about avoiding being gamed.

As part of the security concerns, many BL operators offer samples,  
where any bad-actor is able to include subtle identifiers to track  
points of detection.  When individual bad actors control millions of  
compromised systems, the process of elimination quickly locates  
networks, and eventually specific addresses, where abusive messages  
are being detected.  These addresses might even become targeted in an  
effort to overwhelm the BL operator's resources using DDoS techniques.

A level of trust is required between the BL operator and the network  
provider to be both effective and to improve safely.  Curbing abuse is  
the goal after all.  Defining a BL mode of operation that asks the  
least of the network operator, also does the least in terms of curbing  
abuse.  Only network operators are able to identify bad-actors and  
adequately monitor their activity once reported.

There is also an additional security considerations for BL operators  
that automatically generate lists.  Not monitoring the veracity of the  
address space announcements permits an egregious type of DoS attack,  
where the BL operator becomes an unwitting pawn.

> numerous providers, and change rapidly.  Similarly for the DNS server.

A network provider routes IP addressed packets.  Routing only depends  
upon the IP address and not the domain name related to the address.   
Currently, few BLs rate domain names. IP addresses resolved by the  
name or used by the name server may serve as a reference identifier.   
Until DKIM becomes more popular, source domains of a message remain  
commonly spoofed.

> In many cases, nobody can be.

This is simply not true, or the packet could not be routed.

>> Will there be any recommendation regarding the notification of  
>> listings?
>

No. The goal is to stop the abuse at its source.  As such, prior  
notification of a listing given the network provider can then be  
directed to their customer.  The network provider interceding is  
likely the only means to notify a system operator that their server  
has been compromised.  Compromised systems introduce a significant  
portion of abuse, and many of these systems do not normally send  
email.  Operators of compromised systems that do not normally send  
email are unlikely to notice BL listings.  As compromised systems play  
a major role in the amount of abuse being seen, the network operator  
must play a critical role of abuse notification.

-Doug

---

From: "Al Iverson" <[email-masked]>
Date: Mon, 31 Mar 2008 19:20:42 -0500

On Mon, Mar 31, 2008 at 7:15 PM, Douglas Otis <[email-masked]> wrote:

>  abuse is being routed by a network provider.

Not all BLs list IP addresses.

I strongly disagree with making network provider notification part of
any best practice requirement. It's reflective of very few lists, and
it's not reflective of many kinds of lists -- all run well and
successfully.

Regards,
Al Iverson

-- 
Al Iverson on Spam and Deliverability, see http://www.spamresource.com
News, stats, info, and commentary on blacklists: http://www.dnsbl.com
My personal website: http://www.aliverson.com -- Chicago, IL, USA
Remove "lists" from my email address to reach me faster and directly.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/asrg

---

From: Andrew Kirch <[email-masked]>
Date: Mon, 31 Mar 2008 20:52:59 -0400

> Not all BLs list IP addresses.

The AHBL runs a right hand side (RHSBL) list.
> it's not reflective of many kinds of lists -- all run well and
I concur and note that we let these network providers know their
customers are abusive by listing their customers, and expanding
contiguous blocks when there are multiple nearby abusers. 

Andrew

---

From: Seth <[email-masked]>
Date: Mon, 31 Mar 2008 22:22:22 -0400 (EDT)

> abuse is being routed by a network provider.

Which network provider would you recommend notifying about an entry
that says "X-Mailer: CloakedSender" is a spam indication?

If you want to notify the providers for the emitters of all the spam
you get, feel free.  But you aren't going to get others to believe
that doing so is a requirement on them.

> In addition, the network provider is in the  
> unique position of being able to curtail the abuse immediately.

Tell me again, which provider can curtail the use of "X-Mailer:
CloakedSender" immediately?

> How can a BL operator establish relationships with millions of a
> network providers' customers, without expecting network providers to
> intercede?

How do you define "establish relationships"?  If I publish
dnsbl.noprimes.org, have I established relationships with all users of
prime-number IP addresses?

> Only network provider can establish AUPs,

Anybody can establish an AUP for his own property.  Lots of web boards
have AUPs without being network providers.

> While few black-hole/block list operators are able to coordinate
> with network providers and thereby prevent abuse at the source, _no_
> other approach is as effective or as robust.

So you claim; but so what?  Why should there be any obligation on
anybody based on your claim (even if true) that something is the most
effective or robust approach?

> provider to be both effective and to improve safely.

Since many network providers are quite untrustworthy, that alone is
reason to avoid notifying those you don't know.

>  Defining a BL mode of operation that asks the least of the network
> operator, also does the least in terms of curbing abuse.

Nobody else is obligated to act according to your beliefs about what
is the most effective.

> Currently, few BLs rate domain names.

So?  This isn't a democracy with each BL having one vote.

> IP addresses resolved by the  

Especially for those domains hosted on zombies with 60 second TTLs.

> This is simply not true, or the packet could not be routed.

What is the address space for "X-Mailer: CloakedSender"?

> No. The goal is to stop the abuse at its source.

Whose goal?  Nobody else is required to act according to your goals.

My goal is to identify prime numbers.

>  As such, prior notification of a listing given the network provider
> can then be directed to their customer.

Lots of things "can be".  The fact that something "can be" does not
suffice to create obligations.

Seth