Subject: [Asrg] New Version Notification for draft-irtf-asrg-dnsbl-07

From: John R Levine <[email-masked]>
Date: Fri, 10 Oct 2008 12:02:20 +0100 (BST)

I picked a few more nits and hope it's now ready to send down the 
standards track.

Note that this is the I-D about the technical characteristics of DNSBLs, 
not the BCP on how to manage them.

R's,
John

---------- Forwarded message ----------
Date: Fri, 10 Oct 2008 03:57:51 -0700 (PDT)
From: IETF I-D Submission Tool <[email-masked]>
Subject: [taugh.com-standards] New Version Notification for
     draft-irtf-asrg-dnsbl-07

A new version of I-D, draft-irtf-asrg-dnsbl-07.txt has been successfuly submitted by John Levine and posted to the IETF repository.

Filename:	 draft-irtf-asrg-dnsbl
Revision:	 07
Title:		 DNS Blacklists and Whitelists
Creation_date:	 2008-10-10
WG ID:		 Independent Submission
Number_of_pages: 12

Abstract:
The rise of spam and other anti-social behavior on the Internet has
led to the creation of shared blacklists and whitelists of IP
addresses or domains.  The DNS has become a de-facto standard method
of distributing these blacklists and whitelists.  This memo documents
the structure and usage of DNS based blacklists and whitelists, and
the protocol used to query them.

IRTF Notice

This document is a product of the Anti-Spam Research Group (ASRG).
Comments and discussion may be directed to the ASRG mailing list,
[email-masked].
This document represents the consensus of the Anti-Spam Research
Group of the Internet Research Task Force.

The IETF Secretariat.

_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 13 Oct 2008 11:36:06 +0200

> not the BCP on how to manage them.

I think http://tools.ietf.org/html/draft-irtf-asrg-dnsbl-07 is good 
and hope it won't be delayed further. However, I have a general 
comment which may apply to it and/or the (yet unseen) companion 
document mentioned in the intro.

The document doesn't plainly say that rDNS follows hierarchical 
delegations while DNSBLs make independent statements about someone 
else's IPs. This fact and its implications are so obvious among the 
readers of this document, that the very explanation of rDNS is 
confined between parentheses in an incidental sentence at the 
beginning of section 2.1.

However, who are those readers? Specifically, what documents should a 
politician or a judge read in order to become acquainted with DNSBLs? 
The question is relevant because assigned IP addresses are somehow 
part of a country's territory and IMHO should be administered as such. 
(In this respect, I'm surprised that governments don't run their own 
DNSxLs or, at least, endorse existing ones.)

Because of the importance of the Internet in general, I would suggest 
that RFCs include a legal considerations section for aiding lawmakers, 
where relevant. Am I out of line?

TYFYA
A

---

From: John Levine <[email-masked]>
Date: 14 Oct 2008 16:33:54 -0000

> Because of the importance of the Internet in general, I would
> suggest that RFCs include a legal considerations section for aiding
> lawmakers, where relevant. Am I out of line?

I really don't think it's a good idea for us technonerds to be giving
legal advice.  Just think of the technical advice that lawyers would
give us, and then ask yourself why ours would be any better.

Moreover, the IETF has a long history of endless arguments about legal
issues, most notably intellectual property, which rarely comes to
a conclusion.  So let's not.

R's,
John

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 14 Oct 2008 13:01:13 -0400

> give us, and then ask yourself why ours would be any better.

I think he's suggesting we give law_makers_ advice.  Which is likely
even more dangerous.

> a conclusion.  So let's not.

We had a "bit" of legal maunderings in the DNSBL BCP (which I think is
the "not yet seen" document you were referring to), and we took it all
out for those reasons.

In the BCP
(http://tools.ietf.org/html/draft-irtf-asrg-bcp-blacklists-04), we say:

>    These DNSBLs vary widely in purpose for which the list was intended,
>    the method the list uses to achieve the purpose, the integrity of
>    those overseeing the method, and the stability of the technology used
>    to create and distribute the data.  Listing criteria can sometimes be
>    quite controversial, therefore this document deliberately does not
>    discuss the rightness or wrongness of any criteria.  We assert that
>    DNSBL operators are free to choose whatever listing criteria they
>    wish, as long as those criteria are clearly and accurately
>    communicated.  It is the responsibility of the DNSBL user to ensure
>    that the listing criteria and other aspects of a DNSBL meets their
>    needs.

Taken within context of the rest of the document, the implicit "take
away" should be that any listing criteria is legitimate, as long as
they're clearly/accurately communicated, and it's the responsibility of
the user to choose the one that fits their requirements.  Without
rubbing it in lawyer/judge faces.

The slant we're trying for is that "it's all routine operational stuff".

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 14 Oct 2008 13:01:13 -0400

In the BCP

---

From: der Mouse <[email-masked]>
Date: Tue, 14 Oct 2008 13:31:06 -0400 (EDT)

>> lawmakers, where relevant.

Besides, which jurisdiction(s) would the legal considerations be for?

The Internet is not restricted to $COUNTRY.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 15 Oct 2008 10:22:02 +0200

> (http://tools.ietf.org/html/draft-irtf-asrg-bcp-blacklists-04), we say:

Aha, there it is! Thank you for the pointer.

>>    [...]  We assert that
>>    communicated.

Such affirmations still require an endorsement more binding than the 
regular standardization process, before they can be taken for granted.
Perhaps governments should explicitly ratify STD documents?
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 15 Oct 2008 10:22:23 +0200

> Besides, which jurisdiction(s) would the legal considerations be for?

Any. Although sometimes I hear about astonishing sentences, I didn't 
mean to address U.S. laws specifically. On the opposite, by the few 
legalese I happen to read, it looks like American lawyers are able to 
make precise technical references more often than, say, European ones.

> The Internet is not restricted to $COUNTRY.

Sooner or later governments will have to agree on a unified police 
force, though. Otherwise, it will remain all too easy for lawbreakers 
to get away with their job done. (Perhaps by 2984...)

---

From: Ian Eiloart <[email-masked]>
Date: Wed, 15 Oct 2008 11:24:34 +0100

> Besides, which jurisdiction(s) would the legal considerations be for?

I guess the point would be to direct future legislation, rather than to try 
to reflect current legislation. But, I don't think that RFCs are a great 
place to lobby for legislation.

-- 
Ian Eiloart
IT Services, University of Sussex
x3148
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 15 Oct 2008 08:03:02 -0400 (EDT)

> place to lobby for legislation.

In many jusrisdictions, and in many court cases, the judge will need to 
establish the "customs of the trade". RFCs can be introduced to help 
inform the judge of these customs. So an RFC can have legal significance, 
even if it isn't legal advice, or law itself. We wouldn't want the RFC to 
contain material that would mislead a judge in such a situation.

It isn't a matter of writing law that is valid for every country on earth, 
but of correctly damping the expectations of spammers for spam delivery, 
so that judges will understand that the spammer has "no reasonable 
expectation" of delivery. Of course statutes can override custom, but that 
is not the business of the RFC.

Daniel Feenberg

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 15 Oct 2008 12:41:17 -0400

> Perhaps governments should explicitly ratify STD documents?

Operational practice don't require legal endorsement.  Only that they're
_existing_ industry practice.

I've even had the police opine that, absent legislation to the contrary,
industry standards trump almost everything else.

[This arose out of discussions with the police about being harassed
about Usenet despamming operations when they asked "what's the bad thing
you're doing that causes you to be harrassed?".  After I explained, they
came back with "No, that [despamming] is not illegal if it's customary
and expected by the community"  Being codified somehow (eg: BI index as
a community standard in the case of Usenet) helps.]

IOW, absent specific precedent to the contrary[*], DNSBLs establish a
degree of legal legitimacy simply by existing and being used so much.

[*] There have been decisions around the issue, but none as yet have
ruled that DNSBLs in and of themselves are illegal, only that
misrepresenting (whether by intent or otherwise) their behaviour/entries
can be dangerous.  e360 is a special case due to legal fumblings (eg: no
defense), so that's really not an example.  And that was (alleged)
defamation mostly anyhow.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Bill Cole <[email-masked]>
Date: Wed, 15 Oct 2008 15:26:25 -0400

At 8:03 AM -0400 10/15/08, Daniel Feenberg  imposed structure on a 
stream of electrons, yielding:
>>--On 14 October 2008 13:31:06 -0400 der Mouse 
>><[email-masked]> wrote:
>>
>>I guess the point would be to direct future legislation, rather 
>>than to try to reflect current legislation. But, I don't think that 
>>RFCs are a great place to lobby for legislation.
>>
>
>In many jusrisdictions, and in many court cases, the judge will need 
>to establish the "customs of the trade". RFCs can be introduced to 
>help inform the judge of these customs. So an RFC can have legal 
>significance, even if it isn't legal advice, or law itself. We 
>wouldn't want the RFC to contain material that would mislead a judge 
>in such a situation.
>
>It isn't a matter of writing law that is valid for every country on 
>earth, but of correctly damping the expectations of spammers for 
>spam delivery, so that judges will understand that the spammer has 
>"no reasonable expectation" of delivery. Of course statutes can 
>override custom, but that is not the business of the RFC.

All true.

More broadly, over the past 15 years of casual observation I've seen 
about a dozen incidents of content being excluded from an 
RFC-in-development because it stood some chance of being perceived as 
legal advice or as an attempt to inject particular policy preferences 
into a "standard" that could be waved at judges or lawmakers. I'm far 
from an IETF "insider" but it has been my distinct impression that 
the norms in RFC development have long (and wisely) been averse to 
entanglement with law. This is particularly true of Standards Track 
RFC's, which frequently get everything not strictly technical carved 
off of them in development, sometimes to other types of RFC's.

Beyond that, it is clear to me that any grand plan to add a section 
to RFC's generally is far outside the scope of the ASRG or the IRTF. 
this would be something NOT to be advocated here in the narrow 
context of this one document, which is devised as a technical 
standard with a BCP companion covering related issues of consensus 
opinion rather than objective fact. A campaign to change the way 
RFC's coexist with legal systems would belong more at the ISOC layer 
than here.

-- 
Bill Cole                                  
[email-masked]

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 16 Oct 2008 16:45:38 +0200

Bill Cole wrote:
>>>>> I really don't think it's a good idea [...]
>>>
>>> I don't think that RFCs are a great place to lobby for legislation.
>>>
>> [...] Of course statutes can override 
>> custom, but that is not the business of the RFC.
> 
> norms in RFC development have long (and wisely) been averse to 
> entanglement with law.

I don't know why I differ from everybody else's opinion, but since it 
seems to be so, I'll refrain from insisting and respect the more vast 
experience. Thanks to all who tried to explain; perhaps one day I'll 
understand (for the time being, I haven't even grasped if Asimov meant 
his three laws of robotics to be enforced by RFCs or enacted legislation.)

> Beyond that, it is clear to me that any grand plan to add a section to 
> RFC's generally is far outside the scope of the ASRG or the IRTF. this 
> would be something NOT to be advocated here in the narrow context of 
> this one document, which is devised as a technical standard with a BCP 
> companion covering related issues of consensus opinion rather than 
> objective fact. A campaign to change the way RFC's coexist with legal 
> systems would belong more at the ISOC layer than here.

Correct. However, because of its subject, this RFC might have been a 
good candidate to experiment with such kind of move.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: "David Nicol" <[email-masked]>
Date: Thu, 16 Oct 2008 10:39:08 -0500

On Thu, Oct 16, 2008 at 9:45 AM, Alessandro Vesely <[email-masked]> wrote:

> [Did Asimov mean for] his three laws of
> robotics to be enforced by RFCs or enacted legislation?

I always understood them to be a voluntary industry mitigation of
liability risk.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 17 Oct 2008 09:58:23 +0200

> I always understood them to be a voluntary industry mitigation of

Yeah, that's probably how it started. It doesn't seem reasonable to me 
that it remained that way through several millennia, with presumably 
multiple producers scattered among multiple stellar systems, and 
robots sometimes playing delicate political roles IIRC.

[I have to label this "OT", since I said I shall refrain to insist.]
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Fri, 17 Oct 2008 11:02:56 -0400

> I always understood them to be a voluntary industry mitigation of

Oddly enough, *I* always understood it to be a literary creation, designed
such that the Three Laws *seem* to be a good and proper set, but which Asimov
could use the always-ugly corner cases to build stories around.

In other words, the Three Laws are only interesting *because* they have
corner cases....
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg