Subject: [Asrg] Please take a look at the blacklist BCP draft

From: "John R. Levine" <[email-masked]>
Date: 25 Oct 2010 00:16:17 -0400

We fished this out from behind the virtual desk, dusted it off, updated it 
a tiny bit, and resubmitted it.

It's intended to be a summary of DNSBL best practices.  Take a look, 
please.  If we mostly agree that it's right, or we agree what changes are 
needed to make it right, I can send it along and say there's RG consensus 
on it.

Due to IETF politics I think it's unlikely that this can be an official 
BCP, so the current plan is to publish it as an ASRG document in which we 
researched and summarized the best DNSBL practices (which we actually 
did.)

https://datatracker.ietf.org/doc/draft-irtf-asrg-bcp-blacklists/

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Martijn Grooten <[email-masked]>
Date: Fri, 29 Oct 2010 21:30:18 +0100

> needed to make it right, I can send it along and say there's RG

I had comments similar to Hal's, but Chris's email has convinced me that it's best to publish the document as it is. And I am certainly looking forward to seeing the spam filtering BCP document.

One thing though: the introduction makes it pretty clear the documents is about DNSBLs (DNS-based lists) as opposed to DNSBLs (DNS blacklists). While I think that is a good idea, I doubt I am the only one who finds this a bit confusing. (And I can't help noticing the subject of this email.) I'm not really sure what can be done about this and I certainly don't suggest inventing a new name for DNS-based lists, but perhaps it would help a bit to mention whitelists once or twice in the examples, which now almost exclusively cover blacklists.

Also, doesn't Vipul's Razor use DNS for its signature-lookups? Might be worth mentioning this too as an example. (The general idea, that is; I know of at least one commercial anti-spam solution that uses something similar.)

In any case, it is a really useful document. Good work!

Martijn.

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 29 Oct 2010 20:24:30 -0400

> https://datatracker.ietf.org/doc/draft-irtf-asrg-bcp-blacklists/

I wrote the darn thing, and I really don't want to do this, but I think 
we have to make a policy item tighter.  It's something that's been 
percolating for a while but didn't hit my forebrain again until _after_ 
I submitted this version for publication.

2.2.4.  SHOULD Have Similar Criteria for Listing and Delisting

This section, in the original draft long ago and far away, was 
originally crafted to more directly target some of the more outre 
delisting requirements of some DNSBLs.  Eg: the one that required 
completely re-inventing the ISP's DNS and management infrastructures. 
But more particularly, the ones that demand payment of some kind for 
delisting.  I think the section title even included the word "extortion"...

I was persuaded at the time to adopt more wishy-washy wording about how 
delisting criteria shouldn't be "too far off" the listing criteria - 
which adequately covers some of the, er, non-monetary wierdnesses.  But 
I think we have to be a bit more explicit on the monetary side.

I've always had a strong opinion that spam filtering methodologies must 
_not_ be in conflict of interest.  Further, they must also _not_appear_ 
be in conflict of interest.

In more concrete terms, I don't think a DNSBL used for blocking should 
ever place itself in a position where they seem to profit from a 
particular listing or delisting, regardless of whether they really do.

Think conflict of conflict-of-interest law, and corporate ethics policies.

What I would like to do is add paragraphs much like this to 2.2.4:
-----------
Some DNSBLs used for blocking/negative reputation have had a practise of 
requiring fees or donations to charities from the listee for a 
delisting.  It is generally considered entirely appropriate for a DNSBL 
to charge for access to it by its users - the definition of a commercial 
DNSBL.

However, the practise of requiring a listee to pay for delisting steers 
close to notions of extortion, blackmail or a "protection racket". Even 
if such accusations are entirely unjustified the practise causes uproar 
and damage to the DNSBLs reputation, if not the entire DNSBL mechanism 
as a whole.  Colloquially, "it smells bad".  Therefore, it is 
RECOMMENDED that such DNSBLs do not charge fees or require donations for 
delisting, and RECOMMENDED that such DNSBLs that do charge fees or 
require donations not be used.
-----------
Comments on the need for the change or the text?  "STRONGLY 
RECOMMENDED", "SHOULD NOT"?  Notice I'm still not using "MUST NOT".  It 
does denote an opinion on the practise of those DNSBLs (which ones will 
be obvious) without an outright ban (as much as a BCP can ban anything).

One simple alteration we could consider would be to remove the ", and 
RECOMMENDED ... not be used" section of the last sentence.

Or should I just forget about this?

---

From: "Chris Lewis" <[email-masked]>
Date: Sat, 30 Oct 2010 18:16:06 -0400

> RECOMMENDED ... not be used" section of the last sentence.

As a FYI, I asked SORBS - SORBS dropped their (charitable donation) 
"fine" with the deployment of SORBSv2 about three weeks ago, and 
Michelle would be fine with a "MUST NOT" instead of dithering with not 
"RECOMMENDED".

Which pushes only (AFAIK) UCEPROTECT into the cold.  Which I think would 
be fine with many...

There's been an argument raised that UCEPROTECT's is only an "speed up 
removal" fee.  Frankly, that still flies in the face of the "timely 
removal" language/intent in the BCP, still smells atrocious, and doesn't 
sway me.

So I'm suggesting recasting it as "MUST NOT charge fees".

---

From: Rich Kulawiec <[email-masked]>
Date: Sat, 30 Oct 2010 18:56:01 -0400

I'm with you, for the most part, in the spirit of "MUST NOT" (charge fees)
for delisting/expedited delisting/delisting with extra pepperoni
in order to avoid both impropriety and the appearance of impropriety.

But...should this also mean that a DNSBL "MUST NOT" charge fees *to list*
a domain?

I say "yes".

And let's extend this a bit, generalizing the concept of DNSBL: the
same data could be published as (a) a file (b) a torrent (c) a DNS RPZ
or other formats.  I think if we're going to argue that some action
is appropriate/inappropriate when the data's in a DNSBL, we should
argue the same thing for that same action when the same data's repackaged
in a different form.  So are we prepared to state that delisting
(OR listing) "MUST NOT" involve a fee in all of those cases?

I'm fine with that, by the way.

---rsk

---

From: John Leslie <[email-masked]>
Date: Sat, 30 Oct 2010 19:18:15 -0400

Rich Kulawiec <[email-masked]> wrote:
> 
> I'm with you, for the most part, in the spirit of "MUST NOT" (charge
> fees) for delisting/expedited delisting/delisting with extra pepperoni
> argue the same thing for that same action when the same data's
> repackaged in a different form.  So are we prepared to state that
> delisting (OR listing) "MUST NOT" involve a fee in all of those cases?
> 

   I dislike such fees as much as the next fellow -- I pretty much
refuse to pay them (instead renumbering the server in the two cases
where I've gotten blacklisted)...

   But I really don't follow why documents like this must proscribe
business models.

--
John Leslie <[email-masked]>

---

From: "Chris Lewis" <[email-masked]>
Date: Sat, 30 Oct 2010 20:28:55 -0400

On 10/30/2010 7:18 PM, John Leslie wrote:
> Rich Kulawiec<[email-masked]>  wrote:
>>

>> I say "yes".

A blocklist is generated for the benefit of receivers, and they work by 
providing a negative reputation to someone who's not, er, "volunteered". 
  As such, it's at least conceptually a conflict of interest if not 
outright protection racket to take money from the person they stepped 
on.  "Pay me, otherwise we break your (arm|mail server)".

On the other hand, I can't imagine people paying to be on a DNSBL, 
unless that infers positive reputation (whitelist or something similar). 
  They're "volunteering", and it's for their benefit (and hopefully the 
receiver's (the one who volunteers to _use_ the whitelist) benefit too). 
  Both of them are entering into the agreement.

If you follow who the benefit flows to in either case, you can see that 
at least ethically, there's not a huge problem of _both_ the receiver 
(user) and sender (whitelistee) to paying for listing.  But with 
negative reputation, the benefit of a listing goes only one way, to the 
receiver.

Yes, there can still be accusations that the whitelist is taking money 
from those they shouldn't to help their bottom line.  But for the most 
part, the people who _use_ the DNSWL and are big enough to matter in the 
whitelist's bottom line will know if the DNSWL is telling porkies (user 
complaints), and simply stop using it.  We know they will fire 
whitelists that tell porkies, and we know that it will be noticed.  A 
negative feedback self-correcting thing.

>> I'm fine with that, by the way.

The BCP is only about DNS-based lists, so expanding its coverage 
anywhere near that far _just_ for this would be, I think, vastly 
overreaching ourselves.

"pay for delist from rsync'd but not DNSBL version" would be pretty 
obvious bit of fluffery.

>     But I really don't follow why documents like this must proscribe

It's not a business model that's being proscribed, it's conflict of 
interest or the appearance of conflict of interest.  At least with the 
notion of paying for delisting from a block/negative reputation list.

Part of a BCP is providing an ethical guideline.

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sun, 31 Oct 2010 11:27:49 +0100

On 2010-10-29 21:30:18 +0100, Martijn Grooten wrote:
> Also, doesn't Vipul's Razor use DNS for its signature-lookups?

When I was using Vipul's Razor, it used a simple custom protocol for
lookups, not DNS. But that was several years ago and might have changed.

	hp

-- 
   _  | Peter J. Holzer    | Web 2.0 könnte man also auch übersetzen als
|_|_) | Sysadmin WSR       | "Netz der kleinen Geister".
| |   | [email-masked]         | 
__/   | http://www.hjp.at/ |  -- Oliver Cromm in desd