Subject: Re: [Asrg] Please take a look at the blacklist BCP draft

From: Martijn Grooten <[email-masked]>
Date: Mon, 1 Nov 2010 19:45:46 +0000

Chris Lewis wrote:
> >     But I really don't follow why documents like this must proscribe
> > business models.
>
> It's not a business model that's being proscribed, it's conflict of
> interest or the appearance of conflict of interest.  At least with the
> notion of paying for delisting from a block/negative reputation list.
>
> Part of a BCP is providing an ethical guideline.

I agree with that, just as I agree that DNS blacklists really shouldn't ask a fee for (fast) delisting. I'm a bit hesitant though about saying they MUST NOT do this, seeing as it makes a claim about all sorts of business models, possibly including some that we may not have thought of, but that we will think are quite okay. Hence I'd rather see a SHOULD NOT here.

Martijn.

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.

---

From: John Leslie <[email-masked]>
Date: Mon, 1 Nov 2010 16:28:31 -0400

Chris Lewis <[email-masked]> wrote:
> On 10/30/2010 7:18 PM, John Leslie wrote:
> 
>>  I dislike such fees as much as the next fellow -- I pretty much
>> refuse to pay them (instead renumbering the server in the two cases
>> where I've gotten blacklisted)...
> 
> interest or the appearance of conflict of interest.

   Then (IMHO) it should be stated as a conflict-of-interest issue.

   In general conflicts of interest call for full disclosure, not
prohibitions.

> At least with the notion of paying for delisting from a block/negative
> reputation list.

   There is an actual cost involved in "early expiration" of a listing:
I'm not comfortable forbidding a charge for that.

   However, I do think it has proven an unproductive business practice,
and I'm quite comfortable recommending against it (in addition to
noting the (widespread) perception of a conflict of interest).

   I think our recommendation should also address the question of how
quickly a listing expires: 7 days (UCEPROTECT) is clearly excessive,
but one day might be reasonable.

--
John Leslie <[email-masked]>

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 2 Nov 2010 17:34:40 -0400

I don't think I worded my comments very well; let me try again.

On Sat, Oct 30, 2010 at 08:28:55PM -0400, Chris Lewis wrote:
> A blocklist is generated for the benefit of receivers, and they work
> by providing a negative reputation to someone who's not, er,
> "volunteered".  As such, it's at least conceptually a conflict of
> interest if not outright protection racket to take money from the
> person they stepped on.  "Pay me, otherwise we break your (arm|mail
> server)".

Agreed (well, I think we agree).  In both cases we have possible conflicts
of interest:

	A. You refused to delist $foo because they didn't pay you.
	   (Alternate form: You listed $foo because didn't pay you.)
	B. You delisted $foo because they paid you.

> On the other hand, I can't imagine people paying to be on a DNSBL,
> unless that infers positive reputation (whitelist or something
> similar).  They're "volunteering", and it's for their benefit (and
> hopefully the receiver's (the one who volunteers to _use_ the
> whitelist) benefit too).  Both of them are entering into the
> agreement.

That (something inferring positive reputation) is what I was thinking of.
I can see possible conflicts of interest there too:

	C. You listed $foo because they paid you.
	   (Alternate form: You refused to delist $foo because they paid you.)
	D. You refused to list $foo because they didn't pay you.

> If you follow who the benefit flows to in either case, you can see
> that at least ethically, there's not a huge problem of _both_ the
> receiver (user) and sender (whitelistee) to paying for listing.  But
> with negative reputation, the benefit of a listing goes only one
> way, to the receiver.

I think I'm on board with this, at least partially if not in full.
I certainly don't have a problem with users paying to access a DNSBL
service; I don't see a potential conflict-of-interest there.  But as
soon as senders (whether blacklistees or whitelistees) can effect
changes to a service via a fee, I think there *is* a potential
conflict-of-interest.

I think there's an analogy here with, let's say, Consumer Reports,
which doesn't accept advertising in order to avoid conficts of
interests and the appearance thereof.  (This doesn't means CR is
faultless, of course, but it does mean that by keeping the makers
of the goods and services that it reviews at arm's length that it's
made a serious attempt to stay out of at least one quagmire.)

> Yes, there can still be accusations that the whitelist is taking
> money from those they shouldn't to help their bottom line.  But for
> the most part, the people who _use_ the DNSWL and are big enough to
> matter in the whitelist's bottom line will know if the DNSWL is
> telling porkies (user complaints), and simply stop using it.  We
> know they will fire whitelists that tell porkies, and we know that
> it will be noticed.  A negative feedback self-correcting thing.

I'd like to agree with this; I really would, because it would be
great if things worked this way.  But (a) I don't see it happening
in practice (today) and (b) even if I did, I can still see plenty
of opportunities for DNSBLs and DNSWLs to engage in considerable
chicanery while remaining under the radar.  (Of course they could
do that anyway, for a variety of reasons: caprice, bias, negligence,
etc.  But I think fees pose much more of an issue than any of those.)

> The BCP is only about DNS-based lists, so expanding its coverage
> anywhere near that far _just_ for this would be, I think, vastly
> overreaching ourselves.

Ah, that's one of the things I worded poorly.  I wasn't suggesting
that the BCP coverage be expanded.  I was trying to say that we could
use those additional ways of providing/presenting the same information
as examples while we tried to think our way through the ethical
considerations.  That is, if we think something is ethical/unethical
when it's presented as a file or torrent or whatever, then for
consistency's sake we probably should think the same when it's
presented as a DNSBL.

---rsk

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 2 Nov 2010 19:19:22 -0400

On 11/2/2010 5:34 PM, Rich Kulawiec wrote:

> in practice (today) and

I do.  I know of at least one firing of a significant whitelisting 
mechanism.  I am constrained from providing details, other than to state 
that it was big and someone's bottom line took a major hit.

> (b) even if I did, I can still see plenty

Agreed.

> consistency's sake we probably should think the same when it's

Given that the same principles apply to things as far afield as 
restaurant reviews ;-), I don't think much is to be gained from looking 
at things which are directly equivalent to DSNBLs (lists by file, not DNS).

For John Leslie too: I'll rephrase it slightly to add "conflict of 
interest".  Yes, "conflict of interest" is often simply declared (and 
the person recuses themselves from the decision where they may be in 
conflict).  But because of the nature, politics of DNSBLs, and the 
cloaking they all wear to one degree or another, you couldn't really do 
that.

Also remember it's probably going to be a "SHOULD NOT", which means that 
a DNSBL could still do it and remain in compliance.

Further, if something golly-gee-whiz-bang shows up that makes that 
clause silly, we can always revise it.