Subject: [Asrg] Getting group consensus on draft-irtf-asrg-bcp-blacklists

From: "John R. Levine" <[email-masked]>
Date: 1 Mar 2011 15:28:02 -0500

Now that the kerfuffle seems to have died down, I'd like to see if we have 
group rough consensus (which does not mean perfect unanimity) on the BL 
best practices overview.  Please read through it and say whether you think 
it's OK, or if not, what specific language to change.

Keep in mind that this is an overview of actual practices of well run BLs 
(that's the C in BCP), so if you think we should change something, it 
would be helpful to identify a well-run BL whose practices support the 
proposed change.  Hence it would be completely unhelpful to say "I don't 
run a BL but if I did I would do X."

It is also not very helpful to say "BL X, which 12 people use, does Y" 
since there are vast numbers of obscure BLs with totally wacky practices.

Here's the current draft:

http://tools.ietf.org/html/draft-irtf-asrg-bcp-blacklists-07

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Jason Bertoch <[email-masked]>
Date: Tue, 1 Mar 2011 18:46:49 -0500 (EST)

On 2011/03/01 3:28 PM, John R. Levine wrote:
> Now that the kerfuffle seems to have died down, I'd like to see if we
> have group rough consensus (which does not mean perfect unanimity) on
> the BL best practices overview. Please read through it and say whether
> you think it's OK, or if not, what specific language to change.
>

I still find myself stuck on 2.2.5.  It needs to be removed or changed to not pick on negative-reputation lists.

As this BCP already describes, many (most?) DNSBL's are used as part of an overall scoring system, rather than just at the MTA level.  As such, removal from a negative-reputation list generally has the same net effect as addition to a positive-reputation list.  (Actually, ReturnPath is considered quite favorably in SpamAssassin.)  Any arguments against paid removal from a neg-rep list can be equally applied to paid addition to a pos-rep list.

While I disagree with Claus' particular rhetoric, I somehow feel that everyone who argued against him wouldn't be quite as judgemental against a paid whitelist like ReturnPath.  Not only that, UCEPROTECT is ultimately free...one would only pay for human intervention if the automatic timeframe just isn't soon enough.  Sure, I believe the practice of paying to upgrade your reputation is slimy at best, but why does the BCP pick on neg-rep lists when they, if anyone, SHOULD have evidence of wrong doing?

I'm sorry to pick on ReturnPath...Neil and J.D. have been exceptionally patient on the SA list, and RP's accuracy has improved considerably over the years (though the clarity of reporting issue still needs resolving)...but, in the end, the BCP needs to pick on no-one or pick on everyone that nets the same result.

Finally, with IPv6 staring us in the face, the landscape of DNSBL's will certainly be changing.  The group needs to decide if dictating business/revenue models is even appropriate in a BCP and, if so, needs to elaborate in much more detail to avoid what is ultimately picking on one single DNSBL.

-- 
/Jason

---

From: Neil Schwartzman <[email-masked]>
Date: Tue, 1 Mar 2011 19:01:25 -0500

> I'm sorry to pick on ReturnPath...Neil and J.D. have been exceptionally patient on the SA list, and RP's accuracy has improved considerably over the years (though the clarity of reporting issue sti…

Just to clarify a couple of points:

1. I am no longer working for Return Path. Everyone there remains in my highest esteem, and
2. I disagree with you. Negative reputation is something no-one wants, nor should you be able to buy your way out of it. Conversely, a positive bump to differentiate you from the competition is valuable (but no, no-one who is a crappy sender could bribe their way onto the list, not while I was there, and not since I left), and something those that benefit from the service should pay for, just as ISPs should pay for the use of a DNSBL.

Just as a DNSBL is expected to block all crappy traffic they know about, so too is a whitelist expected to only list the good traffic they know about. While we had some heated debates over the years concerning sanctions to take against clients (I always voted for firing), delisting is just as painful, especially when a client is paying a certification company, and isn't certified. ;-)

I will note that other companies also charged for certifying - Goodmail, and now Spamhaus, among others. Just as it should be. Whitelisting and blacklisting are two different beasts, serving two different masters, and thus, two different business models.

cheers,

n

--
Neil Schwartzman
Executive Director
CAUCE
The Coalition Against Unsolicited Commercial Email, North America Inc.

http://cauce.org
http://twitter.com/cauce
IM: caucecanada
Tel.: +1 (303) 800 6345

---

From: Michael Thomas <[email-masked]>
Date: Tue, 01 Mar 2011 16:14:53 -0800

> 2. I disagree with you. Negative reputation is something no-one wants, nor should you be able to buy your way out of it. Conversely, a positive bump to differentiate you from the competition is val…

Er, well that works well when you're dealing with saint.com and
sinner.com, but real world entities are often a blend of each. This
is going to be particularly true of domain based reputation dealing
with $megacorp. In that case, trying to get off blacklists and onto
whitelists with money or threats or combinations of both is going
to produce real life conflicts of interest. For both operators. How
well did the Usenet Death Penalty work against the invading aol, etc
hordes? Not very as I recall, and that was before the Big Bux were
involved that invariably grease the wheels.

Mike

---

From: Jason Bertoch <[email-masked]>
Date: Tue, 1 Mar 2011 20:24:21 -0500 (EST)

----- Original Message -----
> From: "Neil Schwartzman" <[email-masked]>
> 

Apologies for not knowing the current state of your career.  I just wanted to give credit where it was due :)

> 2. I disagree with you. Negative reputation is something no-one wants,
> nor should you be able to buy your way out of it. Conversely, a
> positive bump to differentiate you from the competition is valuable
> (but no, no-one who is a crappy sender could bribe their way onto the
> list, not while I was there, and not since I left), and something
> those that benefit from the service should pay for, just as ISPs
> should pay for the use of a DNSBL.

I do see your point, and will vouch that RP has gotten better in recent times but, in reality, senders of quality mail don't really need that positive bump, do they?  Sure, in IPv6, that may be the only thing that gets their mail through, but we're not there yet and neither is this BCP.

> 
> Just as a DNSBL is expected to block all crappy traffic they know
> about, so too is a whitelist expected to only list the good traffic
> they know about. While we had some heated debates over the years
> concerning sanctions to take against clients (I always voted for
> firing), delisting is just as painful, especially when a client is
> paying a certification company, and isn't certified. ;-)
> 

In a score-based system, all of that rhetoric is lost to the final recipient.  A listing on a pos-rep list is just as good as no listing on a neg-rep list.  Paying either one to get there results in the same net effect to the final recipient.  And that's who we all care about, right?

> I will note that other companies also charged for certifying -
> Goodmail, and now Spamhaus, among others. Just as it should be.
> Whitelisting and blacklisting are two different beasts, serving two
> different masters, and thus, two different business models.
> 

While I realize RP isn't alone, I've no experience with Goodmail, and Spamhaus' list is just too new to bother with at the moment.  I also understand your argument that, in theory at least, the models are different.  However, my goal was to point out that their net effect was identical and, therefore, the BCP should either address the models as a whole or not address them at all.

--
/Jason

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 1 Mar 2011 21:05:17 -0500

> As this BCP already describes, many (most?) DNSBL's are used as part of an overall scoring system, rather than just at the MTA level.  As such, removal from a negative-reputation list generally has…

The BCP describes that they _can_ be used in an overall scoring system. 
  Everything I've seen seems to indicate that the majority of use isn't 
scoring.  The very largest environments don't, for example.

One of the crux arguments here is why negative-reputation lists are 
being "picked on".

After all, isn't blacklist removal the same as whitelist addition?

Mathmatically, at least in scoring, of course, they are the same.

But, that's where the similarity ends.  They are worlds apart ethically, 
legally and practically.  Just as Steve Atkins said.

We need to see the big picture here.

I don't want to dwell too long on the ethical/legal issues too much, 
other than to point out that charging a fee for not saying/stop saying 
something bad about someone meets at least a general definition of 
extortion or blackmail.

Whereas charging someone to say something good is just ordinary advertising.

The former is paying to undo the reputational damage someone did without 
invitation (and perhaps without justification), the latter is to improve 
the reputation voluntarily.

Of course, there are many reasons where payment for delisting generally 
won't meet legal definitions of extortion or blackmail, not to mention 
the CDA's protections, but (a) those are largely jurisdictionally 
dependent and (b) it really doesn't matter for practical reasons.  Those 
same practical reasons apply in edge-case.

Practical reasons?  They abound.  Throughout my involvement in many 
portions of the industry, it's clear:

1) Providers of all types & stripes simply won't deal with DNSBLs they 
believe to be unethical.  I see comments like that from very large 
providers almost every day.  Many others on this list frequent the same 
places I do, and see them as well.  Good responsive providers who 
remediate other DNSBL listings quickly and effectively simply refuse to 
have anything to do with the perceived "unethical" ones.  They don't fix 
problems, they don't educate users, they encourage people to ignore them.

2) Many organizations simply won't use DNSBLs they believe to be unethical.

3) Paying for delist, while it might not make a great deal of difference 
in overall effectiveness if the DNSBL is good enough to redetect and 
relist quickly, many DNSBLs are not, and can massively impair accuracy. 
  Not to mention legal problems if you're not really careful about what 
the payment actually buys the listee.

4) (1) and (2) are very significant factors, and they in turn lead to:
    a) Real spamming problems don't get resolved, and they continue
       unabated.
    b) False positives don't get resolved, and they continue unabated.
    c) Uptake of a DNSBL is reduced, their usefuless declines.
    d) The bad reputation of an individual DNSBL inevitably leaks to the
       mechanism as a whole (just see IETF diatribes for example).
    e) providers don't educate their users what they're doing wrong
    f) DNSBLs get screamed at for unethical behaviour...
    g) DNSBLs scream back...
    h) everybody acts like children...

These are all bad for the receivers of email and the industry as a whole.

5) For the most part, a blacklist hit is more likely to have a negative 
effect on delivery than a whitelist hit having a positive one.

I'm sure you're scratching your head with this one.  The reality is that 
application of whitelisting in an overall receiver-advantageous  way is 
far more difficult than applying blacklisting, and the results of 
getting it wrong can be far more obvious.  huh? (again ;-).  _Few_ 
people apply whitelists (or at least 3rd party ones) as "allow 
everything through", because it's too dangerous - you allow 
viruses/malware or contra-policy material in for example.  Application 
of whitelisting properly is a delicate operation.  In scoring systems, 
they tend to have small positive scores, whereas many individual 
blacklists have large negative ones.  Or they don't score at all, and 
DNSWLs only apply to _parts_ of the filters.  Etc.

Example: in our system, our local DNSWL can get you past any DNSBL 
listings - but not the ancilliary string filters, SpamAssassin or 
ClamAV.  3rd party DNSWLs have _slight_ positive scores in our DNSBL 
engine.  They can get you past one DNSBL listing, but not two.

6) Hankypanky/sloppiness with whitelisting is usually much easier to 
spot - complaints jump, and if they correlate with a whitelist...  Yes, 
receivers watch these things closely and take action.

{RSK: you asked for an example.  I've got a good one.  Email me and I'll 
tell you.  But it's not for public consumption.]

7) "Express" and "charity" - in the end, the distinction doesn't matter 
for (1) or (2).  Proof?  They don't in real life.

Missing the distinction is, of course, probably wrong, but distinction 
or not, the results are the same.

They haven't mattered with UCEProtect or SORBS.  Consider: UCEProtect 
has been around for a while.  Some of their lists are relatively useful. 
  Claus just said they "protect" 2.5M users.  That isn't a lot. In fact, 
it's tiny.  Other DNSBLs without these problems have _individual_ users 
that are 2 orders of magnitude larger.  It's not the only reason of 
course, but it's one of them.  The effect isn't so severe with SORBS, 
but I do think it's fair to suggest that they would have evolved further 
without it.

Personally, I don't think "express delist for a fee" or "donation" are 
all that bad.  But in the end, that subtlety is lost, and all the 
practical harm acrues anyway.

In the end: other DNSBLs have thought long and hard about this for 
years.  Consider, for example, the universal condemnation of this 
practise from every DNSBL (with the obvious exception of UCEProtect) 
that's said something here.  Notice that SORBS agreed with the BCP. 
Consider for example, the lengths to which the CBL distances itself from 
this practice in its FAQ.  Witness what deliverability experts say about 
them.  ISPs.  Etc.

All of my experience indicates that the consequences of this are so 
severe that it's best for _everyone_ to stay as far clear of it as 
possible.  This is one of those cases where an "appearance of 
impropriety" is just as bad as just plain "impropriety".

Perhaps something will come along to change that.  I doubt it.  But it 
ain't all that hard to draft a successor document and change it.  Better 
to get the stake driven in (thanks Rich for the imagery ;-)

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 1 Mar 2011 21:23:31 -0500

On 3/1/2011 7:14 PM, Michael Thomas wrote:

> How well did the Usenet Death Penalty work against the invading aol, etc

_Every_ applied UDP worked and achieved its goals.  Every single one.

I know.  Not only was I there, I was a big part of implementing all of them.

It may not have looked in their press releases that those battles were 
won - they had bigger PR departments than we did.  We only cared about 
results.  And results we got.

Those were the days when ISPs were first introduced to the idea that 
they needed to handle abuse.  Heady days, worked with most of the 
biggies throughout the period and helped them build abuse departments 
where even the need didn't exist previously.  Some of the people on this 
list got their start from those efforts.

AOL was never seriously considered a UDP target.  They were almost the 
very first to see the need for abuse handling, and until recently set 
the gold standard of excellence in it.

Sure, the AOLers were annoying.  But its their spamming we cared about, 
and their spamming got short shrift.

Over the years, some of them backslid.  Some of them improved.  And some 
of them cycled between with horrifying rapidity.  But without those 
days, we'd probably be several years behind where we are in anti-spam.

OTOH, some might blame me for creating email spam.  It was my chasing 
Jef Slaton off Usenet that caused him to become the first significant 
email spammer.  Yup, all my fault.  Oops.  Sorry about that ;-)

---

From: "Lyndon Nerenberg (VE6BBM/VE7TFX)" <[email-masked]>
Date: Tue, 1 Mar 2011 18:30:38 -0800

> email spammer.  Yup, all my fault.  Oops.  Sorry about that ;-)

Just proves the point: You were not the Messiah, you were a
very naughty boy! :-)

I wonder how many of the cranks now wish we could resurrect the backbone
cabal ... 

--lyndon

---

From: Seth <[email-masked]>
Date: Tue, 1 Mar 2011 22:10:55 -0500 (EST)

Neil Schwartzman <[email-masked]> wrote:

> and something those that benefit from the service should pay for,

As a receiver, I benefit from a whitelisting service, otherwise I
wouldn't bother to use it.  For me, the sender benefits less: I'd
accept good mail anyway, the whitelisting just makes it easier.

So should I have to pay to use a whitelisting service?

Suppose there were a perfect reputation service, that provided
information from "ESP outgoing for confirmed opt-in" through
"trojanned PC, emits only spam" and everything in between ("ISP
outgoing, cancels/blocks spamming customers immediately", etc.).

Clearly that's valuable to a recipient.  It's also valuable to the
high-ranked emitters; so, who "should" pay?

Seth

---

From: Michael Thomas <[email-masked]>
Date: Tue, 01 Mar 2011 20:08:21 -0800

> the gold standard of excellence in it.

Those were the cries I remember hearing back then though. Aol
and all the rest of the commercial ISP's coming onto the net back
then was what laid bare that the UDP wasn't scalable. And it's
still not in the context of reputation. What does a good or bad
reputation mean in the context of a Yahoo! or hotmail? Not much.

Mike

---

From: John Levine <[email-masked]>
Date: 2 Mar 2011 19:51:56 -0000

Going through recent messages, I see 25 people saying they support
the draft in its current form, and two that don't. (Three if you
count "Claus".)

I see that a few people have subscribed recently and I hope they
are going through the archives, to bring themselves up to date
on the discussion, so I'll give it another couple of days.

I think that Chris and Matt have a few minor wording improvements, but
nothing large that they want to adjust.  Keeping in mind that the
highly competent copy editors at the RFC Editor will make a pass and
fix any grammar issues, this is your last change to suggest
clarifications.

Regards,

PS: The archives are here, by the way.

http://www.ietf.org/mail-archive/web/asrg/current/maillist.html

---

From: Laura Atkins <[email-masked]>
Date: Wed, 2 Mar 2011 11:55:36 -0800

> fix any grammar issues, this is your last change to suggest

I support the draft as written. 

laura

-- 
Laura Atkins   [email-masked]

   "If you do not choose to lead, you will forever be led by others.
   Find what  scares you and do it. And you *can* make a difference,
   if you choose to do so." JMS

---

From: David Romerstein <[email-masked]>
Date: Wed, 02 Mar 2011 12:07:22 -0800

On 3/2/2011 11:51 AM, John Levine wrote:
> nothing large that they want to adjust.

> Keeping in mind that the
> fix any grammar issues

I am *so* very glad you said this. I was going to offer to red-pen it. :)

-- D

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 2 Mar 2011 15:27:29 -0500

> fix any grammar issues, this is your last change to suggest

As a FYI: the pending "bits" are:

- two grammatical blunders that someone spotted recently.
- After the previous round (just after 07 was released), John and I 
thought that there were two minor wording revisions that would be worth 
making - in the introduction as I recall.  I think one of them was 
finessing some wording about non-DNS distribution.  Nothing to do with 
dos or don'ts (capitalized or not ;-).  Do you remember that John? 
Haven't found it in a quick scan of my mailbox.

Do you think it worth re-issuing with those nits fixed as an 08, or 
leave that to the copy editors?

---

From: Neil Schwartzman <[email-masked]>
Date: Wed, 2 Mar 2011 15:35:58 -0500

http://cauce.org
http://twitter.com/cauce
IM: caucecanada
Tel.: +1 (303) 800 6345

---

From: Kelly Molloy <[email-masked]>
Date: Wed, 2 Mar 2011 12:51:29 -0800

> I support the draft as written.

I think I said this before, but +1:

---

From: John Levine <[email-masked]>
Date: 2 Mar 2011 20:57:11 -0000

>dos or don'ts (capitalized or not ;-).  Do you remember that John? 

Nope.  I'll see if I can find it.

>leave that to the copy editors?

It's OK to send a note to the editor suggesting things to fix.  People
do it all the time.

R's,
John

---

From: John Levine <[email-masked]>
Date: 2 Mar 2011 21:29:02 -0000

>Haven't found it in a quick scan of my mailbox.

After greppage (accent on the last syllable) I found a few things:

* At the end of 1.1, say something about why DNS and note that there
  are other distrubution methods than DNS, notably rsync

* Add a forward reference from 2.2.2 (about response contact blocking) to 
> advanced planning in the face of DDoS (3.2).  Either that, or a simple 
> sentence about being able to change contact process in case of need.

For the former, perhaps add:

 The DNS has been the most popular distrubution method for DNSBLs due
 to its ubiquity and its good scaling and performance characteristics.
 It is also common to make private arrangements to distribute DNSBL
 data in bulk to high volume users, typically by rsync [ref].  The data
 is the same in either case, the the recommendations in this document
 apply regardless of distribution method, other than the ones in
 Sections 3.1-3.2 that specifically refer to DNS distribution.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 3 Mar 2011 23:57:10 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of David Romerstein
> Sent: Wednesday, March 02, 2011 12:07 PM
> To: [email-masked]
> Subject: Re: [Asrg] Last chance: Getting group consensus on draft-irtf-asrg-bcp-blacklists
> 

I'm a huge fan of making the RFC Editor do as little work as possible, so if you have the time, energy and willingness, please do bust out the red pen.