Subject: Re: [Asrg] Rough consensus on pay to delist

From: Michelle Sullivan <[email-masked]>
Date: Wed, 02 Mar 2011 17:29:29 +0100

Andrew Kirch wrote:
> On 2/27/2011 4:33 PM, Joe Sniderman wrote:
>   
>> On 02/27/2011 04:01 PM, John Levine wrote:
>>     
>>> I'm seeing no support at all for "Claus'" contention that we should
>>> change the language about pay to delist in DNSBL practices draft.
>>>
>>> If anyone else agrees that we should change it, please say so now,
>>> otherwise I think we will consider the discussion over.
>>>       
>> I agree that it should be changed but not removed entirely. Change it
>> from a "MUST NOT" to a "SHOULD NOT" perhaps.
>>
>>
>>     
> Concur here.  I think Claus makes a valid point in that expedited
> service might require expedited cost.  I am also concerned that this is
> in direct contradiction of existing DNSBL practices, such as SORBS.  

Umm it does?
 (FYI SORBS has not imposed any fines since Oct 12, 2010 and the policy
on the website has been updated to indicate there is no such thing as
the SORBS fine any more)

Michelle

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 2 Mar 2011 12:22:43 -0500

> on the website has been updated to indicate there is no such thing as

Indeed, I think that this an important point.  Even though a DNSBL has 
ceased using the practise, it's still used as an argument as if it was 
still being used, and in many places still used as a reason to 
avoid/disparage the DNSBL.

Even after being mentioned numerous times _here_ this meme still 
continues to influence the discourse long after it become invalid - and 
remember, SORBS is in support of 2.2.5.

Further, why shouldn't a "Best Current Practises" document point out 
that a particular existing practise isn't "best"?  Isn't that what BCPs 
are supposed to do if necessary?

---

From: Joe Sniderman <[email-masked]>
Date: Wed, 02 Mar 2011 14:01:52 -0500

> avoid/disparage the DNSBL.

True, unfortunately.  On that one hand, that shows how once adopted, its
hard to ever make the "bad smell" go away, but on the other hand, the
prevalence of using outright false information to disparage DNSBLs, and
how event those with no axe to grind can so often fall for the
misinformation.

> are supposed to do if necessary?

It still is not "in direct contradiction of existing DNSBL practices,
such as SORBS" since that is not SORBS's current DNSBL practice.

-- 
Joe Sniderman <[email-masked]>

---

From: Andrew Kirch <[email-masked]>
Date: Wed, 02 Mar 2011 14:47:09 -0500

> how event those with no axe to grind can so often fall for the
Err, are you accusing me of some sort of personal attack against
Michelle or SORBS?  I don't believe that there's a bad smell there at
all.  After being harassed and sued by a spammer, that legal defense
fund SORBS was running came to my aid big time.  I for one support these
measures.  DNSBL operators open themselves to huge legal liability, even
when protected by 47 USC 230 (at least in the United States).  Denying
them _ANY_ method of revenue generation is quite frankly wrong, and THAT
leaves a bad taste in my mouth.  Quite frankly I believe the entire
section is far outside of the scope of a BCP document.

Andrew

---

From: Andrew Kirch <[email-masked]>
Date: Wed, 02 Mar 2011 14:57:19 -0500

> section is far outside of the scope of a BCP document.
In the interests of attempting to reach consensus I would propose
language which specifies that DNSBL maintainers MUST disclose their
listing, de-listing, and any associated fees prominently in their terms
of service.  At that point it is up to the end-user to decide what is,
and what isn't ethical.  I don't care what you call it, I will sleep
better charging perpetrators of a crime (spam) than its victims.

Andrew

---

From: Joe Sniderman <[email-masked]>
Date: Wed, 02 Mar 2011 15:58:15 -0500

On 03/02/2011 02:47 PM, Andrew Kirch wrote:
> Michelle or SORBS?  

Quite the contrary!

> I don't believe that there's a bad smell there at all.

> After being harassed and sued by a spammer, that legal defense
> measures.

Yes, I am somewhat (probably lots more to it than I know about) familiar
with that chain of events.  My point is that despite the fact that you
clearly have no axe to grind, no hostility or personal issue against
SORBS, that the FUD (namely that SORBS still charges a fine) spread by
those who do seems to have rubbed off on you as well. (unless I am just
misreading you)

Despite the fact that SORBS stopped charging a fine, its common
knowledge that they do charge a fine. Ie, common knowledge in this
regard is wrong.

*That* is the bad smell that doesnt go away. If a DNSBL is willing to
live with that bad smell, I dont think its anyones place to try to stop
them from doing so.

> DNSBL operators open themselves to huge legal liability, even
> leaves a bad taste in my mouth.

Agreed absolutely.  That said, there is a lot of area between best
practice and worst practice.  As a *general* rule, paid delisting is
probably somewhere in the middle of the road on that broad range.

> Quite frankly I believe the entire

I would tend to agree, but not because of any of the specifics of paid
delisting. Business model in general doesnt make sense to cover in a
BCP. That said, even with it included, i think the current text is good
enough.

---

From: Douglas Otis <[email-masked]>
Date: Fri, 04 Mar 2011 11:47:10 -0800

On 3/2/11 11:47 AM, Andrew Kirch wrote:
>  ... After being harassed and sued by a spammer, that legal defense
>  fund SORBS was running came to my aid big time. I for one support
>  these measures. DNSBL operators open themselves to huge legal
>  liability, even when protected by 47 USC 230 (at least in the United
>  States). Denying them _ANY_ method of revenue generation is quite
>  frankly wrong, and THAT leaves a bad taste in my mouth. Quite
>  frankly I believe the entire section is far outside of the scope of a
>  BCP document.

Agreed.

There might also be two-factor authentication techniques, that could 
rely upon SMS  for example) which might be seen as a charge.  How one 
supports a service should be stated, but not dictated as MUSTs by this BCP.

Unfortunately, the basis upon much of the practices advocated are likely 
to prove unworkable in the near future.  As such, there are far too many 
MUSTs.

Also RFC330 should be updated to RFC5735.

-Doug

---

From: John Levine <[email-masked]>
Date: 4 Mar 2011 20:35:04 -0000

> Denying them _ANY_ method of revenue generation ...

Since nobody's proposing that, can we stop now?

R's,
John

PS: Spamhaus says that they're quite adequately funded, presumably
from the large mail systems that pay for bulk access to their lists.

---

From: Douglas Otis <[email-masked]>
Date: Fri, 04 Mar 2011 14:17:26 -0800

> Since nobody's proposing that, can we stop now?
You really mean ANY and ALL.

Exclusion methods for those seeking faster service might be facilitated 
through additional forms of authentication, which might then require 
nominal fees.

2.2.5.  Conflict of Interest

.---
Therefore, negative-connotation DNSBLs MUST not charge fees or require 
donations for delisting or "faster handling", and it is RECOMMENDED that 
such DNSBLs that do charge fees or require donations not be used.
'---

Fees may result as nominal charges related to authentication methods.  
Such authentication might be needed to support services highly prone to 
abuse.  Practical methods MUST BE allowed when mitigating flooding aimed 
a inflicting greater expense or the degradation of services.   
Responding to SMS might prove practical, but would be in conflict with 
the premise stated in 2.2.4 of MUST NOT charge fees in responding to a 
request.   Also, requiring a donation to independent third-parties 
explicitly avoids this being a conflict of interest.

This section is wrong and poorly considered, especially since most spam 
is carried over bot-nets where DoS issues are a greater concern.  None 
of this should be a problem as long as listing is made in good faith, 
and is normally corrected without requests being made.  Why expose these 
services litigation on the basis of nominal fees commonly used elsewhere.

-Doug

---

From: John Levine <[email-masked]>
Date: 5 Mar 2011 00:11:33 -0000

>Such authentication might be needed to support ...

Something like that is hypothetically possible, but we're documenting
existing practice.  If anyone is aware of a BL that people actually
use that's using authentication so complex that they have to charge
for it, let us know.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Sun, 06 Mar 2011 22:22:36 -0800

> use that's using authentication so complex that they have to charge
The BCP makes blanket statements that clearly overreach, as it logically 
fails in its justification. Nominal charges by third-parties as part of 
some type of authentication do not represent a CONFLICT OF INTEREST, as 
implied by the overreaching section making these requirements.  It seems 
unlikely ISP support desks would be receptive to such restrictions.  For 
example, tunneling services requests may impose such requirements.  When 
a service is flooded with spoofed requests, it is not unreasonable to 
require at least non-free email accounts or SMS messages as a method to 
elevate requests.  The way this section has been written, such methods 
would be excluded without any valid justification.  Again, these methods 
do not represent a CONFLICT OF INTEREST nor represent unreasonable or 
unused practices.

-Doug

---

From: Steve Linford <[email-masked]>
Date: Mon, 07 Mar 2011 07:51:50 +0000

On 7 Mar 2011, at 07:22, Douglas Otis wrote:

> The BCP makes blanket statements that clearly overreach, as it logically fails in its justification.

In most people's view, "Pay me to remove you from the blacklist I just put you on" is a significant conflict of interest.

I'm sure it will interest you to know that two separate European consumer protection agencies, OPTA (NL) and OFT (UK), have asked serious questions in law enforcement circles (London Action Plan, etc) about the particular European blacklist that uses this business model, having had many complaints of extortion/racketeering from European Internet users who claim their mail server IPs were held to ransom. With "Pay me to remove you from the blacklist I just put you on" there is a very strong incentive to blacklist wide IP ranges as miscellaneous escalations simply to collect larger amounts of removal fees. The conflict of interest is substantial and should be flagged as extremely poor practice.

  Steve Linford
  The Spamhaus Project
  http://www.spamhaus.org

---

From: Esa Laitinen <[email-masked]>
Date: Mon, 7 Mar 2011 09:13:46 +0100

On Mon, Mar 7, 2011 at 8:51 AM, Steve Linford <[email-masked]> wrote:

> In most people's view, "Pay me to remove you from the blacklist I just put
> you on" is a significant conflict of interest.
>

There is also a significant difference in  "Pay me to remove you from the
blacklist I just put you on"  and "you'll be automatically removed in 7
days, but if you cannot wait, you can also pay to get processed faster",
don't you think?

> I'm sure it will interest you to know that two separate European consumer
> protection agencies, OPTA (NL) and OFT (UK), have asked serious questions in
> law enforcement circles (London Action Plan, etc) about the particular
> European blacklist that uses this business model, having had many complaints
> of extortion/racketeering from European Internet users who claim their mail
> server IPs were held to ransom.
>
>
I actually fail to see what consumer protection agencies have with the issue
to do: normally mailservers are run by companies.

But anyway, blacklists have always drawn heat. Did that stop Spamhaus, for
example?

We're beating a dead horse here: majority of the messages have indicated
that charging for expedited delisting causes a conflict of interest, but
charging for using the list doesn't. I disagree, but can live with it (isn't
the first time I disagree with the majority, won't be the last I guess ;-)

-- 
Mr. Esa Laitinen
Tel. +41 76 200 2870
skype/yahoo: reunaesa
Blog: http://happiloppuuahistaa.blogspot.com

---

From: Brendan Hide <[email-masked]>
Date: Mon, 07 Mar 2011 12:53:47 +0200

I'm joining the bandwagon late it seems. Please note my opinions do not 
in any way reflect the opinions of my Employer.

The ISP I work for went through major expansion of our network in the 
last 2 years. We got our own address space, issued many of these to our 
ADSL customers and had to also, of course, self-manage the network. Very 
quickly UCEPROTECT had us listed because we blundered. We didn't pay. We 
saw how fruitless this would be, so we fixed the issue by installing 
spam filtering on port 25. This worked and now only the spam filter 
server gets listed every now and again, which we're happy to leave for 7 
days. We tell our customers to use port 587 with Authentication. As a 
result the majority of the mail reaching our filter system is blocked as 
spam and only a small amount of actual spam leaves the network.

Despite being on the "receiving end" of UCEPROTECT I feel no ill towards 
them, except as a reminder of how easy it is for poor technical 
implementation to result in spam being sent out. It was our fault.

While I don't like the idea that UCEPROTECT makes money from express 
delistings, I feel this is outside the scope of RFC and technical BCP 
documents. Yes, when a company makes money by "extortion" (and I use 
this term VERY loosely here) its a damned good idea to make their 
listing criteria publically available. However I don't see this being 
relevant except for the case of legal proceeding, again, IMHO outside 
the scope of the document being discussed.

-- 
__________
Brendan Hide
Mobile: +27 83 448 3867
Mobile: [email-masked] (plain text only please)
Web Africa - Internet Business Solutions - http://www.webafrica.co.za/?AFF1E97

---

From: Graeme Fowler <[email-masked]>
Date: Mon, 07 Mar 2011 11:02:10 +0000

On Mon, 2011-03-07 at 09:13 +0100, Esa Laitinen wrote:
> We're beating a dead horse here

Quite - too much effort seems to be concentrating on one piece of
detail.

That said, if we all take a breath and step back a moment, the crux of
the matter appears to me (neither an ISP nor a DNSBL operator, but an
interested observer) to be this:

This discussion is based on a proposed BCP document. That's important:
Best Current Practice.

BCP documents do not preclude operating in a way which is contradictory,
they merely flag those ways as either not being current, or being
acknowledged as not the best way to operate.

Some time ago in this thread a question was asked if anyone knew of any
other currently operating DNSBLs which charge for delisting, or to
expedite delisting. I do not recall an answer being forthcoming.

>From a completely apolitical standpoint (acknowledging that there may be
some smaller DNSBL operators who aren't engaged here operating DNSBLs
which have a very local user base and therefore aren't represented here)
that indicates that payment for delisting or expedited delisting is
*not* a widely held current practice. Ergo, it is not "best" or
"current".

I would like to propose the following change to 2.2.5, which I hope
covers the controversy in words which are slightly less controversial:

------------------------------------------------------------------------
2.2.5 Payment to DNSBL operators

        It is widely considered appropriate for a DNSBL to charge for
        access to it by its users - the definition of a commercial
        DNSBL.
        
        However, the practise of requiring a listee to pay for delisting
        from a negative connotation DNSBL (used by subscribers, paid or
        otherwise, for blocking purposes) is widely considered not to be
        appropriate. This also applies to charges made for expedited
        delisting from a negative connotation DNSBL, for example after a
        malware infection or other temporary condition is cleared.
        
        Negative-connotation DNSBLs MUST NOT charge fees or require
        donations for delisting or expedited delisting. Such a practise
        is controversial and likely to damage the reputation of the
        DNSBL or the DNSBL operator and may render the DNSBL less useful
        than intended.
------------------------------------------------------------------------

I've stuck with MUST NOT there, because the actual best and current
practice is exactly that. Feel free to throw it out with the bathwater.

Graeme

---

From: Douglas Otis <[email-masked]>
Date: Mon, 07 Mar 2011 10:29:47 -0800

On 3/7/11 3:02 AM, Graeme Fowler wrote:
> Negative-connotation DNSBLs MUST NOT charge fees _or require
> donations_ for delisting or expedited delisting. Such a practise
Graeme,

"or require donations"  is overreaching.  How about  "require 
substantial donations" or "require donations as punishment".

To be clear, this is NOT about any direct payment to the listing 
service.  The term "donation" is vague and might be construed to mean 
ALL sources of request be treated alike.  Clearly, requests from "free" 
email services containing thousands of compromised accounts CAN NOT 
receive the same priority as those from cleaner email services.   
Blanket statements of this nature suggests requests originating from 
"fee" versus "free" email not be balanced against limited resources.  It 
seems prudent to advise those making a request, how various sources of 
requests might be handled.  In doing so, one might see this as then 
requiring donations to those email services with good reputations.    
Reviewing requests requires expensive wetware where the quality of the 
service also demands prompt responses to correct obvious errors.

-Doug