Subject: Re: [Asrg] Walter's comments on draft-church-dnsbl-harmful-01.txt

From: Bart Schaefer <[email-masked]>
Date: Sat, 01 Apr 2006 14:21:04 -0800

On Mar 31,  8:59pm, Walter Dnes wrote:
}
}   2) DNSBLs don't block anything, just as restaurant reviewers don't
} pay goons to stand at the entrances of certain restaurants and attack
} would-be patrons with basball bats.  Just like restaurant reviewers,
} DNSBLs publish opinions about certain establishments.  System
} administrators are free to accept or not accept those opinions.

I've never liked this particular flavor of analogy for DNSBLs.  For one
thing, it's backwards.  Independent of who hired the goon, his job is
not to keep people out of the establishment that was reviewed -- it's to
identify those associated with that establishment in order to keep them
out of of *another* establishment.

Some DNSBLs publish opinions ("based on Y, we believe X is a source of
spam"); some publish verifiable facts ("X is an open relay"; "X is in an
IP range allocated to Z"); some publish unverifiable claims of fact ("a
spamtrap received mail from X").  Some publish specific information, and
some publish broad generalities.

Most complaints are about DNSBLs that publish generalities, and involve
individuals who claim either that they don't fit the profile, or that
the profiling itself is invalid; not about "certain establishments" who
claim they've specifically been given a "bad review."

Here's an example of what I consider a more accurate analogy:  It's a
common practice for auto insurance companies to charge different rates
depending on the ZIP code where you live.  If a DNSBL publishing lists
of dynamic IPs is like a ZIP code directory, then the sysadmins who use
it are like auto insurers.

If you want a restaurant analogy:  It's like a restaurant hiring a goon
and giving him a yearbook so he can turn away all local high-schoolers,
because a couple of them once vandalized a restroom.

It's not inherently harmful to publish a ZIP code directory or a high
school yearbook.  It's all a matter of what's done with the information.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Sat, 1 Apr 2006 18:15:04 -0500 (EST)

Bart Schaefer <[email-masked]> wrote:

> If you want a restaurant analogy: It's like a restaurant hiring a
> goon and giving him a yearbook so he can turn away all local
> high-schoolers, because a couple of them once vandalized a restroom.

What is the "it" you're referring to?

The DNSBL publisher is like the yearbook publisher in that example; it
just publishes data.

The restaurant owner is like the mailswerver owner.

One key difference in the US is that the mailserver owners is
_specifically_ permitted by law to take whatever action _he_ thinks is
appropriate to block unwanted email.

Seth

---

From: Bart Schaefer <[email-masked]>
Date: Sat, 01 Apr 2006 21:14:16 -0800

On Apr 1,  6:15pm, Seth Breidbart wrote:
} Subject: Re: [Asrg] Walter's comments on draft-church-dnsbl-harmful-01.txt
}
} Bart Schaefer <[email-masked]> wrote:
} 
} > If you want a restaurant analogy: It's like a restaurant hiring a
} > goon and giving him a yearbook so he can turn away all local
} > high-schoolers, because a couple of them once vandalized a restroom.
} 
} What is the "it" you're referring to?

Blocking mail by checking a DNSBL that lists IP ranges wherein some of
the IPs have been spam sources.

} The DNSBL publisher is like the yearbook publisher in that example;

Yes.

} it just publishes data.

Not precisely; in contrast to most DNSBLs, the yearbook publisher
doesn't advertise the book with a description that reads, "Pictures of
people you might want to keep out of your place of business."

However, I'm not making value judgements here, just analogies.

} The restaurant owner is like the mailswerver owner.

Right.  The restaurant owner could do a lot better with, say, a police
mugbook of known street gang members, but he doesn't have one, or maybe
his other patrons just don't like dining with teenagers anyway.

To carry the analogy further, requiring DSL customers to send mail via
their ISP server is like allowing the kids into the restaurant only if
accompanied by their parents.  Some of the kids, and maybe even some of
the parents, are going to complain.  The Church draft, in effect, argues
that those complaints are enough reason to disparage the whole practice.

I believe that's a misconception, but I don't believe that the counter-
arguments should be based on *different* misconceptions.

} One key difference in the US is that the mailserver owners is
} _specifically_ permitted by law to take whatever action _he_ thinks
} is appropriate to block unwanted email.

True, and not a bad thing either, but not really relevant to whether
some of those actions make DNSBLs in general "harmful."

---

From: "Chris Lewis" <[email-masked]>
Date: Sun, 02 Apr 2006 00:43:51 -0500

> his other patrons just don't like dining with teenagers anyway.

The restaurant gets to choose from police mugbooks of convicted bathroom
vandals, books of security cam pictures of kids vandalizing bathrooms,
books of pictures of kids carrying sledgehammers into bathrooms, kids
living in the same house as bathroom vandals, kids in the same gang as
those carrying sledgehammers, kids in homes that have sledgehammers,
kids that look "funny", kids that look like other kids, pictures of
random kids, pictures of kids who don't vandalize bathrooms, pictures of
all kids, pictures of kids whose first name starts with a letter in the
first half of the alphabet etc.  Some of these books aren't labeled very
well or accurately published.  Some of them are quite accurate.

The restaurant needs to choose which books are appropriate, which ones
keep out the most likely to vandalize, without killing their business by
keeping too many out. If they don't, they're going to lose.

> that those complaints are enough reason to disparage the whole practice.

It does?  Ouch.  Flies in the face of a number of existing published BCPs.

---

From: "Dan Oetting" <[email-masked]>
Date: Sun, 2 Apr 2006 09:17:32 -0600

On Apr 1, 2006, at 10:43 PM, Chris Lewis wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Bart Schaefer wrote:
>

What we don't do enough of is pinning a note to the back of the kids  
shirt to tell the responsible parents that their kid is vandalizing  
restrooms and need to be monitored until it grows up.