[ppml] Last Call for Comment: Policy Proposal 2002-6

[Jill Kulpinski]

how do i take action against people who don't respond?  i am very pro-active in 
making sure our resources are used appropriately, but how do you tell someone 
they are not allowed to post a listing, they need to change their listing, or also...
force people to not use these blacklists?  no matter what we do...some joe-shmo out
there could set up a site and put any address he wanted to on a list and market it
to the internet world as a blacklist.  if someone actually trusts and uses this list...
that should be their problem.  BUT i tell a Customer who has a complaint he or whomever
he serves should not use the listing...and i get 'but everyone....even the major providers use it'.
what can i do....for every list that i get some innocent person off of, who is to stop some other 
person for putting mr. innocent on another list?
and how am i ever supposed to be able to guarantee to a Customer that no one is blacklisting their space?
it is not possible to provide this guarantee, so what is the solution...and both short term and long term 
would be great.

Thanks,
Jill



-----Original Message-----
From: Dr. Jeffrey Race [mailto:jrace at attglobal.net]
Sent: Thursday, November 14, 2002 6:36 PM
To: Jill Kulpinski; ppml at arin.net
Subject: RE: [ppml] Last Call for Comment: Policy Proposal 2002-6


On Thu, 14 Nov 2002 12:28:53 -0800, Jill Kulpinski wrote:
>This whole issue regarding blacklists seems to be growing each day and more 
>rapidly in the past few months.  I would love to know what to tell Customers who 
>are assigned space that was once used by some other Customer who got it 
>blacklisted on one of the thousands of lists out there.  I can not control who 
>creates a blacklist, nor who uses it to set up filters, so is there really any 
>means of providing a Customer address space that will never be blacklisted?  No.  
>But they want temporary fixes in the meantime which is an impractical solution.  
>I would love to hear other people's thoughts on this but I realize I may be 
>getting off of the topic a bit.


It is completely on topic for the reasons you state.

In general,  announcement on Spam-L and NANAE that the ownership of IP address 
space has been taken over by new non-spammer user will cause many or most of
the blocklists to remove the previously offending addresses.   However some 
blocklist managers don't follow these groups assiduously, some blocklist 
managers have a several-month waiting period, and some blocklist managers have
a policy NEVER to admit traffic from any once-polluted address space, possibly 
because they have been lied to so many times.

So there is NO universal retrospective solution.

Therefore, and this is the simple point I have been trying to make here,
there remains only a prospective solution.    That is what you have to face,
and face now, because the use of blocklists is growing rapidly and possibly
exponentially.  It is the only defense we victims have against the present
irresponsible management of IP address space and domain names.

The RIRs are responsible for the proper management, express and
implied, of the IP address space allocated to them.  Since recycling of
IP address space obviously will occur over the years, decades and 
centuries, the RIRs have a duty to prevent pollution of the resources
they manage.  The pollution comes from spamming.   This means the RIRs
have to have a clear policy that IP address users must not spam, must
not allow spammers on their networks, and must have hair-trigger management
systems in place to identify incipient spammers and penalize them (because
blocklist additions can occur in days).  (All this is eminently doable now
by presently existing technical measures, and many ISPs do indeed use such
measures.)  Any user who violates this rule must have his IP address space 
withdrawn. That is the only sanction that anyone will pay attention to.

In short, the RIRs have to take on a role to act, probably agggressively
and violently, against abuse of the resources they manage, by the people
to whom they entrust these resources.   If you list members are not willing
to rise up and force them to prevent spammers from pissing in the pool,
then don't complain about how the water tastes when you swim in it.  It
is the result of your own (in)action.

Jeffrey Race