🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

Part 5 of the email logs.

- -- 
- -Windigo The Feral (NYAR!)
Fight the Woodside Literary Agency! Support the Jayne Hitchcock HELP fund 
<http://www.geocities.com/Hollywood/6172/helpjane.htm> * Boycott Internet 
Spam! <http://spam.abuse.net/spam> * Ban Spam Now! <http://www.cauce.org>

<logs follow>


- From ccaputo@alt.net Sat Nov 15 22:17:56 1997
Date: Sat, 15 Nov 1997 01:22:35 -0800 (PST)
From: Chris Caputo <ccaputo@alt.net>
To: Follower of the Clawed Albino <afn23950@afn.org>
Subject: Re: Question for you

We are not hearing from customers that there is confusion over the type of
service we run.  Customers seem to understand that we do keep logs of who
posts what, but not logs of who downloads what.  Customers seem to
understand that the amount of privacy they choose to have is up to them. 

We are not hearing from customers that they would like to have an
NNTP-Posting-Host: header on their posts.  Whenever customers suspect that
we might be implementing something like that, they get very upset.

When abuse happens from Altopia, it is up to Altopia admins to handle it. 
The buck stops with us. 

> Sir,

What makes you think I am male? 

> The posts were to a *one* crossposted threads from alt.fan.karl-malden.nose,
> were very often REPOSTED threads from alt.fan.karl-malden.nose and
> news.admin.net-abuse.usenet at that, were not in the *least* relevant to
> alt.horror.werewolves or most of the rest of the groups they were posted to, 
> and were meant--by the very admission of the group doing it--to flood the
> regulars off alt.horror.werewolves and destroy any possibility of having
> an on-topic conversation in the newsgroup at all.
>  
> Whilst it's not a flat out binary bombing, it *is* a flood and it *was*
> meant as a denial of service attack.  Apparently I am not the only one who
> agrees with this; there were a number of NANA* regulars who agreed that this
> was meant as an attack.
> 
> I encourage you to please contact Chris Lewis or the meow.org admin,
> fluffy@meow.org, for confirmation that the intent and effect WAS that of a
> denial of service attack on alt.horror.werewolves.  (The latter actually
> offered to run a mailinglist to temporarily replace alt.horror.werewolves
> due to the volume of posting by the various persons involved in the flood.)

We continue to disagree with you on this.  Not that it matters, but others
on NANA* disagree with you on this, while others do agree.  Not that it
matters, but it is debatable and there is no consensus.  Regardless, as
long as a human is taking the time to construct each message, we will not
be doing anything to stop it. 

> Excuse me, but you *did* and *do* have an obligation to Usenet to notify me
> that you intended to do naught about your users deliberately attempting to
> flood alt.horror.werewolves and several other groups.  You at the *very
> least* have an obligation to the users of alt.horror.werewolves who were
> increasingly finding the newsgroup unusable due to the amount of posts by
> the perpetrators--the single most voluminous one being a customer of alt.net
> who was in addition forging headers like mad to implicate Harvard
> University.
> 
> Saying repeatedly "it wasn't a flood" does *not* make it so.  Saying
> "forging headers isn't net.abuse" does *not* make it so.

I continue to believe we do not have the obligation you suggest we do
have.  We should agree to disagree on this.  There is no hope of us
convincing either one of us either way. 

> What I'd like to see is your direct customers also have their home sites
> added to NNTP-Posting-Host, or (in lieu of this) forwarded upon request
> when evidence of net.abuse is occuring.  Sanitising paths would also help.

The first sentence above will not happen.

> (Zippo uses "news.newsdawg.com" for its NNTP-Posting-Host for direct
> customers, but *will* provide NNTP-Posting-Host of the site upon request
> should net.abuse be occuring from their site.)

Zippo has made the decision to act this way.  We do not share in this
decision, based on our own legal analysis with our attorneys. 

> I'm not assuming this.  
> 
> *I literally have several megabytes of present and past abuse related to
> this archived* that will bear me out on this.  Most of it is through open
> NNTP servers (re the net.abuse, the fact the net.abuse is being done as
> harassment, and the fact they have done it before).
> 
> Stopping someone from deliberately forging a valid site's hostname anywhere
> in the headers and stopping users from deliberately trying to harass people
> and destroy newsgroups is *not* restricting freedom of speech.  It is--to
> whit--stopping vandalism.  Plain and simple.
> 
> The persons who were forging paths willy-nilly were NOT interested in valid
> speech.  They were interested in destroying things, making groups unusable,
> and getting innocent people mailbombed (CAUCE in the case of "mahmoud",
> Stanley King and, later, Chris Lewis [and, in general, Harvard University]
> with the "meowbot" posts).  

The above is all conjecture.  We refuse to make judgements like this and
we rely on courts of law to make these kinds of judgements. 

> (And I do have a fair idea on what legally is and is not considered "free
> speech".  I happen to work for a group that fights against censorship IRL.
> I am one of the signatories to the CIEC lawsuit which caused the end of the
> Communications Decency Act.)

Thank you for helping to fight the CDA.  What group do you work for? 

> What you term "freedom", the vast majority of sites--including moderators
> and the *vast* majority of backbomes--consider net.abuse at least.  Under
> some state laws it could even be seen as unauthorised access to a computer
> network, theoretically.  It *IS* something that will get your account nuked
> in no small order on most sites on Usenet.

Whether the action is illegal is something that would need to be decided
in court.  We realize our policy on this matter is not widespread. 

> YM "forge moderation".  Among those are, to whit, PGPMoose and removal of
> net.access to those who persistently forge moderator approval.

PGP-Moose is the one we recommend to sites who want to cleanse moderated
groups.

> And what you are failing to understand is that you have a few bad apples,
> they have the potential to cause other sites to alias you out because you
> have different opinions on net.abuse than most sites, and it can end up
> hurting your legitimate users.

Periodically sites alias us out.  The more this happens, the more we will
lose certain types of customers and the more we will gain other types of
customers.

> I'll tell you right now that moderator forgery would not only likely get you
> permanently banned from net.*, but you'd be getting an AWFUL lot of angry
> mail to all of your feeds.

Before our customers will have access to Usenet II they will have to agree
not to use Approved: headers to post to moderated groups without
permission of the moderator. 

> If this is conjecture, it's conjecture with a goodly amount of proof behind
> it.  I myself have megabytes of proof; the admin of meow.org could explain
> on this, as could Lewis.  This is because we've all dealt with this in past.

This still remains conjecture.

> I'm stating that Altopia's standards are at variance with the majority of
> sites that run Usenet.  Including the sites of folks who buy Altopia feeds.

It is understood that many sites have different policies than our own. 

> If a site is at variance for too long, that site finds it isn't gonna be
> talking to too many people.  This isn't my edict--this is simple fact.
> UUnet may soon find it can't talk to most of Usenet because it's not being
> prompt at stopping abuse from its POPs or notifying folks where it is coming
> from.  And they're damn near the biggest site on the net...

Our policies were made knowing that we will eventually be UDPed by various
sites around the net.  This has already happened and will continue to
happen.  Each site can choose whether the positive contributions of
Altopia users outweigh the negative contributions.  That's really a
wonderful concept if you think about it. 

> > A thousand people could have emailed saying that and our decision on
> > whether it was abuse would be the same.  We would disagree with all of
> > those people, if their opinion was different that ours, after analysis. 
> 
> And had you announced that, you shortly would discover Altopia had become an
> intranet.  Because nobody would accept packets from you, because they felt
> you were an abusive site that tolerated net.abuse.

Ahh, you miss my point.  Whereas you could find a thousand people to email
us one position, we could find another thousand people to email us the
opposite position.  The fragmentation of Usenet between those sites that
value control and those sites that value freedom is a natural thing.

> > You seem to be doing a lot of the investigative work that a law
> > enforcement agency should be doing.  It is unwise for you to be doing it,
> > because you are the one supposedly being harassed.  You run the risk of a
> > law enforcement agency not believing you or taking you seriously when you
> > take the investigation into your own hands. 
> 
> It's awful funny--the Louisville FBI office seems to take it seriously
> enough that they've asked me to forward a summary, and the Attorney-
> General's office is having me file a complaint with them.

In no way am I suggesting this is funny.  I am quite serious. 

> > All postings from Altopia contain "news.alt.net" in the Path: line.  It
> > should be easy to filter based on this, in addition to your other filters. 
> 
> It would be much better if you would simply have stopped the abuse in the
> first place.  (Among other things, there are a few legitimate users of
> alt.net in news.admin.net-abuse.* whose posting I'd like to read on
> occasion.)

I was suggesting filtering within alt.horror.werewolves and not
news.admin.net-abuse.*.  A tradeoff would need to be made between whether
more is lost by filtering versus what is gained by not filtering. 

> You must also keep in mind that most newsreaders cannot filter out by Path:.
> trn and (if my memory of the documentation serves) Souper do allow it, but
> most other newsreaders do not--if the newsreaders have killfiling at all.

If a news reader does not have a feature that is needed, the news reader
author should be petitioned to add the feature.  If the author does not
fill the need, other authors will. 

> Were I to take that step, I'd be asking *most* sites to join me.

And each site would make the decision on their own.  I doubt many sites
would alias us out simply based on your recommendation or that of the
respected individuals in news.admin.net-abuse.*.  Most sites do not even
pay attention to you or those groups.  Most sites are just concerned with
being functional and as long as we are not making their site
dysfunctional, we are not bothering them.  When I say dysfunctional, I
mean in the technical newsflow sense. 

> Are you seriously suggesting that, as a response to net.abuse from your
> users, we should just all alias out Altopia en masse? :P

The issue is that different sites have different definitions of net abuse. 
I would assume that sites that are intensely bothered by our policies
would choose to alias us out.  Others not quite as bothered, would not. 

> Even if a clear pattern emerges that they ARE committing net.abuse.  (Chris,
> I say this in kindness--I pray to Goddess you never get a serial spammer or
> someone who is similarily abusive on your site.  Because the first thing
> they're going to do is take advantage of your leniency there...they'll
> stick to spams JUST under the cancellable limits because they know each
> incident will be considered "individually".)

I did not say each post is considered individually.  An incident can be a
collection of posts.  We have a history of containing spammers in a quick
fashion.

> Then--pray tell--what have you done re the "mahmoud" poster?  HAS be been
> removed?  Is this a copy-cat?  Would you even know if "mahmoud" returned?

This is all confidential and will remain so. 

> > If an abusive post is made using Altopia, then the abuse is coming from an
> > Altopia user.  The IP address or home ISP they used is not relevant.. 
> 
> Even if it's known that the person has a history of repeatedly abusing
> Usenet, and will very likely abuse Usenet again from another site after he
> gets the Golden Boot from Altopia?

Correct.

> Even if the user's AUP has a stricter policy, prohibiting stuff like forging
> moderator approval or Paths?

Correct.  A user makes their own decision whether to violate or abide by
their provider's AUP.  It is not up to us to police that aspect of a
user's communication with us.

> There *DOES* seem to be confusion on that.  Some of your users think you are
> an anon posting service--even though Altopia is actually less secure than a
> true anon-posting service.  Some of your users think you just provide a
> news-feed.  (I've actually heard two different opinions on whether one
> should add an NNTP-Posting-Host header from Altopia customers--depending
> on whether one was using it as just "a better newsfeed" or as the 1997
> equivalent to the belated anon.penet.fi.)

Please tell any customer of Altopia that is confused about this to either
email support@alt.net or post their question to altnet.general.  In no way
are we trying to confuse customers or potential customers of Altopia. 

Chris Caputo
President, Altopia Corporation

- From afn23950@afn.org Sat Nov 15 22:18:21 1997
Date: Sat, 15 Nov 1997 16:25:54 -0500 (EST)
From: Follower of the Clawed Albino <afn23950@afn.org>
To: Chris Caputo <ccaputo@alt.net>
Subject: Re: Question for you

On Sat, 15 Nov 1997, Chris Caputo wrote:

> We are not hearing from customers that there is confusion over the type of
> service we run.  Customers seem to understand that we do keep logs of who
> posts what, but not logs of who downloads what.  Customers seem to
> understand that the amount of privacy they choose to have is up to them. 

News.admin.net-abuse.usenet had a fellow on there statign he was using
alt.net as an anonymous service.  I will be glad to forwad the post to you
on request.
 
> We are not hearing from customers that they would like to have an
> NNTP-Posting-Host: header on their posts.  Whenever customers suspect that
> we might be implementing something like that, they get very upset.

I've heard at least one Altopia customer state on news.admin.net-abuse.
policy that adding NNTP-Posting-Host would be "acceptable".  I will forward
the post to you upon request.

People got concerned when it was added on airnews, too, but it was added as
a security measure.  People got concerned when it was added to Zippo, but it
was added as a security measure.

If all of Airnews' users are going to get *that* huffy over it, it may be
best to split to an anon and a non-anon posting service, as I suggested
earlier.

> When abuse happens from Altopia, it is up to Altopia admins to handle it. 
> The buck stops with us. 

I've no problems--as long as you a) *do* deal with net.abuse (by that I mean
acts which are generally considered to be net.abuse according to most Usenet
sites) and b) you let folks know that you are, or not, going to deal with
it.

> > Sir,
> 
> What makes you think I am male? 

I've heard from others that you're male.  Also, the phone recording
accouncement was from a male.  Hence, "sir".

If I suspected otherwise, I'd say "dear sir and/or madam".

> > The posts were to a *one* crossposted threads from alt.fan.karl-malden.nose,
> > were very often REPOSTED threads from alt.fan.karl-malden.nose and
> > news.admin.net-abuse.usenet at that, were not in the *least* relevant to
> > alt.horror.werewolves or most of the rest of the groups they were posted to, 
> > and were meant--by the very admission of the group doing it--to flood the
> > regulars off alt.horror.werewolves and destroy any possibility of having
> > an on-topic conversation in the newsgroup at all.
> >  
> > Whilst it's not a flat out binary bombing, it *is* a flood and it *was*
> > meant as a denial of service attack.  Apparently I am not the only one who
> > agrees with this; there were a number of NANA* regulars who agreed that this
> > was meant as an attack.
> > 
> > I encourage you to please contact Chris Lewis or the meow.org admin,
> > fluffy@meow.org, for confirmation that the intent and effect WAS that of a
> > denial of service attack on alt.horror.werewolves.  (The latter actually
> > offered to run a mailinglist to temporarily replace alt.horror.werewolves
> > due to the volume of posting by the various persons involved in the flood.)
> 
> We continue to disagree with you on this.  Not that it matters, but others
> on NANA* disagree with you on this, while others do agree.  Not that it
> matters, but it is debatable and there is no consensus.  Regardless, as
> long as a human is taking the time to construct each message, we will not
> be doing anything to stop it. 

Chris (I'll drop the "sir" this time),

Determining whether something is net.abuse by whether or not it was posted
by a script is not only at variance with *every single other Usenet site*
(including a *lot* of sites that deeply respect freedom of speech) but could
cause you to miss clear cases of net.abuse.

I myself have seen spams that were not posted by a script.  Spams that would
fall under the Breidbart Index levels of cancellable spam.  The spammer
posted them individually.

I've also seen "customised spam" where the first paragraph is customised to
the group, but the rest is substantially similar.  These are hand-posted
too, but are and *have* been concidered cancellable spam almost since spam
cancellation began.

*Just because something is hand-posted or posted individually does *not*
mean it is not net.abuse.*  As I've stated, *individually posted or no*,
the intent and the effect *were* that of a newsgroup flood and an attempt to
destroy alt.horror.werewolves.  I am not the only one who noticed this,
fwiw.

The main discussion I've seen on news.admin.net-abuse.* was whether your
lack of response to complaints was worthy of UDP, *not* to whether or not
this was a newsgroup flood.  Only two people disagreed on this, one a German
admin and the other someone who has not been on the net.abuse groups in some
months.

> > Excuse me, but you *did* and *do* have an obligation to Usenet to notify me
> > that you intended to do naught about your users deliberately attempting to
> > flood alt.horror.werewolves and several other groups.  You at the *very
> > least* have an obligation to the users of alt.horror.werewolves who were
> > increasingly finding the newsgroup unusable due to the amount of posts by
> > the perpetrators--the single most voluminous one being a customer of alt.net
> > who was in addition forging headers like mad to implicate Harvard
> > University.
> > 
> > Saying repeatedly "it wasn't a flood" does *not* make it so.  Saying
> > "forging headers isn't net.abuse" does *not* make it so.
> 
> I continue to believe we do not have the obligation you suggest we do
> have.  We should agree to disagree on this.  There is no hope of us
> convincing either one of us either way. 

I'm just stating what others are seeing (and I'm not the only one who's
posted to this effect on the net.abuse groups).

> > What I'd like to see is your direct customers also have their home sites
> > added to NNTP-Posting-Host, or (in lieu of this) forwarded upon request
> > when evidence of net.abuse is occuring.  Sanitising paths would also help.
> 
> The first sentence above will not happen.

Then--more than likely--they will continue to abuse your site.  (Partly
because they know that their home ISP won't get involved in stopping abuse.)
They may also have multiple accounts at Altopia, for all one knows.

> > (Zippo uses "news.newsdawg.com" for its NNTP-Posting-Host for direct
> > customers, but *will* provide NNTP-Posting-Host of the site upon request
> > should net.abuse be occuring from their site.)
> 
> Zippo has made the decision to act this way.  We do not share in this
> decision, based on our own legal analysis with our attorneys. 

Why exactly do your lawyers feel this is a major problem?  (I'm very curious
on this...the only way there would be a problem, legally, should be if
you're running an anonymous site.  And the mere fact that you're logging
pretty much proves this isn't the case.)

> > I'm not assuming this.  
> > 
> > *I literally have several megabytes of present and past abuse related to
> > this archived* that will bear me out on this.  Most of it is through open
> > NNTP servers (re the net.abuse, the fact the net.abuse is being done as
> > harassment, and the fact they have done it before).
> > 
> > Stopping someone from deliberately forging a valid site's hostname anywhere
> > in the headers and stopping users from deliberately trying to harass people
> > and destroy newsgroups is *not* restricting freedom of speech.  It is--to
> > whit--stopping vandalism.  Plain and simple.
> > 
> > The persons who were forging paths willy-nilly were NOT interested in valid
> > speech.  They were interested in destroying things, making groups unusable,
> > and getting innocent people mailbombed (CAUCE in the case of "mahmoud",
> > Stanley King and, later, Chris Lewis [and, in general, Harvard University]
> > with the "meowbot" posts).  
> 
> The above is all conjecture.  We refuse to make judgements like this and
> we rely on courts of law to make these kinds of judgements. 

Chris, with all due respect, this isn't conjecture; I do have verifiable
*proof* where they have *admitted* this was the intent.  So do several
others.

> > (And I do have a fair idea on what legally is and is not considered "free
> > speech".  I happen to work for a group that fights against censorship IRL.
> > I am one of the signatories to the CIEC lawsuit which caused the end of the
> > Communications Decency Act.)
> 
> Thank you for helping to fight the CDA.  What group do you work for? 

Right now, doing volunteer work for Rock Out Censorship (helping get their
site set up on the web and an activist's mailinglist).

> > What you term "freedom", the vast majority of sites--including moderators
> > and the *vast* majority of backbomes--consider net.abuse at least.  Under
> > some state laws it could even be seen as unauthorised access to a computer
> > network, theoretically.  It *IS* something that will get your account nuked
> > in no small order on most sites on Usenet.
> 
> Whether the action is illegal is something that would need to be decided
> in court.  We realize our policy on this matter is not widespread. 

And what I am stating as well is *completely aside from state laws on the
matter* the behaviour *is hurting the functionality of Usenet*.

> > YM "forge moderation".  Among those are, to whit, PGPMoose and removal of
> > net.access to those who persistently forge moderator approval.
> 
> PGP-Moose is the one we recommend to sites who want to cleanse moderated
> groups.

Fine and good.  You *also* need to deal with people who persistently forge
moderator approval.  The fact the moderator isn't letting ther posts through
is a sign in and of itself that the people aren't welcome--if they forge
moderator approval they are basically breaking the lock on a fence to keep
unwelcome people out.  Stronger locks are one solution, but another solution
(part of the whole) is to not allow the people to break locks again.

> > And what you are failing to understand is that you have a few bad apples,
> > they have the potential to cause other sites to alias you out because you
> > have different opinions on net.abuse than most sites, and it can end up
> > hurting your legitimate users.
> 
> Periodically sites alias us out.  The more this happens, the more we will
> lose certain types of customers and the more we will gain other types of
> customers.

Thing is, will the good or bad customers predominate?  (AGIS took *exactly*
this kind of tack with spammers.  They eventually lost a good deal of their
connections with sites, and to this day are seen as spam-mongers.  Most of
AGIS' legitimate customers have left as a result.)

> > I'll tell you right now that moderator forgery would not only likely get you
> > permanently banned from net.*, but you'd be getting an AWFUL lot of angry
> > mail to all of your feeds.
> 
> Before our customers will have access to Usenet II they will have to agree
> not to use Approved: headers to post to moderated groups without
> permission of the moderator. 

No offense, but I don't think that's going to be good enough for the Usenet
II committee.  (In my discussions with them (partly because of the floods a
group in net.* was considered) the net.*-folk have explained that sites that
do not have good net.abuse policies in Usenet as a whole will *not* be given
Usenet II feeds until such time as they correct those policies.  If a site
is slow on removing spammers, or does not deal with certain types of
net.abuse, they will not get a feed.  Period.

Considering you have decidedly unusual policies in dealing with certain
types of net.abuse and do allow some behaviour which is generally considered
abusive (such as forging of moderator approval on Usenet), it is doubtful
you'd get a feed.  If you have issues with this, I suggest you take them up
with the Usenet II committee.

> > If this is conjecture, it's conjecture with a goodly amount of proof behind
> > it.  I myself have megabytes of proof; the admin of meow.org could explain
> > on this, as could Lewis.  This is because we've all dealt with this in past.
> 
> This still remains conjecture.

I've asked the admin of meow.org to back me up (no, I did *not* forward the
mails, but I did note to him you don't seem to think the flooding of AHWW
was, indeed, a flood).  As for my proof, I figured you didn't want to be
mailbombed with 25 megs of zipped files containing my proof of ongoing
flooding with malicious intent.

> > I'm stating that Altopia's standards are at variance with the majority of
> > sites that run Usenet.  Including the sites of folks who buy Altopia feeds.
> 
> It is understood that many sites have different policies than our own. 

It is also understood that users have to generally follow their sites'
AUPs.  Including those of their home site.

> > If a site is at variance for too long, that site finds it isn't gonna be
> > talking to too many people.  This isn't my edict--this is simple fact.
> > UUnet may soon find it can't talk to most of Usenet because it's not being
> > prompt at stopping abuse from its POPs or notifying folks where it is coming
> > from.  And they're damn near the biggest site on the net...
> 
> Our policies were made knowing that we will eventually be UDPed by various
> sites around the net.  This has already happened and will continue to
> happen.  Each site can choose whether the positive contributions of
> Altopia users outweigh the negative contributions.  That's really a
> wonderful concept if you think about it. 

Nice concept in theory, but won't your users be disappointed if they find
that they can only talk to alt.net (and maybe AGIS) customers?  Won't a lot
of them who went to alt.net so they COULD post to Usenet go to other
providers?  Won't that hurt you ultimately?

A number of folks go with an alt.net feed so they can get a better feed of
Usenet.  If they find they will ultimately get no better propogation than at
their home ISP, a number *will* leave.  And you will be ultimately left with
those whom nobody else wants, and eventually Altopia will become an
intranet.

I do *not* want this to happen.  *This* is why I'm trying to encourage you
to consider options that are friendly to the net as a whole and will protect
the anonymity of your legitimate customers who need it.

> > > A thousand people could have emailed saying that and our decision on
> > > whether it was abuse would be the same.  We would disagree with all of
> > > those people, if their opinion was different that ours, after analysis. 
> > 
> > And had you announced that, you shortly would discover Altopia had become an
> > intranet.  Because nobody would accept packets from you, because they felt
> > you were an abusive site that tolerated net.abuse.
> 
> Ahh, you miss my point.  Whereas you could find a thousand people to email
> us one position, we could find another thousand people to email us the
> opposite position.  The fragmentation of Usenet between those sites that
> value control and those sites that value freedom is a natural thing.

And you are still missing *my* point.

Some of your users are doing things that hurt Usenet for *everyone*.  You
are tolerant of some of these things.

Most sites are *not* tolerant of these things--not because they want to
restrict freedom of speech--but *because they hurt Usenet for everyone*.

Sites that persistently do nothing about users who keep hurting the net
*will* end up talking to the ether bunnies.  They're already talking *very*
seriously about UDPing UUnet--which is the largst backbone on the planet--
for being lax on dealing with users that hurt the net.

I do not want Altopia left to be talking just to the ether bunnies.
However, I don't want you to keep protecting users who ARE doing things to
hurt the net because you think it's OK, either.

I also realise that there are a few of your users who do not hurt the net
who need to be anonymous, because their bosses might not like them blowing
the whistle or whatnot.  I also know that the folks who are using your site
to hurt the net do so because their home ISPs likely do not allow them to do
stuff that hurts the net and one can't find their home ISP.

I am giving suggestions where you can protect the folks who have mean bosses
and all, but not let the bad people who hurt the net hide behind you.  THAT
is what I am interested in.  I don't want the people who need Altopia to
post because they have mean bosses or have a bad feed be talking to the
ether bunnies because the bad people kept hiding and folks decided they no
longer wanted to hear from Altopia at all.

> > > You seem to be doing a lot of the investigative work that a law
> > > enforcement agency should be doing.  It is unwise for you to be doing it,
> > > because you are the one supposedly being harassed.  You run the risk of a
> > > law enforcement agency not believing you or taking you seriously when you
> > > take the investigation into your own hands. 
> > 
> > It's awful funny--the Louisville FBI office seems to take it seriously
> > enough that they've asked me to forward a summary, and the Attorney-
> > General's office is having me file a complaint with them.
> 
> In no way am I suggesting this is funny.  I am quite serious. 

And so am I.  I've had no problems presenting this to law enforcement so
far.

> > > All postings from Altopia contain "news.alt.net" in the Path: line.  It
> > > should be easy to filter based on this, in addition to your other filters. 
> > 
> > It would be much better if you would simply have stopped the abuse in the
> > first place.  (Among other things, there are a few legitimate users of
> > alt.net in news.admin.net-abuse.* whose posting I'd like to read on
> > occasion.)
> 
> I was suggesting filtering within alt.horror.werewolves and not
> news.admin.net-abuse.*.  A tradeoff would need to be made between whether
> more is lost by filtering versus what is gained by not filtering. 

In an awful lot of killfiling mechanisms, you can only killfile globally.
That is, if you can killfile at all, or if the killfiling allows you to
killfile by Path: at all.

Newsreaders that even allow killfiling by Path: are uncommon at best.  (I
know for a fact this is the case--for some time, until Airnews started
accepting cancels again, I tried killfiling the Dave the Ressurector posts
without success in tin, slrn and nn, and had considerable difficulty with
it in strn.  (tIt is not exactly trivial to finetune killfiles at times.)

> > You must also keep in mind that most newsreaders cannot filter out by Path:.
> > trn and (if my memory of the documentation serves) Souper do allow it, but
> > most other newsreaders do not--if the newsreaders have killfiling at all.
> 
> If a news reader does not have a feature that is needed, the news reader
> author should be petitioned to add the feature.  If the author does not
> fill the need, other authors will. 

FWIW--maybe, maybe not.  At present, exactly *one* program exists that
handles NoCeM (the GNU News clinet for *nix).  Most programs for gathering
SOUP packets do not contain killfiling mechanisms (Souper-GUI is a notable
exception).  Uqwk, the default SOUP packer for Unix, does not have
killfiling by default--one has to go into strn and killfile first.  Nn,
nn-tk, tin, slrn and most other Unix newsreaders save for trn do not allow
killfiling by Path:.  At present, there are only two newsreaders for Windows
at *all* that allow killfiling (the registered version of Agent and--if
memory serves--the *very* latest version of Netscape Communicator has
rudimentary killfiling) but neither allow killfiling by Path.  Netvigator
for Macintosh allows killfiling by Subject but not by Path.  I can't be sure
for Acorn Archimedes and all, but most common newsreaders for most other
common platforms don't allow killfiling at all.

Even in the world of offline readers, Yarn does not allow killfiling by
Path, only by thread.

Saying that "if you ask for it they will build it" is optimistic at best.

> > Were I to take that step, I'd be asking *most* sites to join me.
> 
> And each site would make the decision on their own.  I doubt many sites
> would alias us out simply based on your recommendation or that of the
> respected individuals in news.admin.net-abuse.*.  Most sites do not even
> pay attention to you or those groups.  

I'd beg to differ a bit on that.  (There are a number of sites that joined
the IDP on AGIS specifically because several folks on the net.abuse groups
detailed abuse coming from the sites, AGIS' refusal to deal with the abuse,
and announced an IDP.)

> Most sites are just concerned with
> being functional and as long as we are not making their site
> dysfunctional, we are not bothering them.  When I say dysfunctional, I
> mean in the technical newsflow sense. 

And what I have explained and have been explaining is that *your users who
were forging paths and flooding Usenet newsgroups *were* making not only
sites but entire newsgroups dysfunctional*.

*Users at your site who forge moderator approval make Usenet dysfunctional*.

*THIS* is part of what I have issue with.

> > Are you seriously suggesting that, as a response to net.abuse from your
> > users, we should just all alias out Altopia en masse? :P
> 
> The issue is that different sites have different definitions of net abuse. 
> I would assume that sites that are intensely bothered by our policies
> would choose to alias us out.  Others not quite as bothered, would not. 

Different sites may have diffrent standards, but there is a generally
accepted standard among most sites as to what is and is not net.abuse.
If sites condone or do not do anything about behaviour generally considered
abusive, they put themselves at risk of UDP.  

> > Even if a clear pattern emerges that they ARE committing net.abuse.  (Chris,
> > I say this in kindness--I pray to Goddess you never get a serial spammer or
> > someone who is similarily abusive on your site.  Because the first thing
> > they're going to do is take advantage of your leniency there...they'll
> > stick to spams JUST under the cancellable limits because they know each
> > incident will be considered "individually".)
> 
> I did not say each post is considered individually.  An incident can be a
> collection of posts.  We have a history of containing spammers in a quick
> fashion.

But you said if everything is "posted individually" you considered it
separate incidents.  You said it above in this letter.
 
What I have attempted to explain to you is that the repeated incidents of
header forging by the "meowbot" and "mahmoud" are a net.abuse problem.  The
"meowbot", along with three or four other individuals--at least one other
being on alt.net--contributing in multiple incidents to a deliberate attempt
at newsgroup flooding.

According to the standards of what you defined a flood as, you likely would
not consider "customised spam" abusive, either.

As I explained as well, the posts were uniformly crossposted, were forged to
implicate folks these people have tried to harass in past (usually in the
Path:), were often REPOSTS of old articles, and had no intent at all other
than that of deliberately flooding alt.horror.werewolves to the point of
unusability.

This is not conjecture--this is fact.  This was in fact stated as the
intent.  The persons responsible have stated this before that the intent
of the floods is *flooding*, and ultimately destroying alt.horror.werewolves
as a functional Usenet newsgroup.  Even were it not posted that was the
intent, anyone who saw the flood in action could tell you that was the
intent.

What part of "three users of alt.net are cooperating with two or three
others who are not on alt.net in a deliberate attempt to make a Usenet
newsgroup unusable for its regular users" are you failing to understand?

> > Then--pray tell--what have you done re the "mahmoud" poster?  HAS be been
> > removed?  Is this a copy-cat?  Would you even know if "mahmoud" returned?
> 
> This is all confidential and will remain so. 

The "Mahmoud" poster forged over 100 articles in 2 days, heavily
crossposted, forged to appear to come from Libya, and claiming that the
poster was a representative of Coalition Against Unsolicied Commercial Email
and further suggesting that CAUCE was virulently anti-semitic.  Among the
croups crossposted to were soc.culture.israel and soc.culture.jewish,
ostenably in an attempt to get the heads of CAUCE mailbombed-by-proxy and
the net.abuse groups flooded by proxy.  The post also used heavily forged
Paths.

This was severe enough that CAUCE has had to issue press statements on the
matter, and is still considering legal action.

I would dare say it *is* our business whether "Mahmoud" lost his Altopia
account or not--there is the chance he might do it again.

> > > If an abusive post is made using Altopia, then the abuse is coming from an
> > > Altopia user.  The IP address or home ISP they used is not relevant.. 
> > 
> > Even if it's known that the person has a history of repeatedly abusing
> > Usenet, and will very likely abuse Usenet again from another site after he
> > gets the Golden Boot from Altopia?
> 
> Correct.

Even if the person may actually have morph accounts at Altopia (multiple
accounts to jump to if they are removed from one)?

> > Even if the user's AUP has a stricter policy, prohibiting stuff like forging
> > moderator approval or Paths?
> 
> Correct.  A user makes their own decision whether to violate or abide by
> their provider's AUP.  It is not up to us to police that aspect of a
> user's communication with us.

Even if people are deliberately using your service to *violate* the AUP of
their own provider, because they fully intend to commit net.abuse and they
know Altopia will not stop certain types of behaviour generally considered
abuse of Usenet?

> > There *DOES* seem to be confusion on that.  Some of your users think you are
> > an anon posting service--even though Altopia is actually less secure than a
> > true anon-posting service.  Some of your users think you just provide a
> > news-feed.  (I've actually heard two different opinions on whether one
> > should add an NNTP-Posting-Host header from Altopia customers--depending
> > on whether one was using it as just "a better newsfeed" or as the 1997
> > equivalent to the belated anon.penet.fi.)
> 
> Please tell any customer of Altopia that is confused about this to either
> email support@alt.net or post their question to altnet.general.  In no way
> are we trying to confuse customers or potential customers of Altopia. 

Noted.

> Chris Caputo
> President, Altopia Corporation

- -wtf (nyar!)



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850

iQCVAwUBNG/nZD0Jz30h6bOhAQG20wP8C9YjAN2z57n3XbJunMYYC9WDQ4+H8vw0
9dS8O0hpVni/S026rcZZGGIFURxB0zoOGml4XeRJvtNpKfUvUXqSmfwrU2mwCpCR
JIByccAowgyqjUqhT/A52GP0wbEFCbAsd9ZmIQ7fccywaM4KXTGCplbzBG9fGacI
FTggni0Tkgc=
=dDy3
-----END PGP SIGNATURE-----