🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

Part 2 of the email logs.

- -- 
- -Windigo The Feral (NYAR!)
Fight the Woodside Literary Agency! Support the Jayne Hitchcock HELP fund 
<http://www.geocities.com/Hollywood/6172/helpjane.htm> * Boycott Internet 
Spam! <http://spam.abuse.net/spam> * Ban Spam Now! <http://www.cauce.org>

<logs follow>


- From afn23950@afn.org Sat Nov 15 22:16:59 1997
Date: Fri, 14 Nov 1997 15:22:48 -0500 (EST)
From: Follower of the Clawed Albino <afn23950@afn.org>
To: Chris Caputo <ccaputo@alt.net>
Subject: Re: Question for you

On Fri, 14 Nov 1997, Chris Caputo wrote:

> On Fri, 14 Nov 1997, Follower of the Clawed Albino wrote:
> > (Again, posted and emailed)
> 
> I am not sure where you are posting these, but please note that I consider
> it rude for you to have done so without my permission.  This lowers my
> opinion of your credibility.  If you continue to do it, please at least
> include something that says I asked you not to and that you are doing it
> explicitly without my permission.  I should have said something in my
> first reply. 

FWIW, I've not posted your emails.  Not yet, anyways.  If you don't wish me
to I'll certainly respect that.

> I am not worried about the things I say becoming public, but that does not
> give you the right to publicize them at your whim and out of context.  My
> hope is to understand your unique mentality in a private manner, so as to
> possibly come up with solutions to the problems you have brought up.
> 
> If you continue to post my response, please at least tell me where to look
> for follow-ups. 

As stated, I've not posted them *yet*--if and when I post them, they would
be on news.admin.net-abuse.usenet and altnet.general.  (This is because
there is an ongoing thread on the groups in question in regards to
Altopia's policies re notification and what it considers/does not consider
abuse of Usenet.)

FWIW, I'll respect your request for me not to post them.  I *do* reserve the
right to post summaries.  This is because this relates, in part, to the
general discussion at hand.

> > > The NNTP-Posting-Host: header is not added to posts from direct customers
> > > of Altopia because we see that as a violation of the customer's privacy.
> > > We are the customer's admins and so complaints about their activities
> > > should come only to us.
> > 
> > The customers of Altopia are not only *your* customers--to my knowledge,
> > Altopia provides NNTP service..
> > 
> > All of your NNTP customers get their *primary* access from another host.
> 
> Many of our customers come to us because they want a service where they
> don't have to worry about their primary provider becoming involved in
> their activities on Usenet.  Reasons for this vary.  Here are some
> examples:
> 
>   - A customer posting controversial speech from a company account does
>     not want to put their job at risk. 

If so, why not set up an actual anonymous NNTP server or relay service?
(Separate from Altopia as a whole)  Anonymity in this case would be
protected, fwiw.  This is very similar to what Mailmasher does, and similar
to what anon.penet.fi did.

(I *will* state more in detail below why it's rather a disservice to try to
run a semianonymous service with users that aren't anonymous at all.)

>   - A customer posting controversial speech from a country that does not
>     allow their thoughts to be uttered, does not want to put their life or
>     freedom at risk. 

Again, anonymous (*true* anonymous) posting services would serve this well.
(FWIW--most countries that would be that restrictive heavily filter packets
anyways, or the US filters packets FROM those countries (i.e. Iran).  It's
somewhat doubtful that they will be able to connect to Altopia in the first
place, or even have Internet access (as Internet access is heavily
restricted in many of these countries, such as Myanmar, where this would be
a concern).)

>   - A customer posting details about sexual abuse to alt.sexual.abuse or
>     another group may not want their hometown provider to be aware of
>     their experiences.  Who knows, maybe it was the provider themselves
>     that participated in the sexual abuse.

Again, a true anonymous or pseudonymous posting service where posts have an
address such as (90945498@anon.alt.net) or (nobody@alt.net) (the latter if
you use the c2.org model) is going to be *much* more effective at this.  (In
fact, two services already exist for this that offer complete accounts--
khijol.org and dhp.com.)  

It is really a disservice of sorts to claim you run an anonymous posting
service when you DO have users who are posting non-anonymously on the same
server.  I suspect most users of alt.net aren't using it as an anon-posting
service; for those who are, I honestly think it'd be better to set up a
dedicated server for this.

This way, the folks who *need* privacy--say, because they post to support
groups or whatnot--can use the anon-posting service (which would just look
like *everything* from it came from "nobody@anon.alt.net") and the rest of
your customers--who were not using the anon-posting service--could have the
regular server which added NNTP-Posting-Host to the server.

In fact, I'm willing to bet that if you *did* set up a dedicated anon server
it'd be considered a valuable resource to the Internet community. ;)

>   - A customer may not want their gender to be known on Usenet.

There are several ways one can hide one's gender on Usenet.  First off, one
can use a nym.  In the case of someone whose userid would show their gender,
one can get a Hotmail account and use it for the From: line (this is a
mailable address).

I should note, though, that one isn't going to generally find out one's
gender from the NNTP-Posting-Host header or an IP address in the Path:
(which is the main tagging I'm asking for).  I'm not asking that someone be
required to put their Real Life address in the headers.  I'm asking that
those who do not explicitly require anon posting capability have the IP in
the NNTP-Posting-Host, and (for those who *do* require anonymity) that a
separate, *dedicated* anon server be set up where all From: lines point to
"nobody@anon.alt.net" (or something similar) and the NNTP-Posting-Host can
either be absent or point to "anon.alt.net".

> We will not change our privacy policy in any way with respect to this, so
> I recommend you don't waste your time asking for a change.  The actions
> that we disagree on as to whether they are abuse, do not warrant us taking
> away our customer's privacy or raising our liability.  Any site that
> disagrees with our privacy policy is welcome to alias out "news.alt.net". 

And my points are teh following:

1) It's sort of a disservice to actual anon-posters to pass yourself off as
   an anon postig service when in fact you aren't.  (You have real users of
   Altopia posting with their actual email addresses, for one.)

2) The needs of anon posters would be better served with a dedicated anon
   server (as explained above).

3) The rest, since by your own admission you don't respond to most complaint
   mail, you need some sort of tagging on them to indicate where the posts
   are coming from (either in the Path: or the NNTP-Posting-Host).

Done this way, this isn't going to compromise anyone who needs an anon
service, nor is it going to compromise someone who wants to use
address-munging to keep from getting mailspam, nor will this compromise
folks who just want to use a nym or a Hotmail addy so they don't get fifteen
million lust-crazed guys mailing her Weird Things because she's female. 

> > Here's my suggestions on what to do:
> > 
> > 1) If you're running a purely anonymous posting service:
> > 
> >    Either have all posts with a From: line pointing to something like
> >    "nobody@alt.net" (c2.org used this successfully), or set up some sort
> >    of pseudonym-system like anon.penet.fi formerly did and dhp.com does now.
> >    (Basically, each user has pseudonymous login and password--you could well
> >    possibly do this via authinfo.)
> > 
> > 2) If you mean to keep it semianonymous:
> > 
> >    1) Add NNTP-Posting-Host: alt.net
> >    2) Require a mailable email address for posting.  (Possibly by
> >       "ack-back".
> > 
> > 3) If you still want to allow munged addresses, etc. and aren't willing to
> >    take the steps needed to set up a separate anon-posting service, you
> >    need to add some way to indicate the IP number or have a way to reply
> >    quickly--even if it's a ticket number for abuse--to requests to stop it
> >    or forward the abuse complaint to the home ISP of the offender.
> > 
> >    (There is a specific reason I insist on this a lot.  In the case of the
> >    three or four individuals from alt.net who were trying to flood AHWW with
> >    about two or three other people, the persons likely have done it before
> >    using a myriad of open NNTP servers [all the way to last year].  There 
> >    was also the strong possibility that one or more of the alt.net posters
> >    were in fact the SAME poster, using multiple From: lines.  Again, they
> >    HAVE done this in past, and the only way to determine the source is by
> >    checking IP numbers.
> > 
> >    (Another good case in point is another alt.net user who seems to be 
> >    trying to start the "Mahmoud" posts again, only this time he is using
> >    a munged "From" line meaning to falsely implicate alt.fan.karl-malden.
> >    nose.  He may be the same person as the "Mahmoud" poster, he may be the
> >    same as the "meowbot" or the other two or three posters from alt.net
> >    who were involved in the AHWW troubles, or it may be yet another copycat.
> >    One cannot determine this without checking IP numbers.)
> 
> Thank you for the suggestions.  I can't say we will implement them, but it
> is good to know what you would like to see.  Have you considered running a
> Usenet service?  You might be good at it. 

Actually, I have considered running a Usenet service at times (and I do help
out Airnews with suggestions at points).  I'm just giving suggestions as to
how to help is all.

I understand you do have legitimate concerns about privacy.  A lot of admins
have legitimate concerns about net.abuse.  Here's hoping we can find some
way to balance the two.  (Among other things, an anon-NNTP server--a
dedicated one that did posts as I noted in 1) above--would be a grand
starting point.  It'd be a needed public service and would also allow you to
tag those who used the main (non-anon) server.)

> > Most sites worried about privacy concerns will state one of the two
> > following:
> > 
> > 1) the account is not abusing the net, or
> > 2) the account is being dealt with according to the AUP.
> > 
> > Many persons are getting worrisome impressions regarding Altopia precisely
> > because you are *not* responding to persons who are complaining, often about
> > bona fide net.abuse.
> 
> We are aware that other sites react to abuse complaints in different ways. 
> This is one of the things that gives each site a unique character.  We put
> a FAQ up to address many of these issues and how we handle them.:
> 
>    http://www.altopia.com/polfaq.htm
> 
> Some of the answers in this FAQ explicitly state that we will ignore
> certain complaints. 

Understood on that and all.  My worry is that several people have complained
regarding stuff that IS against your AUP, and haven't found out anything.
Among other things, they don't find out people (like "mahmoud") have been
told to chill out or been removved till the abuse stops.

I still say some sort of autoresponder or ticketing mechanism would be nice,
if for naught else than to let folks know that their complaints might not be
being sent to /dev/null. ;)  (This would also make it easier for you if a
ticketing mechanism were imlemented, so you'd know if someone were doing
multiple incidents of net.abuse.)

> > >  1) Your definition of abuse was vastly different than ours and so it
> > >     appeared that it would have been futile for us to engage in a
> > >     discussion with you. 
> > 
> > 1) According to your own Acceptable Use Policy, interfering with a Usenet
> >    newsgroup (not merely trolling, but deliberately trying to interfere with
> >    it's workings) is unacceptable.  I sent you repeated evidence of this.
> 
> I'd love to know which specific part of our AUP you are referring to.  We
> disagreed with you that the posts were a denial-of-service or a flood and
> so no action was taken with respect to that.

Thing is, you never notified me of that.  (I could have proven, had you
asked, that these were part of a flood.  A small flood, but one that was
part of a fairly organised campaign and involved sites outside of Altopia as
well.  The alt.net posts alone numbered over 100 posts and took up 33% of
total posts on Airnews a week ago, and this was a few days after the flood
ended.

(Admittedly, the entire AHWW situation is sort of unusual.  I've had to
explain to admins before that this is not just the work of one but of
several people colloborating to make a group unusuable, and that multiple
servers are used as a rule in these attacks (as well as multiple morphed
"From" lines).  Because of the nature of te attacks, you almost have to take
all of it as a whole to get an idea how this is part of a denial of service
attack.  Other servers outside Altopia got abused this round--two open NNTP
servers by a uh.edu user, and two open NNTP servers by someone at Carnegie
Library in Pittsburgh who binary-bombed the groups as part of the flood.)

(The alt.net posts were 33% *alone* of posts on alt.horror.werewolves.  I
did have this confirmed by an Altopia customer (just in case Airnews' feed
was wonky), and this was but *part* of a flood involving multiple
perpetrators (working together) and multiple sites abused.  I could have
explained this had you asked.)

> We did take action with respect to the poster's use of harvard.edu and to
> our knowledge the poster complied with our request. 

Well...not exactly, he didn't.

1) First round, posts were forged to appear from "meowbot@harvard.edu",
   path and NNTP-Posting-Host were forged to implicate Harvard University 
   and one student in particular.  These were cancelled as forgeries by
   Chris Lewis (who informed me you had told him you'd take action if
   Harvard University complained).

2) Second round, munged From: line of "meowbot@bungmunch.edu", path and
   NNTP-Posting-Host still forged to implicate Harvard University.  
   Path also partially forged to falsely implicate Chris Lewis (!harvard.
   edu!clewis).

3) Third round, munged From: line of "meowbot@bungmunch.edu", NNTP-
   Posting-Host forged to nonexistent site (sentence ranting re me),
   Path: is still forged to implicate Harvard University and Chris
   Lewis.

I have not seen posts from the "meowbot" since Friday, November 7.

> > 2) According to your own AUP, much of the stuff such as path forgery was
> >    likely a violation.
> 
> The items that we felt were attempts at forgery were handled by us.  In
> terms of the Path: line it is difficult to discern whether a poster is
> pre-loading to prevent posts from arriving at a particular site, or
> whether they are forging to make posts look as if it came from a
> particular site.

Unless a site is under an active UDP and being aliased out, or someone is
cancelling spam and adds a pseudopath, ther is little legitimate reason for
anyone to be adding stuff to the Path: at all.  To be bluntly honest, I'd be
suspicious if a user was doing it.

In both the "mahmoud" posts and the "meowbot" posts, the paths were forged
to make tracing more difficult.  Both included both real and bogus sites
(the "meowbot" posts included meow.org, which is a real domain, in the Path:
as well).

Had you simply asked, I or others could have explained that the posts and
the Path-forging *were* meant to implicate Harvard.  (The perpetrators have
sent large revenge-spams on Usenet to implicate the person at slking@
harvard.edu in past as harassment aimed at him.  They've also made posts in
past forging the Path: to make it appear to come from him.  These have been
through open NNTP servers.  [Chris Lewis will be happy to confirm this; he's
been dealing with this problem for some time.])

> > 3) I'm going to be flat out and state that some of Altopia's policies--
> >    not all, mind, but several of them--seem to be at variance with 
> >    accepted standards of what is and is not abuse of Usenet.  Among
> >    these are, apparently, that forgery of Approved: headers for posts
> >    to moderated groups is accepted as tolerable at Altopia (this will
> >    get you yanked from nearly EVERY other provider, and will also get
> >    you *rapidly* banned from anon remailers) and that posting of binaries
> >    to non-binary newsgroups (again, this *is* considered a form of net.
> >    abuse) is also tolerated.  If you have problems with this, I suggest
> >    strongly that you take it up with the readers of news.admin.net-abuse.
> >    usenet--it's the admins of Usenet in general who decide what is and is
> >    not net.abuse, not myself.
> 
> In our opinion, there is no such thing as accepted standards on Usenet. 
> Each site decides what rules they want to have.  Each site also decides
> which sites they want to alias out because of policies they don't want to
> tolerate at the remote site.

Most sites generally do not accept stuff like forged moderator approval.
Sites that do tolerate this generally find they're shortly talking to the
ether bunnies, to to speak.

I, for one, wouldn't want your site to suffer this fate.  I'd hate to think
that alt.net users would be basically banned from posting to moderated lists
or Usenet as a whole because you don't deal with people who forge moderator
approval.  (And yes, that *can* happen.  Even dhp.com had to crack down on
Grubor doing it on news.admin.net-abuse.policy.) 

> This is one of the major things that separates Usenet II from Usenet.  As
> I am sure you know, Usenet II has the concepts of soundness and czars. 
> The way this is enforced is very effective. 

I'm fairly aware of how net.* works.  I can also assure you that as long as
your site thinks forging moderator approval is OK, alt.net won't be
considered sound.  (The same goes for mod.*, which will be starting soon)

> > >  2) When you started threatening legal action, we definitely were not
> > >     going to respond, because after that point we have to treat things as
> > >     if they will end up in court.  Correspondence at that point would have
> > >     been pre-trial discovery and that would not be appropriate without the
> > >     presence of our corporate attorney. 
> > 
> > I was noting that legal action was a definite possibility to inform you of
> > the seriousness of what your users were doing, Chris.  And it would not be
> > your lawyer getting involved with *me* if it'd gotten to that point--it
> > would be your lawyer discussing things with law enforcement.
> > 
> > I pointed out to you, repeatedly, that the posts were not only an attempted
> > denial of service attack, they were also meant as harassment *and* they
> > furthermore often contained heavily forged headers designed to implicate
> > innocent sites.  The parties involved in this *have* done this before, 
> > for what it's worth; this is a group of four or five individuals who have
> > been doing this for upwards of a *year*.  So far, your site is the
> > *solitary* one which has been uncooperative in stopping the abuse.
> > 
> > If you wish, I'll gladly provide logs and other info of some of their past
> > attempts, most of them through open NNTP servers.
> > 
> > I, frankly, was hoping that I wouldn't HAVE to have the cops subpoena logs
> > from your site.  My point in this was that this is a serious situation--
> > serious enough that I am considering calling in the cops if necessary to get
> > it stopped.  (There were other incidents, likely by the same parties, that
> > pushed me to that point.  The first was that my fiance, who has not posted
> > to Usenet in *months*, was listserv-bombed, possibly by the same person
> > posting under the "meowbot" aliases; the second was that threats were being
> > directed against a project I am in, and after the listserv-bombing of my
> > fiance I seriously considered disinvolving myself from the project so that
> > the rest of the members could avoid harassment.)
> 
> As our FAQ concerning harassment says, we encourage those who feel they
> are being harassed to contact the appropriate law enforcement agency.  We
> would prefer that you don't contact us concerning harassment because we
> have no way of determining whether harassment is taking place.  That is
> something for a court of law to determine and we do not want to raise our
> liability by becoming involved. 

*nods*
 
> We have cooperated with law enforcement in the past and will continue to
> do so in the future.  If the harassment against you is continuing from
> customers of Altopia, I encourage you to contact law enforcement.  I am
> surprised that we have not yet heard from Kentucky law enforcement since
> you said multiple times that you will be contacting them if we don't
> respond by the deadlines you presented.  Your credibility is questioned
> because you said you would contact them and we have not heard from them.

I have forwarded the info to the Kentucky Attorney-General, who will be
contacting me on the matter after seeing which agency would be involved (KY
State Police, Jefferson County Police, etc.)  The initial convo was to the
effect that it did sound like (at the least) harassing communications under
Kentucky law.

The FBI is investigating the complaint locally; part of the lag there is
that the Louisville office has (by the agent's own admission) only one
computer-literate person.  I've faxed the complaint and an explanation on
what is going on, along with examples, to the office, and the agent is
supposed to be forwarding this to the agent who deals with computer matters.

> > >  3) It is difficult to take seriously correspondence from someone with the
> > >     name "Follower of the Clawed Albino".  If this is your real name, I
> > >     apologize but please try to understand our position. 
> > 
> > 1) FWIW, other sites have *happily* accepted posts and email from this
> >    address and alias.  
> 
> That's irrelevant to us.  Our site chose not to.  The Internet is a big
> space and to expect all sites to react similarly is not reasonable. 

Not arguing with that.  Just stating I've not generally had problems with
net.abuse complaints using this nym.

> > 2) If you had any questions, you could have *easily* asked me and I would
> >    have provided names of folks who can vouch for me.  (For starters,
> >    Chris Lewis could have.)
> 
> We do not rely on people to vouch for other people.  Your credibility with
> us is based solely on your own actions.  Others may have experienced a
> completely different side of you that we were being presented with, and so
> nothing would be gained by us conversing with them.

My point is that, nym aside ;), I do have some experience in dealing with
net.abuse.  Chris Lewis could have vouched that the alt.net probs are part
of the latest of a long-standing net.abuse problem--he's dealt with the
"meowbot" in particular and the newsgroup attacks by the "meowbot" and hir
friends in general.

> Fortunately, this goes both ways.  We are often communicating with people
> that many others would say are horrible, but which in our own
> communication with them seem perfectly fine.
> 
> Do you really want to be judged by what others think of you?  This only
> works if you can choose who to judge you. 

As stated above, I'm not gunning for a popularity contest.  I was stating
that--*had you asked*--I could have pointed you to other sources that
alt.net *has* dealt with in past who can vouch that a) yes, there is a
net.abuse situation going on involving alt.net, b) despite my nym I really
do know what the hell I'm talking about here because he's dealt with it too.

> > 3) It should not *matter* what the nym or name of the person is who is
> >    reporting net.abuse from your site.  The important thing is that *a
> >    potential net.abuse situation is occuring*.
> 
>From the standpoint of handling the abuse, this is correct.
> 
>From the standpoint of replying and conversing with the person, this is up
> to us.  It takes time (I spent over an hour replying to this particular
> message) to engage in a conversation or debate with someone and so we have
> to choose who we engage in a wise manner.  Your email name and the other
> aspects of your mail made it unwise for us to engage you.  I stand by this
> decision. 

I understand you've a limited amount of time.  However, it is not only
downright rude but can exaberate a net.abuse situation if you refuse to
reply to someone because of their "tone" or their nym.

I *still* maintain that this could have been solved a lot easier, and with a
lot less fuss, if alt.net and some sort of ticketing mechanism or at the
least would write back as to whether or not something is being done.  An
AWFUL lot of why folks wonder if alt.net is rogue is because you haven't
replied to them--even UUnet will reply to complaints.

To put it another way--if you don't reply to folks to let them know wheter
or not something is being done just because they've a "funny nym" then you
will find you are going to be able to talk to a lot less sites.

Again, this isn't just me on this.  The only other complaint I have *ever*
had regarding my nym was from a site harbouring an email spammer, which in
itself was rogue.  And the people on the net.abuse groups rightly called it
as a "name flame".  Sometimes people who sound angry and use unusual nyms do
have valid complaints that should be answered...
 
> > 4) With the comment above, you have just indirectly shot any claims on
> >    why Altopia should not add IP-tagging, etc. out of the water.  If
> >    you distrust net.abuse complaints from me simply because of my nom
> >    de plume (which I use, in part, to prevent harassment from spammers
> >    when I make net.abuse complaints--I'm sure NANA* can enlighten you 
> >    on reasons why folks might want to do this) why should anyone trust
> >    ANYTHING from alt.net whatsoever?  At least I can be traced to a
> >    mailable address; I CANNOT say the same for the persons making the
> >    posts I have complained about.
> 
> I did not say we distrust complaints based on email name.  I said we did
> not reply for that reason, among others.

Then why do you have a policy of not responding to people because of their
nyms?

> Complaints, regardless of the source, make us aware of a potential
> problem.  We then research the potential problem and make an assessment
> based on our own policies as to whether it is a real problem.

And had you bothered to mail back, myself and several other people could
have explained to you that *yes*, it *is* a real problem.

I am getting the very real sense that an awful lot of the problem here is a
failure to communicate.  You really, really do need to start communicating
with folks who do make abuse complaints, if for naught else than to prevent
misunderstandings.

> > >  4) Once you started sending multiple messages per day, from our
> > >     perspective you appeared to be unstable and irrational.  The tone of
> > >     your phone calls reaffirmed this suspicion.  This may not be the
> > >     case, but it seemed likely to us that you would take our responses and
> > >     spread them around Usenet or in court, out of context. 
> > 
> > Well, the reason I was sending you multiple messages per day was that *three
> > or four of your users were deliberately trying to flood newsgroups and at
> > least one was deliberately forging paths to make it look as if it came from
> > elsewhere*.  After two weeks of *no* response whatsoever, my mails may have
> > sounded curt.  To be perfectly frank, I was beginning to consider seriously
> > the possibility that alt.net might be outright rogue.
> > 
> > My phone calls, FWIW, were made after my fiance was listserv-bombed, and I
> > think you can understand how I *might* be a bit concerned.  
> > 
> > Let me put it this way--*you* put up with an attempted newsgroup flood that
> > is part of a series of them, that you know from *their own posts* is
> > targeted at you, you complain to a site for two weeks to *please* give you
> > logs so you can find out where it is coming from (and hopefully colloborate
> > it with ten other logs you have, to see if they've moved to a new ISP), and
> > then someone who likely is one of the very perps using your site decides to
> > listserv-bomb my fiance for no reason whatsoever other than he *is* my
> > fiance, and a net.kook who joined in the campaign posted this in a FAQ using
> > his *old* email address, not the one he uses now and which has not appeared
> > on Usenet in *months*.  This tends to shake one up.  A *lot*.
> 
> Frankly, if this was happening to me I would have filtered out each
> instance of the user and ignored/deleted the instances I did see before I
> was able to filter them out. 

That was tried.  Thing is, the alt.net posts *alone* were thirty-three
percent of TOTAL group volume by the time the flood finally ended, and the
flood posts themselves (not counting the binary bombs and including posts
from sites outside alt.net) were over fifty percent.

The fact my fiance was listserv-bombed by persons who were likely some of
the same folks trying to flood AHWW indicates to me that they intend to
harass me off the net altogether.  This is not something that's going to be
solved by killfiles alone.

(I should also note that the perpetrators are known to morph addreses fairly
frequently, specifically to AVOID killfiles.  They also will add tags meant
to distinguish legitimate posts from flood posts.  This actually did happen
in the latest flood; legitimate posts were being tagged with [AHWW] in the
subject, and people were killfiling all posts without the tag.  The flooders
soon started adding the tag expressly to defeat the killfiling.)

> If you really consider our site to be rogue, I recommend you ask your
> provider to alias us out.  In your particular case, we have private
> peering with Airnews so I don't know if they would alias us out, but it is
> certainly worth a try if our posters are bothering you and you can't
> figure out how to use a filter.

As stated above, between the fact the users would morph addresses, would add
tags to defeat killfiles, and the frank net.abuse such as flooding and path
forgery, killfiling it would not have sufficed.  (The administrator of
meow.org, who has dealt with this for some time, could well edify you on why
this is the case, so could Chris Lewis.)

It was your *failure to respond to complaints at all* or indicate you would
or would not do anything is my main complaint.  (The main abuser from
alt.net, as I pointed out, was doing a lot of sillybuggers above and beyond
even mere attempts at group flooding.)  Had you written back, I could have
provided you a history on just what all was going on, how these people abuse
services, how they have stated their intent WAS to destroy alt.horror.
werewolves, etc.  They have done this several times before (though not on
Altopia).

Your site's failure to respond to folks re the Mahmoud stuff also made a
number of folks wonder whether you were rogue.  As I've stated before, you
need to communicate with folks.  We're not asking for handwritten letters--a
ticket number will suffice.  In some cases, you need to write back (for
instance, if you're getting multiple complaints about a user)--there may be
background that they've done this behaviour on other systems before, or that
it's part of a larger net.abuse situation, etc.
  
> > > We did follow-up on your complaints when we felt the complaint was
> > > justified.
> > 
> > I noticed that the flooding of AHWW from alt.net, as well as the initial
> > morph of "mahmoud", seems to have stopped.  I thank you for this.
> 
> No need to thank me.  It seems the posters have decided to stop. 

I'll be keeping a careful eye out in any case.  But at least it's stopped,
for now.  How long it'll stay stopped, I don't know.  (Should I note to you
in this regards that this is at least the sixth attempted flood of AHWW?
The first where Altopia was involved, admittedly, but this is part of a
repeated pattern of net.abuse.)

> > I *will* note that a new morph, who may or may not be the same as the
> > "Mahmoud" poster, seems to be trying to stir up the same stuff again.  He's
> > posting with a munged From: line pointing to afkmn.org:
> > 
> > <begin excerpt>
> > 
> > Path: news-f.iadfw.net!thereisnocabal!news.airnews.net!cabal10!newsfeed.
> > direct.ca!logbridge.uoregon.edu!su-news-hub1.bbnplanet.com!news.bbnplanet.
> > com!news.alt.net!usenet
> > From: cupcake@afkmn.org (Cupcake The Cat)
> > Newsgroups:
> > news.admin.net-abuse.email,news.admin.net-abuse.misc,alt.fan.karl-malden.
> > nose,news.admin.censorship,news.groups,alt.politics.democrat,soc.culture.jewish
> > Subject: Re: CAUCE members demand censorship
> > Date: Wed, 12 Nov 1997 04:31:34 GMT
> > Organization: TUNA !
> > Lines: 24
> > Message-ID: <34693019.6227877@news.alt.net>
> > References: <34662752.61E9@netcom.ca> <646em6$ihn$2@usenet48.supernews.com>
> > <34684fb2$1$fuzhry$mr2ice@news1.mnsinc.com>
> > <64a3dj$sld$2@usenet85.supernews.com> <64adm7$ag1@garcia.efn.org>
> > <64aqp1$kap$2@usenet76.supernews.com>
> > X-Newsreader: Forte Free Agent 1.1/32.230
> > Xref: news-f.iadfw.net news.admin.net-abuse.email:120707
> > news.admin.net-abuse.misc:192530 alt.fan.karl-malden.nose:128472
> > news.admin.censorship:49934 news.groups:329561 soc.culture.jewish:409343
> >  
> > On 11 Nov 1997 23:46:41 GMT, ricardo@primus.paranoia.com (Ricardo Hector
> > Gonzales) wrote:
> >  
> > >Gary Frazier (gfrazier@efn.org) wrote:
> > >: 
> > >: Shut up, Rickie.  No one gave you permission to speak.
> > >: -- 
> > >:                                                Gary
> > >: http://www.efn.org/~gfrazier
> > >: Fight Spam!  Join CAUCE!  http://www.cauce.org
> > >               ^^^^^^^^^^^
> > >
> > >Thanks for representing the censorship motivation of your organization.
> > >People have been saying for a long time that CAUCE is only interested
> > >in censoring individuals and your post is proof of that.
> >  
> > CAUCE has no use for JEW SPAMMERS like you, Ricardo.  If only
> > the Spanish were more efficient during the Inquisition so that your
> > ancestors did not escape to Mexico, the net would be a better place.
> >  
> > <end excerpt>
> > 
> > Now, this isn't to the point of bona fide net.abuse yet.  He's not flooding,
> > he's not doing sillybuggers with the Path.  I don't know what exactly you
> > did re the "Mahmoud" poster, but if he got booted he MIGHT have gotten back
> > on (I don't know, honestly, if you blacklist folks you boot).  I won't ask
> > you to nuke this one--yet.
> 
> The post above does not violate any of our policies.

Ok.  I was just not sure on your policies re people who got kicked off and
come back under another name or address.  (As stated, I'm not asking you to
yank this user for now, as he's not doing blatant net.abuse.)

> > I really *would* have liked to known where some of the AHWW floodposts were
> > coming from (that were through alt.net).  In particular, I'm still half
> > curious if some of 'em came through Springfield, MO POPs (during the last
> > major waves of this, the major culprit was someone using a Springfield, MO
> > POP of Smartnet) of ISPs, or if any came from Carnegie Library (someone's
> > been using open NNTP servers to binary-bomb the same groups being hit by the
> > "naughty noser" problems).  
> 
> If this stuff happens again and you want to know where it is coming from,
> either have law enforcement subpoena the information or have your attorney
> subpoena the information.  The United States system of government has
> checks and balances in it for a reason. 

*nods*  I will requst tht the law enforcement personnel do this, and that
you have agreed to cooperate in this regards.

> Also, feel free to email us the Message-IDs you want us to save away as
> potential evidence and we will do so if you explicitly ask this.  We may
> not reply to your request, but the archiving will likely be done. 

I'll send you the Message-ID's later tonight or tomorrow.

> > I'd be happy, though, even with a note that "this is being dealt with".
> > That and being able to know where abusers are coming from--even if you boot
> > them off, they will often move to another provider or to open NNTP servers
> > until the "home" account is cut off.  (This is another reason it's kind of
> > important to determine whom is posting from alt.net, if you're not intending
> > to go full whole hog with the anonymous posting service.)
> 
> If we tell you where users are coming from, not only do we violate their
> privacy, but we also put ourselves in a position of increased liability
> because users have an expectation that we will not share this information. 

And as I've stated, you're not purely an anon remailer or posting service.
(If alt.net had separate "anon NNTP" and non-anon NNTP servers--as noted
above in my examples on how this could be done--this is going to likely take
care of a lot of your legal liability.)  If Altopia was like anon.penet.fi
or replay.com's anon service, that'd be one thing.  But you're not--you're
selling an NNTP feed, which is not truly anonymous.  You have a number of
alt.net users who use their real names and email addresses, and don't use it
for anon posting at *all*--in fact, I'd probably state that the persons who
use alt.net because they need anon posting capabilities is smaller in number
than folks who use alt.net because (to put it bluntly) their newsfeed at
their home ISP sucks for some reason or another (no binaries, or they don't
want spam cancels, or their "home ISP" server is dropping articles because
of lag).  The people who need the anon posting would be better served by a
server for their use.

This is part of why I say that trying to run Altopia as a hybrid service
(which is what it really is now--a site that has an awful lot of users on it
who just want a better feed, and a number using it for anonymous posting
capabilities--a hybrid between a standard provider and an anon-posting
service) is really a disservice to both sets of users.  Your site is not
truly anonymous (among other things, yo do keep logs)--basically it's got
"anonymity through obscurity" at this point.  The few bad apples on your
server take advantage of this, and have the real potential for ruining it
for everyone (because we can't find out where the abuse is coming from).

's better to run *two* servers in this case--an anon and a non-anon one.
The non-anon one for folks who just need a newsfeed, and the anon one for
people who need anon posting.  You'll have less liability, you'll be better
able to deal with net.abuse (and you won't have quite as many problems with
communication, I suspect), and people will be glad you're providing a *true*
anon-posting service.  Just a suggestion, but I think it'd be helpful in
this case.

> Chris Caputo
> President, Altopia Corporation

- -wtf (nyar!)




-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850

iQCVAwUBNG/mdD0Jz30h6bOhAQE/sAP/bzFVF+DeTaccx/PfY/m6L/yElbAKQWG8
OsSVI89fVRWmupZfx15o/gbsdHmomtLOoygg45E5dBQFT6xjfxd+vLpG0aNoA7VH
RoQI2ngymcbqnTKtfGLlAk0a9xLizVuiMAWN5+hMdXvwukve1CZbdo7Gw8UDPzo/
OIS6XbFuDO4=
=RAh3
-----END PGP SIGNATURE-----