🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

Part 4 of the email logs.

- -- 
- -Windigo The Feral (NYAR!)
Fight the Woodside Literary Agency! Support the Jayne Hitchcock HELP fund 
<http://www.geocities.com/Hollywood/6172/helpjane.htm> * Boycott Internet 
Spam! <http://spam.abuse.net/spam> * Ban Spam Now! <http://www.cauce.org>

<logs follow>


- From afn23950@afn.org Sat Nov 15 22:17:36 1997
Date: Fri, 14 Nov 1997 23:35:35 -0500 (EST)
From: Follower of the Clawed Albino <afn23950@afn.org>
To: Chris Caputo <ccaputo@alt.net>
Subject: Re: Question for you

On Fri, 14 Nov 1997, Chris Caputo wrote:

> On Fri, 14 Nov 1997, Follower of the Clawed Albino wrote:
> > 
> > As stated, I've not posted them *yet*--if and when I post them, they would
> > be on news.admin.net-abuse.usenet and altnet.general.  (This is because
> > there is an ongoing thread on the groups in question in regards to
> > Altopia's policies re notification and what it considers/does not consider
> > abuse of Usenet.)
> > 
> > FWIW, I'll respect your request for me not to post them.  I *do* reserve the
> > right to post summaries.  This is because this relates, in part, to the
> > general discussion at hand.
> 
> If you are going to post summaries then I would prefer you post the
> messages themselves, in their entirety, since that will minimize
> misinterpretations or inaccurate summaries.  Thank you. 

*nods*  Understood on that.  (That was my original intent in any case.)
 
It's not come up yet (the need for even summaries) on NANA* yet, so no need
yet.  

(anonymous and pseudonymous posting)

> Note, I have not said that we run an anonymous server or not.  Whether or
> not what we run is an anonymous service, is not important to us.  You
> appear to be trying to fit our service into your existing framework, but
> whether it fits is not important to us. 
> 
> What we run is what we run.  Customers come to us knowing what they are
> going to get.  We have no plans to fragment our service into components,
> as you have suggested.
>
> We encourage others, like yourself, to set up servers and services that
> they think would be useful to the net community.

The problem is that there ARE users of your site who *do* think that you
provide true anonymous posting when, in fact, you do not.

There are also other persons on your site who use their real addresses and
don't see that much trouble with an NNTP-Posting-Host header.

You are pretty much right now running a hybrid service.  Essentially, you're
providing "anonymity through obscurity".  Thing is, it really doesn't meet
the needs of people who need TRUE anon access, and it doesn't meet the needs
of people in the net.abuse community who need to be able to track WHERE
abuse is coming from.  Splitting the service would preserve the ability to
post anonymously for those who need it as well as allow non-anonymous
posting.  

I'd gladly set up an anon server if I could.  (The main thing preventing me
is a) the lack of a fast net.connection and b) the lack of a stable IP.)  My
issue is that (in your arguments as to why an IP number shouldn't be
proposed) the needs for anonymity for these folks can be better served by a
dedicated anon-NNTP service.  (I explained to one of your users on
news.admin.net-abuse.usenet the differences between Altopia and "true" anon
posting services--he thought your site WAS an anon posting service.)

If it IS an anon posting service, we need to find some way we can deal with
the occasional "bad apples".  If Altopia isn't really meant as an anon
posting service, we need to find a way to manage the needs of those who ARE
using it as such, thinking it IS an anon posting service, whilst making it
easier to deal with the occasional bad apples who do bad things through your
system.
 
> > >   - A customer may not want their gender to be known on Usenet.
> > 
> > There are several ways one can hide one's gender on Usenet.  First off, one
> > can use a nym.  In the case of someone whose userid would show their gender,
> > one can get a Hotmail account and use it for the From: line (this is a
> > mailable address).
> > 
> > I should note, though, that one isn't going to generally find out one's
> > gender from the NNTP-Posting-Host header or an IP address in the Path:
> > (which is the main tagging I'm asking for).  I'm not asking that someone be
> > required to put their Real Life address in the headers.  I'm asking that
> > those who do not explicitly require anon posting capability have the IP in
> > the NNTP-Posting-Host, and (for those who *do* require anonymity) that a
> > separate, *dedicated* anon server be set up where all From: lines point to
> > "nobody@anon.alt.net" (or something similar) and the NNTP-Posting-Host can
> > either be absent or point to "anon.alt.net".
> 
> All your counter-arguments above are fine suggestions, but the fact is we
> already have a service that suits the needs of our customers, and we have
> no plans to change that "formula".  We leave the needs we are not
> fulfilling to others who want to contribute to the net.  End users will
> make their own decisions about what services to use. 

The thing is, your "solution" may have worked at one time.  It is *not*
working now in some cases--specifically, people who are taking advantage of
both the untracability of alt.net's posts and alt.net's unusually
permissive policies to commit net.abuse.  The fact that you have a policy 
of not responding to emails in most cases does not help matters much.
 
Even anon remailers have had to tighten up security a *lot* because bad
folks abused them by sending mailbombs and such through them.  This is
because of modern realities of net.abuse.

Not everyone is going to be nice, Chris.  The days of the utopian Usenet
are, regrettably, quite dead thanks to people like spammers and newsgroup
flooders and persons who do deliberate harass-spams.

> > And my points are teh following:
> > 
> > 1) It's sort of a disservice to actual anon-posters to pass yourself off as
> >    an anon postig service when in fact you aren't.  (You have real users of
> >    Altopia posting with their actual email addresses, for one.)
> 
> In no way are we passing ourselves off as an anonymous posting service. 
> People's perception may be that, but that does not mean we are or not. 

Well, then, you need to clarify this with a number of people--including a
number of your own users, who seem to think that you *are* an anonymous
posting service.
 
> > 2) The needs of anon posters would be better served with a dedicated anon
> >    server (as explained above).
> 
> Then someone should come online and fulfill those needs.  We have chosen
> not to do what you suggest would be useful. 

I'm trying to find a solution that is going to be friendly to both the net
*and* your concerns about privacy.  Believe it or not, I'd rather not have
all of Altopia become an intranet.

> > 3) The rest, since by your own admission you don't respond to most complaint
> >    mail, you need some sort of tagging on them to indicate where the posts
> >    are coming from (either in the Path: or the NNTP-Posting-Host).
> 
> There does not seem to be any trouble figuring out that posts are posted
> from Altopia.  However, based on the idea that there is, I have suggested
> we use "NNTP-Posting-Host: news.alt.net" to avoid confusion.  This is
> likely what we will do for Usenet II.

Part of it, too, is needing to know *where abusive posters are connecting to
Altopia from*--seeing as they may hit other sites, or open NNTP servers,
after being booted from Altopia.  (This was a concern, among other things,
in the "Mahmoud" postings.  The person responsible went straight away to
Supernews, which did show the NNTP-Posting-Host, and the person's home ISP
was contacted.)

> We have no trouble identifying which customers posted what, based on the
> Message-ID.  Since only the admins at Altopia need to be concerned with
> this information, nothing will be done to make it public.

And again, I am stating that--contrary to your claims--in cases of net.abuse
*your site is not the only one which may be concerned where the posts are
coming from*.  The user's home site, regulars of a newsgroup, the
newsgroup's moderator (if moderated), sites being the victims of forgery (if
a site is forged in the Path:, NNTP-Posting-Host, or From: line) are for
starters sites entirely outside of Altopia which may be concerned.

(This is one reason why, among other things, one needs to determine whether
or not Altopia is an anonymous site.  If so, you need to stiffen up
requirements in regards to blocking path forgeries, NNTP-Posting-Host
forgery, and/or forged From: lines; if not, you need to add some way we can
trace where it is coming from, or provide some way to notify someone as to
the IP address.  There *are* different expectations as to the level of
privacy, and conversely how aggressive a site will be in dealing with abuse
of its facilities, depending on whether or not a site is meant as an
anon-posting service.  One wouldn't expect anon.penet.fi to provide IP's,
but one would expect them to block the offending site and shut down that
account if someone was abusing it.)

> > Done this way, this isn't going to compromise anyone who needs an anon
> > service, nor is it going to compromise someone who wants to use
> > address-munging to keep from getting mailspam, nor will this compromise
> > folks who just want to use a nym or a Hotmail addy so they don't get fifteen
> > million lust-crazed guys mailing her Weird Things because she's female. 
> 
> If you feel your ideas will make for a good site, then you or someone you
> convince should bring up a site like that.

Mailmasher.com and nym.alias.net do, to some extent, for the anonymous half.
For the non-anon half, *every single other* public or semipublic NNTP
service (including Airnews, Zippo, DejaNews' web-to-news gateway, and
others) either add an NNTP-Posting-Host to the headers, or they require a
mailable address.  Zippo will also, in cases of abuse, forward IP numbers
upon request.  (The same people who were likely abusing your services abused
Zippo in past, and were traced to smartnet.net some months back with
Zippo's help. Smartnet.net is pretty much defunct now, however, and I
expect the abusers moved to another ISP.)

> > Understood on that and all.  My worry is that several people have complained
> > regarding stuff that IS against your AUP, and haven't found out anything.
> > Among other things, they don't find out people (like "mahmoud") have been
> > told to chill out or been removved till the abuse stops.
> 
> We have no obligation to inform anyone when we enforce our policies.  If
> people can't handle being in the dark about whether their complaints were
> handled, they shouldn't complain.

If you can't be bothered to let people know about an ongoing net.abuse
situation, especially considering there is no way to trace them to their
home ISP, maybe one shouldn't bother to run a pay Usenet site.  But I
digress.

You *do* have an obligation, as a Usenet site, to the users of Usenet as a
whole and your users and Usenet admins in particular to report, in a timely
fashion, what you are doing about net.abuse.  It is partly because UUnet
hasn't replied in timely fashion re abuse from its POPs (which it claims
others rent, yet UUnet keeps the logs) that UUnet is under threat of a
Usenet Death Penalty itself.
 
> > I still say some sort of autoresponder or ticketing mechanism would be nice,
> > if for naught else than to let folks know that their complaints might not be
> > being sent to /dev/null. ;)  (This would also make it easier for you if a
> > ticketing mechanism were imlemented, so you'd know if someone were doing
> > multiple incidents of net.abuse.)
> 
> Internally, we do track multiple incidents of abuse, but this is not and
> will not be made public.
> 
> We've thought about an auto-responder and may implement one at some point. 

I'd be happy if a tracking number was assigned to complaints.  You don't
even have to be specific as to WHAT action was taken (yanked, warned, etc.);
just a tracking number and, upon resolution, a mail stating either "yes,
this is net.abuse and we are taking action" or "this is not against our
AUP".
 
> > Thing is, you never notified me of that.  (I could have proven, had you
> > asked, that these were part of a flood.  A small flood, but one that was
> > part of a fairly organised campaign and involved sites outside of Altopia as
> > well.  The alt.net posts alone numbered over 100 posts and took up 33% of
> > total posts on Airnews a week ago, and this was a few days after the flood
> > ended.
> 
> Again, your definition of a flood is vastly different than our definition. 
> For starters, if someone is taking the time to write each and every
> message, which they were, then there is no way it is a flood regardless of
> what percentage of the group's posts they represent. 

Sir,

The posts were to a *one* crossposted threads from alt.fan.karl-malden.nose,
were very often REPOSTED threads from alt.fan.karl-malden.nose and
news.admin.net-abuse.usenet at that, were not in the *least* relevant to
alt.horror.werewolves or most of the rest of the groups they were posted to, 
and were meant--by the very admission of the group doing it--to flood the
regulars off alt.horror.werewolves and destroy any possibility of having
an on-topic conversation in the newsgroup at all.
 
Whilst it's not a flat out binary bombing, it *is* a flood and it *was*
meant as a denial of service attack.  Apparently I am not the only one who
agrees with this; there were a number of NANA* regulars who agreed that this
was meant as an attack.

I encourage you to please contact Chris Lewis or the meow.org admin,
fluffy@meow.org, for confirmation that the intent and effect WAS that of a
denial of service attack on alt.horror.werewolves.  (The latter actually
offered to run a mailinglist to temporarily replace alt.horror.werewolves
due to the volume of posting by the various persons involved in the flood.)

> We had no obligation to notify you that we disagreed with your definition. 
> Since your definition was so ludicrous, in our opinion, it seemed like a
> waste of time to explain why we disagree.  I stand by this decision today. 

Excuse me, but you *did* and *do* have an obligation to Usenet to notify me
that you intended to do naught about your users deliberately attempting to
flood alt.horror.werewolves and several other groups.  You at the *very
least* have an obligation to the users of alt.horror.werewolves who were
increasingly finding the newsgroup unusable due to the amount of posts by
the perpetrators--the single most voluminous one being a customer of alt.net
who was in addition forging headers like mad to implicate Harvard
University.

Saying repeatedly "it wasn't a flood" does *not* make it so.  Saying
"forging headers isn't net.abuse" does *not* make it so.

(stats deleted)

> > > We did take action with respect to the poster's use of harvard.edu and to
> > > our knowledge the poster complied with our request. 
> > 
> > Well...not exactly, he didn't.
> > 
> > 1) First round, posts were forged to appear from "meowbot@harvard.edu",
> >    path and NNTP-Posting-Host were forged to implicate Harvard University 
> >    and one student in particular.  These were cancelled as forgeries by
> >    Chris Lewis (who informed me you had told him you'd take action if
> >    Harvard University complained).
> 
> Regardless of what Chris Lewis knows or what we said (which I do not
> deny), we took action to stop this users use of harvard.edu in their From:
> address.

But they were still forging it in the rest of the headers; someone
inexperienced in header-tracing, who didn't know that alt.net doesn't add
NNTP-Posting-Host, could have easily thought the posts were coming from
Harvard.
 
> > 2) Second round, munged From: line of "meowbot@bungmunch.edu", path and
> >    NNTP-Posting-Host still forged to implicate Harvard University.  
> >    Path also partially forged to falsely implicate Chris Lewis (!harvard.
> >    edu!clewis).
> > 
> > 3) Third round, munged From: line of "meowbot@bungmunch.edu", NNTP-
> >    Posting-Host forged to nonexistent site (sentence ranting re me),
> >    Path: is still forged to implicate Harvard University and Chris
> >    Lewis.
> 
> It is debatable whether the things you have outlined above can be
> considered implication.  Even if they are, it is debatable whether we
> should intercede.  You may want to check out a recent ruling written about
> at: 
>     http://www.nytimes.com/library/cyber/week/111497suit.html

The intent was clearly to implicate the sites.  (You would have known this
had you bothered to ask--there is a fairly extensive history involving the
persons committing the abuse.  Stanley King has been targeted since 1995 by
the persons committing the net.abuse.  Harvard.edu has likewise been
implicated, not only as harassment towards Mr. King but also because the
abusers have targeted Harvard University nearly since the beginning of their
attempts at net.abuse.)  

> Path pre-loading can be used to make it so sites do not receive posts,
> therefore there is a legitimate use of Path pre-loading.  Further, the
> word "clewis" is not a unique identifier.

"Clewis" was added, likely, to inplicate Chris Lewis (who cancelled the
first round of "meowbot" posts as forgeries, under specific request by
Stanley King).  His address is, as I'm sure you know, clewis@ferret.ocunix.
on.ca.

Claiming that the person who did this forged both harvard.edu and meow.org
in the headers as a "legitimate use of Path pre-loading" is so ludicrous as
to be laughable.

> > Unless a site is under an active UDP and being aliased out, or someone is
> > cancelling spam and adds a pseudopath, ther is little legitimate reason for
> > anyone to be adding stuff to the Path: at all.  To be bluntly honest, I'd be
> > suspicious if a user was doing it.
> 
> It is your right to be suspicious or to not feel it is legitimate, but
> others disagree. 

Most sites will yank your account for path forgeries such as were done by
"Mahmoud" and the "meowbot".  UUnet had to add IP-identification to its own
servers to discourage such forgeries.
 
> > In both the "mahmoud" posts and the "meowbot" posts, the paths were forged
> > to make tracing more difficult.  Both included both real and bogus sites
> > (the "meowbot" posts included meow.org, which is a real domain, in the Path:
> > as well).
> 
> This is why I have asked if you would like to see "NNTP-Posting-Host: 
> news.alt.net" in all posts from Altopia's direct customers.  (Altopia's
> in-direct customers already have NNTP-Posting-Host: <ip-addr> in their
> posts and their Path: lines are sanitized and include their ISP's
> domain.) 

What I'd like to see is your direct customers also have their home sites
added to NNTP-Posting-Host, or (in lieu of this) forwarded upon request
when evidence of net.abuse is occuring.  Sanitising paths would also help.

(Zippo uses "news.newsdawg.com" for its NNTP-Posting-Host for direct
customers, but *will* provide NNTP-Posting-Host of the site upon request
should net.abuse be occuring from their site.)

> > Had you simply asked, I or others could have explained that the posts and
> > the Path-forging *were* meant to implicate Harvard.  (The perpetrators have
> > sent large revenge-spams on Usenet to implicate the person at slking@
> > harvard.edu in past as harassment aimed at him.  They've also made posts in
> > past forging the Path: to make it appear to come from him.  These have been
> > through open NNTP servers.  [Chris Lewis will be happy to confirm this; he's
> > been dealing with this problem for some time.])
> 
> I find it difficult to believe that you are able to provide beyond a
> reasonable doubt what the intent of our customer's actions are.  You are
> welcome to make assumptions, but we are welcome to ignore them since they
> are based on your opinions.  If a customer of our service is breaking the
> law or violating someone's rights, these matters should be taken up in a
> court of law.  To require us to do so would have a chilling effect on free
> speech. 

Let me state this again:

I'm not assuming this.  

*I literally have several megabytes of present and past abuse related to
this archived* that will bear me out on this.  Most of it is through open
NNTP servers (re the net.abuse, the fact the net.abuse is being done as
harassment, and the fact they have done it before).

Stopping someone from deliberately forging a valid site's hostname anywhere
in the headers and stopping users from deliberately trying to harass people
and destroy newsgroups is *not* restricting freedom of speech.  It is--to
whit--stopping vandalism.  Plain and simple.

The persons who were forging paths willy-nilly were NOT interested in valid
speech.  They were interested in destroying things, making groups unusable,
and getting innocent people mailbombed (CAUCE in the case of "mahmoud",
Stanley King and, later, Chris Lewis [and, in general, Harvard University]
with the "meowbot" posts).  

(And I do have a fair idea on what legally is and is not considered "free
speech".  I happen to work for a group that fights against censorship IRL.
I am one of the signatories to the CIEC lawsuit which caused the end of the
Communications Decency Act.)

> > Most sites generally do not accept stuff like forged moderator approval.
> > Sites that do tolerate this generally find they're shortly talking to the
> > ether bunnies, to to speak.
> 
> We have had this policy in effect for 2.5 years now.  Our customers that
> respect the idea of moderation have chosen to not take advantage of this
> freedom.  Our customers that have chosen to take advantage of this
> freedom, have done so because they believe they should. 

What you term "freedom", the vast majority of sites--including moderators
and the *vast* majority of backbomes--consider net.abuse at least.  Under
some state laws it could even be seen as unauthorised access to a computer
network, theoretically.  It *IS* something that will get your account nuked
in no small order on most sites on Usenet.
 
> There are technological ways that sites can avoid being affected by those
> users who want to take advantage of the simplicity of moderation on
> Usenet. 

YM "forge moderation".  Among those are, to whit, PGPMoose and removal of
net.access to those who persistently forge moderator approval.

> > I, for one, wouldn't want your site to suffer this fate.  I'd hate to think
> > that alt.net users would be basically banned from posting to moderated lists
> > or Usenet as a whole because you don't deal with people who forge moderator
> > approval.  (And yes, that *can* happen.  Even dhp.com had to crack down on
> > Grubor doing it on news.admin.net-abuse.policy.)
> 
> If our site becomes less usable to our customers than they will leave and
> find other sites that suit their needs.  What you seem to fail to
> understand is that many of our customers are with us _because_ of our
> policies.

And what you are failing to understand is that you have a few bad apples,
they have the potential to cause other sites to alias you out because you
have different opinions on net.abuse than most sites, and it can end up
hurting your legitimate users.

I've also pointed out that for your *legitimate* users there are many ways
to protect their privacy.  (Namely, setting up a dedicated anon server.)
The rest shouldn't have a problem with their posting-host showing up.  Those
who do, and don't want to use an anon server, I would frankly be suspicious
of--but I suspect those will be very, very few indeed.

> > I'm fairly aware of how net.* works.  I can also assure you that as long as
> > your site thinks forging moderator approval is OK, alt.net won't be
> > considered sound.  (The same goes for mod.*, which will be starting soon)
> 
> When and if our site participates in Usenet II, the rules of Usenet II
> will be applied to our user's activities within Usenet II.  In other
> words, if there is a Usenet II rule against Approved: headers without
> permission from the czar or moderator, then our site will enforce them. 

I'll tell you right now that moderator forgery would not only likely get you
permanently banned from net.*, but you'd be getting an AWFUL lot of angry
mail to all of your feeds.

> The Usenet II soundness concept is wonderfully elegant in this respect,
> but it doesn't apply to the existing Usenet.

Sites which are considered overly lax in Usenet are generally not considered
Usenet II-sound.  If a site tolerates practices which are generally
considered net-abuse in Usenet--even if it doesn't tolerate them in Usenet
II--they probably won't get feeds from anyone.

> > > We have cooperated with law enforcement in the past and will continue to
> > > do so in the future.  If the harassment against you is continuing from
> > > customers of Altopia, I encourage you to contact law enforcement.  I am
> > > surprised that we have not yet heard from Kentucky law enforcement since
> > > you said multiple times that you will be contacting them if we don't
> > > respond by the deadlines you presented.  Your credibility is questioned
> > > because you said you would contact them and we have not heard from them.
> > 
> > I have forwarded the info to the Kentucky Attorney-General, who will be
> > contacting me on the matter after seeing which agency would be involved (KY
> > State Police, Jefferson County Police, etc.)  The initial convo was to the
> > effect that it did sound like (at the least) harassing communications under
> > Kentucky law.
> > 
> > The FBI is investigating the complaint locally; part of the lag there is
> > that the Louisville office has (by the agent's own admission) only one
> > computer-literate person.  I've faxed the complaint and an explanation on
> > what is going on, along with examples, to the office, and the agent is
> > supposed to be forwarding this to the agent who deals with computer matters.
> 
> We look forward to cooperating with these and other law enforcement
> agencies. 

This is encouraging, at least.
 
> > My point is that, nym aside ;), I do have some experience in dealing with
> > net.abuse.  Chris Lewis could have vouched that the alt.net probs are part
> > of the latest of a long-standing net.abuse problem--he's dealt with the
> > "meowbot" in particular and the newsgroup attacks by the "meowbot" and hir
> > friends in general.
> 
> My point is that we have to look at each example of abuse on its own
> merits and that conspiracies are not something that factor into our
> decisions, because by nature they are based on conjecture. 

If this is conjecture, it's conjecture with a goodly amount of proof behind
it.  I myself have megabytes of proof; the admin of meow.org could explain
on this, as could Lewis.  This is because we've all dealt with this in past.
 
> Since you are not on our payroll, your experience or reputation is not
> relevant to our decisions about whether something is abuse.  To claim that
> it is, discredits yourself in our opinion. 

I state my experience to point out--just FWIW--that, believe it or not, I'm
not just blowing wind here.  I know what is and isn't net.abuse according to
the standards of most of Usenet.  I'm aware of the difference between simple
trolling and an actual attempt at denial of service.

The two individuals I mentioned will only confirm to you what I'm saying on
the matter of the "mahmoud" and "meowbot" postings being bona fide
net.abuse.

> > As stated above, I'm not gunning for a popularity contest.  I was stating
> > that--*had you asked*--I could have pointed you to other sources that
> > alt.net *has* dealt with in past who can vouch that a) yes, there is a
> > net.abuse situation going on involving alt.net, b) despite my nym I really
> > do know what the hell I'm talking about here because he's dealt with it too.
> 
> You do not seem to be understanding that we make the judgement call about
> whether something is abuse, not you or anyone you know that does not work
> for Altopia. 

I never said I disagreed--*for Altopia*.

I'm stating that Altopia's standards are at variance with the majority of
sites that run Usenet.  Including the sites of folks who buy Altopia feeds.

If a site is at variance for too long, that site finds it isn't gonna be
talking to too many people.  This isn't my edict--this is simple fact.
UUnet may soon find it can't talk to most of Usenet because it's not being
prompt at stopping abuse from its POPs or notifying folks where it is coming
from.  And they're damn near the biggest site on the net...
 
> > I understand you've a limited amount of time.  However, it is not only
> > downright rude but can exaberate a net.abuse situation if you refuse to
> > reply to someone because of their "tone" or their nym.
> > 
> > I *still* maintain that this could have been solved a lot easier, and with a
> > lot less fuss, if alt.net and some sort of ticketing mechanism or at the
> > least would write back as to whether or not something is being done.  An
> > AWFUL lot of why folks wonder if alt.net is rogue is because you haven't
> > replied to them--even UUnet will reply to complaints.
> > 
> > To put it another way--if you don't reply to folks to let them know wheter
> > or not something is being done just because they've a "funny nym" then you
> > will find you are going to be able to talk to a lot less sites.
> 
> This is your opinion and remains to be seen.

That we will.
 
> > > I did not say we distrust complaints based on email name.  I said we did
> > > not reply for that reason, among others.
> > 
> > Then why do you have a policy of not responding to people because of their
> > nyms?
> 
> I didn't say we have a policy of not responding to people because of their
> nyms.  I said that your nym, in addition to the other questionable aspects
> of your messages, resulted in us choosing to not respond. 

And my point remains--*it should not matter*.  *If someone is reporting that
there is an awful lot of abuse from your site this is usually a sign
something is wrong*.  

If I was somewhat curt in my later mails, I apologise.  The fact remains,
however, that a user at your site was indulging in behaviour that is
considered at the *VAST* majority of sites as being abusive.  One which has
likely indulged in abusive behaviour at several other sites, at that.
 
> > And had you bothered to mail back, myself and several other people could
> > have explained to you that *yes*, it *is* a real problem.
> 
> A thousand people could have emailed saying that and our decision on
> whether it was abuse would be the same.  We would disagree with all of
> those people, if their opinion was different that ours, after analysis. 

And had you announced that, you shortly would discover Altopia had become an
intranet.  Because nobody would accept packets from you, because they felt
you were an abusive site that tolerated net.abuse.

If you're still having troubles as to how the following are considered
abusive by most sites:

a) deliberate newsgroup flooding to the point regulars are abandoning the
   group and there is talk of a list to replace the group
b) forgery of headers
c) falsely implicating real sites in the forged headers
d) stating that you won't answer mail on these, won't let folks know you
   do or do not think are abusive, or for that matter won't give any
   indication mail isn't being routed to /dev/null

please explain which portions you are having trouble with.  I honestly do
want to help.
 
> > I am getting the very real sense that an awful lot of the problem here is a
> > failure to communicate.  You really, really do need to start communicating
> > with folks who do make abuse complaints, if for naught else than to prevent
> > misunderstandings.
> 
> Misunderstandings are not a concern of ours.  If a complainer gets upset
> because we do not respond, that is up to them.  There is no way we are
> going to begin responding to every complaint. 

Not even with a ticket number?  If America Online can respond to
complaints--and they are bigger than Altopia, last I checked--you can
set up a ticketing system.  If it's a matter of not having enough staff,
people will be glad to help...

> > > Frankly, if this was happening to me I would have filtered out each
> > > instance of the user and ignored/deleted the instances I did see before I
> > > was able to filter them out. 
> > 
> > That was tried.  Thing is, the alt.net posts *alone* were thirty-three
> > percent of TOTAL group volume by the time the flood finally ended, and the
> > flood posts themselves (not counting the binary bombs and including posts
> > from sites outside alt.net) were over fifty percent.
> 
> What does percentage have to do with filtering?  It should have been easy
> for you to filter out all postings with "news.alt.net" in the Path: line.

There were NoCeMs being issued at the last ("global killfile" NoCeMs) and
people were killfiling alt.net.  Not only alt.net, but several other sites
as well.  

This was made harder because they were forging path lines half the time,
and even forging tags designed for killfiling/selecting (tagging posts to
make them look like legitimate ones *expressly* to defeat killfiles).
 
> If more than 50 percent of the postings in a group are not what you
> believe to be on-topic, then maybe you should revise your definition of
> what the topic is.  The laughable thing is that this was an alt.* group
> and thus the idea of a topic that must be followed is bogus.  To get the
> kind of control you desire, you should petition for a Usenet II group or
> hierarchy and be the czar or moderator for it. 

You are still not understanding--or possibly avoiding--the point.

*These people who did this were attempting to destroy useful discourse on
alt.horror.werewolves.*

They were NOT interested in posting on-topic.  They were NOT interested in
anything less than destroying alt.horror.werewolves as a functional
newsgroup.

What the "meowbot" and the two other alt.net users were trying--along with
two or three persons outside of alt.net--was the Usenet equivalent of
mailbombing a newsgroup.  They have attempted this, from various sites, for
*months*.

The perpetrators have actually posted to Usenet on multiple occasions
*admitting that this was their solitary goal*.

I would *hope* you are not seriously attempting to defend what is nothing
less than an attempt to destroy a newsgroup for no reason other than
maliciousness.

> > The fact my fiance was listserv-bombed by persons who were likely some of
> > the same folks trying to flood AHWW indicates to me that they intend to
> > harass me off the net altogether.  This is not something that's going to be
> > solved by killfiles alone.
> 
> You seem to be doing a lot of the investigative work that a law
> enforcement agency should be doing.  It is unwise for you to be doing it,
> because you are the one supposedly being harassed.  You run the risk of a
> law enforcement agency not believing you or taking you seriously when you
> take the investigation into your own hands. 

It's awful funny--the Louisville FBI office seems to take it seriously
enough that they've asked me to forward a summary, and the Attorney-
General's office is having me file a complaint with them.

(I should note that the harassment started when I assisted someone else
whose newsgroup was suffering a very similar denial of service attack, only
even more severe [this included rmgroups and rogue cancellations of
legitimate articles, and several forged newgroup/rmgroup messages in the
"big 8" newsgroups].  The perpetrators have stated the attacks are meant as
revenge for my reports on net.abuse and on *their* net.abuse in particular.)

> > (I should also note that the perpetrators are known to morph addreses fairly
> > frequently, specifically to AVOID killfiles.  They also will add tags meant
> > to distinguish legitimate posts from flood posts.  This actually did happen
> > in the latest flood; legitimate posts were being tagged with [AHWW] in the
> > subject, and people were killfiling all posts without the tag.  The flooders
> > soon started adding the tag expressly to defeat the killfiling.)
> 
> All postings from Altopia contain "news.alt.net" in the Path: line.  It
> should be easy to filter based on this, in addition to your other filters. 

It would be much better if you would simply have stopped the abuse in the
first place.  (Among other things, there are a few legitimate users of
alt.net in news.admin.net-abuse.* whose posting I'd like to read on
occasion.)

You must also keep in mind that most newsreaders cannot filter out by Path:.
trn and (if my memory of the documentation serves) Souper do allow it, but
most other newsreaders do not--if the newsreaders have killfiling at all.

> > > If you really consider our site to be rogue, I recommend you ask your
> > > provider to alias us out.  In your particular case, we have private
> > > peering with Airnews so I don't know if they would alias us out, but it is
> > > certainly worth a try if our posters are bothering you and you can't
> > > figure out how to use a filter.
> > 
> > As stated above, between the fact the users would morph addresses, would add
> > tags to defeat killfiles, and the frank net.abuse such as flooding and path
> > forgery, killfiling it would not have sufficed.  (The administrator of
> > meow.org, who has dealt with this for some time, could well edify you on why
> > this is the case, so could Chris Lewis.)
> 
> Your provider aliasing out news.alt.net would mean that you don't even
> have to worry about filtering.

Were I to take that step, I'd be asking *most* sites to join me.

Are you seriously suggesting that, as a response to net.abuse from your
users, we should just all alias out Altopia en masse? :P

> > It was your *failure to respond to complaints at all* or indicate you would
> > or would not do anything is my main complaint.  (The main abuser from
> > alt.net, as I pointed out, was doing a lot of sillybuggers above and beyond
> > even mere attempts at group flooding.)  Had you written back, I could have
> > provided you a history on just what all was going on, how these people abuse
> > services, how they have stated their intent WAS to destroy alt.horror.
> > werewolves, etc.  They have done this several times before (though not on
> > Altopia).
> 
> In other words, you want us to violate the rights of Altopia customers so
> you can perform your own investigation and construct your own
> conspiracies?  This is not something we would even consider helping with. 

No, I'm asking you to *please* either cut the abusers off or provide me with
their IPs so that I can contact them and have the abusers cut off.  Or at
the VERY LEAST to acknowledge mail and/or phone calls.

I've been dealing with net.abuse from the dolts doing this for a *year*,
Chris.  Altopia is just the latest of a *long* string of sites they've
abused.  I don't need to do a heckuva lot of investigation to know what is
going on, and nor does anyone else who is familiar with the group doing the
net.abuse in the first place.

I'm not interested in playing PI.  What I *am* interested in is getting the
persistent net.abuse targeted at AHWW and several other groups, and
targeted at several folks--including myself--stopped in a semipermanent
fashion.  Now that the persons have carried over harassment to my family,
I'm also interested somewhat in making sure they are given a severe spanking
for it.  But my main concern is *getting the flooding and the harassment of
folks for reporting on them trying to destroy newsgroups stopped*.

> > Your site's failure to respond to folks re the Mahmoud stuff also made a
> > number of folks wonder whether you were rogue.  As I've stated before, you
> > need to communicate with folks.  We're not asking for handwritten letters--a
> > ticket number will suffice.  In some cases, you need to write back (for
> > instance, if you're getting multiple complaints about a user)--there may be
> > background that they've done this behaviour on other systems before, or that
> > it's part of a larger net.abuse situation, etc.
> 
> Our service is not based on responding to complaints and therefore it
> remains our choice whether to do so.  Just because some people are unhappy
> about this does not mean it will change.  Even a UDP will not force this
> to change. 

And as I've stated, as a member of the Usenet community you do have a bit of
a responsibility to let folks know what you are going to do re net.abuse
complaints.

> > > > I noticed that the flooding of AHWW from alt.net, as well as the initial
> > > > morph of "mahmoud", seems to have stopped.  I thank you for this.
> > > 
> > > No need to thank me.  It seems the posters have decided to stop. 
> > 
> > I'll be keeping a careful eye out in any case.  But at least it's stopped,
> > for now.  How long it'll stay stopped, I don't know.  (Should I note to you
> > in this regards that this is at least the sixth attempted flood of AHWW?
> > The first where Altopia was involved, admittedly, but this is part of a
> > repeated pattern of net.abuse.)
> 
> The repeated pattern of abuse that you perceive, does not matter to us. 
> Each instance that results in a complaint is researched individually.

Even if a clear pattern emerges that they ARE committing net.abuse.  (Chris,
I say this in kindness--I pray to Goddess you never get a serial spammer or
someone who is similarily abusive on your site.  Because the first thing
they're going to do is take advantage of your leniency there...they'll
stick to spams JUST under the cancellable limits because they know each
incident will be considered "individually".)
 
(re a possible resurgence of the "mahmoud" poster under another nick, but
not actionable as yet.)

> > Ok.  I was just not sure on your policies re people who got kicked off and
> > come back under another name or address.  (As stated, I'm not asking you to
> > yank this user for now, as he's not doing blatant net.abuse.)
> 
> Who said anything about anyone being kicked off?  Obviously, if we kicked
> someone off they would not be allowed back on. 

Then--pray tell--what have you done re the "mahmoud" poster?  HAS be been
removed?  Is this a copy-cat?  Would you even know if "mahmoud" returned?

> > > Also, feel free to email us the Message-IDs you want us to save away as
> > > potential evidence and we will do so if you explicitly ask this.  We may
> > > not reply to your request, but the archiving will likely be done. 
> > 
> > I'll send you the Message-ID's later tonight or tomorrow.
> 
> Sounds good.  Note that our logs only go back a few days, so the sooner
> the better. 

*noted*
 
> > > If we tell you where users are coming from, not only do we violate their
> > > privacy, but we also put ourselves in a position of increased liability
> > > because users have an expectation that we will not share this information. 
> > 
> > And as I've stated, you're not purely an anon remailer or posting service.
> > (If alt.net had separate "anon NNTP" and non-anon NNTP servers--as noted
> > above in my examples on how this could be done--this is going to likely take
> > care of a lot of your legal liability.)  If Altopia was like anon.penet.fi
> > or replay.com's anon service, that'd be one thing.  But you're not--you're
> > selling an NNTP feed, which is not truly anonymous.  You have a number of
> > alt.net users who use their real names and email addresses, and don't use it
> > for anon posting at *all*--in fact, I'd probably state that the persons who
> > use alt.net because they need anon posting capabilities is smaller in number
> > than folks who use alt.net because (to put it bluntly) their newsfeed at
> > their home ISP sucks for some reason or another (no binaries, or they don't
> > want spam cancels, or their "home ISP" server is dropping articles because
> > of lag).  The people who need the anon posting would be better served by a
> > server for their use.
> 
> It sounds like you believe there is a market for this service and so I
> encourage you to set it up.  We do not believe it is in our interest to
> set up a service such as this, at this time.  If you prove to the world or
> us that there is a market, then maybe we will choose to compete with you. 

As soon as I get a stable IP, I may take you up on the offer :)
 
(As far as the pseudonymous posting services go, dhp.com is making some
business, fwiw. ;)

I'm just saying it'd serve the needs of those who *do* need anon posting
better.  (I do realise you do have legitimate concerns with folks who use
Altopia as an anonymous posting service.  Thing is, Altopia isn't
anonymous.)

> > This is part of why I say that trying to run Altopia as a hybrid service
> > (which is what it really is now--a site that has an awful lot of users on it
> > who just want a better feed, and a number using it for anonymous posting
> > capabilities--a hybrid between a standard provider and an anon-posting
> > service) is really a disservice to both sets of users.  Your site is not
> > truly anonymous (among other things, yo do keep logs)--basically it's got
> > "anonymity through obscurity" at this point.  The few bad apples on your
> > server take advantage of this, and have the real potential for ruining it
> > for everyone (because we can't find out where the abuse is coming from).
> 
> If an abusive post is made using Altopia, then the abuse is coming from an
> Altopia user.  The IP address or home ISP they used is not relevant.. 

Even if it's known that the person has a history of repeatedly abusing
Usenet, and will very likely abuse Usenet again from another site after he
gets the Golden Boot from Altopia?

Even if the user's AUP has a stricter policy, prohibiting stuff like forging
moderator approval or Paths?

> > 's better to run *two* servers in this case--an anon and a non-anon one.
> > The non-anon one for folks who just need a newsfeed, and the anon one for
> > people who need anon posting.  You'll have less liability, you'll be better
> > able to deal with net.abuse (and you won't have quite as many problems with
> > communication, I suspect), and people will be glad you're providing a *true*
> > anon-posting service.  Just a suggestion, but I think it'd be helpful in
> > this case.
> 
> If users or you want to think of us as an anonymous posting service, then
> go for it.  If users or you want to think of us as a hybrid, then go for
> that too.  It doesn't matter to us.  Our service is what is presented on
> our web page.  We don't claim to be anything more or anything less. 

There *DOES* seem to be confusion on that.  Some of your users think you are
an anon posting service--even though Altopia is actually less secure than a
true anon-posting service.  Some of your users think you just provide a
news-feed.  (I've actually heard two different opinions on whether one
should add an NNTP-Posting-Host header from Altopia customers--depending
on whether one was using it as just "a better newsfeed" or as the 1997
equivalent to the belated anon.penet.fi.)

Just what side of the fence you are on *does* have implications as far as
net.abuse and dealing with it goes.  Hence my pointing out things.

> Chris Caputo
> President, Altopia Corporation

- -wtf (nyar!)



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850

iQCVAwUBNG/nFT0Jz30h6bOhAQHVRwP/aSJV2qRwAtaAPbC8U5rHyY/nHQmhsGvt
HkG2IDAKuqsp4DnNrmDdASyX76PoD9hhuHg6PSsAMOiw5iNmGk/++nk9/GQjw9d+
cdULTpOsTqOWVAJbZQIw2W/Fh+udu9I/carl7t0bzeqa4S4z5FHEwFXU0FXESSvv
vIGkEGTKHb0=
=mWKb
-----END PGP SIGNATURE-----