🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

Part 3 of the email logs.

- -- 
- -Windigo The Feral (NYAR!)
Fight the Woodside Literary Agency! Support the Jayne Hitchcock HELP fund 
<http://www.geocities.com/Hollywood/6172/helpjane.htm> * Boycott Internet 
Spam! <http://spam.abuse.net/spam> * Ban Spam Now! <http://www.cauce.org>

<logs follow>


- From ccaputo@alt.net Sat Nov 15 22:17:23 1997
Date: Fri, 14 Nov 1997 14:25:32 -0800 (PST)
From: Chris Caputo <ccaputo@alt.net>
To: Follower of the Clawed Albino <afn23950@afn.org>
Subject: Re: Question for you

On Fri, 14 Nov 1997, Follower of the Clawed Albino wrote:
> On Fri, 14 Nov 1997, Chris Caputo wrote:
> > On Fri, 14 Nov 1997, Follower of the Clawed Albino wrote:
> > > (Again, posted and emailed)
> > 
> > I am not sure where you are posting these, but please note that I consider
> > it rude for you to have done so without my permission.  This lowers my
> > opinion of your credibility.  If you continue to do it, please at least
> > include something that says I asked you not to and that you are doing it
> > explicitly without my permission.  I should have said something in my
> > first reply. 
> 
> FWIW, I've not posted your emails.  Not yet, anyways.  If you don't wish me
> to I'll certainly respect that.
> 
> > I am not worried about the things I say becoming public, but that does not
> > give you the right to publicize them at your whim and out of context.  My
> > hope is to understand your unique mentality in a private manner, so as to
> > possibly come up with solutions to the problems you have brought up.
> > 
> > If you continue to post my response, please at least tell me where to look
> > for follow-ups. 
> 
> As stated, I've not posted them *yet*--if and when I post them, they would
> be on news.admin.net-abuse.usenet and altnet.general.  (This is because
> there is an ongoing thread on the groups in question in regards to
> Altopia's policies re notification and what it considers/does not consider
> abuse of Usenet.)
> 
> FWIW, I'll respect your request for me not to post them.  I *do* reserve the
> right to post summaries.  This is because this relates, in part, to the
> general discussion at hand.

If you are going to post summaries then I would prefer you post the
messages themselves, in their entirety, since that will minimize
misinterpretations or inaccurate summaries.  Thank you. 

> > > > The NNTP-Posting-Host: header is not added to posts from direct customers
> > > > of Altopia because we see that as a violation of the customer's privacy.
> > > > We are the customer's admins and so complaints about their activities
> > > > should come only to us.
> > > 
> > > The customers of Altopia are not only *your* customers--to my knowledge,
> > > Altopia provides NNTP service..
> > > 
> > > All of your NNTP customers get their *primary* access from another host.
> > 
> > Many of our customers come to us because they want a service where they
> > don't have to worry about their primary provider becoming involved in
> > their activities on Usenet.  Reasons for this vary.  Here are some
> > examples:
> > 
> >   - A customer posting controversial speech from a company account does
> >     not want to put their job at risk. 
> 
> If so, why not set up an actual anonymous NNTP server or relay service?
> (Separate from Altopia as a whole)  Anonymity in this case would be
> protected, fwiw.  This is very similar to what Mailmasher does, and similar
> to what anon.penet.fi did.
> 
> (I *will* state more in detail below why it's rather a disservice to try to
> run a semianonymous service with users that aren't anonymous at all.)
> 
> >   - A customer posting controversial speech from a country that does not
> >     allow their thoughts to be uttered, does not want to put their life or
> >     freedom at risk. 
> 
> Again, anonymous (*true* anonymous) posting services would serve this well.
> (FWIW--most countries that would be that restrictive heavily filter packets
> anyways, or the US filters packets FROM those countries (i.e. Iran).  It's
> somewhat doubtful that they will be able to connect to Altopia in the first
> place, or even have Internet access (as Internet access is heavily
> restricted in many of these countries, such as Myanmar, where this would be
> a concern).)
> 
> >   - A customer posting details about sexual abuse to alt.sexual.abuse or
> >     another group may not want their hometown provider to be aware of
> >     their experiences.  Who knows, maybe it was the provider themselves
> >     that participated in the sexual abuse.
> 
> Again, a true anonymous or pseudonymous posting service where posts have an
> address such as (90945498@anon.alt.net) or (nobody@alt.net) (the latter if
> you use the c2.org model) is going to be *much* more effective at this.  (In
> fact, two services already exist for this that offer complete accounts--
> khijol.org and dhp.com.)  
> 
> It is really a disservice of sorts to claim you run an anonymous posting
> service when you DO have users who are posting non-anonymously on the same
> server.  I suspect most users of alt.net aren't using it as an anon-posting
> service; for those who are, I honestly think it'd be better to set up a
> dedicated server for this.
> 
> This way, the folks who *need* privacy--say, because they post to support
> groups or whatnot--can use the anon-posting service (which would just look
> like *everything* from it came from "nobody@anon.alt.net") and the rest of
> your customers--who were not using the anon-posting service--could have the
> regular server which added NNTP-Posting-Host to the server.
> 
> In fact, I'm willing to bet that if you *did* set up a dedicated anon server
> it'd be considered a valuable resource to the Internet community. ;)

Note, I have not said that we run an anonymous server or not.  Whether or
not what we run is an anonymous service, is not important to us.  You
appear to be trying to fit our service into your existing framework, but
whether it fits is not important to us. 

What we run is what we run.  Customers come to us knowing what they are
going to get.  We have no plans to fragment our service into components,
as you have suggested.

We encourage others, like yourself, to set up servers and services that
they think would be useful to the net community.

> >   - A customer may not want their gender to be known on Usenet.
> 
> There are several ways one can hide one's gender on Usenet.  First off, one
> can use a nym.  In the case of someone whose userid would show their gender,
> one can get a Hotmail account and use it for the From: line (this is a
> mailable address).
> 
> I should note, though, that one isn't going to generally find out one's
> gender from the NNTP-Posting-Host header or an IP address in the Path:
> (which is the main tagging I'm asking for).  I'm not asking that someone be
> required to put their Real Life address in the headers.  I'm asking that
> those who do not explicitly require anon posting capability have the IP in
> the NNTP-Posting-Host, and (for those who *do* require anonymity) that a
> separate, *dedicated* anon server be set up where all From: lines point to
> "nobody@anon.alt.net" (or something similar) and the NNTP-Posting-Host can
> either be absent or point to "anon.alt.net".

All your counter-arguments above are fine suggestions, but the fact is we
already have a service that suits the needs of our customers, and we have
no plans to change that "formula".  We leave the needs we are not
fulfilling to others who want to contribute to the net.  End users will
make their own decisions about what services to use. 

> > We will not change our privacy policy in any way with respect to this, so
> > I recommend you don't waste your time asking for a change.  The actions
> > that we disagree on as to whether they are abuse, do not warrant us taking
> > away our customer's privacy or raising our liability.  Any site that
> > disagrees with our privacy policy is welcome to alias out "news.alt.net". 
> 
> And my points are teh following:
> 
> 1) It's sort of a disservice to actual anon-posters to pass yourself off as
>    an anon postig service when in fact you aren't.  (You have real users of
>    Altopia posting with their actual email addresses, for one.)

In no way are we passing ourselves off as an anonymous posting service. 
People's perception may be that, but that does not mean we are or not. 

> 2) The needs of anon posters would be better served with a dedicated anon
>    server (as explained above).

Then someone should come online and fulfill those needs.  We have chosen
not to do what you suggest would be useful. 

> 3) The rest, since by your own admission you don't respond to most complaint
>    mail, you need some sort of tagging on them to indicate where the posts
>    are coming from (either in the Path: or the NNTP-Posting-Host).

There does not seem to be any trouble figuring out that posts are posted
from Altopia.  However, based on the idea that there is, I have suggested
we use "NNTP-Posting-Host: news.alt.net" to avoid confusion.  This is
likely what we will do for Usenet II.

We have no trouble identifying which customers posted what, based on the
Message-ID.  Since only the admins at Altopia need to be concerned with
this information, nothing will be done to make it public.

> Done this way, this isn't going to compromise anyone who needs an anon
> service, nor is it going to compromise someone who wants to use
> address-munging to keep from getting mailspam, nor will this compromise
> folks who just want to use a nym or a Hotmail addy so they don't get fifteen
> million lust-crazed guys mailing her Weird Things because she's female. 

If you feel your ideas will make for a good site, then you or someone you
convince should bring up a site like that.

> > > Here's my suggestions on what to do:
> > > 
> > > 1) If you're running a purely anonymous posting service:
> > > 
> > >    Either have all posts with a From: line pointing to something like
> > >    "nobody@alt.net" (c2.org used this successfully), or set up some sort
> > >    of pseudonym-system like anon.penet.fi formerly did and dhp.com does now.
> > >    (Basically, each user has pseudonymous login and password--you could well
> > >    possibly do this via authinfo.)
> > > 
> > > 2) If you mean to keep it semianonymous:
> > > 
> > >    1) Add NNTP-Posting-Host: alt.net
> > >    2) Require a mailable email address for posting.  (Possibly by
> > >       "ack-back".
> > > 
> > > 3) If you still want to allow munged addresses, etc. and aren't willing to
> > >    take the steps needed to set up a separate anon-posting service, you
> > >    need to add some way to indicate the IP number or have a way to reply
> > >    quickly--even if it's a ticket number for abuse--to requests to stop it
> > >    or forward the abuse complaint to the home ISP of the offender.
> > > 
> > >    (There is a specific reason I insist on this a lot.  In the case of the
> > >    three or four individuals from alt.net who were trying to flood AHWW with
> > >    about two or three other people, the persons likely have done it before
> > >    using a myriad of open NNTP servers [all the way to last year].  There 
> > >    was also the strong possibility that one or more of the alt.net posters
> > >    were in fact the SAME poster, using multiple From: lines.  Again, they
> > >    HAVE done this in past, and the only way to determine the source is by
> > >    checking IP numbers.
> > > 
> > >    (Another good case in point is another alt.net user who seems to be 
> > >    trying to start the "Mahmoud" posts again, only this time he is using
> > >    a munged "From" line meaning to falsely implicate alt.fan.karl-malden.
> > >    nose.  He may be the same person as the "Mahmoud" poster, he may be the
> > >    same as the "meowbot" or the other two or three posters from alt.net
> > >    who were involved in the AHWW troubles, or it may be yet another copycat.
> > >    One cannot determine this without checking IP numbers.)
> > 
> > Thank you for the suggestions.  I can't say we will implement them, but it
> > is good to know what you would like to see.  Have you considered running a
> > Usenet service?  You might be good at it. 
> 
> Actually, I have considered running a Usenet service at times (and I do help
> out Airnews with suggestions at points).  I'm just giving suggestions as to
> how to help is all.
> 
> I understand you do have legitimate concerns about privacy.  A lot of admins
> have legitimate concerns about net.abuse.  Here's hoping we can find some
> way to balance the two.  (Among other things, an anon-NNTP server--a
> dedicated one that did posts as I noted in 1) above--would be a grand
> starting point.  It'd be a needed public service and would also allow you to
> tag those who used the main (non-anon) server.)
> 
> > > Most sites worried about privacy concerns will state one of the two
> > > following:
> > > 
> > > 1) the account is not abusing the net, or
> > > 2) the account is being dealt with according to the AUP.
> > > 
> > > Many persons are getting worrisome impressions regarding Altopia precisely
> > > because you are *not* responding to persons who are complaining, often about
> > > bona fide net.abuse.
> > 
> > We are aware that other sites react to abuse complaints in different ways. 
> > This is one of the things that gives each site a unique character.  We put
> > a FAQ up to address many of these issues and how we handle them.:
> > 
> >    http://www.altopia.com/polfaq.htm
> > 
> > Some of the answers in this FAQ explicitly state that we will ignore
> > certain complaints. 
> 
> Understood on that and all.  My worry is that several people have complained
> regarding stuff that IS against your AUP, and haven't found out anything.
> Among other things, they don't find out people (like "mahmoud") have been
> told to chill out or been removved till the abuse stops.

We have no obligation to inform anyone when we enforce our policies.  If
people can't handle being in the dark about whether their complaints were
handled, they shouldn't complain.

> I still say some sort of autoresponder or ticketing mechanism would be nice,
> if for naught else than to let folks know that their complaints might not be
> being sent to /dev/null. ;)  (This would also make it easier for you if a
> ticketing mechanism were imlemented, so you'd know if someone were doing
> multiple incidents of net.abuse.)

Internally, we do track multiple incidents of abuse, but this is not and
will not be made public.

We've thought about an auto-responder and may implement one at some point. 

> > > >  1) Your definition of abuse was vastly different than ours and so it
> > > >     appeared that it would have been futile for us to engage in a
> > > >     discussion with you. 
> > > 
> > > 1) According to your own Acceptable Use Policy, interfering with a Usenet
> > >    newsgroup (not merely trolling, but deliberately trying to interfere with
> > >    it's workings) is unacceptable.  I sent you repeated evidence of this.
> > 
> > I'd love to know which specific part of our AUP you are referring to.  We
> > disagreed with you that the posts were a denial-of-service or a flood and
> > so no action was taken with respect to that.
> 
> Thing is, you never notified me of that.  (I could have proven, had you
> asked, that these were part of a flood.  A small flood, but one that was
> part of a fairly organised campaign and involved sites outside of Altopia as
> well.  The alt.net posts alone numbered over 100 posts and took up 33% of
> total posts on Airnews a week ago, and this was a few days after the flood
> ended.

Again, your definition of a flood is vastly different than our definition. 
For starters, if someone is taking the time to write each and every
message, which they were, then there is no way it is a flood regardless of
what percentage of the group's posts they represent. 

We had no obligation to notify you that we disagreed with your definition. 
Since your definition was so ludicrous, in our opinion, it seemed like a
waste of time to explain why we disagree.  I stand by this decision today. 

> (Admittedly, the entire AHWW situation is sort of unusual.  I've had to
> explain to admins before that this is not just the work of one but of
> several people colloborating to make a group unusuable, and that multiple
> servers are used as a rule in these attacks (as well as multiple morphed
> "From" lines).  Because of the nature of te attacks, you almost have to take
> all of it as a whole to get an idea how this is part of a denial of service
> attack.  Other servers outside Altopia got abused this round--two open NNTP
> servers by a uh.edu user, and two open NNTP servers by someone at Carnegie
> Library in Pittsburgh who binary-bombed the groups as part of the flood.)
> 
> (The alt.net posts were 33% *alone* of posts on alt.horror.werewolves.  I
> did have this confirmed by an Altopia customer (just in case Airnews' feed
> was wonky), and this was but *part* of a flood involving multiple
> perpetrators (working together) and multiple sites abused.  I could have
> explained this had you asked.)
> 
> > We did take action with respect to the poster's use of harvard.edu and to
> > our knowledge the poster complied with our request. 
> 
> Well...not exactly, he didn't.
> 
> 1) First round, posts were forged to appear from "meowbot@harvard.edu",
>    path and NNTP-Posting-Host were forged to implicate Harvard University 
>    and one student in particular.  These were cancelled as forgeries by
>    Chris Lewis (who informed me you had told him you'd take action if
>    Harvard University complained).

Regardless of what Chris Lewis knows or what we said (which I do not
deny), we took action to stop this users use of harvard.edu in their From:
address.

> 2) Second round, munged From: line of "meowbot@bungmunch.edu", path and
>    NNTP-Posting-Host still forged to implicate Harvard University.  
>    Path also partially forged to falsely implicate Chris Lewis (!harvard.
>    edu!clewis).
> 
> 3) Third round, munged From: line of "meowbot@bungmunch.edu", NNTP-
>    Posting-Host forged to nonexistent site (sentence ranting re me),
>    Path: is still forged to implicate Harvard University and Chris
>    Lewis.

It is debatable whether the things you have outlined above can be
considered implication.  Even if they are, it is debatable whether we
should intercede.  You may want to check out a recent ruling written about
at: 
    http://www.nytimes.com/library/cyber/week/111497suit.html

Path pre-loading can be used to make it so sites do not receive posts,
therefore there is a legitimate use of Path pre-loading.  Further, the
word "clewis" is not a unique identifier.

> I have not seen posts from the "meowbot" since Friday, November 7. 
> 
> > > 2) According to your own AUP, much of the stuff such as path forgery was
> > >    likely a violation.
> > 
> > The items that we felt were attempts at forgery were handled by us.  In
> > terms of the Path: line it is difficult to discern whether a poster is
> > pre-loading to prevent posts from arriving at a particular site, or
> > whether they are forging to make posts look as if it came from a
> > particular site.
> 
> Unless a site is under an active UDP and being aliased out, or someone is
> cancelling spam and adds a pseudopath, ther is little legitimate reason for
> anyone to be adding stuff to the Path: at all.  To be bluntly honest, I'd be
> suspicious if a user was doing it.

It is your right to be suspicious or to not feel it is legitimate, but
others disagree. 

> In both the "mahmoud" posts and the "meowbot" posts, the paths were forged
> to make tracing more difficult.  Both included both real and bogus sites
> (the "meowbot" posts included meow.org, which is a real domain, in the Path:
> as well).

This is why I have asked if you would like to see "NNTP-Posting-Host: 
news.alt.net" in all posts from Altopia's direct customers.  (Altopia's
in-direct customers already have NNTP-Posting-Host: <ip-addr> in their
posts and their Path: lines are sanitized and include their ISP's
domain.) 

> Had you simply asked, I or others could have explained that the posts and
> the Path-forging *were* meant to implicate Harvard.  (The perpetrators have
> sent large revenge-spams on Usenet to implicate the person at slking@
> harvard.edu in past as harassment aimed at him.  They've also made posts in
> past forging the Path: to make it appear to come from him.  These have been
> through open NNTP servers.  [Chris Lewis will be happy to confirm this; he's
> been dealing with this problem for some time.])

I find it difficult to believe that you are able to provide beyond a
reasonable doubt what the intent of our customer's actions are.  You are
welcome to make assumptions, but we are welcome to ignore them since they
are based on your opinions.  If a customer of our service is breaking the
law or violating someone's rights, these matters should be taken up in a
court of law.  To require us to do so would have a chilling effect on free
speech. 

> > > 3) I'm going to be flat out and state that some of Altopia's policies--
> > >    not all, mind, but several of them--seem to be at variance with 
> > >    accepted standards of what is and is not abuse of Usenet.  Among
> > >    these are, apparently, that forgery of Approved: headers for posts
> > >    to moderated groups is accepted as tolerable at Altopia (this will
> > >    get you yanked from nearly EVERY other provider, and will also get
> > >    you *rapidly* banned from anon remailers) and that posting of binaries
> > >    to non-binary newsgroups (again, this *is* considered a form of net.
> > >    abuse) is also tolerated.  If you have problems with this, I suggest
> > >    strongly that you take it up with the readers of news.admin.net-abuse.
> > >    usenet--it's the admins of Usenet in general who decide what is and is
> > >    not net.abuse, not myself.
> > 
> > In our opinion, there is no such thing as accepted standards on Usenet. 
> > Each site decides what rules they want to have.  Each site also decides
> > which sites they want to alias out because of policies they don't want to
> > tolerate at the remote site.
> 
> Most sites generally do not accept stuff like forged moderator approval.
> Sites that do tolerate this generally find they're shortly talking to the
> ether bunnies, to to speak.

We have had this policy in effect for 2.5 years now.  Our customers that
respect the idea of moderation have chosen to not take advantage of this
freedom.  Our customers that have chosen to take advantage of this
freedom, have done so because they believe they should. 

There are technological ways that sites can avoid being affected by those
users who want to take advantage of the simplicity of moderation on
Usenet. 

> I, for one, wouldn't want your site to suffer this fate.  I'd hate to think
> that alt.net users would be basically banned from posting to moderated lists
> or Usenet as a whole because you don't deal with people who forge moderator
> approval.  (And yes, that *can* happen.  Even dhp.com had to crack down on
> Grubor doing it on news.admin.net-abuse.policy.)

If our site becomes less usable to our customers than they will leave and
find other sites that suit their needs.  What you seem to fail to
understand is that many of our customers are with us _because_ of our
policies.

> > This is one of the major things that separates Usenet II from Usenet.  As
> > I am sure you know, Usenet II has the concepts of soundness and czars. 
> > The way this is enforced is very effective. 
> 
> I'm fairly aware of how net.* works.  I can also assure you that as long as
> your site thinks forging moderator approval is OK, alt.net won't be
> considered sound.  (The same goes for mod.*, which will be starting soon)

When and if our site participates in Usenet II, the rules of Usenet II
will be applied to our user's activities within Usenet II.  In other
words, if there is a Usenet II rule against Approved: headers without
permission from the czar or moderator, then our site will enforce them. 
The Usenet II soundness concept is wonderfully elegant in this respect,
but it doesn't apply to the existing Usenet.

> > > >  2) When you started threatening legal action, we definitely were not
> > > >     going to respond, because after that point we have to treat things as
> > > >     if they will end up in court.  Correspondence at that point would have
> > > >     been pre-trial discovery and that would not be appropriate without the
> > > >     presence of our corporate attorney. 
> > > 
> > > I was noting that legal action was a definite possibility to inform you of
> > > the seriousness of what your users were doing, Chris.  And it would not be
> > > your lawyer getting involved with *me* if it'd gotten to that point--it
> > > would be your lawyer discussing things with law enforcement.
> > > 
> > > I pointed out to you, repeatedly, that the posts were not only an attempted
> > > denial of service attack, they were also meant as harassment *and* they
> > > furthermore often contained heavily forged headers designed to implicate
> > > innocent sites.  The parties involved in this *have* done this before, 
> > > for what it's worth; this is a group of four or five individuals who have
> > > been doing this for upwards of a *year*.  So far, your site is the
> > > *solitary* one which has been uncooperative in stopping the abuse.
> > > 
> > > If you wish, I'll gladly provide logs and other info of some of their past
> > > attempts, most of them through open NNTP servers.
> > > 
> > > I, frankly, was hoping that I wouldn't HAVE to have the cops subpoena logs
> > > from your site.  My point in this was that this is a serious situation--
> > > serious enough that I am considering calling in the cops if necessary to get
> > > it stopped.  (There were other incidents, likely by the same parties, that
> > > pushed me to that point.  The first was that my fiance, who has not posted
> > > to Usenet in *months*, was listserv-bombed, possibly by the same person
> > > posting under the "meowbot" aliases; the second was that threats were being
> > > directed against a project I am in, and after the listserv-bombing of my
> > > fiance I seriously considered disinvolving myself from the project so that
> > > the rest of the members could avoid harassment.)
> > 
> > As our FAQ concerning harassment says, we encourage those who feel they
> > are being harassed to contact the appropriate law enforcement agency.  We
> > would prefer that you don't contact us concerning harassment because we
> > have no way of determining whether harassment is taking place.  That is
> > something for a court of law to determine and we do not want to raise our
> > liability by becoming involved. 
> 
> *nods*
>  
> > We have cooperated with law enforcement in the past and will continue to
> > do so in the future.  If the harassment against you is continuing from
> > customers of Altopia, I encourage you to contact law enforcement.  I am
> > surprised that we have not yet heard from Kentucky law enforcement since
> > you said multiple times that you will be contacting them if we don't
> > respond by the deadlines you presented.  Your credibility is questioned
> > because you said you would contact them and we have not heard from them.
> 
> I have forwarded the info to the Kentucky Attorney-General, who will be
> contacting me on the matter after seeing which agency would be involved (KY
> State Police, Jefferson County Police, etc.)  The initial convo was to the
> effect that it did sound like (at the least) harassing communications under
> Kentucky law.
> 
> The FBI is investigating the complaint locally; part of the lag there is
> that the Louisville office has (by the agent's own admission) only one
> computer-literate person.  I've faxed the complaint and an explanation on
> what is going on, along with examples, to the office, and the agent is
> supposed to be forwarding this to the agent who deals with computer matters.

We look forward to cooperating with these and other law enforcement
agencies. 

> > > >  3) It is difficult to take seriously correspondence from someone with the
> > > >     name "Follower of the Clawed Albino".  If this is your real name, I
> > > >     apologize but please try to understand our position. 
> > > 
> > > 1) FWIW, other sites have *happily* accepted posts and email from this
> > >    address and alias.  
> > 
> > That's irrelevant to us.  Our site chose not to.  The Internet is a big
> > space and to expect all sites to react similarly is not reasonable. 
> 
> Not arguing with that.  Just stating I've not generally had problems with
> net.abuse complaints using this nym.
> 
> > > 2) If you had any questions, you could have *easily* asked me and I would
> > >    have provided names of folks who can vouch for me.  (For starters,
> > >    Chris Lewis could have.)
> > 
> > We do not rely on people to vouch for other people.  Your credibility with
> > us is based solely on your own actions.  Others may have experienced a
> > completely different side of you that we were being presented with, and so
> > nothing would be gained by us conversing with them.
> 
> My point is that, nym aside ;), I do have some experience in dealing with
> net.abuse.  Chris Lewis could have vouched that the alt.net probs are part
> of the latest of a long-standing net.abuse problem--he's dealt with the
> "meowbot" in particular and the newsgroup attacks by the "meowbot" and hir
> friends in general.

My point is that we have to look at each example of abuse on its own
merits and that conspiracies are not something that factor into our
decisions, because by nature they are based on conjecture. 

Since you are not on our payroll, your experience or reputation is not
relevant to our decisions about whether something is abuse.  To claim that
it is, discredits yourself in our opinion. 

> > Fortunately, this goes both ways.  We are often communicating with people
> > that many others would say are horrible, but which in our own
> > communication with them seem perfectly fine.
> > 
> > Do you really want to be judged by what others think of you?  This only
> > works if you can choose who to judge you. 
> 
> As stated above, I'm not gunning for a popularity contest.  I was stating
> that--*had you asked*--I could have pointed you to other sources that
> alt.net *has* dealt with in past who can vouch that a) yes, there is a
> net.abuse situation going on involving alt.net, b) despite my nym I really
> do know what the hell I'm talking about here because he's dealt with it too.

You do not seem to be understanding that we make the judgement call about
whether something is abuse, not you or anyone you know that does not work
for Altopia. 

> > > 3) It should not *matter* what the nym or name of the person is who is
> > >    reporting net.abuse from your site.  The important thing is that *a
> > >    potential net.abuse situation is occuring*.
> > 
> >From the standpoint of handling the abuse, this is correct.
> > 
> >From the standpoint of replying and conversing with the person, this is up
> > to us.  It takes time (I spent over an hour replying to this particular
> > message) to engage in a conversation or debate with someone and so we have
> > to choose who we engage in a wise manner.  Your email name and the other
> > aspects of your mail made it unwise for us to engage you.  I stand by this
> > decision. 
> 
> I understand you've a limited amount of time.  However, it is not only
> downright rude but can exaberate a net.abuse situation if you refuse to
> reply to someone because of their "tone" or their nym.
> 
> I *still* maintain that this could have been solved a lot easier, and with a
> lot less fuss, if alt.net and some sort of ticketing mechanism or at the
> least would write back as to whether or not something is being done.  An
> AWFUL lot of why folks wonder if alt.net is rogue is because you haven't
> replied to them--even UUnet will reply to complaints.
> 
> To put it another way--if you don't reply to folks to let them know wheter
> or not something is being done just because they've a "funny nym" then you
> will find you are going to be able to talk to a lot less sites.

This is your opinion and remains to be seen.

> Again, this isn't just me on this.  The only other complaint I have *ever*
> had regarding my nym was from a site harbouring an email spammer, which in
> itself was rogue.  And the people on the net.abuse groups rightly called it
> as a "name flame".  Sometimes people who sound angry and use unusual nyms do
> have valid complaints that should be answered...
>  
> > > 4) With the comment above, you have just indirectly shot any claims on
> > >    why Altopia should not add IP-tagging, etc. out of the water.  If
> > >    you distrust net.abuse complaints from me simply because of my nom
> > >    de plume (which I use, in part, to prevent harassment from spammers
> > >    when I make net.abuse complaints--I'm sure NANA* can enlighten you 
> > >    on reasons why folks might want to do this) why should anyone trust
> > >    ANYTHING from alt.net whatsoever?  At least I can be traced to a
> > >    mailable address; I CANNOT say the same for the persons making the
> > >    posts I have complained about.
> > 
> > I did not say we distrust complaints based on email name.  I said we did
> > not reply for that reason, among others.
> 
> Then why do you have a policy of not responding to people because of their
> nyms?

I didn't say we have a policy of not responding to people because of their
nyms.  I said that your nym, in addition to the other questionable aspects
of your messages, resulted in us choosing to not respond. 

> > Complaints, regardless of the source, make us aware of a potential
> > problem.  We then research the potential problem and make an assessment
> > based on our own policies as to whether it is a real problem.
> 
> And had you bothered to mail back, myself and several other people could
> have explained to you that *yes*, it *is* a real problem.

A thousand people could have emailed saying that and our decision on
whether it was abuse would be the same.  We would disagree with all of
those people, if their opinion was different that ours, after analysis. 

> I am getting the very real sense that an awful lot of the problem here is a
> failure to communicate.  You really, really do need to start communicating
> with folks who do make abuse complaints, if for naught else than to prevent
> misunderstandings.

Misunderstandings are not a concern of ours.  If a complainer gets upset
because we do not respond, that is up to them.  There is no way we are
going to begin responding to every complaint. 

> > > >  4) Once you started sending multiple messages per day, from our
> > > >     perspective you appeared to be unstable and irrational.  The tone of
> > > >     your phone calls reaffirmed this suspicion.  This may not be the
> > > >     case, but it seemed likely to us that you would take our responses and
> > > >     spread them around Usenet or in court, out of context. 
> > > 
> > > Well, the reason I was sending you multiple messages per day was that *three
> > > or four of your users were deliberately trying to flood newsgroups and at
> > > least one was deliberately forging paths to make it look as if it came from
> > > elsewhere*.  After two weeks of *no* response whatsoever, my mails may have
> > > sounded curt.  To be perfectly frank, I was beginning to consider seriously
> > > the possibility that alt.net might be outright rogue.
> > > 
> > > My phone calls, FWIW, were made after my fiance was listserv-bombed, and I
> > > think you can understand how I *might* be a bit concerned.  
> > > 
> > > Let me put it this way--*you* put up with an attempted newsgroup flood that
> > > is part of a series of them, that you know from *their own posts* is
> > > targeted at you, you complain to a site for two weeks to *please* give you
> > > logs so you can find out where it is coming from (and hopefully colloborate
> > > it with ten other logs you have, to see if they've moved to a new ISP), and
> > > then someone who likely is one of the very perps using your site decides to
> > > listserv-bomb my fiance for no reason whatsoever other than he *is* my
> > > fiance, and a net.kook who joined in the campaign posted this in a FAQ using
> > > his *old* email address, not the one he uses now and which has not appeared
> > > on Usenet in *months*.  This tends to shake one up.  A *lot*.
> > 
> > Frankly, if this was happening to me I would have filtered out each
> > instance of the user and ignored/deleted the instances I did see before I
> > was able to filter them out. 
> 
> That was tried.  Thing is, the alt.net posts *alone* were thirty-three
> percent of TOTAL group volume by the time the flood finally ended, and the
> flood posts themselves (not counting the binary bombs and including posts
> from sites outside alt.net) were over fifty percent.

What does percentage have to do with filtering?  It should have been easy
for you to filter out all postings with "news.alt.net" in the Path: line.

If more than 50 percent of the postings in a group are not what you
believe to be on-topic, then maybe you should revise your definition of
what the topic is.  The laughable thing is that this was an alt.* group
and thus the idea of a topic that must be followed is bogus.  To get the
kind of control you desire, you should petition for a Usenet II group or
hierarchy and be the czar or moderator for it. 

> The fact my fiance was listserv-bombed by persons who were likely some of
> the same folks trying to flood AHWW indicates to me that they intend to
> harass me off the net altogether.  This is not something that's going to be
> solved by killfiles alone.

You seem to be doing a lot of the investigative work that a law
enforcement agency should be doing.  It is unwise for you to be doing it,
because you are the one supposedly being harassed.  You run the risk of a
law enforcement agency not believing you or taking you seriously when you
take the investigation into your own hands. 

> (I should also note that the perpetrators are known to morph addreses fairly
> frequently, specifically to AVOID killfiles.  They also will add tags meant
> to distinguish legitimate posts from flood posts.  This actually did happen
> in the latest flood; legitimate posts were being tagged with [AHWW] in the
> subject, and people were killfiling all posts without the tag.  The flooders
> soon started adding the tag expressly to defeat the killfiling.)

All postings from Altopia contain "news.alt.net" in the Path: line.  It
should be easy to filter based on this, in addition to your other filters. 

> > If you really consider our site to be rogue, I recommend you ask your
> > provider to alias us out.  In your particular case, we have private
> > peering with Airnews so I don't know if they would alias us out, but it is
> > certainly worth a try if our posters are bothering you and you can't
> > figure out how to use a filter.
> 
> As stated above, between the fact the users would morph addresses, would add
> tags to defeat killfiles, and the frank net.abuse such as flooding and path
> forgery, killfiling it would not have sufficed.  (The administrator of
> meow.org, who has dealt with this for some time, could well edify you on why
> this is the case, so could Chris Lewis.)

Your provider aliasing out news.alt.net would mean that you don't even
have to worry about filtering.

> It was your *failure to respond to complaints at all* or indicate you would
> or would not do anything is my main complaint.  (The main abuser from
> alt.net, as I pointed out, was doing a lot of sillybuggers above and beyond
> even mere attempts at group flooding.)  Had you written back, I could have
> provided you a history on just what all was going on, how these people abuse
> services, how they have stated their intent WAS to destroy alt.horror.
> werewolves, etc.  They have done this several times before (though not on
> Altopia).

In other words, you want us to violate the rights of Altopia customers so
you can perform your own investigation and construct your own
conspiracies?  This is not something we would even consider helping with. 

> Your site's failure to respond to folks re the Mahmoud stuff also made a
> number of folks wonder whether you were rogue.  As I've stated before, you
> need to communicate with folks.  We're not asking for handwritten letters--a
> ticket number will suffice.  In some cases, you need to write back (for
> instance, if you're getting multiple complaints about a user)--there may be
> background that they've done this behaviour on other systems before, or that
> it's part of a larger net.abuse situation, etc.

Our service is not based on responding to complaints and therefore it
remains our choice whether to do so.  Just because some people are unhappy
about this does not mean it will change.  Even a UDP will not force this
to change. 

> > > > We did follow-up on your complaints when we felt the complaint was
> > > > justified.
> > > 
> > > I noticed that the flooding of AHWW from alt.net, as well as the initial
> > > morph of "mahmoud", seems to have stopped.  I thank you for this.
> > 
> > No need to thank me.  It seems the posters have decided to stop. 
> 
> I'll be keeping a careful eye out in any case.  But at least it's stopped,
> for now.  How long it'll stay stopped, I don't know.  (Should I note to you
> in this regards that this is at least the sixth attempted flood of AHWW?
> The first where Altopia was involved, admittedly, but this is part of a
> repeated pattern of net.abuse.)

The repeated pattern of abuse that you perceive, does not matter to us. 
Each instance that results in a complaint is researched individually.

> > > I *will* note that a new morph, who may or may not be the same as the
> > > "Mahmoud" poster, seems to be trying to stir up the same stuff again.  He's
> > > posting with a munged From: line pointing to afkmn.org:
> > > 
> > > <begin excerpt>
> > > 
> > > Path: news-f.iadfw.net!thereisnocabal!news.airnews.net!cabal10!newsfeed.
> > > direct.ca!logbridge.uoregon.edu!su-news-hub1.bbnplanet.com!news.bbnplanet.
> > > com!news.alt.net!usenet
> > > From: cupcake@afkmn.org (Cupcake The Cat)
> > > Newsgroups:
> > > news.admin.net-abuse.email,news.admin.net-abuse.misc,alt.fan.karl-malden.
> > > nose,news.admin.censorship,news.groups,alt.politics.democrat,soc.culture.jewish
> > > Subject: Re: CAUCE members demand censorship
> > > Date: Wed, 12 Nov 1997 04:31:34 GMT
> > > Organization: TUNA !
> > > Lines: 24
> > > Message-ID: <34693019.6227877@news.alt.net>
> > > References: <34662752.61E9@netcom.ca> <646em6$ihn$2@usenet48.supernews.com>
> > > <34684fb2$1$fuzhry$mr2ice@news1.mnsinc.com>
> > > <64a3dj$sld$2@usenet85.supernews.com> <64adm7$ag1@garcia.efn.org>
> > > <64aqp1$kap$2@usenet76.supernews.com>
> > > X-Newsreader: Forte Free Agent 1.1/32.230
> > > Xref: news-f.iadfw.net news.admin.net-abuse.email:120707
> > > news.admin.net-abuse.misc:192530 alt.fan.karl-malden.nose:128472
> > > news.admin.censorship:49934 news.groups:329561 soc.culture.jewish:409343
> > >  
> > > On 11 Nov 1997 23:46:41 GMT, ricardo@primus.paranoia.com (Ricardo Hector
> > > Gonzales) wrote:
> > >  
> > > >Gary Frazier (gfrazier@efn.org) wrote:
> > > >: 
> > > >: Shut up, Rickie.  No one gave you permission to speak.
> > > >: -- 
> > > >:                                                Gary
> > > >: http://www.efn.org/~gfrazier
> > > >: Fight Spam!  Join CAUCE!  http://www.cauce.org
> > > >               ^^^^^^^^^^^
> > > >
> > > >Thanks for representing the censorship motivation of your organization.
> > > >People have been saying for a long time that CAUCE is only interested
> > > >in censoring individuals and your post is proof of that.
> > >  
> > > CAUCE has no use for JEW SPAMMERS like you, Ricardo.  If only
> > > the Spanish were more efficient during the Inquisition so that your
> > > ancestors did not escape to Mexico, the net would be a better place.
> > >  
> > > <end excerpt>
> > > 
> > > Now, this isn't to the point of bona fide net.abuse yet.  He's not flooding,
> > > he's not doing sillybuggers with the Path.  I don't know what exactly you
> > > did re the "Mahmoud" poster, but if he got booted he MIGHT have gotten back
> > > on (I don't know, honestly, if you blacklist folks you boot).  I won't ask
> > > you to nuke this one--yet.
> > 
> > The post above does not violate any of our policies.
> 
> Ok.  I was just not sure on your policies re people who got kicked off and
> come back under another name or address.  (As stated, I'm not asking you to
> yank this user for now, as he's not doing blatant net.abuse.)

Who said anything about anyone being kicked off?  Obviously, if we kicked
someone off they would not be allowed back on. 

> > > I really *would* have liked to known where some of the AHWW floodposts were
> > > coming from (that were through alt.net).  In particular, I'm still half
> > > curious if some of 'em came through Springfield, MO POPs (during the last
> > > major waves of this, the major culprit was someone using a Springfield, MO
> > > POP of Smartnet) of ISPs, or if any came from Carnegie Library (someone's
> > > been using open NNTP servers to binary-bomb the same groups being hit by the
> > > "naughty noser" problems).  
> > 
> > If this stuff happens again and you want to know where it is coming from,
> > either have law enforcement subpoena the information or have your attorney
> > subpoena the information.  The United States system of government has
> > checks and balances in it for a reason. 
> 
> *nods*  I will requst tht the law enforcement personnel do this, and that
> you have agreed to cooperate in this regards.
> 
> > Also, feel free to email us the Message-IDs you want us to save away as
> > potential evidence and we will do so if you explicitly ask this.  We may
> > not reply to your request, but the archiving will likely be done. 
> 
> I'll send you the Message-ID's later tonight or tomorrow.

Sounds good.  Note that our logs only go back a few days, so the sooner
the better. 

> > > I'd be happy, though, even with a note that "this is being dealt with".
> > > That and being able to know where abusers are coming from--even if you boot
> > > them off, they will often move to another provider or to open NNTP servers
> > > until the "home" account is cut off.  (This is another reason it's kind of
> > > important to determine whom is posting from alt.net, if you're not intending
> > > to go full whole hog with the anonymous posting service.)
> > 
> > If we tell you where users are coming from, not only do we violate their
> > privacy, but we also put ourselves in a position of increased liability
> > because users have an expectation that we will not share this information. 
> 
> And as I've stated, you're not purely an anon remailer or posting service.
> (If alt.net had separate "anon NNTP" and non-anon NNTP servers--as noted
> above in my examples on how this could be done--this is going to likely take
> care of a lot of your legal liability.)  If Altopia was like anon.penet.fi
> or replay.com's anon service, that'd be one thing.  But you're not--you're
> selling an NNTP feed, which is not truly anonymous.  You have a number of
> alt.net users who use their real names and email addresses, and don't use it
> for anon posting at *all*--in fact, I'd probably state that the persons who
> use alt.net because they need anon posting capabilities is smaller in number
> than folks who use alt.net because (to put it bluntly) their newsfeed at
> their home ISP sucks for some reason or another (no binaries, or they don't
> want spam cancels, or their "home ISP" server is dropping articles because
> of lag).  The people who need the anon posting would be better served by a
> server for their use.

It sounds like you believe there is a market for this service and so I
encourage you to set it up.  We do not believe it is in our interest to
set up a service such as this, at this time.  If you prove to the world or
us that there is a market, then maybe we will choose to compete with you. 

> This is part of why I say that trying to run Altopia as a hybrid service
> (which is what it really is now--a site that has an awful lot of users on it
> who just want a better feed, and a number using it for anonymous posting
> capabilities--a hybrid between a standard provider and an anon-posting
> service) is really a disservice to both sets of users.  Your site is not
> truly anonymous (among other things, yo do keep logs)--basically it's got
> "anonymity through obscurity" at this point.  The few bad apples on your
> server take advantage of this, and have the real potential for ruining it
> for everyone (because we can't find out where the abuse is coming from).

If an abusive post is made using Altopia, then the abuse is coming from an
Altopia user.  The IP address or home ISP they used is not relevant. 

> 's better to run *two* servers in this case--an anon and a non-anon one.
> The non-anon one for folks who just need a newsfeed, and the anon one for
> people who need anon posting.  You'll have less liability, you'll be better
> able to deal with net.abuse (and you won't have quite as many problems with
> communication, I suspect), and people will be glad you're providing a *true*
> anon-posting service.  Just a suggestion, but I think it'd be helpful in
> this case.

If users or you want to think of us as an anonymous posting service, then
go for it.  If users or you want to think of us as a hybrid, then go for
that too.  It doesn't matter to us.  Our service is what is presented on
our web page.  We don't claim to be anything more or anything less. 

Chris Caputo
President, Altopia Corporation


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850

iQCVAwUBNG/myT0Jz30h6bOhAQGM6wP/d9P8gZBL0lVkcGT5cBwXX1k137g+hN4F
jSKG8QIuDBmH3DoxnjFMrT9Z1+7Wu/dd9skmJOeSsY1mYDn6VyAHQUydO85ZvJYy
zaOwaFp3EFS8MhpSR39rI1trOakywB9ucZNClg8OuevOvkPWQw9R31GD3CyTSBRO
eS8ee3eS3Ew=
=B6Oj
-----END PGP SIGNATURE-----