🚀 go-pugleaf

Steve Smith (sgs@access1.digex.net) wrote:
: In article <2qs3c7$dpe@access3.digex.net>,
: Kevin McCormick <kmccorm@access.digex.net> wrote:

: >[Canter & Siegal prove they're slimeballs ....]

: I consider C&S's advertising the equivalent of going to "open mike
: night" at a nightclub and doing a 10 minute ad.  More than a few of
: these, and the forum becomes useless.  They have the fairly typical
: attitude among lawyers that "if there's not a law against it, it's
: OK".

: The question is what do we do about it?

: Personally, I plan on putting together a little RN macro that will
: quote the entire message, add a line at the end to the effect of "Your
: message was not appropriate to newsgroup comp.foo.  Please read the
: charter of comp.foo before posting any more similar articles."  Note --
: terse, no flames, no threats.  Then send it back to them.  Every time I
: see it.  I see it 500 times, I send 500 messages.  If enough
: people do this, the traffic will crush any internet provider, even if
: it's something like netcom.  Won't take a very high percentage.

He puts on a daemon that runs once a minute, draining his mailbox.  
Messages under 1K are kept; messages longer than 1K are remailed back to 
the sender with the message that the message was rejected as being too 
long.  You end up blasting your *own* system.  Further, he uses the MAIL 
FROM: <> format in SMTP to prevent the message from returning, and by 
having the From: address to point to your address, your system then
cannot bounce it back.

: Doug, if you're monitoring this discussion, I suggest that you think
: very seriously about what *you* are going to do to keep Digex from
: getting squashed if a C&S wanabe uses Digex for something like this.
: Easiest things I can think of right offhand are to

: 1.  Charge for huge quantities of mail, outgoing or incoming.  Make 'em
:     pay for the core dumps or whatever.

None of the software, as far as I know, has metering capability on 
outgoing mail or news.

: 2.  Limit the number of news postings (and perhaps mail messages) that
:     an account can send.  100/day?  200?

Unless you are going to meter sendmail, limiting mail is not necessarily 
going to be an easy thing to do.  And very few people want to mess around 
with sendmail.cf files, let alone changing the internals of sendmail.

: 3.  Limit the number of newsgroups that can be crossposted to at one
:     time (20 or so shouldn't put a crimp on legitimate crossposting)

C&S *do not* crosspost: that was the *entire* problem.  This makes the 
problem *worse*, not better.  If Canter & Siegel had simply cross posted 
one message to every single newsgroup, it would have generated *one* 
message and probably would have received 1% of the notice and complaints 
they got.  

Had the message been totally crossposted, it would have generated only 
perhaps 100K on each system (1K of message and 99K of XREF: items).  
Instead, the same message got posted thousands of times, ONCE FOR EACH 
NEWSGROUP.  

As bad as C&S's message was, *had* they cross-posted the message, people 
would have seen it once and it would not been so damaging to systems that 
got loaded with megabytes of mail from this one message.

: 4.  When somebody gets a huge quantity of mail, spool it *immediately*
:     to tape.  Make them come in and pick up the tape in person.  If they
:     can't read it, that's their problem.

Private mail is subject to the Electronic Communications Protection Act 
in the absence of a notice on the system to the contrary.  The postmaster 
who places mail into a spool tape the user cannot get access to may be 
violating a federal law in this respect, but I haven't read it recently 
to be sure.

While what they do is wrong, refusing to say, mail them the tape if they 
ask for it and paid the postage plus tape cost will almost certainly show 
malice if you got sued.

With ECPA allowing punitive damages or statutory damages as high as
$10,000.00, plus court costs and attorneys fees, I'd think long and hard
before acting in bad faith.

Sure, you may not lose but you may spend $20,000 defending the case.

: The key, of course, is to avoid stepping on legitimate users.

: This is yet another thing that we should worry about *now*, before it
: becomes a real problem.  C&S sending out 5000 news postings is a minor
: irritation.  1000 C&S lookalikes sending out 5000 postings each every
: week would kill the net.

After 3 or 4 of these happening, automated "armm" servers would start
killing duplicated messages appearing in lots of newsgroups.  If this
happens, CRC-32 or MD-5 checking of messages against prior postings would
take place, and duplicates would be refused, the way duplicate message-ids
are refused on the same newsgroup. 

What we need to do is think of ways to fix the problem rather than to 
simply react to it.

This is why I believe we do not need legislation on this matter: we can 
figure ways to solve our own problems without having some net.police swarm 
all over us like the FBI at Waco.

--
Reports on Security Problems: To Subscribe write PROBLEMS-REQUEST@TDR.COM
Paul Robinson - paul@tdr.com / tdarcos@MCIMail.com / tdarcos@access.digex.net
Voted "Largest Polluter of the (IETF) list" by Randy Bush <randy@psg.com>
Voted "Largest Polluter of digex.general" by Mike <voss@orange.digex.net>