Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Wed, Mar 24, 2004 at 04:30:34PM -0500, Tanner Lovelace wrote:
> Steven Champeon said the following on 3/24/04 4:16 PM:
> 
> >Tanner, you're smarter than that. If I can send you email, you're
> >providing an Internet service, by definition.
> >
> >If you send email, you're using that Internet service. You (Tanner) are
> >a "customer" or user of that service, and therefore if you want to be a
> >good neighbor on the network we have to share for better or for worse,
> >you should be prepared to support the various roles required of everyone
> >else providing similar services.
> 
> Sure, that's fine.  But then perhaps the RFC should move that address
> to a different place and make it more explicit that it is a
> "must have" and that by the very act of connecting to the Internet
> you have to have this address.  As it stands now, it is obviously
> unclear.

OK, fine. I can see that argument. As you can see, the relevant RFC was
released in 1997, and was based on an earlier draft, so maybe it needs
to be updated. I guess the point I've been trying to make is that to
nearly everyone but, apparently, not you, it's an obvious requirement,
makes sense, doesn't need to be spelled out any further. 

So perhaps that explains why there hasn't been an RFC to supercede it
with more direct language and the use of capitalized MUST and SHOULD
keywords and so forth like many of the more formal RFCs do (IIRC, this
usage was being defined around the same time as RFC 2142, in RFC 2119,
so it's not surprising that it wasn't used for 2142). It /does/ say
anyone providing network services "must" provide abuse@, FWIW.

There was a thread on Bugtraq in January asking for a new RFC, to deal
specifically with virus outbreaks and the like, that included explicit
requirements for supporting these accounts. The old RFCs are out of
date, obviously, and these things take time and have to achieve some
level of support from the community before adoption as an RFC, BCP, or
STD.

Anyway, I can accept that you're just trying to do the right thing,
and can understand why you'd be loath to do something simply because
it's suggested in what you think is a vague manner. And I agree that
these things ought to be codified in a way that made them even more
clear and strict. But then, I think lots of things ;)
 
None of this, however, mitigates what appears to be the primary issue:
that you don't like coercion regardless of whether it serves worthy
purposes, and you seem to still misunderstand that /all/ of these
services, SPEWS, RFCi, the SBL, CBL, etc. are /voluntarily/ used by ISPs
and others because they either agree with the listing criteria, or
because they're generally well-disposed towards them but misunderstand
their proper implementation (like anyone using SPEWS L2 to block/reject
mail). If I wanted to publish a DNSBL zone that only contained "IPs
associated with Tanner Lovelace", that's up to me, and it's up to
whoever uses it whether they trust my judgement in doing so. It's not
really coercion if the provided services are voluntarily adopted, is it?

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
Buy "Cascading Style Sheets: Separating Content from Presentation, 2/e" today!
http://www.amazon.com/exec/obidos/ASIN/159059231X/heskecominc-20/ref=nosim/