ietf-asrg
[Top] [All Lists]

[Asrg] UCEPROTECT's comment on draft-irtf-asrg-bcp-blacklists-07

2011-02-27 00:17:28
This is the official statement from the maintainers of the
UCEPROTECT-Network
about this section of your RFC - Draft:

2.2.5.  Conflict of Interest

   Some DNSBLs used for blocking/negative reputation have had a practise
   of requiring fees or donations to charities from the listee for
   delisting.

   It is generally considered entirely appropriate for a DNSBL to charge
   for access to it by its users - the definition of a commercial DNSBL.

   However, the practise of requiring a listee to pay for delisting from
   a negative connotation DNSBL steers perilously close to notions of
   extortion, blackmail or a "protection racket".  Even if such
   accusations are entirely unjustified the practise causes uproar and
   damage to the DNSBLs reputation, if not the entire DNSBL mechanism as
   a whole.  Colloquially, "it smells bad".

   Therefore, negative-connotation DNSBLs MUST not charge fees or
   require donations for delisting or "faster handling", and it is
   RECOMMENDED that such DNSBLs that do charge fees or require donations
   not be used.

We recommend that you remove the complete last sentence, because it reflects

only your personal opinion, how a DNSBL should be operated.

Since you claim the document would be intended to provide guidance to
DNSBL operators so that they may be able to identify what features users 
would be interested in seeing as a part of a high-quality, well-managed
DNSBL,
it is not your business to tell the operators they "MUST NOT" charge 
delisting or "faster handling" fees.
The recommendation that such DNSBLs which are charging for removals
should not be used is a personal opinion and as such it has also no place 
in a guidance which is addressed to DNSBL operators.

The main purpose of a DNSBL is to prevent spam to get delivered to the
users of said DNSBL.

Delistings at UCEPROTECT-Network are free of charge and they happen 
fully automatic 7 days after we have seen the last abuse originating from
listed IPs.
For those that want a manual intervention (expedited express delisting) 
a fee is charged here.

People tend to ignore their faults and most are unwillig to learn from their

faults if it has no or only minor consequences.

This can be shown by checking the histories of many listees at blocklist
that allow free self-removals like the PSBL.

It is not a big deal to find IPs that were removed 40 to 50 times per year
and got relisted at PSBL after 2 or 3 days again.

We at UCEPROTECT-Network made the expirience that people which did
not care about the security of their systems and got abused by spammers
learned an unforgettable lesson by dealing with our removal procedures:

NEVER GO ONLINE AGAIN WITH AN UNSECURE SYSTEM.

They would not have learned that lesson if they would have been able to 
escape from ourlists immediatley free of charge like they did from others.

New listings of formerly listed static IPs are really rare at UCEPROTECT.

So UCEPROTECT was able to educate those former listees to take care
of their systems next time, which clearly prevents futher spam form those
systems.

That is a really important point, which is often not seen by people which
had
never run a public DNSBL.

Regards

Claus von Wolfhausen
Technical Director
UCEPROTECT-Network
http://www.uceprotect.net
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg