Re: Detweiler abuse again

I understand Eric's comments about the use of logging to "catch" Detweiler
in the act here.  Frankly, I expected more criticism of that action than I
received.  I should make it clear that I do not routinely log, but that after
receiving the complaints I forwarded to the list I added a line to my
maildelivery file to save all messages with the same subject line as the
offending message to a file.  Within minutes, the message from Detweiler
appeared.

I'm not sure Eric's idea about connecting via sockets would eliminate all
possibilities of logging.  It seems that with telnet, at least, the systems
that you connect to are able to find your host name.  Still, host names
would be more private than full addresses.

Grepping the Blacknet log file for "request-remailing-to" shows the
following messages which have accumulated overnight:

request-remailing-to: comp.sys.ti.explorer@news.cs.indiana.edu
request-remailing-to: rec.mag@news.demon.co.uk
request-remailing-to: rec.sport.football.australian.usenet@decwrl.dec.com
request-remailing-to: alt.fan.addams@news.cs.indiana.edu
request-remailing-to: soc.history@news.demon.co.uk
request-remailing-to: comp.archives.msdos.d@news.cs.indiana.edu
request-remailing-to: rec.pets.dogs.usenet@decwrl.dec.com
request-remailing-to: comp.sys.sgi.graphics.usenet@decwrl.dec.com
request-remailing-to: alt.fan.vejcik@news.demon.co.uk
request-remailing-to: alt.fan.addams@news.cs.indiana.edu
request-remailing-to: rec.pets.dogs.usenet@decwrl.dec.com
request-remailing-to: alt.abortion.inequity@news.cs.indiana.edu
request-remailing-to: alt.security@news.demon.co.uk
request-remailing-to: alt.sports.football.pro.dallas-cowboys.usenet@decwrl.dec.com
request-remailing-to: rec.music.classical.guitar@news.cs.indiana.edu
request-remailing-to: news.announce.important@news.demon.co.uk
request-remailing-to: misc.health.alternative.usenet@decwrl.dec.com
request-remailing-to: alt.beer@news.cs.indiana.edu
request-remailing-to: alt.archery@news.demon.co.uk
request-remailing-to: alt.sports.basketball.nba.wash-bullets.usenet@decwrl.dec.com

One good thing is that he is apparently targetting just a few mail-to-news
gateways.  I was worried because one of the complaints I got came from
a mailing list; it would be completely infeasible to block all mailing list
addresses.  But blocking the mail-to-news gateways would be pretty easy.

(As an aside: how do these gateways take the heat?  Should I suggest to those
complaining to me that my system is intended for email, not usenet, anon-
ymity, and that they should direct their complaints to the mail-to-news
gateways which are the "real" cause of the problem?  Is this tactic likely
to be politically effective?)

Now, I haven't received any complaints from the administration at this
commercial system for which I pay about $30 a month.  In fact, I have never
received any complaints about my remailer from the admins, even though I
assume that at least some complaints have been sent to root or postmaster
here.  I know that the owner of the Portal system was at the hacker's
conference a couple of years ago (according to a report on the cp list),
and that he supposedly pledged his commitment to the concept of anonymous
remailers.  I have never contacted him, but perhaps I am protected to
some extent by his beliefs.

At this point, I will probably take no action and see if this blows over.
If I get more complaints, though, I will probably block the mail-to-news
gateways as outgoing addresses.

Another alternative would be for me to forward outgoing mail which is
directed to the mail-to-news gateways through another remailer, such
as Xenon's at netcom.com.  

Thanks for the suggestions and advice.

Hal

>I'm not sure Eric's idea about connecting via sockets would eliminate all
>possibilities of logging.  

I did not mean to imply this.  Using daemons would get rid of the
_default_ loging that occurs on systems.  Changing logging from
opt-out to opt-in would make a large practical difference right now.

>It seems that with telnet, at least, the systems
>that you connect to are able to find your host name.  Still, host names
>would be more private than full addresses.

This was exactly my point in a previous article.  An email address
identifies both a machine and a user, where an IP connection (e.g.
telnet) only reveals the machine.  Now if the sysadmin of the
originating machine logs and shares information with the destination
machine, the user can be identified.  But again, this is an opt-in
monitoring system.

Eric

hughes@ah.com (Eric Hughes)  writes:
>
> >I'm not sure Eric's idea about connecting via sockets would eliminate all
> >possibilities of logging.  
> 
> I did not mean to imply this.  Using daemons would get rid of the
> _default_ loging that occurs on systems.  Changing logging from
> opt-out to opt-in would make a large practical difference right now.

  Using a remailer daemon on a well-known port (777, anyone?) would only
  result in defeating logging that is done via SMTP-agents like sendmail.
  It is still possible for the sysadmin on the host to do a TCP-wrapper
  log which logs the connection to the remailer from the originator.
  Again, this only provides IP address information, which makes it easy
  to hide if the originator comes from a machine like netcom or the well.

> This was exactly my point in a previous article.  An email address
> identifies both a machine and a user, where an IP connection (e.g.
> telnet) only reveals the machine.  Now if the sysadmin of the
> originating machine logs and shares information with the destination
> machine, the user can be identified.  But again, this is an opt-in
> monitoring system.

  Yes... also the remailer daemon could do opt-in monitoring of both ends
  of it's connections... Full accountability could be possible, but only
  with the complicity of everyone in the path...

 Jon Boone | PSC Networking | boone@psc.edu | (412) 268-6959 | PGP Key # B75699
 PGP Public Key fingerprint =  23 59 EC 91 47 A6 E3 92  9E A8 96 6A D9 27 C9 6C

> (As an aside: how do these gateways take the heat?  Should I suggest to
> those complaining to me that my system is intended for email, not
> usenet, anonymity, and that they should direct their complaints to the
> mail-to-news gateways which are the "real" cause of the problem?
> Is this tactic likely to be politically effective?)

No, and it would probably backfire.  If the mail-to-usenet gateways get
abused, the administrators of the gates will probably start blocking
incoming mail, as CMU and Berkeley have done.

(The CMU gateway is outnews+netnews.group.name@andrew.cmu.edu  You can
try it and see what results you get.)

It might be more effective if you bounced messages from detweiler back
to him, CC: postmaster with a notice saying "Due to repeated abuses of
this email service, messages from detweile@cs.colostate.edu are no
longed accepted.  Unsent message follows:

>It might be more effective if you bounced messages from detweiler back
>to him, CC: postmaster

Why even bounce?  If you want to make the remailers do something with
unwanted mail, one could honor the remailing request, but not
anonymize it.

Eric