Re: Remailer in a box

From:	IN%"loki@obscura.com"  "Lance Cottrell"  9-MAY-1996 18:58:23.21

On Thu, 9 May 1996, E. ALLEN SMITH wrote:

>> 	After taking a look at www.cyberpass.net, I can see why you're
>> encoraging people to use it - about like Sameer encouraging people to use
>> c2.org.

>Guilty

	No problem. Modesty is an overrated virtue.

>I am not pushing the anonymous accounts until my laywer finishes the user 
>agreement for them. It is a bit of a tricky document (Sameer, want a copy 
>when it is done?). The whole site is days away from a complete redesign, 
>so I am not putting much effort into the current interface. Thanks for 
>the suggestions though.

	I suspect that the legal types on cypherpunks would be interested in
seeing it. Quite welcome on the suggestions.

>The >= 18 condition is to cover my butt. Since minors can not be parties 
>to contracts, I have no protection with them as clients. I am only a 
>provider for adults, and they take full responsibility for any children 
>allowed to use the connection. Fuck the CDA, but keep an eye on its claws.

	I see your difficulty. It is an additional one with respect to
anonymous accounts. Hmm... you could put the burden on other ISPs by only
having anonymous accounts via telnet access - and not accepting such from
k12.edu domains. Bit of a limit, though.
	-Allen

E. ALLEN SMITH writes:
 > 	I see your difficulty. It is an additional one with respect to
 > anonymous accounts. Hmm... you could put the burden on other ISPs by only
 > having anonymous accounts via telnet access - and not accepting such from
 > k12.edu domains. Bit of a limit, though.

1) New .edu registrations are restricted to colleges, but you have
   rogues like sidwell.edu (Chelsea's Quaker school), plus the odd
   17-year-old attending college like I did.

2) .k12.STATE.us is safe enough to restrict, except that some people
   are staff members who will be unhappy.  Of course, those people can
   just change their DNS so it responds to a PTR request with
   a.root-servers.net.  So naturally you don't let the students manage
   your servers (although frankly, the staff members have little time
   or knowledge to do it themselve; most would be happy to find a
   trustworthy student).  Even so, said smart student will discover
   that it's possible to spoof the DNS by spamming a client with
   responses.  That's particularly easy since the source of the packet
   will likely be the same subnet that the smart student.

You can't use the DNS for authentication of any type, particularly if
a Damoclean CDA is hanging over your head.

-russ <nelson@crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.

On Thu, 9 May 1996, E. ALLEN SMITH wrote:

> From:	IN%"loki@obscura.com"  "Lance Cottrell"  9-MAY-1996 18:58:23.21
> 
> On Thu, 9 May 1996, E. ALLEN SMITH wrote:
> 
> >I am not pushing the anonymous accounts until my laywer finishes the user 
> >agreement for them. It is a bit of a tricky document (Sameer, want a copy 
> >when it is done?). The whole site is days away from a complete redesign, 
> >so I am not putting much effort into the current interface. Thanks for 
> >the suggestions though.
> 
> 	I suspect that the legal types on cypherpunks would be interested in
> seeing it. Quite welcome on the suggestions.
> 
> >The >= 18 condition is to cover my butt. Since minors can not be parties 
> >to contracts, I have no protection with them as clients. I am only a 
> >provider for adults, and they take full responsibility for any children 
> >allowed to use the connection. Fuck the CDA, but keep an eye on its claws.
> 
> 	I see your difficulty. It is an additional one with respect to
> anonymous accounts. Hmm... you could put the burden on other ISPs by only
> having anonymous accounts via telnet access - and not accepting such from
> k12.edu domains. Bit of a limit, though.
> 	-Allen
> 

I expect the majority of our anonymous account to be telnet. We are 
setting up the contract to make it clear that any contract signed with a 
minor is invalid, and that any access of our system by that individual is 
actually illegal (various statutes on misuse of computer resources are 
quoted).

I don't know about posting the agreement. My lawyer may not want to see all 
his hard work in the public domain. I will ask.

	-Lance

-------------------------------------
Lance Cottrell   loki@infonex.com
President Infonex Internet Services
http://www.Infonex.com
-------------------------------------