More involuntary c'punk subscriptions on the way?

In the May '96 issue of Computer Security Alert, Padgett Peterson 
provides an explanation of how mail bombing is done.  It's on page 3 
under the "E-mail Security" column with the headline "Mad Bombers on the 
Net."  In the article, Padgett explains the three "stages" of mail 
bombing:  First is to send ungodly amounts of mail from you to the 
target, the next is to post something offensive under a forged ID to one or 
more of the "less ruly" [his words] USENET groups, such as alt.2600 or 
alt.tasteless [his citations], and the third is to subscribe people to 
mailing lists against their will using forged e-mail.

Naturally, Padgett (bless his twisted little mind) indicates that the 
most severe results can be achieved by sending forged subscription 
requests to "the larger listservers such as cypherpunks", that generate in 
excess of a hundred messages a day.

Since hackers and wannabes probably read INFOSEC publications with more 
zeal than do INFOSEC practitioners, I'd say we're likely to be in for even 
more of the "I don't want to be on this list" sorts of traffic.

And Padgett, next time you get interviewed on mail bombing by the press, 
why don't you point them to "The KISS Army Mailing List," or something of 
that sort?

------------------------------------------------------------------------- 
|      Liberty is truly dead              |Mark Aldrich                 | 
|    when the slaves are willing          |GRCI INFOSEC Engineering     | 
|     to forge their own chains.          |maldrich@grci.com            | 
|        STOP THE CDA NOW!                |MAldrich@dockmaster.ncsc.mil | 
|_______________________________________________________________________| 
|The author is PGP Empowered.  Public key at:  finger maldrich@grci.com |
|    The opinions expressed herein are strictly those of the author     | 
|         and my employer gets no credit for them whatsoever.           | 
-------------------------------------------------------------------------

>Since hackers and wannabes probably read INFOSEC publications with more 
>zeal than do INFOSEC practitioners, I'd say we're likely to be in for even 
>more of the "I don't want to be on this list" sorts of traffic.

the mailing list infrastructure of cyberspace is at an 
incredibly immature stage of development imho, and this is a
good example of its lack of refinement. there is wide open
room for improvement and a lot of demand as well imho.

one possible short-term solution is to do the following: have
the mailing list send a secret password to the subscription
address before starting the list. the person replies with the
secret password to confirm they wanted the subscription. it's
a tedious two-stage process, but in some cases it may be
appropriate.

as far as long-term solutions go, I'd like to see some serious
thought about the following problems:

1. how do people avoid getting mail from entities they don't want,
but at the same time get mail from entities they do. note this
problem is far larger than that of mere mailing lists.

2. how can good cyberspatial forums be constructed that are
bulletproof against pranks.

3. how can these forums be integrated with future software such
as Netscape to give a good interface to the user.


I think there is room for an enterprising cyberspace company to
work on these problems and make a lot of money for succeeding.
for example, imagine a system similar to Yahoo that catalogs the
massive amounts of email mailing lists out there. "been done"?
no, sorry, I don't think so. there is a list by DeSilva or someone
that is pretty good, but I think only scratches the surface of
public mailing lists. a yahoo-like indexing system merely for
"cyberspace mailing lists" I think might be a profitable endeavor
to pursue.

another neat thing would be to have a "mailing list manager" built
into software. instead of this ridiculous concept of people hand-typing
and sending commands to listservers (all of which have different 
syntaxes and behavior etc.) I would like to see a "mailing list standard". a
standard way that a mailing list operates (as far as dealing with
headers, errors, subscribing, unsubscribing, etc.). 

then I would like to see a gui interface that handles all the options. 
you just see a group somewhere and a button that you press to
"subscribe". the software would automatically separate your mailing
list traffic into separate folders. it would keep track of what 
lists you are on, and all you would have to do is look at that
list and hit an "unsubscribe" button corresponding to a group you
are currently in, whenever you wanted to.

I really think that the above capabilities are going to prove
very valuable in the future and are the logical next step in
"civilizing cyberspace" after the web and netscape have overtaken the 
planet.

if I get some positive feedback from this message that others are
interested, I might go to the trouble to write up some preliminary
ideas on a standard. it really bugs me that this area hasn't been
standardized by this point, nor does there seem to be any activity
by any groups towards doing so.

<< Secret password sent by listserv, scheme >>

This is how it is done in the Philippines.