Re: Pasting in From:

nobody@REPLAY.COM (Anonymous) wrote:

> > From: Andy Dustman <andy@neptune.chem.uga.edu>
> > Newsgroups: alt.privacy.anon-server
> > Subject: Pasting in From:
> > Date: Sunday, November 30, 1997 8:03 PM
> 
> [ ... ]
>  
> > So, I propose a compromise: What if I enable pasting of From:, but if a
> > From: header is pasted in, a short disclaimer is added to the beginning
> of
> > the body of the message. Would that mess anyone up? I think this would be
> > sufficient to avoid most problems with "forging".
> 
> What are the advantages of pasting a From: above pasting a Reply-To: ?

For one thing, many newsreaders list messages by From:  and Subject:
line.  By putting in a distinctive From: line, your posts will be
identifiable without readers having to download and read each message
body.

By pasting in a From: header, an anonymous poster can thus make his
posts recognizeable.  Pasting in a Reply-To doesn't accomplish the
same thing.  In essence, pasting enables one to adopt a
non-replyable pseudonym.  Why burden the 'nym servers if the poster
doesn't want e-mail replies to his posts?

The alternative suggestion of posting from a replyable 'nym address
does not really address the issue.  If one wants to post with a
From: address of "santaclaus@northpole.gov", why should a remailer
make that any more difficult than doing it from a non-anonymous ISP?
(If "jolly ol' St. Nick" is worried about his e-mail address being
forged, he can always request source blocking.)

-----BEGIN PGP SIGNED MESSAGE-----

The risks of allowing pasted From: lines far outweigh the benefits. Pasting
of From lines makes remailer operators much more vulnerable to charges of
fostering forgery rather than simple anonymity.

Spam baiting is another obvious risk. Forged postings with deplorable
content will bring down retribution on the forgery victim. Forged From
lines can also be used to subscribe victims to thousands of mailing lists.

The uses of this "feature" can be duplicated with other mechanisms such as
nym-servers, which provide persistent unique From lines without the
possibility of forgery of arbitrary addresses. Users desiring greater
security can simply point the reply capability of the nym server at the
nearest /dev/null.


	-Lance



- ----------------------------------------------------------
Lance Cottrell   loki@infonex.com
PGP 2.6 key available by finger or server.
http://www.infonex.com/~loki/

"Love is a snowmobile racing across the tundra.  Suddenly
it flips over, pinning you underneath.  At night the ice
weasels come."
                        --Nietzsche
- ----------------------------------------------------------


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQEVAwUBNIJTRcogYxMMzklZAQHNTAf9G1n+k2BabVQipsr0bcF38Hus2TqFLig8
qCHBVrzaMxEmh9bGrEveMoF+x63kmejsNL2tiNU1HkQgs7M6nYWlYvNF2JUziMmS
2hZLMK7G67xyGHZH2Xl+f5dinNXE33vvs051kUSo1AH8Ryh4hYjvblup7uGGyBzC
YvToZa8B31GZOIGpzkUQo97RP7+BjVelnaatUmosn+52BmCMV3saDkdf1aTit/jP
+gZZGgtM+jUwG9s1+zYebv4uK3vbNL46Xd353AnYDElXXkvX2sDA3OyomYYqZ65X
ramu5RS0JXzNCB3OC68Z4AJpFc2SE6pTQDgUp0A9nMmf4ltV4JVTnA==
=4HIu
-----END PGP SIGNATURE-----

On Sun, 30 Nov 1997, Lance Cottrell wrote:

> The risks of allowing pasted From: lines far outweigh the benefits. Pasting
> of From lines makes remailer operators much more vulnerable to charges of
> fostering forgery rather than simple anonymity.
> 
> Spam baiting is another obvious risk. Forged postings with deplorable
> content will bring down retribution on the forgery victim. Forged From
> lines can also be used to subscribe victims to thousands of mailing lists.
> 
> The uses of this "feature" can be duplicated with other mechanisms such as
> nym-servers, which provide persistent unique From lines without the
> possibility of forgery of arbitrary addresses. Users desiring greater
> security can simply point the reply capability of the nym server at the
> nearest /dev/null.

I've said all of this before myself, and still people want it. So there
will be two safeguards which should prevent the aforementioned problems:

1) The From: address on USENET posts will be mangled a la mail2news_nospam
to prevent spam baiting. Most of the posts I see with pasted From: lines
(from replay, in alt.privacy.anon-server) use a fake address and aren't
trying to impersonate anyone. 

2) Whenever a From: line is pasted, a disclaimer will be inserted at the
top of the body, stating that the original sender has set the From: line,
and that the identification cannot be verified. The fact that it is up at
the top of the body should mean people should actually see it before
reacting.

3) As someone else has suggested, it does indeed insert a Sender: header
with the remailer's address.

Two basic points also about "forgeries". First, you can forge headers
pretty easily without any programs other than telnet. Second, if this
actually does become misused frequently, all I need to do is delete one
character from one file (a # in headers.del) and it will be disabled. I
consider this an experimental feature, and if it doesn't work out, I'll
just turn it back off.

Andy Dustman / Computational Center for Molecular Structure and Design
For a great anti-spam procmail recipe, send me mail with subject "spam".
Append "+spamsucks" to my username to ensure delivery.  KeyID=0xC72F3F1D
Encryption is too important to leave to the government. -- Bruce Schneier
http://www.athens.net/~dustman mailto:andy@neptune.chem.uga.edu   <}+++<

-----BEGIN PGP SIGNED MESSAGE-----

>On Sun, 30 Nov 1997, Lance Cottrell wrote:
>> [Spam baiting, forged mailing list subscriptions]
These are easy enough; the address-munging gets rid of these and
also things like forgings to alt.test and other bots,
though eventually the spammers may catch on to "User <AT> Foo <DOT> com" etc.

The hard problem is
>> Forged postings with deplorable content will bring down retribution 
>> on the forgery victim. 

I shut down my remailer a few years ago because of this one;
the forger posted hate mail to the gay newsgroups with the victim's name
at the bottom (didn't even use From: pasting, just message body.)
Supporting From: pasting just encourages this.

It's possible to cancel the one forged usenet message,
but that didn't stop the flames many people emailed to her,
and fewer systems are accepting cancels these days,
especially when forged by remailers...

Besides Usenet, other popular tactics for retribution are
sending death threats to politicians, sending child pornography
to mailing lists, forging messages _from_ politicians, etc.
Disclaimer/warning headers help, but can't stop it all.

At 10:07 AM 12/01/1997 -0500, Andy Dustman wrote:
>Two basic points also about "forgeries". First, you can forge headers
>pretty easily without any programs other than telnet. Second, if this

This was before Gary Burnore's attacks on the remailer networks,
but it's also an obvious tactic for either flamers or Feds to use
for getting remailers shut down.  If somebody forges a Usenet posting
with telnet, it's not _your_ problem (usually).  If they use your remailer,
it is your problem.  And if they get remailers closed down a lot,
it's all of our problems.

>2) Whenever a From: line is pasted, a disclaimer will be inserted at the
>top of the body, stating that the original sender has set the From: line,
>and that the identification cannot be verified. The fact that it is up at
>the top of the body should mean people should actually see it before
>reacting.

It's worth also repeating it at the bottom.  Putting it in the headers
is invisible with most newsreaders, though.

By the way, one technical risk with From:-pasting is that you need to
parse or substitute special characters including parens and anglebrackets.
Otherwise it's easy for people to paste in syntactically incorrect headers,
which really annoy some gateways and mail clients - nested parens are
a particular problem.

Basically, I think you're getting yourself in for excitement
and adventure and really wild stuff by supporting this :-)


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQBVAwUBNIMYKvthU5e7emAFAQFg6wH9HhJ2RJA0SVBAGZ7hu4mo/dtc6PzPB5+g
NP2utlAEDSbuTrchPKVw4SkZOdkRWlXLD3nmCsdOScIjuZOQtY8nKw==
=vqyf
-----END PGP SIGNATURE-----

				Thanks! 
					Bill
Bill Stewart, stewarts@ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639

stewarts@ix.netcom.com wrote:
> -----BEGIN PGP FORGED MESSAGE-----
> >On Sun, 30 Nov 1997, Lance Cottrell wrote:
> >> [Spam baiting, forged mailing list subscriptions]

> The hard problem is
> >> Forged postings with deplorable content will bring down retribution
> >> on the forgery victim.
 
> I shut down my remailer a few years ago because of this one;
> the forger posted hate mail to the gay newsgroups with the victim's name
> at the bottom (didn't even use From: pasting, just message body.)
> Supporting From: pasting just encourages this.

  So what's the problem? Has everyone forgotten how to use their
delete key? Does nobody have anything better to do with their time
and resources than to waste them being offended by people who are
trying to offend them?
  It never fails to amaze me that complainers point out that an
'abusive' letter started out, "I hate niggersfaggotsjewsyou!"
and then proceed to list the other fifty 'abusive' things that
the writer had to say. Do these people correct the spelling as
they are reading the 'abusive' messages?

> Besides Usenet, other popular tactics for retribution are
> sending death threats to politicians, sending child pornography
> to mailing lists, forging messages _from_ politicians, etc.
> Disclaimer/warning headers help, but can't stop it all.

  Laissez-faire...
  I have never been very enamored of becoming a babysitter to the
whole fucking world in the enterprises I enter into. I set up an
anonymous remailer system for a mental health group and the first
time they claimed that someone was 'abusing' it, I told them,
"You're all fucking crazy! What the fuck do you expect? That's
why you have the list in the first place."
  I can't believe the lame fucks who complain about politically
incorrect anarchists on the CypherPunks list, or who suggest that
list members who may or may not hate niggersfaggotsjewsyou somehow
reflect well or badly on the CypherPunk Nation/Flag/Cause.
  Got a problem with my politics? I wear a grey blazer. You can 
a different colored blazer, so my posts don't reflect badly on
you.

  Identity/source forgery is not usually a major problem in itself,
but becomes one because of the people who buy into the game being 
played because they can't fuck up their boss without getting fired,
so they're waiting for someone to 'give them a reason...'
  I followed an anti-spam list full of dweebs who had no idea how
to tell a good header from a badly forged header, and they would
spam god-and-everybody, en mass, like a blind lynch mob. It was
hilarious to watch.

  I can make my own Bill Stewart <stewarts@ix.netcom.com> signature
and inundate the InterNet with "I like to kill babies after I molest
them (signed) posts." Although it would undoubtedly be a pain in the
ass for you, it would also result in the education of a lot of
complainers as to the principles of identity and digital signitures,
albeit at the expense of your time and resources.
  I can also do the same with the perceived net identities of other
people, including politicians and random strangers. And so can anyone
else. So what? It's part of life. We can route around the damage, or
we can make it a felony punishible by death, or we can give up our
job, family and hobbies in order to spend the rest of our life 
crusading against the 'wrong' that has been done to us.

  There seem to be an increasing number of people who are crying
out for elephant-gun solutions to fly-swatter problems.
  During the censorship experiment, my nephew and his friends were
reading some of the grand schemes proposed for dealing with the
spam/flames/etc on the list. (Everyone must wear an aluminum foil
hat and generate hash-cash e-postage to be sent to a Mars base
station for conversion to an exchange medium based on their hair
color and weight...) He looked at me, mystified, and said, "Don't
these guys have <Delete> keys?"

  There are always going to be people who read the disclaimers
and warnings on anonymously sent email and still harass our good
pal, <president@whitehouse.gov> because 'he' sent them a message
saying, "I dare you to spam me, asshole!"
  One of the little known secrets of the universe is that a great
many problems can be 'solved' by simply ignoring them, or by using
common sense.
"Doctor, it hurts when I do _this_."
  "Don't _do_ that."

GrayMonger

At 07:45 AM 12/2/97 -0600, TruthMonger wrote:
>  So what's the problem? Has everyone forgotten how to use their
>delete key?   Does nobody have anything better to do with their time
>and resources than to waste them being offended by people who are
>trying to offend them?

Well TruthMonger (if that is your real name,) I think you are missing the
point.  For purposes of the discussion, no one cares about the content of
the messages, who or why they are being sent, nor is anyone bothered by
anything concerning the message itself.  What's being discussed is scarce
resources of remailer operators.

It's much like spam.  It's a very shortsighted view when a user says "why
can't you just hit the delete button?"  This is an incorrect answer for a
user who received one piece of spam, but whose small ISP, being the relay,
lost all mail services for two days.

Most remailers are operated with donated time and resources.  Problems with
the remailer, especially artificially generated ones, are just simply not
desired.  Perhaps it is just me, but if my phone rings because of some
message on the Cracker remailer, then I don't care for it happening and I
get offended.  When last month a prosecutor for the Attorney General's
office called me about a packet of material he had received on Cracker, I
didn't care for the call.  It interrupted a phone call I was having with
the communications director of his ex-boss who is now running for Governor.
 Clearly, it cuts into time I have to do other things.

When a police detective calls, not only do I have to explain about
remailers and answer his questions, but I have to spend time making him
prove he's a policeman before I tell him I can't tell him anything.  This
can take two or more phone calls and waste even more of my time.

So why am I getting these phone calls and email messages?  What is needed
to make them stop?  I don't even run a remailer!


  -- Robert Costner                  Phone: (770) 512-8746
     Electronic Frontiers Georgia    mailto:pooh@efga.org  
     http://www.efga.org/            run PGP 5.0 for my public key

Robert A. Costner <pooh@efga.org> writes:
> It's much like spam.  It's a very shortsighted view when a user says "why
> can't you just hit the delete button?"  This is an incorrect answer for a
> user who received one piece of spam, but whose small ISP, being the relay,
> lost all mail services for two days.

See HashCash: http://www.dcs.ex.ac.uk/~aba/hashcash/

Hashcash ensures that the would be spammer has to consume more
resources than you do.  Hashcash is arbitrarily expensive to create
and cheap to verify.  It's also decentralised and anonymous.

Adam

Robert A. Costner wrote: 
> At 07:45 AM 12/2/97 -0600, TruthMonger wrote:
> >  So what's the problem? Has everyone forgotten how to use their
> >delete key?   Does nobody have anything better to do with their time
> >and resources than to waste them being offended by people who are
> >trying to offend them?
> 
> Well TruthMonger (if that is your real name,) I think you are missing the
> point.  For purposes of the discussion, no one cares about the content of
> the messages, who or why they are being sent, nor is anyone bothered by
> anything concerning the message itself.  What's being discussed is scarce
> resources of remailer operators.

  I was responding to Bill and Lance's comments in regard to forgery
victims being set up as targets of retribution. I think references to
"deplorable content" indicate some measure of judgement in regard to
defining what is considered 'abuse' of a remailer.
  However, you are right about the thread basically dealing with the
reprecussions to the remailer operators and their resources as an end
result of the particular modes of remailer use. At the risk of actually
being on-topic in a thread, I should point out that I have always been
of the opinion that it is up to the individual remailer operators to
judge what level and types of use they are able to provide as a service
with their given time and resources.

> Most remailers are operated with donated time and resources.  Problems with
> the remailer, especially artificially generated ones, are just simply not
> desired.  

  True, but I doubt that the artificially generated attacks on a 
remailer are possible to fully deter, no matter what convolutions
one puts themselves through in order to stop it.
  I can post the following to USENET:
From: JoeBlow@hotmail.com
To: All USENET Groups
Subject: Robert A. Costner uses his remailer for hate attacks

-----Begin Forwarded Message-----
Received: from anon.lcs.mit.edu (anon.lcs.mit.edu [18.26.0.254])
Delivered-To: remailer-operators@anon.lcs.mit.edu
Message-Id: <3.0.3.32.19971202094253.037e0654@mail.atl.bellsouth.net>
X-Sender: rcostner@mail.atl.bellsouth.net
Date: Tue, 02 Dec 1997 09:42:53 -0500
To: remailer-politics@server1.efga.org
From: "Robert A. Costner" <pooh@efga.org>
Subject: I Hate People Of All Colors, and I Kill Their Children
  <blah, blah, blah>
-----End Forwarded Message----

> Perhaps it is just me, but if my phone rings because of some
> message on the Cracker remailer, then I don't care for it happening and I
> get offended.  When last month a prosecutor for the Attorney General's
> office called me about a packet of material he had received on Cracker, I
> didn't care for the call.  It interrupted a phone call I was having with
> the communications director of his ex-boss who is now running for Governor.
>  Clearly, it cuts into time I have to do other things.

  If you are in a position where it is unwise for you to simply tell
certain people, "Learn how to use a Delete key, shit for brains!" then
this is obviously a personal cost to you for your connection to the
Cracker remailer.
  Everything you do cuts into the time you have to do other things.
Personally, I appreciate the time and resources you provide for 
supporting remailer services.
  However, when I email politicos and other public figures I often
advise them that they can only fuck so many people for so long before
the lynch mob is going to show up on their doorstep and I don't want
to hear them whining about their fate in life. I sometimes use a
remailer, even when I cc: public mailing lists (thus making the
source/identity of the post/poster obvious), just because I find
that there are many self-important jerkoffs who love to fuck with
people for the smallest of reasons, unless it actually requires
them to make a real effort to do so.
  Feel free to provide my email and/or home address to any legal
entity who has a problem with anonymous posts from my shallowly
disguised identity, but you might want to warn them that unless
their penis is long enough to reach to their own asshole, they
are not likely to profit from any suggestion I might make to them.
 
> When a police detective calls, not only do I have to explain about
> remailers and answer his questions, but I have to spend time making him
> prove he's a policeman before I tell him I can't tell him anything.  This
> can take two or more phone calls and waste even more of my time.

 Tell them you'll send them a faq/fax for their edification, and to
contact you again only if they are too ignorant to understand the
basic concepts.
  And why do you have to make him prove he's a policeman in order not
to tell him anything?
  When I deal with John Law I tell them that I will be happy to deal
with them at my convenience, unless they can provide a reasonable need
for expediency. Their alternative is to explain to a judge why they
arrested you for considering your own time as valuable as theirs, and
giving you cause to refuse to cooperate, in the process.

> So why am I getting these phone calls and email messages?  What is needed
> to make them stop?  I don't even run a remailer!

  You're a public figure. You're getting your fifteen minutes of
'flame'.
 
>   -- Robert (Spam Me!) Costner 

TruthMonger
(Or so I would have you believe...)

>  I was responding to Bill and Lance's comments in regard to forgery
>victims being set up as targets of retribution. I think references to
>"deplorable content" indicate some measure of judgement in regard to
>defining what is considered 'abuse' of a remailer.

This excerpt made clear for me the distinction: 

1. There is a temporary problem with forgery & retribution, but this goes
away when the populace gets a clue about authentication.  In this case,
technology and a little cultural learning solve a social problem.

In practice, this cultural awareness could be encouraged by spamming the
masses with letters from various interesting forged parties, e.g., irs.gov.
 Or spoofing a  public news streams and messing with the stock market.  

I wonder if the recent classified government report
on infohacking the infrastructure included these pranks?

But enough gedankenpranking. Getting a copy of PGP integrated into
everyone's grandmother's GUI email clients, so that this is widely used and
understood by the masses, is the positive way to do this.

2. There is an everpresent truly social problem with people who want to
control the configuration of other people's bits.

This problem is solvable by a set of strongly-enforced rules (e.g.,
"Freedom of speech" -more generally, freedom of information storage and
manipulation in any form) which would have priority over the behavior of
the  mobs (e.g., in the voting booth).

In the US we're supposed to have this but there is some question ---perhaps
we need to hold lawmakers personally criminally liable when they pass
unconstitutional laws--- however the architecture is sound if implemented
correctly.

So in the future we'll not trust anything without a public key, censors
will be laughed at instead of getting congressional time, and anonymity
will be commonplace and as understood as digital signatures.

I guess this list is pretty much an ill-tempered
view of the future..





David Honig 			honig@alum.mit.edu
---------------------------------------------------
If we can prevent the government from wasting the labours of the people
under the pretense of
 caring for them, they will be happy.  -TJ

-----BEGIN PGP SIGNED MESSAGE-----

At 07:45 AM 12/02/1997 -0600, TruthMonger wrote:

>  It never fails to amaze me that complainers point out that an
>'abusive' letter started out, "I hate niggersfaggotsjewsyou!"
>and then proceed to list the other fifty 'abusive' things that
>the writer had to say. 

The real problem, besides the emotional distress some people feel
at the abuse they get in response to forged postings,
and the potential loss of reputation capital, is that people
keep trying to call their ISP to get them shut down,
and some ISPs do this sort of thing, squashing abusive-sounding customers
first and asking questions later.  Ok, soon-to-be-ex customers...

>  I can make my own Bill Stewart <stewarts@ix.netcom.com> signature
>and inundate the InterNet with "I like to kill babies after I molest

Actually, I tend to go for drowning them in bath water,
then throwing them out.  But you know that, you've helped....

I've also got a TOTO filter set in Eudora that flags messages
from TOTO's systems.  Doesn't matter if it's him, or TM,
or LittleDogMonger, or his neighbors in Saskatchewan,
I'd rather have the warning  :-)
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQBVAwUBNIU5l/thU5e7emAFAQFb4gIAnQJOfaUJIzhFkR2lsQMhYbrIfRzuCGT9
ubHaDVVv0jZUzZA+R2zZTXUiCx45kPmNJmjYd1D47cZNp7bE2L20kQ==
=pkXy
-----END PGP SIGNATURE-----

				Thanks! 
					Bill
Bill Stewart, stewarts@ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639

At 07:53 AM 12/3/97 EST, Dr.Dimitri Vulis KOTM wrote:
>Bill Stewart <stewarts@ix.netcom.com> writes:
>
>> The real problem, besides the emotional distress some people feel
>> at the abuse they get in response to forged postings,
>> and the potential loss of reputation capital, is that people
>> keep trying to call their ISP to get them shut down,
>> and some ISPs do this sort of thing, squashing abusive-sounding customers
>> first and asking questions later.  Ok, soon-to-be-ex customers...
>
>Yes, this is one of the problems. Earlier this year pedophile Chris Lewis
>from Northern Telecom forged a bunch of spam e-mail to look like it came
>from dm.com (my domain).  I got about 500 obnoxious e-mails, which I
>semi-automatically responded to, and had a rather unpleasant conversation
>with the assholes at my upstrea (PSI): "If you prove that this e-mail didn't
>originate at your site, you will not be held responsible".

If you could find a competant jury you would be able to show breach of
contract
had they done anything, because they should know better than to believe
forgeries.
Admittedly this is a major hassle you should not have to endure.


------------------------------------------------------------
      David Honig                   Orbit Technology
     honig@otc.net                  Intaanetto Jigyoubu

Information is a dense, colorless, odorless material readily transmitted
across empty space and arbitrary boundaries by shaking charged particles.

David Honig <honig@otc.net> writes:

> At 07:53 AM 12/3/97 EST, Dr.Dimitri Vulis KOTM wrote:
> >Bill Stewart <stewarts@ix.netcom.com> writes:
> >
> >> The real problem, besides the emotional distress some people feel
> >> at the abuse they get in response to forged postings,
> >> and the potential loss of reputation capital, is that people
> >> keep trying to call their ISP to get them shut down,
> >> and some ISPs do this sort of thing, squashing abusive-sounding customers
> >> first and asking questions later.  Ok, soon-to-be-ex customers...
> >
> >Yes, this is one of the problems. Earlier this year pedophile Chris Lewis
> >from Northern Telecom forged a bunch of spam e-mail to look like it came
> >from dm.com (my domain).  I got about 500 obnoxious e-mails, which I
> >semi-automatically responded to, and had a rather unpleasant conversation
> >with the assholes at my upstrea (PSI): "If you prove that this e-mail didn't
> >originate at your site, you will not be held responsible".
> 
> If you could find a competant jury you would be able to show breach of
> contract
> had they done anything, because they should know better than to believe
> forgeries.
> Admittedly this is a major hassle you should not have to endure.
I suspect that if the assholes at PSI pulled my plug and I sued them for
breach of contract, the case would never get to the jury.  A judge would
toss it.  You see, I'm an ISP.  Most ISP's contracts with their backbones
say explicitly that the backbone can pull the plug any time it wants to
for no reason and with no warning.  There are very few backbones and they
all talk to each other and basically have a cartel.  it's not like if you
don't like PSI's standard ISP contract, you can go to Sprint and get a
better one; they're a cartel with very little competition. Indeed, it's
highly unusual even to have a language requiring the backbone to give a
notice before pulling your plug.

I might have a good cause of action against Chris Lewis, but the asshole is
in Canada. (I found out the forger's home address. I hope someone blows his
fucking brains out, for he surely deserves to die.) In what court would I
sue him (for interfering with my contractual relations with PSI)?

If you're an individual user and check your contract with your ISP, you'll
likely see that the ISP too can pull your plug any time it feels like it for
no reason, and doesn't even have to turn over to you your files, e-mail, etc.
If a forger (like Chris Lewis) forges something objectionable in a user's
name and the ISP has to spend a lot of time responding to the complaints,
it's not unusual for the ISP to get rid of the controversial user even though
the user hasn't posted the traffic that's causing the complaints.
If there was more competition in the field, the ISP would have to demonstrate
abuse by the user to pull the user's plug.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

At 12:07 PM 12/4/97 EST, Dr.Dimitri Vulis KOTM wrote:
>I might have a good cause of action against Chris Lewis, but the asshole is
>in Canada. (I found out the forger's home address. I hope someone blows his
>fucking brains out, for he surely deserves to die.) In what court would I
>sue him (for interfering with my contractual relations with PSI)?

Just so you can quit whining...

This topic was recently covered in a Spam seminar that was sponsored by
EFGA.  Based on the case of Jones vs. National Inquirer, you claim to have
an action perpetrated against an individual (you) in your home state.  You
file in either federal or state court of your state.  If, as in the recent
Texas case brought by Flowers.com and TISPA against a spammer, the
defendant does not show, there is a high likelihood that you will be
awarded damages.  There is a company in North Carolina that will collect
the judgement out of Canada for you.

In most matters where I have been involved with Chris Lewis, I have tended
to side with Chris.  Your question was such a simplistic one, that I though
it deserved an answer.


  -- Robert Costner                  Phone: (770) 512-8746
     Electronic Frontiers Georgia    mailto:pooh@efga.org  
     http://www.efga.org/            run PGP 5.0 for my public key

"Robert A. Costner" <pooh@efga.org> writes:

> At 12:07 PM 12/4/97 EST, Dr.Dimitri Vulis KOTM wrote:
> >I might have a good cause of action against Chris Lewis, but the asshole is
> >in Canada. (I found out the forger's home address. I hope someone blows his
> >fucking brains out, for he surely deserves to die.)
[snip]
>
> In most matters where I have been involved with Chris Lewis, I have tended
> to side with Chris.

Therefore you're a censorous cocksucker and an asshole.  Fuck you.

C, P, & G. Lewis reside at:
483 Vances Side Road (Box 124),
Dunrobin (a suburb of Ottawa),
Ontario K0A 1T0, Canada,
home tel: +1 613 832 0541, office tel: +1 613 763 2935

I hope some homicidal maniac makes use of this information.

Chris Lewis uses the resources of his employer, Northern Telecom / Bell North
Research, to forge his cancels. Complaints about Chris Lewis should be sent
directly to Human Resources. That way they go directly into his personnel file
for safekeeping and remain unadulterated by his chain of command. Nortel does
not have a security officer in personnel (incredible as it seems, it's true),
so use the director as follows:

Jim Young, Director, Human Resources
Tel: +1 905 863 4636
Fax: +1 905 863 8300 (one of three faxes, so call for the others if line is busy)
E-mail: jamesy@bnr.ca

Main Nortel switchboard is at +1 613 763 2935.

Below is the chain of command for Chris Lewis, but beware of complaints to
them as they try to cover up for each other:

* David R. Niles, Assistant Vice-President
Research and Development for Infrastructure
Information Systems
Tel: +1 613 763 8635
Fax: +1 613 765 3893
Home address: 624 Glenside Terrace, Orleans, Otario K4A 2B6, Canada
Home tel: +1 613 834 2006

* Reginald I. "Reg" Foulkes, Director
Messaging and Security
Internet & Security Systems 8M80
Tel: +1 613 763 4131
E-mail: riskit@bnr.ca, v2ksys@bnr.ca
Home address: RR 2 Stn main, Trenton, Ontario K8V 5P5, Canada
Home tel: +1 613 392 5042

* Seema Goel, Manager 8M86
Tel: +1 613 763 9161
E-mail: secdevco@bnr.ca
Note that this e-mail address is sometimes used by another woman
named Marie L. Lewis.

* Chris Lewis, 8M86
Tel: +1 613 763 2935
Home address as above.

Also cc: all complaints to the following:

* Marie L. Lewis
Messaging and Security Infrastructure
Tel: +1 613 763 3495

* Marcus Leech
Tel: +1 613 763 9145
Fax: +1 613 765 1407
e-mail: mleech@bnr.ca
Home: RR 3 Stn Main, Smiths Falls, Ontario K7A 4S4, Canada
Home tel: +1 613 283 3711

At 07:31 AM 12/5/97 EST, Dr.Dimitri Vulis KOTM wrote:
>"Robert A. Costner" <pooh@efga.org> writes:
>
>> At 12:07 PM 12/4/97 EST, Dr.Dimitri Vulis KOTM wrote:
>> >I might have a good cause of action against Chris Lewis, but the
asshole is
>> >in Canada. (I found out the forger's home address. I hope someone blows
his
>> >fucking brains out, for he surely deserves to die.)
>[snip]
>>
>> In most matters where I have been involved with Chris Lewis, I have tended
>> to side with Chris.
>
>Therefore you're a censorous cocksucker and an asshole.  Fuck you.

My!  What language!  And without a remailer.

At least the "snip" part gave you instructions on how to follow proven
legal procedure to file against alleged spam in a situation like this, so
you no longer have to whine about Chris Lewis being in Canada and you not
having a clue as to how to deal with it.


  -- Robert Costner                  Phone: (770) 512-8746
     Electronic Frontiers Georgia    mailto:pooh@efga.org  
     http://www.efga.org/            run PGP 5.0 for my public key

Bill Stewart <stewarts@ix.netcom.com> writes:

> The real problem, besides the emotional distress some people feel
> at the abuse they get in response to forged postings,
> and the potential loss of reputation capital, is that people
> keep trying to call their ISP to get them shut down,
> and some ISPs do this sort of thing, squashing abusive-sounding customers
> first and asking questions later.  Ok, soon-to-be-ex customers...

Yes, this is one of the problems. Earlier this year pedophile Chris Lewis
from Northern Telecom forged a bunch of spam e-mail to look like it came
from dm.com (my domain).  I got about 500 obnoxious e-mails, which I
semi-automatically responded to, and had a rather unpleasant conversation
with the assholes at my upstrea (PSI): "If you prove that this e-mail didn't
originate at your site, you will not be held responsible".

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

At 12:14 AM 12/01/1997 -0500, Robert A. Costner wrote:
>Best I can tell, the only reasonable good purpose for this is to create a
>persistent nym identity without a reply to capability.  

Actually, setting the reply to point to your nymserver address
is the one legitimate use I can see for it, though that
capability probably should be provided by the nymserver.
The reason for chaining through remailers is to gain anonymity.

>I would think the best way to put in a persistent nym capability would be
>to database the PGP key id's along with the persistent identity.  

But you don't need a special anonymity server to do that;
a keyserver plus either a personna certificate or some archiving mechanism is enough.
The certificate shows that you're the first+only person at that
certificate issuer to use the name you've chosen; the archive
shows that the first poster using the name <nym> used PGP Key <key>.
I have a PGP key I use for signing pseudonyms which performs
the personna certificate function - I'll verify uniqueness
of keys that I've signed.  

> This also keeps someone from stealing another's reputation capital.
The PGP signature key is enough to do that, and without the 
digital signature there's no way to prevent forgery.
(I've got mixed feelings about whether to sign a key for a 
name who has a known history without having the key attached.  
I've signed Black Unicorn's, but the other nyms I've signed have been 
for users who announced their key along with their initial use of the nym.)

				Thanks! 
					Bill
Bill Stewart, stewarts@ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639