response 75 of 104:

Oct 12 22:17 UTC 1995

I think there is, and I think I've been describing it.  Sure there are
systems that don't go along, but not many and they tend to cave into outside
pressure (see nyx).

response 77 of 104:

Oct 13 19:25 UTC 1995

        Well, there are some rules that seem kind of consistant, but
not on what you guys are squabbling about.

response 79 of 104:

Oct 15 22:51 UTC 1995

        Our reputation isn't an asset as it stands, and for it to become
one, I don't want to see the changes it would have to undergo!

response 81 of 104:

Oct 22 09:49 UTC 1995

        Nice, but that's not what steve and co. keep telling me our
net-reputation is.

response 83 of 104:

Oct 25 06:43 UTC 1995

My personal opinion is that our reputation is good among those sites that
have worked with staff to track down illegal net usage. I have had
users from other sites attack our non-verified mail policy after getting
bombed/spammed, and STeve reported some folks at an internet monitoring
agency who were very surprised that our policy is so open. They were
concerned about these risks, I suspect.

So I think our reputation is quite mixed out there.

I think the momentum to do this has been lost, because of technical problems
in determining the true origin of the mail. without a technical solution
to that problem, the question of limiting mail is academic.

response 85 of 104:

Oct 26 19:13 UTC 1995

        It would certainly appear thus. _Ahem_! Translator, please..

response 87 of 104:

Nov 2 15:44 UTC 1995

        Ah. I see. I'm with you on that one: unless emergent, the problem
shouldn't be handled so dramatically.

response 89 of 104:

Nov 4 07:09 UTC 1995

There are a large number of different ways where this becomes a pain.
For instance.  Suppose 6 nasty people decide they really want to be able
to send mail to some certain site that we've restricted - perhaps it's a
news gateway, perhaps it's a private mailbox.  Grex membership for one
month isn't really all that expensive.  All they need do is find some
innocent person to be the fall guy, send us $ in that person's name, and
use the acct they've created in that guy's name.  Actually, they don't
even have to log in on that account to do stuff - they could setup
"procmail" to act as a proxy on their behalf, and then just mail the
"fall guy" whenever they wanted.

I can think of any number of variations on this basic idea, and most of
them would be a royal pain to sort out.  I've seen plenty of evidence
that the sorts of people who we'd want to block, are precisely the sort
of people who are both capable of, and would enjoy being a pain in this
manner.  In the cases that have arisen, where we might be tempted to do
this, I've never seen any evidence of legitimate traffic passing
through, either before or after, that would be affected by such a block.
So, the pain is great, and the gain is small from building in any such
specialized logic in sendmail.  It's simplier to push the line out a bit
and say "everyone", instead of "everyone but members", accomplishes the
same good, and doesn't put us at the same risk.

response 91 of 104:

Nov 5 09:26 UTC 1995

The technical & administrative aspects interact to form a system; it's
silly to evaluate one without the other.  However, even from a technical
standpoint, it's still not trivial.  The mailer software does have a
"notion" of the "control-address"; nominally the sender, but it wasn't
intended for the use you want to make of it.  Mail originated by on-site
users is fairly easy to classify - but what about mail originated
off-site?  What about .forwards & aliases? And then there are even more
difficult cases, such as mailer daemon messages and the like.  These are
all areas which have already received considerable attention from the
"cracker" community; so there is considerable knowledge out there about
how to trick mail software to do all sorts of perverse things.  It's
easy to design a mechanism that will block all such mail.  It's much
hard to build in a loop-hole, and then to make the promise the loop-hole
won't be misused.

What I'm looking for here is an easy answer for somebody who does, in
fact, want us to "block all mail from grex", but lacks the technical
expertise or know-how to do it themselves.  I'm not at all in favour of
a system that I think would in fact expose us to greater risk, both to
the system as a whole, and also to individual legitimate members.

response 93 of 104:

Nov 5 21:44 UTC 1995

  Marcus, I agree, both admin and tech issues are important; I wasn't
clear which your previous response addressed.  #91 clarifies the tech
problems, thanks.  What do you mean about mail originated by off-site
users?  Aside from .forward files and aliases, can an off-site user
somehow send outbound mail from Grex?

response 95 of 104:

Nov 8 06:06 UTC 1995

There are stilla ny number of betyter ways to get mail sent; why does this
increase the reward for stealing a Grex account to any significant extent?

response 97 of 104:

Nov 8 21:38 UTC 1995

Well, there is that, I suppose, but do we not invite that now, by our open
newuser poicy?  I just don't see that all that much difference is made, but
if staff agrees with you, I'll bow to your collective judgement.

response 99 of 104:

Nov 20 08:53 UTC 1995

perhaps a blanket "solution" is antiethical to a sporadic problem?
  
just a question.