Subject: Re: draft-ietf-usefor-usepro-02

From: John Stanley <[email-masked]>
Date: Tue, 28 Dec 2004 12:39:30 -0800 (PST)

Seth Breidbart <sethb@xxxxxxxxx>:

>No, I'm not.  I'm stating that in some cases it is possible to verify
>some addresses. 

Nobody is debating that. The problem comes in the next step, when 
"possible to verify" gets turned upside down and becomes "not permitted
to use". The same philosophy ought to hold: if you don't know, don't 
pretend you do, and don't act based on the lack of info. "I can't verify
this address, so I will act based on that lack of info..." is WRONG.

>Or, perhaps, "now + 30 seconds" is when the posting will be made,

Or perhaps "now + eternity" when the verification cannot be accomplished.
You keep assuming that verification is possible, and yet you just said 
that you were talking about a few cases where it is.

And just as an example, it will take much more than 30 seconds for the 
server to send email to my home system, for my home system to dial in and 
pick up my email, for me to drive home after work so I can read my home 
email, for me to reply, for the reply to get spooled back out, and then 
back to the server. If I'm travelling, it may be a week or more before I
get to my home email. Thirty seconds my ass. Stop pretending you know how 
everyone else's systems work.

And as another example, it will take much more than 30 seconds for the
server to send email to my home system and get any response back when the
address I am using is a spam-trap that goes into /dev/null. And yet, it is
a "valid address" (deliverable) in a valid domain that I am authorized to
use.

>> Right. Turn a ten second process for posting an article into a three
>> day adventure.
>  ^^^
>YM "minute"  HTH

No, ass, I meant what I wrote. If I meant "minute", I would have written
minute. But nice try at putting words in my mouth, again.

>> And since they DO NOT KNOW, they should DO NOTHING SPECIAL.

>That is, they shouldn't post the article?

You think posting an article is the "special" case? Wow. And Wow, you 
think that MOST of the articles that are posted to USENET shouldn't be
posted because the address cannot be verified? That's the result of
"not posting unless verified" being the normal case.

>In most cases where the account actually belongs to the poster, it can.

Wrong. Perhaps at Panix, where they pretend they can, they've convinced
you they can. Not in the real world. The server I use cannot even verify
the address the agents put in for me, much less anything else I might want
to use. (If the server tried to verify the address it wouldn't accept
anything I post, since the agents put in a bogus address BY ISP
CONFIGURATION.) There are an infinite number of addresses it cannot
verify.  I think that counts as a majority over the relatively few that
Panix can.

>>>MAY means the _site_ is permitted to do something. 
>
>> Not when we say the _poster_ MAY do something.

>The poster MAY do something.  

That's what I said. Where did you get "the _site_ is permitted"?

>The site is not required to accept it.

Yes, and that is the contradiction.  If the server doesn't accept it, then
the poster MAY NOT do it. MAY isn't the same as MAY NOT.

>The site will tell him what it wants, no matter what we say.

A clearer statement of abdication is rarely seen here. The site will do
what it wants no matter what we say, so why bother saying anything? If
your opinion is the consensus, and I don't see anyone else opposing it so
it must be, then to whom do we send the email to get the working group 
disbanded?

>Or do you want to say that a site which says "I won't let you post
>that article because you didn't pay your bill" is non-compliant?

Where the fuck do we say that posters don't have to pay their bills? Why 
do you keep making this shit up?  Where do you see anything in the draft
about paying the bill? Is it the same place you see crap about spammers
getting a "free ride"?

>> And I think anyone who has seen crossposting wars knows that the
>> likelyhood of a group appearing a second time is extremely high,

>Even to
>alt.mycatcreatedthisnewsgroup.asdjkl32587iodjklgu8904756o2i5hgoi9834ht?

Yes. Followup agents are instructed to copy (oops, I mean "take") the
content of the previous newsgroups header as the "default" destination
for their new article. Unless the user notices the group and removes it
(which in practice does not happen very much, at least until the 
crossposting is pointed out) it will be in the next article. That's 
"likely" in english. I don't know what it is in your language.

>If sites *have to* accept it, then they have to accept the articles
>where it is used, right? 

If you say so. I didn't say that, but if you think it should be, who am I
to argue?

No, of course not. Don't be stupid. The From header is just one part of 
the message. The discussion is about accepting or rejecting the message 
based on the content of the From header and nothing else. If the message
has some other problem, then it is not being rejected because the poster
used .invalid in the From header, now is it? 

Do you just not have any way of supporting your position, so you'll try to
claim I'm supporting spammers? That's cheap and dishonest.

>Telling the user that he must follow the terms of service that he
>agreed to when he signed up for the account is not harming him, 

IF there were such terms presented to him for his acceptance, you might
have an argument. (There were no such terms in anything I've seen anyplace 
I've posted, so I expect such public presentation of such specific terms 
is rare.) But there is still harm, even if the poster was presented with
such terms and did agree to them. Of course, if you don't pay for 
transport and processing of spam, you don't recognize that harm.

>I'm not saying that it isn't a good thing.  I'm saying that you (or
>we) can't control sites' policies, and we shouldn't pretend we can.

By telling the poster that he MAY do something, we've taken it out of
the realm of "site policy". Otherwise, the ENTIRE standard is "site 
policy" and we have no business pretending we can control anything. Let's
fire off that email to the IETF telling them we've dropped the idea of a 
news standard, ok?

>>>Because your interpretation of the rule they stated isn't the same as
>>>their interpretation of it.
>
>> It is simple english. It is pretty hard to misinterpret.

>Yet you managed to.  

I'm not the one misinterpreting it. Their rule is "must use valid email 
address in From header". When I use a valid address and they reject it,
that's a misinterpretation of their own rule. But they've been mislead 
into thinking they can determine this BECAUSE WE IMPLY TO THEM THEY CAN.

>Their rule is "Postings made through this server
>must carry the address assigned to you by this company in the From
>header."

That's your interpretation of the rule, but that's not "must use valid 
email address". That's just another example of your pretense that "valid" 
and "verified" are the same thing. Or perhaps the rule at Panix is what 
you list. It's not the rule anyplace I post from, and I've never seen it.
And unless I considered Panix to be a spam-trap address, I'd not accept
those terms -- if they were presented to me prior to my signing up. 

But that isn't even a rule that Panix publishes. I've just looked at all
the rules they list, and the rule you state is not one of them. There 
isn't even anything close. So, were I to sign up to Panix, I'd expect to
be able to use any of the nearly infinite number of valid addresses I have
control over. If they don't let you do that, then you need to talk to them
about it. You're paying them for service, they ought to provide it.

>The fact that they CAN validate some email addresses does not imply
>that they know whenever an email address in invalid.

Now you understand. So if they don't know it is invalid, they ought not
to act as if they know it is. 

>As I've said
>consistently, what they know is that the person attempting to post has
>not validated that email address to them.

And that is not the same as using an invalid address, and without knowing
that, there are no grounds for rejecting the article. So, by rejecting
the article, they are pretending to be able to know "invalid" when all 
they know is "unverified". "Unverified" is the normal case. It should not
merit special action -- and since you confused "special" and "posting" 
before, I'll make it clearer: they should not reject an article for having
an invalid From header when they do not know it is invalid.

---

From: Seth Breidbart <[email-masked]>
Date: Tue, 28 Dec 2004 16:14:38 -0500 (EST)

> to use".

If I can't verify you as the owner of that email address, then you
can't use my server to post with that email address.

> The same philosophy ought to hold: if you don't know, don't 
> pretend you do, and don't act based on the lack of info.

I'm not acting, I'm declining to act.

> "I can't verify this address, so I will act based on that lack of
> info..." is WRONG.

I'm acting based on the KNOWN FACT that you have failed to verify the
address you're attempting to use.

> Or perhaps "now + eternity" when the verification cannot be

If you can't verify the address to me, then you can never use it on my
server.

> that you were talking about a few cases where it is.

I'm not assuming that it's possible, I'm stating that my policy
(that's my policy, I'm not requiring that anyone else adopt it)
requires that verification.

> You think posting an article is the "special" case?

Yes, I think a lot more strings are not posted than are posted.

> Wow. And Wow, you think that MOST of the articles that are posted to
> USENET shouldn't be posted because the address cannot be verified?

No, I never claimed that.  I claimed that it's an acceptable policy
for a server to refuse to post articles if the From header can't be
verified to the satisfaction of that server.

It's equally acceptable for a server to allow any From address ending
in ".invalid" to be used.

> That's the result of "not posting unless verified" being the normal
> case.

I'm saying there is _no_ "normal case" but rather that each server can
have the policy its owner desires.

> verify.  I think that counts as a majority over the relatively few that

Actually Panix can verify infinitely many addresses, too.  So now
let's consider reality, instead.

> That's what I said. Where did you get "the _site_ is permitted"?

Are you claiming that the owner of a machine is required to run the
machine the way _you_ want instead of the way _he_ wants?

> Yes, and that is the contradiction.  If the server doesn't accept
> it, then the poster MAY NOT do it. MAY isn't the same as MAY NOT.

You may ask me to post something.  I may decline to accede to your
request.  Those are both "MAY".

> A clearer statement of abdication is rarely seen here. The site will
> do what it wants no matter what we say, so why bother saying
> anything?

To tell it what it ought to do so that interaction with other sites
works properly.

> Where the fuck do we say that posters don't have to pay their bills?

When you said that a poster MAY use ".invalid" and that the server is
therefore REQUIRED to post the message.

> Why do you keep making this shit up?

It's a logical consequence of the rule that you're arguing for.

> crossposting is pointed out) it will be in the next article.

Or there's a Followup-To header.

> No, of course not. Don't be stupid.

So now you agree that a site need not accept an article that has a
 From header ending in .invalid?

> The From header is just one part of the message. The discussion is
> about accepting or rejecting the message based on the content of the
> From header and nothing else. If the message has some other problem,
> then it is not being rejected because the poster used .invalid in
> the From header, now is it?

Where do you think you get the right to decide on policies that sites
must follow?  "Articles must be syntactically valid according to these
rules" is fine, because that affects interoperability.

> is rare.)

They don't get that specific, but they all say that the ISP can do as
it wishes.

> the realm of "site policy".

I don't agree; but if you insist that's the case, we have to put it
back.

> Otherwise, the ENTIRE standard is "site policy" and we have no
> business pretending we can control anything.

We "control" whether or not something is considered well-formed and
standards-compliant.

> I'm not the one misinterpreting it. Their rule is "must use valid
> email address in From header".

Maybe their rule is "must use address you have verified to be valid in
the From header."

> to act as if they know it is. 

If I try to login to your system without giving a password, your
system doesn't know whether or not I'm the owner of the account.  So
why does it act as if it knows I'm not?

>>As I've said consistently, what they know is that the person
>>attempting to post has not validated that email address to them.
>
> And that is not the same as using an invalid address, and without
> knowing that, there are no grounds for rejecting the article.

Without knowing that I'm not you, your system has no grounds for
rejecting my login request.

> So, by rejecting the article, they are pretending to be able to know
> "invalid" when all they know is "unverified". "Unverified" is the
> normal case.

Except for people who want to post, where "verified" is the required
case.

> they should not reject an article for having

But they may, if they so choose, reject an article for not having a
 From header that they do not know to be valid.

Seth