Subject: Re: draft-ietf-usefor-usepro-02

From: John Stanley <[email-masked]>
Date: Mon, 27 Dec 2004 13:07:37 -0800 (PST)

Seth Breidbart <sethb@xxxxxxxxx>:

>> Were that as far as it goes, fine. It isn't. The next step is the 
>> pretense. "You may not use this address".

>It's not a pretense, and it's saying "I won't let you use this address
>_now_."

 pre-tense n.
    1. a claim, esp. an unsupported one, as to some
       distinction or accomplishment; pretension
    2. a false claim or profession
    3. a false show of something

Yes, it certainly is a pretense, and "_now_" is the only time that 
matters. NOW is when the posting is being made, and NOW is when the 
posting is most likely most relevant to anything.

>> This statement demonstrates the farce. It might not be verified
>> because it is impossible to verify.

>It's certainly a reasonable policy to say "If you can't verify it to
>me, then I won't let you use it."

You are continuing the farce. You are pretending that it is possible,
in the general case, to verify an arbitrary address. That only leaves
"can't verify", and thus it is a poor policy to say "you can't use an
address you can't verify to me". It's like saying "you can withdraw your
money from this bank on the days when the sun comes up in the west." Part
of the condition being required will NEVER happen, so the whole statement
is a farce.

>They could send you a token and ask you to prove you received it.

Right. Turn a ten second process for posting an article into a three day
adventure. 

>No, what they know is which ones they know to be valid, and which ones
>they don't know to be valid. 

And since they DO NOT KNOW, they should DO NOTHING SPECIAL.

>Not knowing that something is valid is
>not the same as knowing that it isn't valid.

Not when the result is that it is treated as if it is not valid.

>Do you know that I am wearing shoes right now? 

I neither know nor care, nor do I intend on doing anything based on my
lack of information. That's how news agents should act. They don't know,
they ought to do nothing based on information they don't have.

>It _can_ make the determination "You have not demonstrated to me that
>you own the account you wish to post as."

Big F'ing deal. So what? In most cases, it simply cannot be done. Get over
it. Stop pretending that the news agent is the arbiter of who you are and
what addresses are valid for you.

>> MAY is a permissive word meaning they are permitted to do something. If 
>> they are not permitted to do something, then we are wrong.

>MAY means the _site_ is permitted to do something. 

Not when we say the _poster_ MAY do something. That is clearly and 
unambiguously a statement about what the POSTER may do. If we tell the 
poster he MAY do something, we have no business saying that the site can 
tell him otherwise. Otherwise, there is no purpose for the standard and we 
should just stop right now.

>> The draft makes no such fine distinction in tenses. "Likely to be 
>> crossposted to" is open-ended. Even so, given the instructions we provide 
>> for followup agents, and observed conditions on the net, a group that HAS
>> BEEN crossposted to is very likely to be crossposted to again. Not just 
>> "likely", VERY likely.

>So you claim; but I can show examples otherwise.

Unfortunately for your argument, this would be proving a negative, and 
that you cannot do. The fact that it has not happened in a certain case 
does not prove that it is not likely to happen, only that it did not 
happen in that specific case. And I think anyone who has seen crossposting 
wars knows that the likelyhood of a group appearing a second time is 
extremely high, even if you consider the fact that it has already happened
as anything other than proof that it has already happened and already 
meets the "likely" standard. (Note that it is not "likely again", just
"likely", in our draft.)

>> Since I have already, the answer is yes, I am very likely to graduate. It 
>> is a certainty.

>Not in the language I speak.

Well, this draft is in english, and that is the language _I_ speak, so 
you'll just have to accept that, while it may not be true in whatever 
language YOU speak, it is true in english. Something that has already 
happened is "very likely" to happen. You cannot unring the bell.

>> We ought to tell them MUST, since we also tell users they MAY use them.

>Sites don't MUST accept _anything_.  Are you saying that spammers
>using .invalid should get a free pass?

Please read what is actually written and stop making stupid things up. I 
don't recall saying anything about spamming or "free pass", and if you can 
find anything that I've said about either, please feel free to produce it, 
or the apology for implying it was said.

What I DID say, if you read the words, is that we tell POSTERS that they 
MAY use .invalid. If we say they MAY use it, then we cannot honestly tell 
sites that they don't have to accept it. It's a contradiction. 

What sites accept as far as UCE or UBE or whatever has NOTHING to do with 
the address that appears in the From header, and you ought to know better.

>> What is the global harm saying they must accept the standard way of 
>> denoting an invalid address?

>Preventing them from doing what they want which doesn't harm anyone
>else.

Excuse me? Telling the user, who WE have told MAY use an invalid address
crafted in an obviously invalid way, that he must use a VALID and
spammable address in his USENET postings is NOT harming him? I'm happy for
you that you don't get buckets of spam and don't have to pay for the
transport of same, but in the real world quite a bit of time and money
goes towards that problem, and not giving spammers a "free ride" by
handing them spammable addresses is a Good Thing, and doing otherwise DOES
cause them harm. That's the entire reasoning behind the .invalid address 
scheme.  It's a bit late to claim that it isn't a Good Thing.

>"Here's the standard way of doing things.  Some sites don't allow you
>to do that despite it being the standard way of doing it at sites that
>do allow it."

We just told them they may do it. Either we tell them they may do it or we 
don't. 

>Or would you claim that sites are required to allow crossposts to 9
>newsgroups because that's the "standard way" to have a posting show up
>in those 9 newsgroups?

Does our draft explicitely say that people MAY crosspost to 9 groups? I 
don't think so. Were we to say that, then yes, I would claim that OUR 
telling people they MAY do something is binding on the servers which 
deal with that. That's why this is a "standard" and not just "hints".

>> So, I use an address from one of my other domains. They say "no". And yet
>> I'm using a valid and working address. I'm following the stated rule, and 
>> yet, I am not permitted to post. Why is that?

>Because your interpretation of the rule they stated isn't the same as
>their interpretation of it.

It is simple english. It is pretty hard to misinterpret. They are 
misinterpreting it because the implication they have gotten from 
our draft is that they CAN, indeed, validate email addresses and thus CAN
tell me that my address is invalid. Even with all of the "forget for a 
moment" clauses in the description of the situation. 

I want that error removed. This draft is the cause. It can be corrected.

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 27 Dec 2004 16:52:18 -0500 (EST)

> Yes, it certainly is a pretense,

Where is the pretense?  It is saying something that's absolutely
correct.

> and "_now_" is the only time that matters. NOW is when the posting
> is being made, and NOW is when the posting is most likely most
> relevant to anything.

Or, perhaps, "now + 30 seconds" is when the posting will be made,
after the poster verifies the ability to use that address.

> in the general case, to verify an arbitrary address.

No, I'm not.  I'm stating that in some cases it is possible to verify
some addresses.  I'm stating that it is a _reasonable_ policy (not the
only possible policy, merely one of many reasonable ones) to allow
posting only with verified addresses.

> That only leaves "can't verify", and thus it is a poor policy to say
> "you can't use an address you can't verify to me".

I don't understand that statement at all.

> It's like saying "you can withdraw your money from this bank on the
> days when the sun comes up in the west."

No, it's like saying "You can withdraw your money from this bank after
you've proven that it's your money."

> Part of the condition being required will NEVER happen, so the whole
> statement is a farce.

Why do you claim I can never verify that I have the right to use a
particular email address?

I've verified the ability to use the one I'm sending this from to
Panix.

I could easily verify it to google (I might even have done so in the
past).

> Right. Turn a ten second process for posting an article into a three
> day adventure.
  ^^^
YM "minute"  HTH

> And since they DO NOT KNOW, they should DO NOTHING SPECIAL.

That is, they shouldn't post the article?

> Not when the result is that it is treated as if it is not valid.

I don't think I want to deposit money in the bank you run.  You'll let
anybody have it unless there's proof they aren't me.

> they ought to do nothing based on information they don't have.

There's no reason that every news agent in the world must act in the
way that you think they ought to.  Their policies are up to their
owners and administrators.

> Big F'ing deal. So what? In most cases, it simply cannot be done.

In some cases it can, in some it can't.  In most cases where the
account actually belongs to the poster, it can.

> Get over it. Stop pretending that the news agent is the arbiter of
> who you are and what addresses are valid for you.

I'm not pretending that it is.  I'm saying that it's the arbiter of
which addresses IT will let me use.

> Not when we say the _poster_ MAY do something.

The poster MAY do something.  The site is not required to accept it.

> That is clearly and unambiguously a statement about what the POSTER
> may do. If we tell the poster he MAY do something, we have no
> business saying that the site can tell him otherwise.

The site will tell him what it wants, no matter what we say.

Or do you want to say that a site which says "I won't let you post
that article because you didn't pay your bill" is non-compliant?

> that you cannot do.

I've proven many negatives.

> The fact that it has not happened in a certain case does not prove
> that it is not likely to happen, only that it did not happen in that
> specific case.

Nor did I say otherwise.

> And I think anyone who has seen crossposting wars knows that the
> likelyhood of a group appearing a second time is extremely high,

Even to
alt.mycatcreatedthisnewsgroup.asdjkl32587iodjklgu8904756o2i5hgoi9834ht?

> happened is "very likely" to happen. You cannot unring the bell.

I'm sorry that your language doesn't have tenses, but English does.

> sites that they don't have to accept it.

If sites *have to* accept it, then they have to accept the articles
where it is used, right?  But those articles might be spam or
otherwise objectionable (to the site's policy).

> It's a contradiction. 

No, it isn't.

> What sites accept as far as UCE or UBE or whatever has NOTHING to do
> with the address that appears in the From header, and you ought to
> know better.

Sites can have their own policies for what they'll accept in that
header.

> spammable address in his USENET postings is NOT harming him?

Telling the user that he must follow the terms of service that he
agreed to when he signed up for the account is not harming him, even
if you want a standard that's more lax.

> I'm happy for you that you don't get buckets of spam and don't have
> to pay for the transport of same, but in the real world quite a bit
> of time and money goes towards that problem, and not giving spammers
> a "free ride" by handing them spammable addresses is a Good Thing,
> and doing otherwise DOES cause them harm. That's the entire
> reasoning behind the .invalid address scheme.  It's a bit late to
> claim that it isn't a Good Thing.

I'm not saying that it isn't a good thing.  I'm saying that you (or
we) can't control sites' policies, and we shouldn't pretend we can.

> We just told them they may do it. Either we tell them they may do it or we 

As far as _we_ are concerned, they may.  Their site might feel
otherwise.

Are you saying that sites may not put a size limit on messages, or
otherwise constrain them more than we do?

> It is simple english. It is pretty hard to misinterpret.

Yet you managed to.  Their rule is "Postings made through this server
must carry the address assigned to you by this company in the From
header."

> They are misinterpreting it because the implication they have gotten
> from our draft is that they CAN, indeed, validate email addresses
> and thus CAN tell me that my address is invalid.

The fact that they CAN validate some email addresses does not imply
that they know whenever an email address in invalid.  As I've said
consistently, what they know is that the person attempting to post has
not validated that email address to them.

Seth