Even challenges are evil (Blacklist feature will be dropped)

On Mon, 18 Oct 2004, Erez Zadok wrote:

> In message <[email protected]>, Marco Paganini writes:

> > Given some recent (and other not so recent) events where clueless people
> > added mailer-daemon or a mailing-list address to their blacklists, I decided
> > to drop the blacklist feature *entirely* for future versions of ASK.
>
> Sigh.  I briefly read the messages above.
>
> I don't know Marco.  Personally, I don't think you should give in to a few
> misinformed idiots.  You've developed great and very useful software!  Don't
> cripple it as a "quick fix" to those who yell (and if Debian wants to drop
> ASK, let them -- Debian users who want ASK will know where to get it, or
> they'd switch to another distro.)

I have a different opinion here. I think it's great for ASK to benefit
from Debian's rich infrastructure, and that Marco stayed admirably
cool while under the flamethrower.


> I also think it's a bad idea to change visible user behavior in any widely
> used software, esp. taking away features, and esp. while in the middle of a
> release (in 3.0, that'd be fine, IMHO).  I've used 2.5.x for a while and I
> consider it rock solid (so don't tell me "it's only alpha/beta quality
> anyway" :-)

Sure taking away features is not good generally speaking. On the other
hand, removing a feature which sole purpose is to send hate mail does
not seem like a major and "crippling" change to me.


> I'd be more in favor of changing the default behavior of blacklist: make it
> ignore and drop the mail by default.

I think it's more or less what Marco has planned to do.


> But please give me the ability to send
> a nastygram to those I really care to do so (very few people, in my case,
> who've abused my email significantly).  You can create an undocumented (not
> even in the FAQ) "expert" flag if you'd like that, if enabled in .askrc,
> will send a nastygram and not just drop the mail.  And while it won't
> completely eliminate the risk of bounce loops, it might minimize it enough
> to a reasonable compromise between the haves and have-nots.

I think a better way to do that could be to leave the old code
commented out in the source, without any documentation at all. The
documentation would say that the feature is deprecated and not longer
available. Only users who dive into the code (and in this mail archive
:-) would know about it, and would have to modify the code, which is a
significant border to cross, really moving the responsibility further
away from the developer and package maintainers.

But even that might be considered offensive. Everyone please consider
the point of view of ASK-opponents. Not all of them are obsessed like
Karsten; most of them have a valid point: it's not because the SMTP
system is fundamentally broken (not implementing the slightest piece
of authentification and abuse control at all) and massively abused
that no one should care and not try to be "good citizens". Why?
Because even if spam has gone up to amazing levels, every spurious
message still has a cost.  Every spurious auto-response is still an
extra burden for system and network administrators and even end users.
In this regard, we _have to_ that admit challenge-response systems
like ASK are "evil". As Marco usually puts it: CR systems did not
create the problem, _but_ they contribute to it.

I know ASK is evil, but I still use it because I am admittedly a bit
"selfish" and because I consider it's not my job to fix SMTP. It's the
job of vendors, ISP's, IETF's, whatever. I'll become a better citizen
when the big guys will do their part. I promise.

So if challenges are already a (necessary?) evil, what about
nastygrams and blacklists? Really not required. Let's not push this
too far, and be happy that a CR system is accepted in Debian. We all
can leave without nastygrams.



-- 
"Je n'ai fait cette lettre-ci plus longue que parce que je n'ai pas eu
le loisir de la faire plus courte." -- Blaise Pascal



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl