Audit Trails and Relay Blocking Lists

Check out this article on SFGate.com. It's an editorial by David Lazarus that talks about a local arts group being listed on Joe Jared's block list, for running an open relay. Here's a couple of snippets from it:
A little digging revealed that OsiruSoft, based in the Southern California city of Orange, is a one-man operation run by a software programmer named Joe Jared. He began keeping a list of spammers and potential spammers a couple of years ago purely as a way to protect his own computers.
I asked if he had evidence that Theatre Arts' server in fact had been used for spam.
"No," Jared admitted. "But if it had not been, my system would not have found it."

"I have no record of any spam," Jared replied. "But I know how my system operates.
"
The author of the editorial goes to great pains to paint Joe in a bad light.

I think Joe has the right to put whatever he wants into his list, so I disagree with the overall tone of the editorial. But, I'm also concerned for Joe. I think that practical necessity states that a blocking list operator needs to keep an audit trail, in case a listee ever brings legal action.

Legal issues aside, it would also have helped to keep the listed arts group, and the newspaper editorialist, from finding easy ammo to use against Joe. I think the listed group would have understood what was going on a lot easier if there was archived proof that spam was actually relayed through the server.

Do you think the editorial would have been different (or would it even have been written), if when David Lazarus had talked to Joe, if the conversation included "Here's when it was listed. Here's when we received spam through it. Here's a copy of that spam." I think things would have went differently, and Joe would've come off a lot more favorably.

Why does that matter? Because getting other internet users to support a blocking list, to use it, means explaining things so they can understand what it does and why it exists. If they incorrectly think that a list operator simply scans the internet looking for things to block, or if they correctly realize that a list doesn't make proof available to substantiate a claim, they're less likely to believe in you or your goals.

No comments:

Post a Comment

Comments policy: Al is always right. Kidding, mostly. Be polite, and you're welcome to join in, even if it's a differing viewpoint.