From: css@netcom.com (Chris Schefler)
Date: Sun, 23 Jan 94 13:56:33 PST
To: cypherpunks@toad.com
Subject: No Subject
Message-ID: <199401232150.NAA15458@mail.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


On Jan 22, Eric Hughes wrote:
> 
> Tim mentioned that he'd had some problems getting stuff back from the
> list.  Others have sent me mail wondering about strange formats from
> the mailer.  Well, toad got mailbombed.
> 
> The culprit--and no attempt at anonymity here--was 'css@netcom.com'.

So far you're right on...no attempt at anonymity.  I have never felt the
need to cower behind anonymity.  I take responsibility my actions, right
or wrong.  
> 
> He was trying to get off the list by sending to
> owner-cypherpunks@toad.com. 

You're batting 1000!

> Well that address is a bounce handling
> address, and I don't read it very often, and then I ignore
> non-computer generated messages.  Two words: clueless and projecting.
> 
> He made at least three separate kinds off attacks: sending mail back
> to posters to the list, sending mail back to the list at large, and
> mailbombing toad with UNSUBSCRIBE x 200 messages, many (several dozen)
> at a time.

Okay, you're starting to veer away from reality a bit here.  Yes, I did
all those things.  But it was not an 'attack'.  I started out sending
unsubscribe requests to *both* owner-cypherpunks and cypherpunks, every
few days.  Those were the only addresses I had.  I was last week receiving
50 messages a day.  I accidentally deleted some of my real mail going
through and deleting all yours.  As I have said many,  many times, I
thought I was subscribing to a periodic newsletter.  There was no warning
that I would receive 50 messages a day, and apparently no mechanism for
gettin of the list once I was on.  I simply made ever more vehement requests
to be removed from your list.  As each one was ignored, I stepped up the
volume of my requests.  After about 10 days of no response (short of some
foul-languaged vicious flames from your readers furious because I bounced
one or two of their letters - but they couldn't understand why I was 
unhappy about receiving 50 unwanted letters a day).  What you call a
'mailbomb' was the only action out of everything I tried which actually
got some response.  Let's stay clear on this:  all I ever wanted, and
all I want now, is TO BE REMOVED FROM THIS LIST.  I am still receiving
messages even though the administrator told me after the 'mailbomb'
that he had removed me from the list.

> 
> What is humorous to me is not the lost sysadmin time (hours) but the

Why would that be humorous?         

> lack of sophistication in the attack.  No attempt at hiding identity,
> lack of creativity in bomb content, lack of specificity in targeting.

I don't hide.  In fact, hiding would have undermined my purpose.  I was
trying to draw attention to my ignored requests to be removed from your
list--that's all.  No secret spy-novel conspiracy stuff here.  

Stay clear on this:  I have no desire whatsoever to waste your time or
undermine your ability to have your forum.  I simply demand to be 
excluded.

You seem to be framing this as some sort of terrorist action.
Once again, I was just trying to get some response to my ignored requests.
By the way, I sent a warning out several days before the 'attack' stating
that if I did not get removed, I would try to shut down your remailer.
That got no response.  And, in all my protests before the
'attack', I got many flames from you people but nobody told me how I
could GET OFF THE LIST.

> 
> For example, he could have forged a post to one of the .test groups in
> usenet with the list administrator (me) as target.  Hundreds of
> messages would have flowed in to my mailbox over the next week,
> cramping my ability to use my inbox.  Such a forgery could be done,
> say, by using an anonymous poster and gluing in a Reply-To: field.
> 
> Or even better might have been picking a large mailing list that
> doesn't rewrite header fields and making sure that it leaves the
> mailer with 17 Received: fields and an Errors-To: field pointing to
> the victim.  The cypherpunks alias on toad, for example, tacks on 3
> Received fields in addition to the one or two that your mailer uses,
> but you can just add empty Received: fields--the code that bounces
> mail when it sees more than 17 (or 18-21, depending) Received: fields
> doesn't look at their contents.  These fields can be added with
> outgoing ## header pasting, for example.  I do not recommend using the
> cypherpunks mailing list for this purpose, however.
> 
> Eric
> 
Now you've really lost me.  Presumably, you did not like the fact that I
shut down your remailer.  But the very next day you send me a step-by-step
guide on how to do it more effectively and with anonymity.  Go figure.

Oh, I think I understand now.  You're trying to give people ideas about
how to bomb me, right?  Trying to start a war??  Am I mistaken in sensing,
Eric, that you are enjoying this?  Well, I am not.  Why don't you just
do the reasonable, mature thing and just allow me to be excluded from
your forum.

Again, again, again: I have no desire to sit around trying figure out 
ways to cause you trouble.  All I want is one thing.  Can you guess 
what that is?  I thought you could.

I don't want anonymity.  My name is Chris Schefler.  I WANT OFF YOUR LIST.
If you do not take me off, I will take appropriate measures again.  
Perhaps I will take some of your suggestions.

As I said, I am still receiving your messages.

Eric - what is the problem.  What don't you understand about this:

TAKE ME OFF YOUR LIST.  NOW.  Get on with your life, please, without me!
>