From: Hal <hfinney@shell.portal.com>
Date: Mon, 14 Feb 94 18:11:32 PST
To: cypherpunks@toad.com
Subject: Detweiler abuse again
Message-ID: <199402150209.SAA13346@jobe.shell.portal.com>
MIME-Version: 1.0
Content-Type: text/plain


I got a lot of complaints today about copies of Tim's old "Blacknet" posting
being sent to inappropriate groups:

>  From paw@coos.dartmouth.edu  Mon Feb 14 09:34:13 1994
>  Date: Mon, 14 Feb 1994 12:31:44 -0500
>  From: paw@coos.dartmouth.edu (Pat Wilson)
>  To: hfinney@shell.portal.com, root@portal.com, postmaster@portal.com
>  Subject: Re: Introduction to Blacknet
>  Newsgroups: comp.sys.sun.admin
>  References: <199402120837.AAA22008@jobe.shell.portal.com>
>  Status: R
>  
>  In comp.sys.sun.admin you write:
>  
>  >Introduction to BlackNet
>  
>  [etc]
>  
>  I believe that this is an illegal and unethical use of the Net 
>  for commercial purposes (to say nothing of bounds of decency).  
>  This posting lends credence to all sorts of (US) gov't paranoia.
>  Please cease and desist immediately.  
>  
>  Non-anonymously,
>  
>  -- 
>  Pat Wilson
>  Maanger, Academic Unix Systems Group
>  Dartmouth College
>  paw@northstar.dartmouth.edu
>  
>  From mcr@unison.com  Mon Feb 14 10:11:51 1994
>  Date: Mon, 14 Feb 1994 10:11:22 -0800
>  To: hfinney@shell.portal.com
>  From: mcr@unison.com (Michael Riehle)
>  X-Sender: mcr@hal822.unison.com
>  Subject: Introduction to Blacknet
>  Status: R
>  
>  This message appears to be from someone who is offering an illegal service
>  and is certainly not welcome.  I can't tell if this person is serious or if
>  this is just a sick joke.  It certainly isn't appropriate regardless.
>  
>  >Date:         Mon, 14 Feb 1994 00:50:01 +0000
>  >Reply-To: HP-3000 Systems Discussion <HP3000-L@UTCVM.UTC.EDU>
>  >Sender: HP-3000 Systems Discussion <HP3000-L@UTCVM.UTC.EDU>
>  >Comments:     This message is NOT from the person listed in the From line.  It
>  >is from an automated software remailing service operating at that address. 
>  >Please report problem mail to <hfinney@shell.portal.com>.
>  >Comments:     Warning -- original Sender: tag was NETNEWS@AUVM.AMERICAN.EDU
>  >From: nobody <nobody@SHELL.PORTAL.COM>
>  >Subject:      Introduction to Blacknet
>  >To: Multiple recipients of list HP3000-L <HP3000-L@UTCVM.UTC.EDU>
>  >
>  >Introduction to BlackNet
>  >
>  > [...]
>  
>  From kwthomas@nsslsun.nssl.uoknor.edu  Mon Feb 14 12:38:27 1994
>  Date: Mon, 14 Feb 94 14:37:01 CST
>  From: kwthomas@nsslsun.nssl.uoknor.edu (Kevin W. Thomas)
>  To: hfinney@shell.portal.com
>  Subject: Re: Introduction to Blacknet
>  Newsgroups: comp.sys.sun.admin
>  In-Reply-To: <199402120837.AAA22008@jobe.shell.portal.com>
>  Organization: National Severe Storms Laboratory
>  Cc: root@shell.portal.com, root@jobe.shell.portal.com
>  Status: R
>  
>  In article <199402120837.AAA22008@jobe.shell.portal.com> you write:
>  >Introduction to BlackNet
>  >
>  >BlackNet is currently building its information inventory. We are interested
>  >in information in the following areas, though any other juicy stuff is
>  >always welcome. "If you think it's valuable, offer it to us first."
>  >
>  >- trade secrets, processes, production methods (esp. in semiconductors)
>  >
>  >BlackNet can make anonymous deposits to the bank account of your choice,
>  >where local banking laws permit, can mail cash directly (you assume the
>  >risk of theft or seizure), or can credit you in "CryptoCredits," the
>  >internal currency of BlackNet (which you then might use to buy _other_
>  >information and have it encrypted to your special public key and posted in
>  >public place).
>  
>  This doesn't belong in "comp.sys.sun.admin", or any other Usenet group.  It's
>  postings like this that give Usenet a bad name.
>  
>  	Kevin W. Thomas
>  	National Severe Storms Laboratory
>  	Norman, Oklahoma
>  
>  From lab@biostat.mc.duke.edu  Mon Feb 14 14:05:15 1994
>  To: hfinney@shell.portal.com
>  Subject: Re: Introduction to Blacknet
>  In-reply-to: nobody@shell.portal.com's message of Mon, 14 Feb 1994 11:32:23 -0800
>  Date: Mon, 14 Feb 1994 17:04:09 -0500
>  From: "Lance A. Brown" <lab@biostat.mc.duke.edu>
>  Status: R
>  
>  What _IS_ this doing in misc.health.diabetes?
>  
>  Thanks,
>    Lance
>  
>  
>  nobody  <nobody@shell.portal.com> writes:
>  > Introduction to BlackNet
>  
>  
>  > Your name has come to our attention. We have reason to believe you may be
>  > interested in the products and services our new organization, BlackNet, has
>  > to offer.
>  > [...]
>  
>  From appel@cea.Berkeley.EDU  Mon Feb 14 14:24:03 1994
>  To: hfinney@shell.portal.com, root@shell.portal.com
>  Subject: Re: Introduction to Blacknet
>  In-reply-to: nobody@shell.portal.com's message of Sat, 12 Feb 1994 03:49:18 -0800
>  Date: Mon, 14 Feb 1994 14:23:06 -0800
>  From: Shannon Appel <appel@cea.Berkeley.EDU>
>  Status: R
>  
>  Please be aware that your anonymous remailer is being abused.  The
>  following inappropriate post was recently sent to a rec.games.frp
>  group.  Please see that this type of thing does not happen again.
>  
>  Shannon
>  --
>  > Introduction to BlackNet
>  > 
>  > 
>  > [...]

I set up a log file for "blacknet" postings, and got this:

> From hal@alumni.cco.caltech.edu  Mon Feb 14 17:46:41 1994
> Received: from nova.unix.portal.com (nova.unix.portal.com [156.151.1.101]) by jobe.shell.portal.com (8.6.4/8.6.4) with ESMTP id RAA11362 for <hfinney@shell.portal.com>; Mon, 14 Feb 1994 17:46:41 -0800
> Received: from punisher.caltech.edu (punisher.cco.caltech.edu [131.215.48.151]) by nova.unix.portal.com (8.6.4/8.6.4-1.13) with ESMTP id RAA03081 for <hfinney@shell.portal.com>; Mon, 14 Feb 1994 17:46:41 -0800
> Received: from alumni.cco.caltech.edu by punisher.caltech.edu with ESMTP 
> 	(8.6.4/DEI:4.41) id RAA14916; Mon, 14 Feb 1994 17:45:46 -0800
> Received: from localhost by alumni.cco.caltech.edu 
> 	(8.6.4/DEI:4.41) id RAA23534; Mon, 14 Feb 1994 17:45:42 -0800
> Received: from handel.cs.colostate.edu by alumni.cco.caltech.edu with SMTP
> 	(8.6.4/DEI:4.41) id RAA23522; Mon, 14 Feb 1994 17:45:34 -0800
> Message-Id: <199402150145.RAA23522@alumni.cco.caltech.edu>
> Received: by handel.cs.colostate.edu
> 	(1.37.109.4/16.2) id AA28603; Mon, 14 Feb 94 18:45:32 -0700
> Date: Mon, 14 Feb 94 18:45:32 -0700
> From: lawrence detweiler <detweile@CS.ColoState.EDU>
> To: hfinney@shell.portal.com
> request-remailing-to: comp.sys.ti.explorer@news.cs.indiana.edu
> subject: Introduction to Blacknet
> 
> Introduction to BlackNet
> 
> 
> Your name has come to our attention. We have reason to believe you may be
> interested in the products and services our new organization, BlackNet, has
> to offer.
> [...]

It seems Larry is sending this posting to lots of inappropriate groups
using several different mail-to-news gateways.  This is a good way to
get remailers shut down, which may be his ultimate goal.

I call upon remailer operators to block incoming messages from Detweiler's
known aliases.  Thos using the slocal-based "cypherpunks" remailer perl
scripts can add the following lines near the front of their maildelivery
files.

# Filter Detweiler
From ld231782@longs.lance.colostate.edu  file  ?  /dev/null
From 	an12070@anon.penet.fi  		 file  ?  /dev/null
From 	detweile			 file  ?  /dev/null

Unless his access to the remailer network is blocked, he will be able to
continue to abuse the system until it gets shut down.

The alternative would be to block my remailer's access to all known
mail-to-news gateways, but I am reluctant to take that step because of
the loss of this ability for those who legitimately need it.  If his abuse
keeps up, though, that may be the only choice left.

Hal Finney
hfinney@shell.portal.com