From: eric@remailer.net (Eric Hughes)
Date: Sat, 21 Jan 95 09:12:11 PST
To: cypherpunks@toad.com
Subject: Re: Remailers-in-a-box
In-Reply-To: <199501210129.AA01692@ideath.goldenbear.com>
Message-ID: <199501211711.JAA13370@largo.remailer.net>
MIME-Version: 1.0
Content-Type: text/plain


   From: Greg Broiles <greg@ideath.goldenbear.com>

   In this model, who deals with mailbombs/spams/requests for address blocks?
   It is this sort of administrivia (plus the threat of liability) that
   makes running a remailer troublesome, not a lack of someone's $20/month.

This point is right on.

   I think it's disingenuous to say that "X pays the bills for the network
   link; X purchased the hardware and keeps it running; the box is in X's
   house/office; X is the person who reads complaint mail and responds (or
   fails to); but because Y sends X $20/month, the remailer (and attendant
   liability for its mis/use) belongs to Y."

The whole point of separation of operations and ownership is to
actually separate them.  If the computer/network service owner (X
above) is participating in any _semantically meaningful_ way in the
operation of the remailer service, then they too are part of the
remailer service.  If the computer/network service is responding to
complaint mail, or even getting properly directed complaint mail, they
are exposing themselves to participation in the remailing service.

As with liability for content, the important issue here is the state
of mind of the computer/network operator.  If they know sufficiently
many details about the nature of the remailer operation, the boundary
of separation is breached.  

Unfortunately, the standard mechanism of complaint on the internet is
the postmaster address.  Complainants do not always follow the nice
complaint instructions in the headers of email.  A remailer run out of
a shell account will have postmaster complaints addressed to the
computer/network operator rather than the remailer operator.

Therefore, a second postmaster address is required.  A second
postmaster address means another domain name.  This new domain name
can be either a subdomain or a brand new one.  I don't think it will
matter much, although a domain not related to the computer/network
operator would further the separation.

Now setting up new domain names, while pretty easy, requires the
cooperation of DNS operators.  Typically these connections have been
informal and a low barrier to entry but only if you know somebody who
does domain names.  DNS operation is not yet a separate service to
buy, but I suspect it will become so.  In the meanwhile the offers of
DNS provision by John and Strick are welcome.

   [...] I don't think that anyone - not courts,
   and not the world-in-general - is going to pay attention to that 
   formalism when it's clear that a machine essentially under the control
   of X is being used for 'antisocial' means.

As important as legal protections are, direct action against spammers
attacks the machine infrastructure directly.  A word to the wise
computer/network provider.

Eric