Subject: Re: [Asrg] processing mailing list headers (was FeedBack loops)

From: Franck Martin <[email-masked]>
Date: Fri, 14 Nov 2008 16:24:11 +1200 (ANAT)

ok we need to see the problem from the right angle. 

Sometimes when the user clicks the button spam it means unsubscribe, or stop. 

How do we provide this capability to the user (in as simple way) so it really means that. 

Problem: fake headers, the user thinks he/she is unsubscribing while the intended result is to suppress a spam report. 
Keep SPAM button: even if there is an usubscribe button the user may still want to report a spam 

So there is a need for a process at the MUA and MTA to make sure the unsubscribe header is valid and will be honored. 

I think list management functions should be better build in MUA. X-headers for mailing lists has been there for ages but they look like more a waste of space. I may be mistaken but which MxA system process list headers usefully? 

----- Original Message ----- 
From: "Steve Atkins" <[email-masked]> 
To: "Anti-Spam Research Group - IRTF" <[email-masked]> 
Sent: Friday, 14 November, 2008 2:42:03 PM (GMT+1200) Auto-Detected 
Subject: Re: [Asrg] FeedBack loops 

On Nov 13, 2008, at 6:31 PM, Barry Shein wrote: 

>> But second, and this is the much larger problem: widespread 
>> adoption of 
>> this will almost instantly lead to its mass exploitation by spammers. 
> 
> How? Maybe I lack imagination, but why is this any more of a problem 
> than spammers just sending unsub etc requests now? 
> 
> One would hope the path between a customer clicking a spam complaint 
> button and the service provider is reasonably reliable. And the unsub 
> could be verified by the same sort of means it might be verified 
> today. For example I might only execute an unsub from AOL if it came 
> either from a customer who was actually sub'd to the list or from 
> AOL's feedback loop MTA. I suppose an FBL could also set up some sort 
> of asymmetric key pair method at setup. 
> 
> But maybe I'm missing something entirely. 

I think so, yes. 

The suggestion is that the sender of the email can suppress sending 
a report via feedback loop by including an unsubscription link in the 
headers of the mail. 

One flaw with that is that this allows spammers to suppress feedback 
loop 
reports. Consider the (usual) case where the recipient of the feedback 
loop is not the author of the original email, rather they're a service 
provider 
to the original author. 

Cheers, 
Steve 

_______________________________________________ 
Asrg mailing list 
[email-masked] 
https://www.irtf.org/mailman/listinfo/asrg 
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Seth <[email-masked]>
Date: Fri, 14 Nov 2008 00:44:36 -0500 (EST)

Years back, I made a suggestion to insert the ISP into the loop so the
ISP _knows_ that the user opted in to a list.  That makes it easy for
the ISP to decide that "TIS" means "unsubscribe" (or even "Ask the
user if that was an oops").

Without the ISP knowing that the subscription is legitimate, the
message has to be reported the usual way.

Seth

---

From: Matthias Leisi <[email-masked]>
Date: Fri, 14 Nov 2008 07:09:00 +0100

Franck Martin schrieb:

> So there is a need for a process at the MUA and MTA to make sure the
> unsubscribe header is valid and will be honored.

Which would be roughly equal to "make sure the Received: headers and the
From: header are valid"?

"valid" would mean 1) it is technically resolveable (as an email
address, an URL, whatever) and 2) it points to a non-spammer that will
not use the information received as eg a confirmation of an email
address read by an end-user.

I have my doubts that this approach will succeed. For such an approach
to succeed, it would need to be mutually secured/authenticated, but I
don't see a feasible method for this at the moment.

(Of course, it would be technically possible, but organisationally
expensive and may have undesireable side-effects.)

-- Matthias

---

From: Steve Atkins <[email-masked]>
Date: Thu, 13 Nov 2008 22:16:31 -0800

> don't see a feasible method for this at the moment.

A list of trusted ESPs, probably provided by a certification authority  
is
one approach. Authenticated by peer IP address or dkim signature.

> expensive and may have undesireable side-effects.)

Hotmail do it, and it works fine for them. I'm fairly sure some of the
other big names do it too.

Cheers,
   Steve

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 14 Nov 2008 10:35:16 +0100

> message has to be reported the usual way.

Yes! Opt-in info has to be stored at the recipient's server, in 
addition to the sender's:

The sender obviously needs the recipient's address; but cannot provide 
a standard mechanism for unsubscribing, since there isn't one.

The recipient's ESP could use the knowledge that a message belongs to 
a subscribed list in a number of useful ways (e.g. to suppress auto 
responders.) Semantically, that would validate the sender's opt-in 
record. However, notifying opt-ins is not standardized either.

Thus, I think there is a whole protocol that we're missing. Can't we 
just specify it in an RFC and see if it flies?
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: "David Nicol" <[email-masked]>
Date: Fri, 14 Nov 2008 15:05:41 -0600

On Thu, Nov 13, 2008 at 10:24 PM, Franck Martin <[email-masked]> wrote:
> I think list management functions should be better build in MUA. X-headers
> for mailing lists has been there for ages but they look like more a waste of
> space. I may be mistaken but which MxA system process list headers usefully?

The traditional "Ask your friendly neighborhood geek to do it for you"
system makes efficient use of mailing list headers.

A lot of technical types seem to forget that your basic non-technical
person thinks an "MTA" is a kind of sandwich.

Gmail is very nice, they offer a shortcut for creating rules triggered
on mailing list headers; I'm not sure which ones they use for that
purpose

Yesterday I submitted a gmail wishlist item to replace their "report
as spam" button with an "unsubscribe" button when viewing a message
with list headers (and keep "report as spam" in the "more actions"
drop-down.)  Maybe they'll implement it.

-- 
"Slingshot delivers all mail shipments to the post office by bicycle!"
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Franck Martin <[email-masked]>
Date: Sat, 15 Nov 2008 15:18:45 +1200 (ANAT)

And I did a Zimbra bug report too: 
http://bugzilla.zimbra.com/show_bug.cgi?id=33203