Subject: Re: [Asrg] FeedBack loops

From: Franck Martin <[email-masked]>
Date: Wed, 12 Nov 2008 14:34:32 +1200 (ANAT)

Thanks Steve for clarifying my thinking. 

For the scale, it would not send to to all, but to the ones who are registered for such feedback. So a config file that specifies when and to who to send the ARF reports. 

It seems also that MUAs, when a mail server is involved (MTA + other tools), have a way to report SPAM to the mailserver (special mailbox, special folder) so the filter can learn from the user reports. 

I lodged this bug on http://bugzilla.zimbra.com/show_bug.cgi?id=33109 I'm curious to see how the Zimbra developpers looks at it. 

----- Original Message ----- 
From: "Chris Lewis" <[email-masked]> 
To: "Anti-Spam Research Group - IRTF" <[email-masked]> 
Sent: Wednesday, 12 November, 2008 12:48:01 PM (GMT+1200) Auto-Detected 
Subject: Re: [Asrg] FeedBack loops 

Steve Atkins wrote: 
> On Nov 11, 2008, at 3:24 PM, Franck Martin wrote: 
> 
>> Yes it is a simple process, I was just thinking of having that 
>> process as a ready in-built engine, or third-party engine in MTAs. 
>> For the moment as said it is mainly custome code. If such 
>> capabilities would be available in sendmail or postfix, that would 
>> allow fbl to be implemented by large organisations (like 
>> universities, etc...) easily. 
> 
> ARF is pretty much unrelated to the MTA. 

Well, you could certainly envisage an ARF implementation directly tied 
into a filtering MTA that fires off an ARF for every spam it can 
identify if it can figure out who to send it to. 

However, given the volumes that even merely medium sized MTAs see, and 
at least some possibility of false positives, even if it didn't blow the 
ARF-recipients off the air, the volume and potential problems would 
render it useless. 

It just don't scale. 

_______________________________________________ 
Asrg mailing list 
[email-masked] 
https://www.irtf.org/mailman/listinfo/asrg 
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 12 Nov 2008 11:49:08 -0700

On 11/11/2008 19:34, "Franck Martin" <[email-masked]> wrote:

> It seems also that MUAs, when a mail server is involved (MTA + other tools),
> have a way to report SPAM to the mailserver (special mailbox, special folder)
> so the filter can learn from the user reports.
> 
> I lodged this bug on http://bugzilla.zimbra.com/show_bug.cgi?id=33109 I'm
> curious to see how the Zimbra developpers looks at it.

Standardizing that process could be an interesting project for the ASRG to
take on.  There've been attempts before, but they always get bogged down by
attempts to add novel but unlikely use cases.

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 12 Nov 2008 15:09:14 -0500

Franck Martin wrote:
> For the scale, it would not send to to all, but to the ones who are
> registered for such feedback. So a config file that specifies when and
> to who to send the ARF reports.

Right, I alluded to that.

But, say, I instrumented our MTAs (not our spamtraps!) to send ARF
reports about filter firings to an ARF-supporting access provider, who
just happened to have a lot of infected machines?  Like some do.

Without mentioning any names, there's a couple providers who _do_
support ARF, whose abuse-reporting-system I'd probably blow off the air,
to the tune of hundreds or thousands of reports per day.  With the
traps, in one case, at one time, it'd have been close to 100,000/day to
just one provider.

Now get a few other sites doing the same.  Boom! ;-)

It doesn't scale.

It can _sometimes_ be done.  On prior arrangement and special
circumstances (eg: considerably stricter "this is spam" determination
than our filters normally apply), I did an entirely automated ARF feed
to Hotmail off our MTAs.  This also was designed to not submit more than
one ARF report for the same sender per (I think) 8 hours.  A hacked
together kludge.

It could not have been done if Hotmail hadn't 100% automated their end
of the process to the extent of zapping the account without a human in
the loop.  Which is why we had to be so strict about being absolutely
FP-free.  Not appropriate at all with "normal" filter reliability, and
"someone should be in the loop to double-check", which I hope most of
believe is necessary for this to become a "standard practise".

There were one or three other sites with which Microsoft had made
similar arrangements.  They wouldn't tell me who they were (but I
suspected who at least one of them was ;-)

It worked wonderfully well for its brief lifetime of applicability. We
sent several thousand the first day.  Couple hundred the next.  A few
dozen for the next couple days.  Then zero.  I dismantled it after a week.

The Nigerian infestation went off and took over Yahoo (IIRC) somewhere
during the first 2-3 days.

Serious BOT infestations would be worse.

Here's a useful thought experiment: Check out

http://cbl.abuseat.org/domain.html

Remember that CBL's detection reliability is extremely good, and also
that the CBL only makes detection on an actual email attempt from the
listed IP.  If telekom.gov.tr supported ARF, and the CBL instrumented
their detectors to generate ARF, that would be at least 440,000 unique
IP reports over whatever interval the CBL is reporting.  Which seems to
be about a week...  What abuse desk could cope with that flow rate?  No-one.

[I do some specialized BOT feeds to ISPs with at least 3-way
"redundancy" in selecting which IPs to report.  They help.  But ARF
simply isn't appropriate for that.]

> It seems also that MUAs, when a mail server is involved (MTA + other
> tools), have a way to report SPAM to the mailserver (special mailbox,
> special folder) so the filter can learn from the user reports.

There are ways to do this, including via, say, SpamAssassin hosted on MTAs.
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Wed, 12 Nov 2008 12:29:30 -0800

> be about a week...  What abuse desk could cope with that flow rate?   

I have customers handling 250,000 reports via email a day, and they're
not all as nicely automatable as ARF either, so it's not entirely out  
of the
question. :)

ARF is not really intended for unsolicited reports, though, it's  
intended
for solicited reports between consenting parties to be handled via  
automated
processing, often with no eyeballs on the content at either end. If the
sender and the receiver consent to using ARF for high traffic reporting
it's not something that will affect anyone else much.

(That still doesn't make ARF necessarily the right format for that
sort of thing, though.)

Cheers,
   Steve

---

From: der Mouse <[email-masked]>
Date: Wed, 12 Nov 2008 15:27:24 -0500 (EST)

>> registered for such feedback.  [...]
> support ARF, whose abuse-reporting-system I'd probably blow off the
> air, to the tune of hundreds or thousands of reports per day.

> Now get a few other sites doing the same.  Boom! ;-)

<devil's-advocate>

And, for a site that generates that much spam but can't be arsed to set
up enough abuse-desk resources to handle the resulting feedback volume,
is that such a bad outcome?

</devil's-advocate>

> It doesn't scale.

Actually, I think it scales just fine; the feedback volume is linear in
the spam volume.  It's just that the senders are too cheap to set up
abuse-handling infrastructure that can handle complaint volume that's
linear in the volume of spam they emit (at least with a constant of
proportionality anything close to what you provide - and as long as
that constant is less than 1, I strongly believe that's their problem).

I have trouble seeing pointing up such broken situations as a bad
thing.

For the net, that is, as opposed to the individual senders or receivers
(or postmasters).  Which is the perspective I would hope we're taking
here.  Prisoner's Dilemma issues are a separate discussion. :)

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg