Subject: [marf] draft-ietf-marf-base-00

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 26 Jan 2010 15:12:27 -0800

As you can see I've posted the revised draft, i.e. draft-shafranovich-feedback-report with the recently discussed modifications, as draft-ietf-marf-base-00.

We have a deliverable of June to submit this to the IESG for approval.  Please review it and submit any feedback to this list.  If it's quiet, we can start a working group last call on it at our planned working group meeting at the next IETF general meeting in Anaheim, and get that one off our list early.

-MSK

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 26 Jan 2010 20:35:59 -0500

Just wanted to let you guys know that I have a repository of all the
past drafts and diffs between versions here:

http://www.shaftek.org/publications/drafts/abuse-report/

I added this version as well.

Yakov

On Tue, Jan 26, 2010 at 6:12 PM, Murray S. Kucherawy <[email-masked]> wrote:
> As you can see I’ve posted the revised draft, i.e.
> draft-shafranovich-feedback-report with the recently discussed
> modifications, as draft-ietf-marf-base-00.
>
>
>
> We have a deliverable of June to submit this to the IESG for approval.
> Please review it and submit any feedback to this list.  If it’s quiet, we
> can start a working group last call on it at our planned working group
> meeting at the next IETF general meeting in Anaheim, and get that one off
> our list early.
>
>
>
> -MSK
>
>
>
> _______________________________________________
> marf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/marf
>
>

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 26 Jan 2010 16:12:19 -0500
To: [email-masked]
Cc: [email-masked], [email-masked]
Subject: Re: [feedback-report] [marf] MARF working group is chartered

On Tue, Jan 26, 2010 at 3:33 PM, Barry Leiba
<[email-masked]> wrote:
>
> I suggest that the first order of business is to approve the next
> version of draft-shafranovich-feedback-report-08 as
> draft-ietf-marf-feedback-report-00, the first working group document.
> Comments, yea or nay?
>

I believe that Murray had a later draft that had significant changes.
Should we use that instead?

From: "Murray S. Kucherawy" <[email-masked]>
To: ARF mailing list <[email-masked]>
Date: Tue, 26 Jan 2010 12:37:43 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: [feedback-report] FW: WG Action: Messaging Abuse Reporting Format (marf)

Folks,

The IETF has officially created the working group to advance the work done here to date.

This list will continue to exist, but discussions specifically about the working group's efforts need to take place on the official working group's list.  Please be sure to subscribe over there if you want to participate in that work, if you haven't already.

-----Original Message-----
From: IESG Secretary [mailto:[email-masked]] 
Sent: Tuesday, January 26, 2010 12:30 PM
To: [email-masked]
Cc: Murray S. Kucherawy; [email-masked]; [email-masked]
Subject: WG Action: Messaging Abuse Reporting Format (marf) 

A new IETF working group has been formed in the Applications Area.  
For additional information, please contact the Area Directors or the WG
Chairs.

Messaging Abuse Reporting Format (marf)
---------------------------------------------------
Current Status: Active Working Group

Chairs:
 Murray S. Kucherawy ([email-masked])
 Barry Leiba ([email-masked])

Applications Area Directors:
 Lisa Dusseault ([email-masked])
 Alexey Melnikov ([email-masked])

Applications Area Advisor:
 Alexey Melnikov ([email-masked])

Mailing Lists:
 General Discussion: [email-masked]
 To Subscribe: https://www.ietf.org/mailman/listinfo/marf
 Archive: http://www.ietf.org/mail-archive/web/marf/

Description of Working Group:

Messaging anti-abuse operations between independent services often
requires sending reports on observed fraud, spam, virus or other abuse
activity. A standardized report format enables automated processing.
The Abuse Reporting Format (ARF) specification has gained sufficient
popularity to warrant formal codification, to ensure and encourage
future interoperability with new implementations. The primary
function of this working group will be to solicit review and
refinement of the existing specification.

A report format is amenable to processing by humans or software,
with the latter requiring the format to be standardized, to permit
interoperability between automated services, particularly without
prior arrangement.

ARF was developed as a community effort within the context of a
messaging trade organization independent of the IETF
(MAAWG, http://www.maawg.org), and uses a format similar to
a Delivery Status Notification (DSN, RFC3464) to report fraud, spam,
viruses or other abusive activity in the email system.

ARF as initially defined is already in widespread use at large ISPs,
so interoperability can be demonstrated. Some tools already exist
for processing ARF messages, a few of which are open source. In
order to preserve the installed base, the working group will make the
minimum changes necessary to the existing specification and will seek
to have backward compatibility. Furthermore, some extensions to the
current proposal are of interest to the community, such as the
means for an operator to advertise an email address to which abuse
reports using ARF should be sent. The working group will take on
the task of considering and specifying such a mechanism.

Existing ARF usage employs draft-shafranovich-feedback-report-08,
which will provide the working group's starting point.

The working group should consider such factors as:
* implementation experience
* ability to achieve broad implementation and interoperability
* existing uses of ARF
* internationalization
* ability to address a wider range of uses

Thus, the working group's specific tasks are as follows:

1) The group will first produce a Proposed Standard track
specification of ARF. This will document current use, removing
any portions that are not implemented and/or not required for a
minimum implementation (these may be considered for extensions
at some later date if demand warrants). This will include not
only the format of an ARF message, but must also include
appropriate documentation of security considerations and creation
of IANA registries for elements of ARF to support future
extensions, as well as informational sections conveying current
best practices.

2) The group will produce an informational document detailing
guidelines for deploying and using ARF, including descriptions
of current practices and their rationales.

3) The group will specify the integration of ARF into DKIM-aware
environments, with draft-kucherawy-dkim-reporting-06 as its input.
It contains extensions to DKIM that are related to ARF as a means
of reporting DKIM-related failures which include phishing
("fraud") and as such are relevant to the ARF effort. The group
will produce Proposed Standard track specification for these
ARF and DKIM extensions.

4) The group will finally consider a means for publishing the address
to which ARF reports should be sent. Not all ARF participants
wish to use abuse@(domain), which is the current standard
(RFC2142), as the place to send automated ARF-formatted reports.
The group will either conclude that the industry should continue to
use this de facto standard (and thus no specification is
appropriate), or will produce a Proposed Standard track document
identifying the means by which that address should be advertised.

The group may consider re-chartering to cover related work, including
consideration of items removed since earlier versions of ARF as
possible extensions, once these deliverables have been achieved.

The working group is aware of related activities in other SDOs, namely
the Open Mobile Alliance (http://www.openmobilealliance.org)
"MWG-SpamRep"
effort and a similar as-yet-unnamed effort inside the GSM Alliance
(GSMA, http://www.gsm.org). The working group will coordinate efforts
with those groups, and with MAAWG, as required.

Goals and Milestones:

Jun 2010 Submit ARF specification for IETF approval
Sep 2010 Submit ARF guidelines document for IETF approval
Mar 2011 Submit DKIM reporting specification for IETF approval
Sep 2011 Submit ARF address advertising specification for IETF approval

Date: Tue, 26 Jan 2010 15:33:00 -0500
From: Barry Leiba <[email-masked]>
To: [email-masked], [email-masked]
Subject: [feedback-report] MARF working group is chartered
Reply-To: [email-masked]

The MARF working group is now officially chartered:
http://www.ietf.org/dyn/wg/charter/marf-charter.html

Murray and I are chairs, and we have requested a 1.5-hour meeting slot
at IETF 77 in Anaheim.

You should be able to contact the chairs through the tools alias,
though it's possible that it will take a little longer for it to work:
<[email-masked]>

Please use the IETF marf mailing list, <[email-masked]>, for all
working group correspondence.  If there's a discussion that the chairs
think is sufficiently off topic or out of scope that we'd like it not
to be there, you can bring it back to the list at mipassoc.  Please
subscribe to the marf list if you plan to participate in the working
group.

I suggest that the first order of business is to approve the next
version of draft-shafranovich-feedback-report-08 as
draft-ietf-marf-feedback-report-00, the first working group document.
Comments, yea or nay?

-- Barry Leiba, marf working group chair

Date: Tue, 26 Jan 2010 10:49:50 -0800
From: Dave CROCKER <[email-masked]>
Organization: Brandenburg InternetWorking
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

On 1/21/2010 9:04 AM, Murray S. Kucherawy wrote:
>> From: Dave CROCKER
...
>> I've received notice that the mailing list is to be moved, to be hosted at
>> the IETF.
...
> Speaking from the MAAWG side of things, I don't see a reason that the list
> has to be moved.  This list was created long before the IETF had any
> particular interest in ARF, and there's no rule anyplace that says there can
> only be one list on a particular topic.  So the two lists can coexist,

Barry's concern about divergent discussion, if there are two lists, is 
well-taken.  Still, efforts often have multiple lists, covering complementary 
issues.

Certainly it's good for something that's standardized to have a broader pre- and 
post- standards discussion forum, concerning requirements, deployment, 
experiences, etc.

So it really becomes more of a courtesy to the standards list, to supply ana 
archive of earlier discussions.  At this point, I'm thinking of it more as a 
matter of helping to establish context than to 'move' the list.

Bad things might come of this, but I doubt any side-effects will be all /that/ bad.

So I'm in the process of forwarding an archive to the IETF.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Sat, 23 Jan 2010 22:19:20 -0500
To: "[email-masked]" <[email-masked]>
Organization: Atid/2
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

In <[email-masked]>, on 01/21/2010
   at 06:50 AM, Dave CROCKER <[email-masked]> said:

>The simplest approach would be for me to lock the list from postings
>until the  archive is moved to the new list and then announce the new
>list, for everyone to  subscribe to.

I believe that what is critical is to publish the switchover date. If you
lock the old list before the switchover, that date should also be
announced ahead of time.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

Date: Sat, 23 Jan 2010 00:20:52 +0530 (IST)
From: Atmaram Red <[email-masked]>
To: [email-masked]
Subject: [feedback-report] (no subject)

Date: Fri, 22 Jan 2010 10:48:42 -0800
From: Dave CROCKER <[email-masked]>
Organization: Brandenburg InternetWorking
To: "Murray S. Kucherawy" <[email-masked]>
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
Reply-To: [email-masked]

On 1/22/2010 9:33 AM, Murray S. Kucherawy wrote:
>>> That appears to be discussing the "MARF" protocol.
>>
>> I hope the plan is that MARF is the WG, ARF is still the protocol.
>
> That's my current belief.

You think the IESG objects only to the name of the wg being generic, but won't 
mind having the protocol name be "too" generic?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

Date: Fri, 22 Jan 2010 10:47:32 -0800
From: Dave CROCKER <[email-masked]>
Organization: Brandenburg InternetWorking
To: Steve Atkins <[email-masked]>
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
Reply-To: [email-masked]

On 1/21/2010 4:51 PM, Steve Atkins wrote:
> That appears to be discussing the "MARF" protocol.
>
> That isn't an arbitrary name change that'll discard existing mindshare and
> spread confusion amongst users about the difference between "ARF" and "MARF",
> is it?

Probably.

But it's a common IETF action, where SSL -> TLS is one of the more visible examples.

With luck, we can merely suggest that MARF is pronounced with a silent M...

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

From: Steve Atkins <[email-masked]>
Date: Fri, 22 Jan 2010 10:00:31 -0800
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

On Jan 22, 2010, at 9:33 AM, Murray S. Kucherawy wrote:

>> -----Original Message-----
>> From: [email-masked] [mailto:abuse-
>> [email-masked]] On Behalf Of John R. Levine
>> Sent: Thursday, January 21, 2010 5:40 PM
>> To: Steve Atkins
>> Cc: ARF mailing list
>> Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
>> 
>>> That appears to be discussing the "MARF" protocol.
>> 
>> I hope the plan is that MARF is the WG, ARF is still the protocol.
> 
> That's my current belief.

That'll work.

Cheers,
  Steve

From: "Murray S. Kucherawy" <[email-masked]>
To: "John R. Levine" <[email-masked]>, Steve Atkins <[email-masked]>
Date: Fri, 22 Jan 2010 09:33:58 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

> -----Original Message-----
> From: [email-masked] [mailto:abuse-
> [email-masked]] On Behalf Of John R. Levine
> Sent: Thursday, January 21, 2010 5:40 PM
> To: Steve Atkins
> Cc: ARF mailing list
> Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
> 
> > That appears to be discussing the "MARF" protocol.
> 
> I hope the plan is that MARF is the WG, ARF is still the protocol.

That's my current belief.

From: "Murray S. Kucherawy" <[email-masked]>
To: Steve Atkins <[email-masked]>, ARF mailing list <[email-masked]>
Date: Fri, 22 Jan 2010 09:33:34 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

> -----Original Message-----
> From: [email-masked] [mailto:abuse-
> [email-masked]] On Behalf Of Steve Atkins
> Sent: Thursday, January 21, 2010 4:51 PM
> To: ARF mailing list
> Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
> 
> That appears to be discussing the "MARF" protocol.
> 
> That isn't an arbitrary name change that'll discard existing mindshare
> and spread confusion amongst users about the difference between "ARF"
> and "MARF", is it?

My unconfirmed understanding is that the IESG felt "Abuse Report Format" was too generic, i.e. it established no context for the abuse being reported.  The IETF covers a lot of different areas of Internet activity, not just messaging, so the name needed to be more precise.

I'm not really concerned about the above.  I think the active participants are smart enough and involved enough to keep it all straight.

Date: 21 Jan 2010 20:39:37 -0500
From: "John R. Levine" <[email-masked]>
To: "Steve Atkins" <[email-masked]>
Cleverness: None detected
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

> That appears to be discussing the "MARF" protocol.

I hope the plan is that MARF is the WG, ARF is still the protocol.

R's,
John

From: Steve Atkins <[email-masked]>
Date: Thu, 21 Jan 2010 16:51:24 -0800
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

On Jan 21, 2010, at 4:31 PM, Murray S. Kucherawy wrote:

>> -----Original Message-----
>> From: [email-masked] [mailto:abuse-
>> [email-masked]] On Behalf Of Yakov Shafranovich
>> Sent: Thursday, January 21, 2010 4:23 PM
>> To: [email-masked]
>> Cc: [email-masked]
>> Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
>> 
>> What is the new list name?
> 
> I was waiting for some kind of formal announcement from the IESG to forward, but since the cat's out of the bag, it's [email-masked].  You can subscribe at https://www.ietf.org/mailman/listinfo/marf.

That appears to be discussing the "MARF" protocol.

That isn't an arbitrary name change that'll discard existing mindshare and spread confusion amongst users about the difference between "ARF" and "MARF", is it?

Cheers,
  Steve

From: "Murray S. Kucherawy" <[email-masked]>
To: Yakov Shafranovich <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 21 Jan 2010 16:31:04 -0800
Accept-Language: en-US
acceptlanguage: en-US
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

> -----Original Message-----
> From: [email-masked] [mailto:abuse-
> [email-masked]] On Behalf Of Yakov Shafranovich
> Sent: Thursday, January 21, 2010 4:23 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
> 
> What is the new list name?

I was waiting for some kind of formal announcement from the IESG to forward, but since the cat's out of the bag, it's [email-masked].  You can subscribe at https://www.ietf.org/mailman/listinfo/marf.

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 21 Jan 2010 19:22:53 -0500
To: [email-masked]
Cc: [email-masked]
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

What is the new list name?

On Thu, Jan 21, 2010 at 9:50 AM, Dave CROCKER <[email-masked]> wrote:
> Folks,
>
> I've received notice that the mailing list is to be moved, to be hosted at the IETF.
>
> While the IETF has had hosting available for quite awhile, it hasn't been a
> requirement for chartered working groups.  Apparently that's changed.
>
> Since this is not currently a highly active or large list, that switch should
> not be overly difficult, but I thought it proper to check with folks first about
> how to proceed, so that a) service is not interrupted, and b) the archive is
> preserved.
>
> This is, essentially, a manual database synchronization tasks, where some of the
> transaction components are measured in days.
>
> The simplest approach would be for me to lock the list from postings until the
> archive is moved to the new list and then announce the new list, for everyone to
> subscribe to.
>
> Thoughts?
>
> d/
> --
>
>   Dave Crocker
>   Brandenburg InternetWorking
>   bbiw.net
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>

Date: Thu, 21 Jan 2010 14:03:13 -0500
From: Barry Leiba <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list
Reply-To: [email-masked]

For those who don't know, the new list is already up: [email-masked]

> So the two lists can coexist, the current list for general discussion
> on the topic and the ietf.org list for actual working group discussion
> in the context of IETF work.

Whether this is wise or not depends upon what actually gets discussed
here (on the "old" list).  There's a danger of fragmenting useful
discussion in two places, and having IETF participants who are not
subscribed here miss things they ought to see and comment on.  This
list should certainly stay around, and it'd be a great place to
discuss things that are out of scope for the IETF working group, but
the regular participants should keep an eye on it and direct
discussions that are appropriate for the IETF group to the IETF
mailing list.

Barry

From: "Murray S. Kucherawy" <[email-masked]>
To: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 21 Jan 2010 09:04:13 -0800
Accept-Language: en-US
acceptlanguage: en-US
Subject: Re: [feedback-report] Switching to an IETF-hosted mailing list

> -----Original Message-----
> From: [email-masked] [mailto:abuse-
> [email-masked]] On Behalf Of Dave CROCKER
> Sent: Thursday, January 21, 2010 6:51 AM
> To: [email-masked]
> Subject: [feedback-report] Switching to an IETF-hosted mailing list
> 
> Folks,
> 
> I've received notice that the mailing list is to be moved, to be hosted
> at the IETF.
> 
> [...]
> 
> Thoughts?

Speaking from the MAAWG side of things, I don't see a reason that the list has to be moved.  This list was created long before the IETF had any particular interest in ARF, and there's no rule anyplace that says there can only be one list on a particular topic.  So the two lists can coexist, the current list for general discussion on the topic and the ietf.org list for actual working group discussion in the context of IETF work.  The ietf.org list can have a copy of the archive for historical reference if it wants, since it's an open archive anyway.

Date: Thu, 21 Jan 2010 06:50:46 -0800
From: Dave CROCKER <[email-masked]>
Organization: Brandenburg InternetWorking
To: [email-masked]
Subject: [feedback-report] Switching to an IETF-hosted mailing list
Reply-To: [email-masked]

Folks,

I've received notice that the mailing list is to be moved, to be hosted at the IETF.

While the IETF has had hosting available for quite awhile, it hasn't been a 
requirement for chartered working groups.  Apparently that's changed.

Since this is not currently a highly active or large list, that switch should 
not be overly difficult, but I thought it proper to check with folks first about 
how to proceed, so that a) service is not interrupted, and b) the archive is 
preserved.

This is, essentially, a manual database synchronization tasks, where some of the 
transaction components are measured in days.

The simplest approach would be for me to lock the list from postings until the 
archive is moved to the new list and then announce the new list, for everyone to 
subscribe to.

Thoughts?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

Date: Thu, 14 Jan 2010 23:26:39 +0000
From: Alexey Melnikov <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Chairs for the ARF working group

Alexey Melnikov wrote:

> Hi,
> In my capacity of Area Director sponsoring formation of this working 
> group, I would like to solicit recommendations about chairs for the 
> WG-to-be.

I forgot to mention that self nominations are permitted and encouraged.

> Ideally I am looking for one experienced IETF person and for one chair 
> who is new to IETF and is an expert in the field.
>
> Please send your feedback directly to me.
>
> Thank you,
> Alexey

-- 
IETF Application Area Director, <http://www.ietf.org/IESGmems.html>
Internet Messaging Team Lead, <http://www.isode.com>
JID: same as my email address

Date: Thu, 14 Jan 2010 23:25:13 +0000
From: Alexey Melnikov <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: [feedback-report] Chairs for the ARF working group

Hi,
In my capacity of Area Director sponsoring formation of this working 
group, I would like to solicit recommendations about chairs for the 
WG-to-be. Ideally I am looking for one experienced IETF person and for 
one chair who is new to IETF and is an expert in the field.

Please send your feedback directly to me.

Thank you,
Alexey

-- 
IETF Application Area Director, <http://www.ietf.org/IESGmems.html>
Internet Messaging Team Lead, <http://www.isode.com>
JID: same as my email address

From: "J.D. Falk" <[email-masked]>
Date: Mon, 11 Jan 2010 14:33:41 -0700
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Reporting phone numbers with ARF

On Jan 5, 2010, at 4:01 PM, Yakov Shafranovich wrote:

> This is a question that was asked to me by an ISP. My answer is to use
> Reported-URI field as follows:
> 
> Reported-URI: tel:+1-201-555-0123
> 
> The formatting is as per RFC 3966.
> 
> I know that helpdesk software may not support this, but from a
> standards viewpoint is there anything wrong with this approach?

I believe that's exactly why we settled on URIs rather than hostnames, services, et cetera.

--
J.D. Falk <[email-masked]>
Return Path Inc

Date: Wed, 06 Jan 2010 13:31:10 -0500
From: Michael Adkins <[email-masked]>
To: Ricardo Signes <[email-masked]>
Cc: [email-masked]
Subject: Re: [feedback-report] AOL ARF reports suddenly less useful?

Ricardo Signes wrote:
> Some time within the last 24 hours or so, AOL's ARF-style reports seem to have
> become drastically less useful.  Although the original reporter's address has
> long been redacted (by being replaced with "redacted") they now seem to be
> obscuring *all* kinda of local parts.  For example:
>
>   List-Subscribe: <mailto:[email-masked]>
>
> Well, great.  They also redact the Errors-To and Return-Path.
Yes, the user's email address is redacted anywhere it is present in the
header. That is not new.

>   Also, their
> header folding appears to be broken, as the message/rfc822 part of one report
> now reads like this:
>
>   X-Pobox-Relay-ID:
>   	B4599EE4-F98A-11DE-97BC-2B0D0635E987-05628567!b-pb-sasl-quonix.pobox.com
>   	x-aol-global-disposition: G
>
> Other places, headers are wrapped where no whitespace appears, corrupting its
> contents.
>   
You'll have to send us a full original example.

> I can keep devising new ways to take automatic action, but... anybody from AOL
> want to let me know that this was a glitch?  The last thing I want to is to
> have to fight an ongoing battle against the dying usefulness of ARF reports.
>
>   

Date: Wed, 6 Jan 2010 13:33:10 -0500
From: Ricardo Signes <[email-masked]>
To: Michael Adkins <[email-masked]>
Cc: [email-masked]
Subject: Re: [feedback-report] AOL ARF reports suddenly less useful?

* Michael Adkins <[email-masked]> [2010-01-06T13:31:10]
> Ricardo Signes wrote:
> > Some time within the last 24 hours or so, AOL's ARF-style reports seem to have
> > become drastically less useful.  Although the original reporter's address has
> > long been redacted (by being replaced with "redacted") they now seem to be
> > obscuring *all* kinda of local parts.  For example:
> >
> >   List-Subscribe: <mailto:[email-masked]>
> >
> > Well, great.  They also redact the Errors-To and Return-Path.
> Yes, the user's email address is redacted anywhere it is present in the
> header. That is not new.

The user's email address is not the list-subscribe address, the error-to
address, or the retun-path.  They do not share significant substrings, even.

Shall I send these to the address above at corp.aol.com, or is there a better
role address for this problem report?

-- 
rjbs

Date: Wed, 6 Jan 2010 12:14:03 -0500
From: Ricardo Signes <[email-masked]>
To: [email-masked]
Subject: [feedback-report] AOL ARF reports suddenly less useful?

Some time within the last 24 hours or so, AOL's ARF-style reports seem to have
become drastically less useful.  Although the original reporter's address has
long been redacted (by being replaced with "redacted") they now seem to be
obscuring *all* kinda of local parts.  For example:

  List-Subscribe: <mailto:[email-masked]>

Well, great.  They also redact the Errors-To and Return-Path.  Also, their
header folding appears to be broken, as the message/rfc822 part of one report
now reads like this:

  X-Pobox-Relay-ID:
  	B4599EE4-F98A-11DE-97BC-2B0D0635E987-05628567!b-pb-sasl-quonix.pobox.com
  	x-aol-global-disposition: G

Other places, headers are wrapped where no whitespace appears, corrupting its
contents.

I can keep devising new ways to take automatic action, but... anybody from AOL
want to let me know that this was a glitch?  The last thing I want to is to
have to fight an ongoing battle against the dying usefulness of ARF reports.

-- 
rjbs

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 5 Jan 2010 21:43:48 -0500
To: Steve Atkins <[email-masked]>
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Reporting phone numbers with ARF

On Tue, Jan 5, 2010 at 7:27 PM, Steve Atkins <[email-masked]> wrote:
>
> On Jan 5, 2010, at 6:01 PM, Yakov Shafranovich wrote:
>
>> This is a question that was asked to me by an ISP. My answer is to use
>> Reported-URI field as follows:
>>
>> Reported-URI: tel:+1-201-555-0123
>>
>> The formatting is as per RFC 3966.
>>
>> I know that helpdesk software may not support this, but from a
>> standards viewpoint is there anything wrong with this approach?
>
> In ARF standards terms? I don't think so, though it might be worth listing some of the URIs that could reasonably be used in that field, for the benefit of readers who think all URIs start with http.
>

I can think of the following being used but some are really stretching the spec:

dns:
ftp:
http:
im:
mailto:
news:
nntp:
sip:
tel:
xmpp:

Yakov

From: Steve Atkins <[email-masked]>
Date: Tue, 5 Jan 2010 19:27:31 -0500
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Reporting phone numbers with ARF

On Jan 5, 2010, at 6:01 PM, Yakov Shafranovich wrote:

> This is a question that was asked to me by an ISP. My answer is to use
> Reported-URI field as follows:
> 
> Reported-URI: tel:+1-201-555-0123
> 
> The formatting is as per RFC 3966.
> 
> I know that helpdesk software may not support this, but from a
> standards viewpoint is there anything wrong with this approach?

In ARF standards terms? I don't think so, though it might be worth listing some of the URIs that could reasonably be used in that field, for the benefit of readers who think all URIs start with http.

(Operationally, I can't think offhand of anyone who would care about use of a phone number at all, let alone accept abuse reports via email or signup for a feedback loop, but that's not our problem.)

Cheers,
  Steve

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 5 Jan 2010 18:01:42 -0500
To: [email-masked]
Subject: [feedback-report] Reporting phone numbers with ARF

This is a question that was asked to me by an ISP. My answer is to use
Reported-URI field as follows:

Reported-URI: tel:+1-201-555-0123

The formatting is as per RFC 3966.

I know that helpdesk software may not support this, but from a
standards viewpoint is there anything wrong with this approach?

Yakov

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 4 Jan 2010 19:45:01 -0500
To: [email-masked]
Subject: [feedback-report] Followup on "redacted" header

--0016e6d7ef16148eb8047c6027bb
Content-Type: text/plain; charset=ISO-8859-1

I think that the consensus is so far that the "redacted" header
feature isn't necessary. We can always add the header later on if
needed.

Let's move on to other things.

Yakov

---------- Forwarded message ----------
From: Tobias Knecht <[email-masked]>
Date: 2010/1/4
Subject: Re: [feedback-report] Let's get started
To:
Cc: [email-masked]

Hi all,

> I will have to consult with Return Path, our FBL hosting provider,
> to determine whether such a thing would be feasible for them.

That is exactly the point. We were discussing about leaving DKIM out
(thank god), because nobody is using it. We were discussing about
getting rid of some Feedback Types, because nobody is using it.

And now we are discussing about adding an optional field, that only
makes sense in a mandatory way (which by the way I don't like) and I
guess less than 10% of all current arf messages (AOL, ...?) are using
this field at the moment. So we create work for the other 90% who are
free to do so or let it go. And we do all that for the benefit of
telling complaining report receivers, that we have already told them
that the reports are redacted? (Assuming we implemented it, because
there is no need, because it's optional).

I'm confused, seems like it's going in circles.

--0016e6d7ef16148eb8047c6027bb
Content-Type: application/pgp-signature; name="signature.asc"
Content-Disposition: attachment; filename="signature.asc"
Content-Transfer-Encoding: base64
X-Attachment-Id: 0.0.1

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjEuNC45IChHTlUv
TGludXgpCkNvbW1lbnQ6IFVzaW5nIEdudVBHIHdpdGggTW96aWxsYSAtIGh0dHA6Ly9lbmlnbWFp
bC5tb3pkZXYub3JnLwoKaUVZRUFSRUNBQVlGQWt0Q2JlNEFDZ2tRdkI0TTV5UXlxRGZKSkFDYUFq
N3dIdi93RGJhZWc4UVI1MjZBb1hlcQplSmNBb09tWEs0R2E0aU44blpPZEtLZ3VoMmJmaDNpMwo9
MlM1ZQotLS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0K
--0016e6d7ef16148eb8047c6027bb--

Date: Mon, 04 Jan 2010 23:38:34 +0100
From: Tobias Knecht <[email-masked]>
Organization: abusix UG =?ISO-8859-1?Q?(haftungsbeschränkt)?User-Agent: Thunderbird 2.0.0.23 (X11/20090817)
CC: [email-masked]
Subject: Re: [feedback-report] Let's get started

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig2E2E3F4DAF5B7F3DADC260F3
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi all,

> I will have to consult with Return Path, our FBL hosting provider, 
> to determine whether such a thing would be feasible for them.  

That is exactly the point. We were discussing about leaving DKIM out
(thank god), because nobody is using it. We were discussing about
getting rid of some Feedback Types, because nobody is using it.

And now we are discussing about adding an optional field, that only
makes sense in a mandatory way (which by the way I don't like) and I
guess less than 10% of all current arf messages (AOL, ...?) are using
this field at the moment. So we create work for the other 90% who are
free to do so or let it go. And we do all that for the benefit of
telling complaining report receivers, that we have already told them
that the reports are redacted? (Assuming we implemented it, because
there is no need, because it's optional).

I'm confused, seems like it's going in circles.

Tobias

--------------enig2E2E3F4DAF5B7F3DADC260F3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

--------------enig2E2E3F4DAF5B7F3DADC260F3--

Date: Mon, 4 Jan 2010 16:47:47 -0500
From: Todd Herr <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] Let's get started

On Tue, Dec 29, 2009 at 11:05:08PM -0800, Murray S. Kucherawy wrote:
> > -----Original Message-----
> > From: John R. Levine [mailto:[email-masked]]
> > Sent: Tuesday, December 29, 2009 11:02 PM
> > To: Murray S. Kucherawy
> > Cc: [email-masked]
> > Subject: Re: [feedback-report] Let's get started
> > 
> > >> Content-Redacted: Yes
> > >
> > > I think it is.  And we don't need to register it because it exists in
> > a format we're defining ourselves, not in the message header proper.
> > >
> > > Anyone object, or shall I add this and adjust various wording
> > accordingly?
> > 
> > I don't have any theological objections, but it might be interesting to
> > ask RR, AOL, and other ARF senders who redact whether they'd be likely
> > to
> > add it.
> 
> Well, they're on the list and (at least occasionally) participating.  Fellas?

I will have to consult with Return Path, our FBL hosting provider, 
to determine whether such a thing would be feasible for them.  

-- 
Todd Herr
Principal Engineer and Postmaster              V: 703.345.2447
Road Runner Email Operations                   M: 571.287.0366
[email-masked]                      AIM: RRMailToddHerr

From: "J.D. Falk" <[email-masked]>
Date: Mon, 4 Jan 2010 13:49:14 -0700
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] Let's get started

On Jan 4, 2010, at 9:35 AM, Michael Adkins wrote:

> We already add -
> 
> "Redacted-Address: redacted
> Redacted-Address: redacted@"
> 
> to the second mime part to indicate that the the word 'redacted' has
> been used in place of the original local part of the email address, both
> on its own or as part of a full email address, in the third mime part.

Would you want to add that to the registry of fields, once that registry is formed?

If so, perhaps that's sufficient for this effort.

--
J.D. Falk <[email-masked]>
Return Path Inc

Date: Mon, 04 Jan 2010 11:35:58 -0500
From: Michael Adkins <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [feedback-report] Let's get started

We already add -

"Redacted-Address: redacted
Redacted-Address: redacted@"

to the second mime part to indicate that the the word 'redacted' has
been used in place of the original local part of the email address, both
on its own or as part of a full email address, in the third mime part.

Murray S. Kucherawy wrote:
>> -----Original Message-----
>> From: John R. Levine [mailto:[email-masked]]
>> Sent: Tuesday, December 29, 2009 11:02 PM
>> To: Murray S. Kucherawy
>> Cc: [email-masked]
>> Subject: Re: [feedback-report] Let's get started
>>
>>     
>>>> Content-Redacted: Yes
>>>>         
>>> I think it is.  And we don't need to register it because it exists in
>>>       
>> a format we're defining ourselves, not in the message header proper.
>>     
>>> Anyone object, or shall I add this and adjust various wording
>>>       
>> accordingly?
>>
>> I don't have any theological objections, but it might be interesting to
>> ask RR, AOL, and other ARF senders who redact whether they'd be likely
>> to
>> add it.
>>     
>
> Well, they're on the list and (at least occasionally) participating.  Fellas?
>
> _______________________________________________
> abuse-feedback-report mailing list
> [email-masked]
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>