Subject: [marf] X-ARF

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 1 Sep 2010 14:12:11 -0400

Does anyone know anything about this:

http://www.x-arf.org/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 1 Sep 2010 11:15:11 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Yakov Shafranovich
> Sent: Wednesday, September 01, 2010 11:12 AM
> To: [email-masked]
> Subject: [marf] X-ARF
> 

Looks like a new home for the previous attempts to extend ARF to general network abuse reporting.

---

From: Steve Atkins <[email-masked]>
Date: Wed, 1 Sep 2010 11:16:19 -0700

> Does anyone know anything about this:

It's Tobias Knecht / Abusix.

Cheers,
  Steve

---

From: Tobias Knecht <[email-masked]>
Date: Thu, 02 Sep 2010 00:57:39 +0200

> It's Tobias Knecht / Abusix.

Not only me. ;-)
There are a few European institutions testing this at the moment and the
feedback so far is pretty good.

The intention is as Murray correctly mentioned an extension.

In our opinion ARF is a good and fitting format for messaging and it is
as I understood it more between ISPs and Senders.

X-ARF shall be a format for the needs abuse departments have today.
Generic expandable to fit need of abuse departments also in future.

X-ARF website is pretty alpha-alpha, but if somebody thinks X-ARF might
be a good idea and feels already bored since ARF is "finished" feel free
to contact me. We are happy for all help, early adopters, authors,
ideas, suggestions and what so ever.

Thanks,

Tobias

---

From: "Alex Bobotek" <[email-masked]>
Date: Wed, 1 Sep 2010 23:28:46 -0700

Very interesting work.

As we all know, messaging abuse is NOT insular, but related to so many
of the other security issues (infection, theft of service, ...).  So I
think it makes sense for a number of abuse information feeds to flow
into and between organazations' abuse-management and info systems.  

There's also (as has been noted in MARF) IODEF in IETF.  

We're facing the question of how to best integrate mail abuse reporting
with mobile messaging reporting and reporting of non-messaging abuse.
IMHO, this is the long-term target.  While we (or at least I) ponder,
the standards are proceeding down disparate paths.  For example, X-ARF
is using YAML, SpamRep XML, and RFC5965 name/value pairs.

I feel it would be helpful to have an architecture/concept doc
describing one or more integrated abuse management and info framework.
Does anyone know of such a doc?  Is anyone else interested in writing
one?  I started outlining one in Maastricht, and would be happy to share
this.

Regards,

Alex

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tobias Knecht
Sent: Wednesday, September 01, 2010 3:58 PM
To: [email-masked]
Subject: Re: [marf] X-ARF

Not only me. ;-)

Thanks,

Tobias

_______________________________________________
marf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/marf

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 02 Sep 2010 09:39:03 -0400

In <AANLkTi=13xWQnDrQJHjOibZT76eF=[email-masked]>, on
09/01/2010

>http://www.x-arf.org/

I just took a look at it, and I'm not happy about the use of
text/plain for structured data. If the WG takes any ideas from X-ARF
they should be recast in a form compatible with RFC 3464 and RFC 5965;
use of multipart/report and something similar to
message/feedback-report.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 2 Sep 2010 12:27:18 -0400

Do we need to coordinate with the IODEF?

---

From: "Alex Bobotek" <[email-masked]>
Date: Thu, 2 Sep 2010 11:40:52 -0700

No strong feelings either way on IODEF from me.  But IODEF seems to be a part of the anti-abuse ecosphere that service providers and investigators may want to feed into and between their anti-abuse systems.

Regards,

Alex