Subject: [marf] I-D Action: draft-ietf-marf-as-01.txt

From: [email-masked]
Date: Wed, 21 Dec 2011 16:13:27 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Messaging Abuse Reporting Format Working Group of the IETF.

	Title           : Creation and Use of Email Feedback Reports: An Applicability Statement for the Abuse Reporting Format (ARF)
	Author(s)       : J.D. Falk
                          M. Kucherawy
	Filename        : draft-ietf-marf-as-01.txt
	Pages           : 6
	Date            : 2011-12-21

   RFC 5965 defines an extensible, machine-readable format intended for
   mail operators to report feedback about received email to other
   parties.  This document describes one common method for utilizing
   this format for reporting at scale between large mailbox providers,
   and from large mailbox providers to other mail sending entities.

   [NOTE TO EDITOR: Murray Kucherawy is listed as an author only to
   enable him to complete the publication process on behalf of J.D.
   Falk.  Please remove Murray from the author list prior to
   publication.]

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-marf-as-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-marf-as-01.txt

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 21 Dec 2011 16:19:04 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Wednesday, December 21, 2011 4:13 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [marf] I-D Action: draft-ietf-marf-as-01.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Messaging Abuse Reporting
> Format Working Group of the IETF.
> 
> 	Title           : Creation and Use of Email Feedback Reports: An
> Applicability Statement for the Abuse Reporting Format (ARF)
> 	Author(s)       : J.D. Falk
>                           M. Kucherawy

Minor editorial changes and polishing, and temporarily taking over editorial duties for JD as we prepare to send this to the IESG.  A full diff is available through the datatracker.

Alessandro is working on some edits for the WG to consider.  I'm planning to make a call for consensus on his changes (which will be derived from draft-veseley-marf-abuse-reporting) when we see them, and then either way initiate a Working Group Last Call on this in the first half of January.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 22 Dec 2011 05:07:52 -0000

It's basically fine, but of course that doesn't keep me from
suggesting changes.

There's two fairly different contexts in which people use ARF.  The
original one, and still by far the most common, is when two mail
systems make a private agreement to exchange abuse reports, usually
reports due to recipients manually reporting messages as spam.

The other one is sending reports between parties that don't know each
other, with the recipient address typically being abuse@domain, or
looked up via RIR WHOIS or the like.  The reports may be manual, or
automated due to hitting spam traps, or scored high by spam filters,
or anything else.  At least one large provider (Yahoo) has said that
it wants all its reports as ARF, and I've been sending all my
reports as ARF for over a year.  I can report that it works at least
as well as any other form.

I'd suggest reorganizing the draft a little to clarify that prior
agreement vs. no prior agreement are two different applications, both
in current use.  If people want, I can suggest specific changes.

R's,
John

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 22 Dec 2011 07:55:50 -0500

In <[email-masked]>, on 12/22/2011
   at 05:07 AM, "John Levine" <[email-masked]> said:

>At least one large provider (Yahoo) has said that
>it wants all its reports as ARF,

Which is a problem, because currently ARF is designated for reporting
spam sources, not, e.g., spam drop boxes, spam support sites. In
effect yahoo is refusing to accept reports for broad categories of
abuse.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: "John Levine" <[email-masked]>
Date: 22 Dec 2011 19:41:03 -0000

>spam sources, not, e.g., spam drop boxes, spam support sites.

Drop boxes:

Feedback-Type: abuse
Reported-URI: mailto:[email-masked]

Spam support sites:

Feedback-Type: abuse
Reported-URI: http://randomcustomer.yahoo.com/fakemanlydrugs.html

Phishing:

Feedback-Type: fraud
Reported-URI: http://bankofamerica.randomcustomer.yahoo.com/enteryourlifehistory.html

I don't know if Yahoo pays attention to these, but ARF lets you report them.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 22 Dec 2011 19:41:03 -0000

Drop boxes:

Feedback-Type: abuse

Spam support sites:

Feedback-Type: abuse

Phishing:

Feedback-Type: fraud

R's,
John

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 22 Dec 2011 15:53:15 -0500

In <[email-masked]>, on 12/22/2011

>Reported-URI: mailto:[email-masked]

Doesn't that conflict with RFC 5965?

1.1.  Purpose

   The reports defined in this document are intended to inform mail
   operators about:

   o  email abuse originating from their networks;

   o  potential issues with the perceived quality of outbound mail,
      such as email service providers sending mail that attracts
      the attention of automated abuse detection systems.

   Please note that while the parent "multipart/report" content
   type defined in [REPORT] is used for all kinds of administrative
   messages, this format is intended specifically for
   communications among providers regarding email abuse and related
   issues, and SHOULD NOT be used for other reports.

>I don't know if Yahoo pays attention to these,

They used to send the bedbug letter :-(

---

From: "John Levine" <[email-masked]>
Date: 22 Dec 2011 22:10:27 -0000

>Doesn't that conflict with RFC 5965?

No.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 22 Dec 2011 22:10:27 -0000

No.

R's,
John

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Fri, 23 Dec 2011 00:17:53 -0500

In <[email-masked]>, on 12/22/2011

>No.

Abuse complaints from the recipients are not communications among
providers. How do they not violate the RFC 5965 text that I quoted
from 1.1.  Purpose?

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 23 Dec 2011 17:47:58 +0100

> providers. How do they not violate the RFC 5965 text that I quoted

Isn't it to inform mail operators about email abuse originating from
their networks?

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 23 Dec 2011 18:12:24 +0100

> reports due to recipients manually reporting messages as spam.

Another original use case is the unilateral FBL from a mail system to
a bulk sender.

> looked up via RIR WHOIS or the like.

One of the like methods should be described in the reporting-discovery
draft.  RIRs' refurbishing of their databases and access methods seems
to be arriving earlier than that, at least for ARIN.

However, whois databases need the cooperation of network providers to
get updated.  PTR records suffer of the same complication, worsened by
the need to maintain consistency between DNS and rDNS.  The other
method --the RFC 2142 "abuse" role-- being what it is, if
report-discovery will make it it seems it will be the one more
universally available to mailbox providers.

> The reports may be manual, or automated due to hitting spam traps,
> or scored high by spam filters, or anything else.

This classification is also worth being made, IMHO.  Not sure where
and why, though.

> in current use.  If people want, I can suggest specific changes.

I wrote some changes, but didn't post the resulting draft.  For the
time being I copied it in http://www.tana.it/file/

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Fri, 23 Dec 2011 13:04:34 -0500

In <[email-masked]>, on 12/23/2011

>Isn't it to inform mail operators about email abuse originating from

The relevant test is "this format is intended specifically for
communications among providers regarding email abuse and related
issues, and SHOULD NOT be used for other reports." That would seem to
exclude using it for an abuse report from the recipient rather than
from his provider.

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 23 Dec 2011 20:09:12 +0100

> exclude using it for an abuse report from the recipient rather than

Hm... the second bullet clarifies that ESPs are targets rather than
senders of reports.  Perhaps, s/among/involving/ would yield a better
wording if "providers" also includes mailbox providers.  In any case,
the requirement level ("SHOULD NOT") seems to be referred to "email
abuse and related issues" --irrespectively of the original intention.
 In that sense, I don't think that utilizing ARF for user-to-provider
reporting would violate RFC 5965.

Note that Section 2 of reporting-discovery has a similar definition.

---

From: "John Levine" <[email-masked]>
Date: 23 Dec 2011 23:22:43 -0000

>exclude using it for an abuse report from the recipient rather than

Read it in context.  It means it's an abuse report, not a DSN.

Just to be clear, you're telling me that I don't understand what
my own RFC means?

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 23 Dec 2011 23:22:43 -0000

R's,
John

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Sat, 24 Dec 2011 17:25:12 -0500

In <[email-masked]>, on 12/23/2011
   at 11:22 PM, "John Levine" <[email-masked]> said:

>Just to be clear, you're telling me that I don't understand what my
>own RFC means?

I'm telling you that what you wrote doesn't express what you meant to
express.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 24 Dec 2011 23:35:03 -0800

> From: John Levine [mailto:[email-masked]]
> Sent: Wednesday, December 21, 2011 9:08 PM
> To: [email-masked]
> Cc: Murray S. Kucherawy
> Subject: Re: [marf] I-D Action: draft-ietf-marf-as-01.txt
> 

Yes, please.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 25 Dec 2011 23:46:45 -0000

>I'm telling you that what you wrote doesn't express what you meant to

I'm not aware of anyone else who reads that sentence the way you do,
so I'm not inclined to do anything about it.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 25 Dec 2011 23:46:45 -0000

R's,
John

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Mon, 26 Dec 2011 10:15:56 -0500

In <[email-masked]>, on 12/25/2011
   at 11:46 PM, "John Levine" <[email-masked]> said:

>Cc: [email-masked]

That's causing duplicate messages.

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 26 Dec 2011 20:53:44 +0100

> That's causing duplicate messages.

Probably triggered by
Mail-Followup-To: Message Abuse Report Format working group <[email-masked]>

---

From: "John Levine" <[email-masked]>
Date: 26 Dec 2011 23:33:03 -0000

>That's causing duplicate messages.

Surely in 2001 you have software that can deal with it.

R's,
John

PS: Lose the Reply-To:.

---

From: "John Levine" <[email-masked]>
Date: 26 Dec 2011 23:33:03 -0000

R's,
John

PS: Lose the Reply-To:.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Tue, 27 Dec 2011 12:41:07 -0500

In <[email-masked]>, on 12/26/2011

>Mail-Followup-To: Message Abuse Report Format working group

That sounds plausible; I've removed it from my template. Thanks.