Subject: Re: Reputation services for SenderID

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Fri, 27 Aug 2004 23:24:52 -0700

>with the number of IP addresses authorized by the SPF2 record, and
 >even for domains which only authorize a very few IP addresses, we'll
 >have no practical way (except manual processing of requests) to
 >correct outdated blacklist listings.

  A lookup to IADB, which is an accreditation database rather than a 
blacklist or a whitelist, can (and will for listed IP addresses) give 
you enough information to determine whether the blacklist listing 
should be decreased in weight or even overridden.  That information 
includes, among other things, the opt-in level of the mailing list mail 
which comes from that IP address, and whether that IP address is listed 
in Bonded Sender or Habeas.  If an IADB-listed IP address returns a 
code indicating that all mailing list mail coming from that IP address 
is, for example, confirmed-opt-in, that's useful information in the 
face of the IP address also appearing on a blacklist.

SPF publishers who are also listed in IADB include the 
"accredit=%{ir}.iadb.isipp.com" in their SPF records; I assume it would 
be the similar for SPF2.  The information returned from an IADB query 
includes whether an SPF record is published for that IP, so there is a 
closed loop there - if you check SPF first, you'll know that the IP is 
listed in IADB and you can get more info there - if you check IADB 
first, you'll know that there is an SPF record for that IP address.

Some receivers prefer to do their lookups to IADB2 rather than IADB - 
IADB2 provides an aggregated weighted score rather than, but based on, 
the individual bits of information.

(http://www.isipp.com/iadb.php)

Anne

Anne P. Mitchell, Esq.
President/CEO
Institute for Spam and Internet Public Policy
Professor of Law, Lincoln Law School of SJ
Committee Member, Asilomar Microcomputer Workshop

---

From: "Douglas Otis" <[email-masked]>
Date: Sat, 28 Aug 2004 04:44:27 -0700 (PDT)

> the individual bits of information.

This is a listing service that, for a setup up fee and so much per month,
will accept lists of IP addresses.  These types of IP based white-listing
services existed well before SPF.  The publisher must have dominion over
the IP addresses effectively.  Pay for mailing rights work for bulk
mailers.  The selection of listing services is also provided by a simple
scheme within CSV, but where a domain name is used.  The history
associated with a name does not require a payment stream to a
white-listing service.

-Doug

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Sat, 28 Aug 2004 04:56:04 -0700

I'm not sure that this line of discussion below is on-topic, so if I'm 
wrong to follow up, please whack me:

> will accept lists of IP addresses.

Not an accurate representation.  It's an accreditation service which 
researches, verifies, and accredits IP addresses which are listed in 
the database.  Senders do indeed pay a monthly fee for listing, which 
is how it is supported so that we can make it available for free for 
receivers to query.  There is no set-up fee.  There is an application 
fee if the senders are not otherwise known to us, and fairly well, 
through industry channels.  That fee is used to do a background check, 
check references, etc., as part of the accreditation process.

>   These types of IP based white-listing
> services existed well before SPF.

IADB is not, emphatically not, a whitelist.  The information contained 
in IADB about the IPs and the mail flowing therefrom is purely factual 
and objective, with no value judgement made at all, nor expectation 
about what querying sites will do with that information - use it to 
accept mail, use it to reject mail, use it to figure out lottery 
numbers - it's entirely up to the querying site.  That's the whole 
purpose of IADB - to put as much _factual_ information into the hands 
of the querier as possible so that they can make informed, educated 
decisions and choices about how to process email coming from any given 
IP address (whereas whitelists and blacklists tell you whether you 
should accept or reject that email).

Anne

Anne P. Mitchell, Esq.
President/CEO

---

From: "Douglas Otis" <[email-masked]>
Date: Sat, 28 Aug 2004 06:12:46 -0700 (PDT)

>> This is a listing service that, for a setup up fee and so much per
>> month, will accept lists of IP addresses.
>

This was not said to diminish the value of your services.  I was
attempting to clarify money establishes a history.  Tracking the history
of an individual is a difficult task when working with IP addresses as an
identity.  This adds to the cost of these services.

>> These types of IP based white-listing services existed well before SPF.
>
> numbers - it's entirely up to the querying site.

Perhaps the relationship between paying and having a record with some
information added is objective and that the white pays for the black. 
There must be trust in the address information, especially when there are
negative assertions applied.  This is where this model becomes weakest. 
Those causing trouble will not help in tracking their addresses.  I did
not intend to imply any negative assertions about this type of service. 
Again, the point I was attempting to make was the setup fees and payment
stream provides credibility to addresses associated with a customer's
claim.  I would expect the setup fee pays for vetting this information.  I
was only attempting to highlight difference between only using IP
addresses and the benefits of using domain names.  The major benefit is
from maintaining history without tracking IP addresses.

What I am sure has been lost in this conversation, is that the Sender-ID
Mailbox Domain is not adequately validated to be used as a basis for
negative assertions.  The authentication of CSV, although weak by most
security standards, is significantly stronger at establishing an
accountable domain identity.

Both CSV and SPF allow the sender to recommend a service. ; )

-Doug

---

From: Dave Crocker <[email-masked]>
Date: Sat, 28 Aug 2004 08:32:47 -0700

Anne,

APME> IADB is not, emphatically not, a whitelist.  The information contained
APME> in IADB about the IPs and the mail flowing therefrom is purely factual
APME> and objective, with no value judgement made at all, nor expectation

  I thought I had understood what IADB was about, but now I am confused.

  The web page says:

       The ISIPP Accreditation Database (IADB) is a DNS list of the
       domains and/or IP addresses of senders who either a) meet ISIPP's
       criteria as determined by background, reference, and other checks
       ("non-vouched listings"), or b) are personally known to ISIPP to
       meet the criteria and to be good Internet mailing citizens, and
       for whom we will thus vouch ("vouched listings").

This very definitely defines a service that makes a value judgement.

Please clarify.

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>

---

From: "Anne P. Mitchell, Esq." <[email-masked]>
Date: Sat, 28 Aug 2004 11:06:10 -0700

> This very definitely defines a service that makes a value judgement.

Dave,

Thank you for pointing that out, as I can see where it is confusing and 
we need to clarify that on our website.

In order to be *allowed* to be listed in IADB you must pass the 
background check - *unless* we already know you through various 
activities - that can take the place of the background check.  That's 
the only aspect of vouched/unvouched.  It's a hurdle to entry.

The data listed/contained in IADB itself is purely factual information, 
for example:

Publishes SPF record
Publishes Microsoft "Caller I.D. for Email" record
Participates in Habeas program
Participates in Ironport's Bonded Sender program
Accepts unverified sign-ups such as through web page
Accepts unverified sign-ups, gives chance to opt out
Adds only customer and inquirer email addresses to mailing list without 
opt-in, gives chance to opt out

..and so on.  The full list of codes is at:  
http://www.isipp.com/iadbcodes.php

Does that help to clarify any?

Anne

Anne P. Mitchell, Esq.
President/CEO

---

From: Dave Crocker <[email-masked]>
Date: Sat, 28 Aug 2004 11:35:03 -0700

Anne,

APME> In order to be *allowed* to be listed in IADB you must pass the 
APME> background check ...
APME> The data listed/contained in IADB itself is purely factual information,
APME> for example:

There is an added bit of information, to the strictly 'factual' set of
data you provide in the entry.

That bit of information is that they passed your background check.

Your basis for choosing a particular set of criteria is not 'factual'.
It is determined by you opinion of what the requirements should be set
for listing.

This is not a bad thing at all, but it also is not objective. In fact,
it is the REAL value of such a listing, namely that the entity being
referred to was able to pass your test.

It is at the core of the value proposition for serious
accreditation/reputation services, namely someone's independent
assessment of the entity being considered.

d/