Subject: Re: [feedback-report] remove unused feedback types
From: "John R. Levine" <[email-masked]>
To: Alessandro Vesely <[email-masked]>
Cc: ARF mailing list <[email-masked]>
Date: Sun, 23 Aug 2009 09:19:08 -0400 (EDT)
List-Id: Public forum for discussion on the feedback-report draft <abuse-feedback-report.mipassoc.org>

> A different, yet related, question is whether anyone sends them.
> I guess we all do AV scanning of mail in transit, and possibly
> differ on drop vs reject issues. What about sending an ARF
> report? Should it contain the actual virus or just the headers?

I have been "denaturing" the virus by changing the first bytes of the 
base64 to xxxxxx and sending the first 50 lines of the message.  In 
retrospect, that hasn't been very successful.  Even though the denatured 
version is not even executable, I still get back way too many rejections 
from anti-virus software.  One Russian DNSBL keeps listing me for sending 
viruses, and they told me that even though they know I'm not sending 
viruses, it's still my fault for triggering their AV software's false 
alarms.

Since I have a public archive of all the spam I report, for the benefit of 
people whose MUAs or ticketing systems smash the copy of the spam in the 
report, I should change it just to say it was a virus and leave the link 
to the archive.

R's,
John

Date: Sun, 23 Aug 2009 13:44:42 +0400
From: Alessandro Vesely <[email-masked]>
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] remove unused feedback types

J.D. Falk wrote:
> John R. Levine wrote:
> 
>>>> Keep: abuse, dkim, not-spam, other
>>>> Drop: fraud, miscategorized, opt-out, virus
>>> -1, the "fraud" and "virus" types convey additional information which
>>> may not be easily available otherwise.
>> Has anyone ever seen an actual ARF report with a fraud or virus tag? I
>> haven't.
> 
> Nor have I.  I agree that they'd be useful in theory, but if they aren't 
> used in the real world....

A different, yet related, question is whether anyone sends them. 
I guess we all do AV scanning of mail in transit, and possibly 
differ on drop vs reject issues. What about sending an ARF 
report? Should it contain the actual virus or just the headers?

From: Mark Martinec <[email-masked]>
To: [email-masked]
Date: Sat, 22 Aug 2009 01:57:42 +0200
Organization: J. Stefan Institute
Subject: Re: [feedback-report] remove unused feedback types

John R. Levine wrote:
> I send ARF reports to [email-masked] and they seem to process them as
> well as they process anything else.

Perhaps they do now. The last time I experimented with formats sent
to [email-masked], I always received some generic response claiming that
I must provide the full original message, even though the original message
was attached (as ARF or as a normal message/rfc822 attachment).
Once I switched to including the message in-line (as per their instructions
on the web page) as a plain text, their responses became sensible.

J.D. Falk wrote:
> Could you ask one of these recipients whether they process your fraud 
> reports differently from other ARF messages?  If they ignore the type field, 
> then perhaps we could do away with it entirely.

Since I don't have any closer contacts there, it's hard to get any personal
response, let alone any insider information to questions like this.

But I can tell that when initially I was sending them both spam and fraud
reports (clearly stating one or the other in the first line, followed by
essential data like a sending IP address and DKIM signature confirmation),
the fraud reports were (and still are) answered reassuringly, explicitly
mentioning fraud:

  In this particular case, we have taken appropriate action against the 
  Yahoo! account in question that was reported for fraudulent activities,
  as per our Terms of Service (TOS).

while in cases of spam reports they may or may not claim "taking
appropriate action". Since some months back, I stopped sending them
spam reports, while still sticking with genuine fraud reports.

Perhaps it's just my imagination, but I do believe that (clearly marked)
fraud reports draw more careful attention then generic/spam reports.

  Mark

Date: Fri, 21 Aug 2009 18:40:14 -0400 (EDT)
From: "John R. Levine" <[email-masked]>
To: "J.D. Falk" <[email-masked]>
Cleverness: None detected
Cc: [email-masked]
Subject: Re: [feedback-report] remove unused feedback types

>> Despite the fact that Yahoo! does not accept attachments in complains
>> sent to their abuse address
>
> ARF was never intended to be forced upon unwilling recipient addresses.

I send ARF reports to [email-masked] and they seem to process them as 
well as they process anything else.

R's,
John

Date: Fri, 21 Aug 2009 16:31:05 -0600
From: "J.D. Falk" <[email-masked]>
To: [email-masked]
Subject: Re: [feedback-report] remove unused feedback types

Mark Martinec wrote:

> Despite the fact that Yahoo! does not accept attachments in complains
> sent to their abuse address

ARF was never intended to be forced upon unwilling recipient addresses.

(Yahoo! /does/ have an inbound ARF processing system, but it's separate from 
abuse@.  I don't know what their current access policy is.)

> Perhaps it is just my belief, but I think the abuse reports cleary
> marked as "fraud" do attract more attention, are more easily recognized
> as valid, and as such acted upon.

Could you ask one of these recipients whether they process your fraud 
reports differently from other ARF messages?  If they ignore the type field, 
then perhaps we could do away with it entirely.

-- 
J.D. Falk
Return Path Inc
http://www.returnpath.net/

From: Mark Martinec <[email-masked]>
Organization: J. Stefan Institute
To: [email-masked]
Date: Fri, 21 Aug 2009 19:12:09 +0200
Subject: Re: [feedback-report] remove unused feedback types

John R. Levine writes:

> >> Keep: abuse, dkim, not-spam, other
> >> Drop: fraud, miscategorized, opt-out, virus
> >
> > -1, the "fraud" and "virus" types convey additional information
> > which may not be easily available otherwise.
>
> Has anyone ever seen an actual ARF report with a fraud or virus tag?  I
> haven't.  My reports just say abuse, like everyone else's.  If your ARF
> parser can't tell whether a reported message contains a virus, you're not
> trying.
>
> My recollection is that the extra types were added at the insistence of
> some ESP types who were under the misconception that it would make systems
> sending reports from feedback loops do their list management for them.

Despite the fact that Yahoo! does not accept attachments in complains
sent to their abuse address (and hence ARF can't currently be used
(I'm not sure if it is still so)), our site is sending them abuse reports
exclusively for "fraud" type of mail, and this is clearly indicated in
our reports. I believe these reports are acted upon, as I do receive
a steady trickle of confirmations from their operators in response
to each of our reports.

Perhaps it is just my belief, but I think the abuse reports cleary
marked as "fraud" do attract more attention, are more easily recognized
as valid, and as such acted upon.

  Mark

Date: Fri, 21 Aug 2009 11:22:33 -0600
From: "J.D. Falk" <[email-masked]>
To: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] remove unused feedback types

John R. Levine wrote:

>>> Keep: abuse, dkim, not-spam, other
>>> Drop: fraud, miscategorized, opt-out, virus
>>
>> -1, the "fraud" and "virus" types convey additional information which
>> may not be easily available otherwise.
>
> Has anyone ever seen an actual ARF report with a fraud or virus tag? I
> haven't.

Nor have I.  I agree that they'd be useful in theory, but if they aren't 
used in the real world....

Murray S. Kucherawy wrote:

 > The opendkim filter produces "fraud" reports for messages that fail the
 > ADSP test.

Would one of the dkim types be more appropriate?

-- 
J.D. Falk
Return Path Inc
http://www.returnpath.net/

From: "Murray S. Kucherawy" <[email-masked]>
To: "John R. Levine" <[email-masked]>
Date: Fri, 21 Aug 2009 09:19:14 -0700
Accept-Language: en-US
acceptlanguage: en-US
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] remove unused feedback types

> -----Original Message-----
> From: John R. Levine [mailto:[email-masked]]
> Sent: Friday, August 21, 2009 8:49 AM
> To: Murray S. Kucherawy
> Cc: Javier Godoy; ARF mailing list
> Subject: RE: [feedback-report] remove unused feedback types
> 
> > The opendkim filter produces "fraud" reports for messages that fail
> the ADSP test.
> 
> Any idea how popular it is?

You'd have to add its stats to that of dkim-milter, which also has had that feature for some time now.  Download stats are available via SourceForge.

From: "Murray S. Kucherawy" <[email-masked]>
To: "John R. Levine" <[email-masked]>, Javier Godoy <[email-masked]>
Date: Fri, 21 Aug 2009 08:47:16 -0700
Accept-Language: en-US
acceptlanguage: en-US
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] remove unused feedback types

> -----Original Message-----
> From: [email-masked] [mailto:abuse-
> [email-masked]] On Behalf Of John R. Levine
> Sent: Thursday, August 20, 2009 9:28 PM
> To: Javier Godoy
> Cc: ARF mailing list
> Subject: Re: [feedback-report] remove unused feedback types
> 
> >> Keep: abuse, dkim, not-spam, other
> >> Drop: fraud, miscategorized, opt-out, virus
> >
> > -1, the "fraud" and "virus" types convey additional information which
> may not
> > be easily available otherwise.
> 
> Has anyone ever seen an actual ARF report with a fraud or virus tag?  I
> haven't.  My reports just say abuse, like everyone else's.  If your ARF
> parser can't tell whether a reported message contains a virus, you're
> not
> trying.

The opendkim filter produces "fraud" reports for messages that fail the ADSP test.

Date: Fri, 21 Aug 2009 11:48:48 -0400 (EDT)
From: "John R. Levine" <[email-masked]>
To: "Murray S. Kucherawy" <[email-masked]>
Cleverness: None detected
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] remove unused feedback types

> The opendkim filter produces "fraud" reports for messages that fail the ADSP test.

Any idea how popular it is?

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

Date: Fri, 21 Aug 2009 00:28:29 -0400 (EDT)
From: "John R. Levine" <[email-masked]>
To: Javier Godoy <[email-masked]>
Cleverness: None detected
Cc: ARF mailing list <[email-masked]>
Subject: Re: [feedback-report] remove unused feedback types

>> Keep: abuse, dkim, not-spam, other
>> Drop: fraud, miscategorized, opt-out, virus
>
> -1, the "fraud" and "virus" types convey additional information which may not
> be easily available otherwise.

Has anyone ever seen an actual ARF report with a fraud or virus tag?  I 
haven't.  My reports just say abuse, like everyone else's.  If your ARF 
parser can't tell whether a reported message contains a virus, you're not 
trying.

My recollection is that the extra types were added at the insistence of 
some ESP types who were under the misconception that it would make systems 
sending reports from feedback loops do their list management for them.

R's,
John

From: "Javier Godoy" <[email-masked]>
To: "J.D. Falk" <[email-masked]>, <[email-masked]>
Date: Thu, 20 Aug 2009 23:37:38 -0300
Subject: Re: [feedback-report] remove unused feedback types

> It's a pretty safe bet that Return Path is among the top three generators of
> ARF messages (counting by message), and we only use the 'abuse' type -- yet
> I still see confusion about the others.  This leads to interoperability
> issues, such as when a feedback consumer assumes that they'll only have to
> care about "opt-out" while pretty much all of the feedback providers in the
> world only provide "abuse".
>
> So, to kick off the first argument as we move into the possible creation of
> a formal IETF WG, I propose that we:
>
> Keep: abuse, dkim, not-spam, other
> Drop: fraud, miscategorized, opt-out, virus

-1, the "fraud" and "virus" types convey additional information which may not 
be easily available otherwise.

fraud: the end user has read the message and found it was a kind of fraud, 
instead of plain UCE. This kind of abuses might be treated differently when 
reported.

virus: a system could detect that an attachment contains a virus, and remove 
it. Later, the same system or another, could report this fact. .

Regards

Javier
----- Original Message ----- 
From: "J.D. Falk" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, August 20, 2009 5:37 PM
Subject: [feedback-report] remove unused feedback types

Date: Thu, 20 Aug 2009 14:37:20 -0600
From: "J.D. Falk" <[email-masked]>
To: [email-masked]
Subject: [feedback-report] remove unused feedback types

It's a pretty safe bet that Return Path is among the top three generators of 
ARF messages (counting by message), and we only use the 'abuse' type -- yet 
I still see confusion about the others.  This leads to interoperability 
issues, such as when a feedback consumer assumes that they'll only have to 
care about "opt-out" while pretty much all of the feedback providers in the 
world only provide "abuse".

So, to kick off the first argument as we move into the possible creation of 
a formal IETF WG, I propose that we:

Keep: abuse, dkim, not-spam, other
Drop: fraud, miscategorized, opt-out, virus

And keep the registry, so that new types may be added in the future if a 
demonstrable need arises.

What say you?

-- 
J.D. Falk
Return Path Inc
http://www.returnpath.net/