Subject: RE: [Sipping] draft-niccolini-sipping-feedback-spit-00

From: "Saverio Niccolini" <[email-masked]>
Date: Wed, 22 Mar 2006 10:53:39 +0100

Hi,

answers are inline.

> I don't feel standardizing this is helpful for SPIT.  There 
> has been years
> of research into email antispam.  While they have content and 
> subject lines
> (and SIP doesn't), 

As also Samir said: SIP do have subject headers.

I agree with you that we do not have the content in voice for filtering:
that is why we need the feedback even more.

> the problem of 'blacklisting' someone is 
> very complex
> (how does one get off the list, what if a blacklisted person 
> is a legitimate
> customer of a legitimate company [wants to get their car 
> repaired at the
> local car dealer, or wants to get a pizza delivered] but that 
> person earlier
> in the day was harassing their congressman's office and got 
> blacklisted?

We are not talking about blacklisting only in the draft. And anyway 
a feedback may also not turn into a blacklisting action (it depends on
how you want to use the feedback).
Blacklisting is one of the methods for SPIT prevention, but it is
not the only one.
Let's think of a reputation system, it may also profit from feedback
information.

> I don't think we want to go there, at least not in SIP or in SIPPING.
> 
> Whoever does go there can tell us what information they find 
> useful.  And
> I'm sure it'll be sip-identity and some codification of the 
> claimed SPIT
> offense.

I am pretty sure SIP identity can help in SPIT prevention but
I do not see it as THE method. And it has still some problems
(see Section 6 of draft-ietf-sipping-spam-02).

My opinion is that we need more methods to be combined if we want to be
effective in SPIT prevention and we have to leverage what email has to
offer
(see Section 5 of draft-ietf-sipping-spam-02) and feedback is used in
email systems (my web.de account has a feedback mechanism built-in)

Cheers,
Saverio

> 
> -d
> 
> _______________________________________________
> Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> This list is for NEW development of the application of SIP
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments of core SIP
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 22 Mar 2006 07:31:09 -0800

> As also Samir said: SIP do have subject headers.

SDP has s=, too, but neither are used much especially on SIP phones.

> I agree with you that we do not have the content in voice for 
> filtering: that is why we need the feedback even more.

We disagree on what's needed to reduce the problem of spam / spit.

> Let's think of a reputation system, it may also profit from feedback

I'm quite familiar with existing email spam prevention techniques,
blacklisting, spam scoring (SpamAssassin and the like), community
spam reporting (Couldmark and Brightmail and the like), and am aware
of techniques used by AOL, Yahoo, and GMail to reduce the spam that
users see.

I'm not convinced the information you're suggesting to report
is sufficient for these systems.  I'm asking if you have interacted
with those groups, or with IETF's own DKIM group, to see what
reputation systems need.

To date, there is no single reputation system 'interface' for 
email.  Email, and email spam, has been around for a decade.  

If your intent is to provide input into a reputation system, it
seems good to build on what has been done for these systems and
how those systems handle false reports.  For example, in email,
it's very common for someone to get on a mailing list and later
want to get off the mailing list.  Many of those people click
on the 'spam' button rather than the 'unsubscribe' link.  Which
makes some sick sense -- afterall, it was lore that clicking on 
'unsubscribe' told the spammers they had found an active email
address.  Back to existing PSTN phones, I belong to frequent
guest programs for various hotels and they sometimes call me
for special deals at specific hotels.  I can imagine that if
some people are in that same situation they might simply click
'spam' -- causing the same improper feedback to a reputation
system as with mailing lists.

> I do not see it as THE method.

I agree, it isn't the only method.

> And it has still some problems

This is where SIP needs to look over to DKIM for help.  One of the issues in
section 6 of that I-D is that it's impossible to determine if missing SIP
Identity was because the originating domain doesn't use SIP Identity, or if
it was stripped off.  DKIM provides a way to determine if a remote domain
signs its messages by doing a DNS query to determine their policy.  SIP
could borrow this idea, with the necessary modifications (SIP is obviously
not email).

> email systems (my web.de account has a feedback mechanism built-in)

My opinion remains that it's too early to standardize this yet.

-d