Subject: [marf] draft-vesely-marf-abuse-reporting-00 comments

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Sun, 04 Sep 2011 11:55:12 -0400

4.  Forwarding Abuse Reports From Local Users

Shouldn't the forwarding be to the abuse team of the source IP address
in addition to the abuse team of an authenticated sending domain?
Also, shouldn't the fallback be to use the abuse team of the source IP
address rather than the abuse team of an unauthenticated sending
domain?

5.  Receiving Abuse Reports From Other Mailbox Providers

I strongly disagree with "The obvious correction for an acknowledged
policy contravention is to remove the email address of the original
recipient from whatever storage it was retrieved from for sending the
reported message, including mailing lists." The obvious correction is
to remove *all* addresses for which consent was not given, not just to
listwash.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 05 Sep 2011 10:03:26 +0200

> in addition to the abuse team of an authenticated sending domain?

A very interesting question.  I didn't dare recommend that, as it
would amount to two messages (or more, if targeting also higher level
allocations) for each abuse report.  It would be a bit better to send
a report to the IP team and have them forward it to the domain, but
not all ISPs would be willing to cooperate.

Perhaps, MPs can realize whether reporting abuse to a given domain
sorts any effect, and switch to reporting to the IP team as soon as it
is clear that the domain does not react.

> address rather than the abuse team of an unauthenticated sending

Absolutely, if there is an abuse team for the IP.

> to remove *all* addresses for which consent was not given, not just to

Yeah, but since we don't know whether consent was actually given, we
cannot assume they do.  <OT>Even in countries where consent is
mandatory, mailbox providers are not entitled to collect list
subscriptions on behalf of their users.  That way, users are confined
to annotate on paper whom the gave consent for what, with the sole
computer support of possible monthly reminders: a quite ineffective
"time-distributed" database...</OT>

---

From: "John Levine" <[email-masked]>
Date: 5 Sep 2011 16:32:54 -0000

In article <[email-masked]> you write:
>in addition to the abuse team of an authenticated sending domain? ...

Since we're writing a standard for interoperability, not a BCP for
abuse desks, I don't think we should tell people what to do with their
reports beyond general advice to pass them along to responsible parties
insofar as they can.

Having run abuse.net for over a decade, I can assure you that
identifying the best place to send reports, whether keyed on domains
on or IP addresses, is a black art and not something you can put in a
standard.  There are plenty of heuristics and guesses, but no
algorithm.

R's,
John

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Mon, 05 Sep 2011 10:13:10 -0400

In <[email-masked]>, on 09/05/2011
   at 10:03 AM, Alessandro Vesely <[email-masked]> said:

>cannot assume they do.

Understood, but we cam certainly suggest that they investigate instead
of listwashing.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Mon, 05 Sep 2011 21:51:29 -0400

In <[email-masked]>, on 09/05/2011
   at 04:32 PM, "John Levine" <[email-masked]> said:

>standard.

It's already there. I'm questioning the current wording.

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 06 Sep 2011 10:55:45 +0200

On 05/Sep/11 16:13, Shmuel (Seymour J.) Metz wrote:
> Understood, but we can certainly suggest that they investigate instead
> of listwashing.

You mean adding something like

   An abuse team may need to investigate whether email addresses are
   stored legitimately on their customer's systems, or if any malware
   is running there

?

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Tue, 06 Sep 2011 12:15:15 -0400

In <[email-masked]>, on 09/06/2011

>   stored legitimately on their customer's systems, or if any malware

Yes.