Subject: [marf] Fwd: I-D Action: draft-vesely-marf-abuse-reporting-00.txt

From: Alessandro Vesely <[email-masked]>
Date: Sat, 03 Sep 2011 14:39:29 +0200

I posted this, about issues that current WG drafts cannot address.

Does the WG want to adopt it as a WG draft, and discuss it?

TIA for your time.

-------- Original Message --------
From: [email-masked]
To: [email-masked]
Subject: I-D Action: draft-vesely-marf-abuse-reporting-00.txt
Date: Sat, 03 Sep 2011 05:22:43 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : Abuse Reporting
	Author(s)       : Alessandro Vesely
	Filename        : draft-vesely-marf-abuse-reporting-00.txt
	Pages           : 8
	Date            : 2011-09-03

   This documents covers issues of spam reporting by the general public.

   The Abuse Reporting Format (ARF) was originally developed for use by
   large operators.  However, abuse reporting is also useful for medium
   and small operators.  The need to automate abuse reporting originates
   from the volume of spam, not the size of the operators.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-vesely-marf-abuse-reporting-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-vesely-marf-abuse-reporting-00.txt
_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 3 Sep 2011 22:45:15 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Saturday, September 03, 2011 5:39 AM
> To: Message Abuse Report Format working group
> Subject: [marf] Fwd: I-D Action: draft-vesely-marf-abuse-reporting-00.txt
> 

Hi Alessandro,

Thanks for the draft.  It's a long weekend here so I suspect a lot of folks in North America won't get to this until the middle of next week.  That includes me; I haven't read all of it yet and won't for a few more days.

Based on your Abstract alone, I'm wondering: Does this introduce material not covered by http://datatracker.ietf.org/doc/draft-jdfalk-maawg-cfblbcp/ ?

-MSK (as participant for the moment)

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 9 Sep 2011 10:33:08 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
> Sent: Saturday, September 03, 2011 10:45 PM
> Subject: Re: [marf] Fwd: I-D Action: draft-vesely-marf-abuse-reporting-00.txt
> 
> Based on your Abstract alone, I'm wondering: Does this introduce
> material not covered by http://datatracker.ietf.org/doc/draft-jdfalk-
> maawg-cfblbcp/ ?

I'm assuming the answer to that is "yes" given other list traffic since.

The draft-jdfalk-maawg-cfblbcp document is moving forward as an independent submission.  If the working group thinks there are points in Alessandro's document that would be good addenda to what the independent submission says, we can put those in the applicability statement (draft-ietf-marf-as).  So instead of Alessandro going ahead with his document (and it would be weird for this group to produce two BCPs on the same topic), we should review what he says and then propose text that JD should add to the AS and then see if any of it gets consensus.

Sound good?

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 13 Sep 2011 10:41:02 -0700

> Sent: Friday, September 09, 2011 10:33 AM
> The draft-jdfalk-maawg-cfblbcp document is moving forward as an
> independent submission.  If the working group thinks there are points
> in Alessandro's document that would be good addenda to what the
> independent submission says, we can put those in the applicability
> statement (draft-ietf-marf-as).  So instead of Alessandro going ahead
> with his document (and it would be weird for this group to produce two
> BCPs on the same topic), we should review what he says and then propose
> text that JD should add to the AS and then see if any of it gets
> consensus.

Given the conversation in the other thread, there's interest (at least from Alessandro) about discussing the handling of feedback reports that are generated without a private arrangement between the producer and the consumer.  The MAAWG BCP and our Applicability Statement discuss FBLs with private arrangements, but not reports from the general public.

Barry and I agree that this is something we should consider because such things will happen, either because report generators just start using "abuse@" as the destination without prior arrangement, or because the reporting-discovery draft gets traction.

The right place to do this would be in additional sections added to draft-ietf-marf-as.  It's fine for that document to point to the MAAWG BCP for the pre-arranged FBL case (as it already does), and then also discuss things about sending or receiving feedback outside of the context of a formalized FBL.

So far John and Alessandro have some experience they're bringing to bear on the topic.  If that could be coalesced into additional sections for the AS, that would probably be ideal.  There are other FBL experts on this list (obviously) and I'd like it if they could weigh in as well.

-MSK, as co-chair (and proxying Barry via IM)

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 14 Sep 2011 10:25:41 +0200

On 13/Sep/11 19:41, Murray S. Kucherawy wrote:
> 
> The right place to do [the handling of feedback reports that are
> generated without a private arrangement between the producer and
> the consumer] would be in additional sections added to 
> draft-ietf-marf-as.  It's fine for that document to point to the 
> MAAWG BCP for the pre-arranged FBL case (as it already does), and 
> then also discuss things about sending or receiving feedback 
> outside of the context of a formalized FBL.

I agree on that.  I only wrote a separate document after JD said that
non-solicited feedback need to be a different Applicability Statement.
http://www.ietf.org/mail-archive/web/marf/current/msg01117.html

Yet, it may be convenient to rough-hew that stuff as a separate
document, at least until we hear from JD.  I dunno whether WG-doc vs.
individual submission makes any difference in such respect.  Please
advise.

On 13/Sep/11 19:03, Murray S. Kucherawy also wrote:
> I don't think we could codify, in protocol at least, anything at
> all about WHOIS.  In its current form it isn't a reliable source of
> any kind of information.

It seems to be getting more and more reliable, even including advice
about reliability, in some cases.  I'd consider it more reliable than
rDNS + domain-name lookup, but would like to hear from John on this point.

> All of that might change if the WEIRDS effort is successful, but
> for now WHOIS is a wild west.

IMHO, the larger part of the difficulty is the need to interface five
different RIRs.  It would be great if WEIRD could come out with an
homogeneous rDNS-like interface --obviously OT here.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Wed, 14 Sep 2011 07:26:14 -0400

In <[email-masked]>, on 09/14/2011
   at 10:25 AM, Alessandro Vesely <[email-masked]> said:

>It seems to be getting more and more reliable,

I parse whois data with Perl regexen, and IMHO the data are still far
too unstandardized, e.g., some addresses are present only in comments,
some data are available only by following links whose existence
depends on the particular RIR.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 14 Sep 2011 09:46:43 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Shmuel Metz
> Sent: Wednesday, September 14, 2011 4:26 AM
> Subject: Re: [marf] Private vs. "public" FBLs
> 

That's my observation as well.  I believe it's the case that any reliability people see from WHOIS is coincidental, and not the result of any standards effort from IETF or a policy effort from ICANN.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 14 Sep 2011 09:49:27 -0700

> Sent: Wednesday, September 14, 2011 1:26 AM
> To: [email-masked]

There's certainly nothing stopping you from developing your individual submission, but the chairs feel that material should really be rolled into the AS once the WG has consensus on what text to add to it to cover this other specific use case.

---

From: "John Levine" <[email-masked]>
Date: 14 Sep 2011 19:22:06 -0000

>That's my observation as well.  I believe it's the case that any
>reliability people see from WHOIS is coincidental, and not the result of
>any standards effort from IETF or a policy effort from ICANN.

Domain WHOIS for ICANN gTLDs is actually well standardized, except for
.com and .net.  (I realize this is like saying all water is fresh,
except for the ocean.)  I believe that the plan is to migrate .com and
.net to the standard format at some point, but I don't know what the
schedule is.

The RIRs are indeed all different, and even when the format is reasonably
well defined, the data are often missing or contradictory.

In any event, I think we agree that scraping data from WHOIS is not
suitable for any IETF standardization any time soon.

R's,
John

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 20 Sep 2011 15:36:35 -0700

> The right place to do this would be in additional sections added to draft-ietf-marf-as.  It's fine for that document to point to the MAAWG BCP for the pre-arranged FBL case (as it already does), an…

An alternative could be to have a separate Applicability Statement discussing open/ad-hoc/non-pre-arranged feedback streams, so that readers aren't confused.  That also leaves room for future ASes on virus reporting, et cetera -- a whole series.

--
J.D. Falk
the leading purveyor of industry counter-rhetoric solutions