Subject: Re: [marf] Comments on draft-jdfalk-marf-as-00

From: "J.D. Falk" <[email-masked]>
Date: Thu, 1 Sep 2011 12:22:47 -0700

On Aug 24, 2011, at 10:19 AM, Shmuel (Seymour J.) Metz wrote:

> There should be some discussion of MARF reports initiated from generic
> MUA's rather than MUA's provided by the MSA operator.

Do you have any examples of this type of functionality in MUAs available today?

> There should be a statement that MARF is not meant to replace plain
> text reports to abuse and postmaster, but rather is an additional
> option.

I believe we covered that in marf-base, but I wouldn't be opposed to saying it again.  Can you suggest some appropriate language?

--
J.D. Falk
the leading purveyor of industry counter-rhetoric solutions

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 01 Sep 2011 20:36:56 -0400

In <[email-masked]>, on
09/01/2011

>Do you have any examples of this type of functionality in MUAs

I'm afraid not, but I believe that we should discuss the issue.

I've got a tool that I use to analyze individual messages and collect
whois data on hosts either in the headers or in URL's; it would be a
SMOP to modify it to generate a MARF report. The user would have to
know hown many leading Received header fields to skip. I'm willing to
contribute the code[1] if it would help.

>I believe we covered that in marf-base, but I wouldn't be opposed to
>saying it again.  Can you suggest some appropriate language?

He's my first crack at it. In 2.  Creating and Sending Reports, at end
of paragraph 1:

     A Mailbox Provider that does not offer another mechanism
     should accept MARF reports from authenticated MSA users
     and may offer tools for generating those reports.

As new paragraph:

 5.  MUA authors that provide for generating MARF reports
     SHOULD provide a "this is spam" option and MAY provide a
     "this is not spam" option. The number of Received header
     fields to skip and the target mailbox addresses should be
     configuration data tather than solicited at each use. Such
     reports should be sent only using SMTPAUTH.

[1] Be warned, it's rapid protyping at its worst and really needs
    a redesign.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 01 Sep 2011 21:07:10 -0400

>saying it again.  Can you suggest some appropriate language?

Whoops! I sent suggested language for an unrelated item. The test I
suggest for this item is a new paragraph in 1. Introduction

     While it is desirable for network operators to accept
     complaints at abuse and Postmaster mailboxes in MARF
     format, they MUST continue to accept and process plain
     text abuse reports those mailboxes.