Subject: [Asrg] 6. Proposals - CRI Draft - 4.1 Loop Avoidance

From: "Peter Kay" <[email-masked]>
Date: Wed, 1 Oct 2003 06:07:41 -1000

I finally had a chance to come up for air to respond to Eric/Yakov's
draft 
at http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt  .
ASRG owes you much for your hard work in creating this document and I
personally thank you for furthering an important area of
interoperability.

On loop avoidance section, specifically:

"For CRI systems that issue challenge messages, it is also recommended
that each CRI system use a local systemwide user, such as [email-masked],
for issuing challenges rather than preserving the original sender's
email address as the sender of the challenge message."

We disgree.

Most CR systems automatically/dynamically add the recipient to the
sender's whitelist.  So if I send an email to [email-masked], he's
automatically added to my whitelist.  If the mail-from on his challenge
is [email-masked], his email comes straight to my inbox without delays or
filters and certainly won't get challenged.  If the mail-from on his
challenge is "[email-masked]", the CRI protocol needs to be invoked,
possibly creating unecessary overhead.

Keeping the mail-from consistent allows CRI systems to naturally
interoperate and assuming that the CR system adds recipients to the
whitelist, elegantly solves the problem of CR systems challenging other
challenges.  

Peter

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Wed, 1 Oct 2003 20:30:47 -0400

If we start adding various messaging such as with DSNs...I don't think
that we should be hijacking a sender's email address to carry various
protocol information.

Of course, that's just my opinion and why it's merely a recommendation
rather than a must, shall...

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
Peter
> Kay
> Sent: Wednesday, October 01, 2003 12:08 PM
> To: [email-masked]
> Subject: [Asrg] 6. Proposals - CRI Draft - 4.1 Loop Avoidance
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 01 Oct 2003 22:06:07 -0400

Can this be left as a recommendation but not required, so the 
implementors will be left to decide? Or do we need to make a decision on 
this? Also, would this be relevant to the BCP area?

Eric Dean wrote:
>>automatically added to my whitelist.  If the mail-from on his
> 
> challenge
> 
>>is [email-masked], his email comes straight to my inbox without delays
> 
> or
> 
>>challenge is "[email-masked]", the CRI protocol needs to be
> 
> invoked,
> 
>>whitelist, elegantly solves the problem of CR systems challenging
> 
> other
> 
>>challenges.
>>
>>Peter
>>
>>
>>
>>
>>

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 1 Oct 2003 22:46:15 -0400

>that we should be hijacking a sender's email address to carry various

Perhaps.  Just keep in mind that you need to interoperate with more 
than just other CR systems.

As an example, a user of a CR system sent mail to our support system. 
Our spam filters validated the sending email address by doing a MAIL 
FROM/RCPT TO.  Then we generated an auto-reply.  His CR system 
rejected the our auto-reply and we got a bounce report from our 
server.  Then the CR system sent us two challenges.  One went to the 
support system, but it didn't use the same subject, so it didn't have 
the ticket number, so it generated a new ticket, to which we 
responded (fortunately the CR system didn't challenge that as well). 
The other challenge was generated by the CR mail server, which 
generates challenges when it gets a RCPT TO, rather than when it gets 
a message (and they aren't the only ones who use that stunt).  That 
reply went to a trap address that we use for the MAIL FROM--so no 
damage there, just annoyance.

So here's the count of messages sent.

User - 1
Support System - 2
CR System - 2

And of course we have a bogus support ticket to clear out.
And the user doesn't get any feedback that we've gotten their support 
request until it moves through the queue to a human.  At which point 
our support folks have to go to the web site and answer the challenge.

-- 
Kee Hinckley
http://www.messagefire.com/         Next Generation Spam Defense
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: "Eric Dean" <[email-masked]>
Date: Thu, 2 Oct 2003 13:36:53 -0400

That is all a recommendation is..theoretically, if a server is CRI
compliant...the challenge does njot need to go to the sender anyway..so
it doesn't matter who the sender is

> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Yakov Shafranovich
> Sent: Wednesday, October 01, 2003 10:06 PM
> To: Eric Dean
> Cc: 'Peter Kay'; [email-masked]
> Subject: Re: [Asrg] 6. Proposals - CRI Draft - 4.1 Loop Avoidance
>

---

From: "Eric Dean" <[email-masked]>
Date: Thu, 2 Oct 2003 13:38:00 -0400

Your example, highlights one of the exact reasons why CRI is justified.