Subject: [Gen-art] Gen-ART telechat review of draft-ietf-marf-not-spam-feedback-01.txt

From: Brian E Carpenter <[email-masked]>
Date: Fri, 16 Sep 2011 14:39:37 +1200

Please see attached review.

---

From: Barry Leiba <[email-masked]>
Date: Fri, 16 Sep 2011 08:55:02 -0400

> (Raised in LC review, no reply but it was only a week ago.)

Yes, sorry.  I got the review and am acting on it, but I was just
waiting to roll in all the comments for a revision.

>    In most cases, "not-spam" reports will probably not be taken on their
>    own, but will be considered along with other information, analysis of
>    the message, etc.
>
> Did you consider using a normative SHOULD NOT ... SHOULD instead
> of "will probably not ... will"?

We -- the editors and the working group -- did, and we thought it best
to put this in as narrative, rather than as anything normative.  The
WG thinks it's a difficult line to straddle, between giving advice on
how to handle this stuff and trying to tell operators what to do.

> Similarly, in the Security Considerations, "Operators need to be careful"
> seems very mild to me. Generating hundreds of "not-spam" reports seems
> like a very plausible gambit for a spamming botnet. (A bot receives spam
> from one of its own swarm, and generates a completely valid "not-spam"
> report to be sent to the victim's own provider. Repeat until done.)
> This would essentially nullify the value of any "not-spam" report,
> unless operators deploy heuristics to detect it.

Yes, and similarly here, with the balance.  In fact, operators are
well aware of what they have to do for these cases, and new ones
become aware quickly.  Still, each operator has its own way of dealing
with it.  The Messaging Anti-Abuse Working Group (MAAWG) has put out
their recommendations for how to use complaint feedback loops, and
some of what's in there will apply.  They're working on re-publishing
it in the IETF stream (
http://tools.ietf.org/html/draft-jdfalk-maawg-cfblbcp-01 ), and the
MARF WG is working on an Applicability Statement that cites the MAAWG
document and adds other recommendations (
https://tools.ietf.org/html/draft-ietf-marf-as is an early version).
We think that's the right place for more detailed, and more
normative-looking advice.

Probably the right thing to do is to put an informative reference into
this document to those other two (or just to the MARF AS), and I will
do that in the revision.

Barry

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 20 Sep 2011 08:53:53 +1200

I am happy with the changes made in the -02 draft, so s/Almost ready/Ready/.

Regards
   Brian