Subject: Re: [marf] Misuse of ARF by spam-friendly ISPs

From: "J.D. Falk" <[email-masked]>
Date: Tue, 2 Aug 2011 17:42:35 -0700

On Jul 30, 2011, at 9:30 PM, Murray S. Kucherawy wrote:

> I wonder if this could be mentioned in the BCP effort we're doing (JD?).

I suppose it could be added to the growing list of use cases that draft-jdfalk-marf-as specifically does not address, along with individual user submissions, virus/malware reports, churning monkey butter, et cetera.

> Failing that, if we decide to update the base document given the recent flurry of input, this could certainly go in there.  But it's too early to make that call, I think.

Sounds to me like what's actually needed is a BCP on accepting abuse reports from the general public -- maybe a task for the ASRG?

--
J.D. Falk
the leading purveyor of industry counter-rhetoric solutions

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 03 Aug 2011 12:02:13 +0200

On 03/Aug/11 02:42, J.D. Falk wrote:
> I suppose it could be added to the growing list of use cases that
> draft-jdfalk-marf-as specifically does not address, along with
> individual user submissions, virus/malware reports, churning monkey
> butter, et cetera.

What is the meaning of a list of non-addressed use cases?  Possibly
suggest that they are not worth being addressed in general?  Hmm...
that's quite strange, especially considering that everyone likes the
monkey butter.

> Sounds to me like what's actually needed is a BCP on accepting
> abuse reports from the general public -- maybe a task for the
> ASRG?

I agree such a BCP is needed, and I take this chance to propose it
again.  The ASRG has already done research on this topic, and John
summarized it in

  http://wiki.asrg.sp.am/wiki/Adding_a_junk_button_to_MUAs

That still looks current.  It allows MUAs to report in a variety of
ways.  For SMTP, it is obviously better to wrap the offending mail in
an ARF message, but not mandatory.

For homogeneity, I'd put this extra BCP in MARF rather than ASRG.
There are related issues, like manual vs. auto submission, and privacy
considerations.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 3 Aug 2011 06:33:28 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Wednesday, August 03, 2011 3:02 AM
> To: [email-masked]
> Subject: Re: [marf] Misuse of ARF by spam-friendly ISPs
> 
> suggest that they are not worth being addressed in general?

It's referring to a list of use cases that the ARF was not designed to handle.  There's no intent that I can see to state that those use cases aren't interesting to handle.

The issue is whether it's reasonable for an "abuse@" address to accept only reports that are ARFs.  I would suggest that such is a violation of RFC2142, but it doesn't explicitly state that all formats have to be accepted so I'd probably ultimately lose that argument.

> Hmm...

That's a new one on me.  What does it mean?

> an ARF message, but not mandatory.

Just to be precise, I think JD is suggesting a BCP about how one handles received abuse reports, not how they are generated.  The point at issue is that one large service provider has decided only to accept abuse mail if it's an ARF; free-form complaints are no longer accepted.  It's caused quite a bit of trouble, not the least of which being the three co-authors of ARF getting a lot of "I hope you're happy" hate-mail.

> There are related issues, like manual vs. auto submission, and privacy

I'd be fine with that, but I'd invite the ASRG to comment.

-MSK (as participant)

---

From: "John Levine" <[email-masked]>
Date: 3 Aug 2011 18:18:19 -0000

>The issue is whether it's reasonable for an "abuse@" address to
>accept only reports that are ARFs.  I would suggest that such is a
>violation of RFC2142, ...

Before there was ARF, I got plenty of responses saying that they ONLY
take reports with the message pasted into the body of the message, or
that they ONLY take reports with the message as an attachment, and so
forth, so that bridge burned long ago and the ashes are cold.

I agree that it's pretty lame to demand ARF, but it does sort of select
for people who have some idea what they're doing.

R's,
John

---

From: Laura Atkins <[email-masked]>
Date: Wed, 3 Aug 2011 11:27:46 -0700

> for people who have some idea what they're doing.

Not really, it's selecting for people who can write code that works with their mail client and conforms to a standard.  It doesn't select for people who can send intelligent, useful reports. I can send a perfectly competent abuse report, but I don't have the skills to code a ARF report generator. 

laura 

-- 
Laura Atkins
Word to the Wise			"The Deliverability Experts!"
Direct: 650 678-3454		Fax: 650 249-1909
AIM: wttwlaura			YIM: wttw_laura
Delivery blog: <http://blog.wordtothewise.com/>

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 3 Aug 2011 12:24:35 -0700

> that's quite strange, especially considering that everyone likes the

It was somewhat of a joke, but there does seem to be mounting pressure to address other use cases in a BCP or AS.  My advice to those who want other use cases addressed is to write a draft addressing them.

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 3 Aug 2011 12:36:16 -0700

> It's referring to a list of use cases that the ARF was not designed to handle.  There's no intent that I can see to state that those use cases aren't interesting to handle.

Actually, what I meant was that draft-jdfalk-marf-as and draft-jdfalk-maawg-cfblbcp only fully address the complaint feedback loop use case.  There are other cases that ARF can handle, such as spam traps or (maybe) virus/malware reports, which I'd think we should discuss in a separate AS or BCP.

Either way, though, I think that bitching at a single ISP about their abuse@ policy is out of scope for any IETF document.  If that practice becomes common, maybe a "considered harmful" draft could be appropriate.  So far, though, there is one (1) example, which just happens to be a big ISP that some people love to hate.  It would be inappropriate, unprofessional, and somewhat silly to try to use the IETF as a weapon against them.

> That's a new one on me.  What does it mean?

http://www.jwz.org/gruntle/monkeybutter.html

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 04 Aug 2011 13:45:35 +0200

On 03/Aug/11 15:33, Murray S. Kucherawy wrote:
> Just to be precise, I think JD is suggesting a BCP about how one
> handles received abuse reports, not how they are generated.

Yes, a MUA that downloaded a message from pop3.example.com would send
it back to some address of example.com.

In the same way, some other mailbox provider receiving abuse reports
from its customers, finds out that a reported message belongs to
example.com (DKIM or SPF auth, or IP assigned to example.com), and
sends the report to some other address of example.com.

There are a number of ways to discover which addresses of example.com
should be used in each case.  This, IMHO, should be the main topic of
the new BCP.

> The point at issue is that one large service provider has decided
> only to accept abuse mail if it's an ARF; free-form complaints are
> no longer accepted.

While RFC 2142 is the last option for a tool, it is the easiest one
for sending an abuse report manually.  Because ARF is most probably
managed automatically, hand written reports that include meaningful
free-text should never be ARF-wrapped, nor sent to ARF-addresses.
Reporting-discovery has a re= for the relevant role account.  It
defaults to abuse@.

I'd take JD's advice and write a draft addressing both topics above,
but I cannot start that before September.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Thu, 04 Aug 2011 17:59:25 -0400

In
<[email-masked]>,
on 08/03/2011
   at 06:33 AM, "Murray S. Kucherawy" <[email-masked]> said:

>It's referring to a list of use cases that the ARF was not designed
>to handle. 

What about reports[1] to LE? Is that worth considering in the future?

>accept only reports that are ARFs. 

IMHO that's a form of spam support. OTOH, if someone publishes a
separate address for reports in ARF format, then IMHO it's reasonable
to reject anything in *that* mailbox that's not ARF.

>It's caused quite a bit of trouble, not the least of which being the
>three co-authors of ARF getting a lot of "I hope you're happy"
>hate-mail.

I'd regard such complaints as misdirected and the authors as wingnuts.
Yahoo never needed ARF to ignore legitimate complaints.

[1] Especially for spam associated with crimes against persons
    rather than just the intrinsic crimes against property.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: "J.D. Falk" <[email-masked]>
Date: Fri, 5 Aug 2011 10:15:38 -0700

> What about reports[1] to LE? Is that worth considering in the future?

If we can get some law enforcement folks involved and find out what they want/need, sure.  They probably want all sorts of metadata that most reporters can't offer, though.

On the other hand, there are already government agencies consuming ARF as it is.

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Sun, 07 Aug 2011 01:03:22 -0400

In <[email-masked]>, on
08/05/2011

>On the other hand, there are already government agencies consuming

For generic spam, sure, but not for, e.g., child pornography,
counterfeit drugs.