Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

From: Terry Zink <[email-masked]>
Date: Sat, 19 May 2012 00:14:39 +0000

Okay.

I have written my very first Internet Draft and uploaded it to the IETF site, and it passed all of the nits.  It is available here:

http://datatracker.ietf.org/submit/status/41308/

It is entitled "Recommendations for the use of whitelists for email senders transmitting email over IPv6".  The abstract in the summary page is correct, but if you click on the .txt file, it is wrong (I uploaded an older version of the draft, tried to fix it but couldn't... but the summary page is correct).

Reviews and comments are welcome.  I hope to bring this up for discussion at the next IETF meeting in Vancouver, BC.

-- Terry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Saint-Andre
Sent: Thursday, April 05, 2012 3:41 PM
To: Murray S. Kucherawy
Cc: [email-masked]
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

On 4/5/12 4:38 PM, Murray S. Kucherawy wrote:
>> -----Original Message----- From: [email-masked] 
>> [mailto:[email-masked]] On Behalf Of Terry Zink
>> Sent: Thursday, April 05, 2012 3:17 PM To: [email-masked]
>> Subject: [apps-discuss] Looking to begin discussion about email and
>> IPv6
>> 
>> [...] I have some ideas on how to address this, at least in the short 
>> term. I'd also like go gauge interest for discussing this at the 
>> Vancouver IETF at the end of July.
> 
> Hi Terry,
> 
> This is a frequent topic in industry, especially at the Messaging 
> Anti-Abuse Working Group (MAAWG, http://www.maawg.org) which is not 
> part of IETF.  You'd probably get a lot of interested people if you 
> put together a BoF there.  You can probably get some people together 
> at IETF in Vancouver too for a bar BoF.

Which reminds me that there's been talk about holding IETF interim meetings for relevant WGs at conferences like MAAWG and RIPE. Our new AppsArea overlords might want to consider something like that at a future MAAWG meeting. :)

Peter

--
Peter Saint-Andre
https://stpeter.im/

_______________________________________________
apps-discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Barry Leiba <[email-masked]>
Date: Fri, 18 May 2012 22:12:11 -0400

Hi, Terry.

> It is entitled "Recommendations for the use of whitelists for email senders transmitting
> email over IPv6".  The abstract in the summary page is correct, but if you click on the
> .txt file, it is wrong (I uploaded an older version of the draft, tried to fix it but couldn't...

If it's the wrong version, it's probably not a great idea to get
people to review it yet... and it looks like you actually cancelled
the submission, so the draft is not really in the system.  I'll
contact you off list to help you get the right version uploaded.
Sometimes the system can be a bit confusing the first time one tries
to use it.

Barry

---

From: Terry Zink <[email-masked]>
Date: Sat, 19 May 2012 03:09:32 +0000

Er, I meant this link here:

http://datatracker.ietf.org/submit/status/41309/42d68ba727abfd834c85707f0f651ffd/

Sorry about that.

-- Terry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Terry Zink
Sent: Friday, May 18, 2012 5:15 PM
To: [email-masked]
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Okay.

-- Terry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Saint-Andre
Sent: Thursday, April 05, 2012 3:41 PM
To: Murray S. Kucherawy
Cc: [email-masked]
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Peter

--
Peter Saint-Andre
https://stpeter.im/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 19 May 2012 03:10:51 +0000

> Sent: Friday, May 18, 2012 8:10 PM
> To: Terry Zink; [email-masked]

That document is half-submitted.  You need to go to that link yourself and complete the form before it will actually post to the datatracker.

-MSK

---

From: Terry Zink <[email-masked]>
Date: Sat, 19 May 2012 16:59:34 +0000

Wow, I'm on a roll today (sigh).  It's actually here.

https://datatracker.ietf.org/doc/draft-tzink-ipv6mail-whitelist/

-- Terry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Terry Zink
Sent: Friday, May 18, 2012 5:15 PM
To: [email-masked]
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Okay.

-- Terry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Saint-Andre
Sent: Thursday, April 05, 2012 3:41 PM
To: Murray S. Kucherawy
Cc: [email-masked]
Subject: Re: [apps-discuss] Looking to begin discussion about email and IPv6

Peter

--
Peter Saint-Andre
https://stpeter.im/

---

From: Barry Leiba <[email-masked]>
Date: Tue, 22 May 2012 12:36:53 -0400

> I have written my very first Internet Draft and uploaded it to the IETF site
>
> It is entitled "Recommendations for the use of whitelists for email senders
> transmitting email over IPv6".
>

I have some comments to kick things off, mostly editorial, not to the
substance of the proposal.  You might consider these and work up an
-01 version, while others are working on their comments on the
substance:

-- Abstract --
   This document contains a plan for how providers of email services
   can manage the problem of email abuse over IPv6.  Spammers can
   send mail from a very large range of IPv6 addresses, and this will
   make current antispam technology less effective.

Be careful about making it sound like you think you have the FUSSP.  I
suggest "manage one aspect of the problem", or some such, and "current
antispam blocklisting technology".

Later in the abstract: "interim transition" seems a bit redundant to me.

-- Sections 1.x --

I suggest that you try to use terms from RFC 5598, and cite that as a
normative reference.  Your definition for "email", for example, is
fluffy, and in this document it really means "SMTP mail" anyway.
Don't try to re-invent terms, when we have a good reference set up
already.

-- Section 1.8 --

I suggest you use RFC 5782 as a (normative) reference for IP
black/white listing, and cite it here and in Section 2.

-- Section 2 --

In IETF terms, IP is not "transport" (TCP is transport, and IP is at a
lower stack layer).  I suggest that you change things like
"transitioned from an IPv4 transport to that of IPv6," to simply
"transitioned from IPv4 to IPv6," and "when operating using IPv4 as a
transport mechanism," to "when operating over IPv4."

OLD
   By rotating through IPs quickly, a blocklist would always
   be one step behind spammers and lose its effectiveness.
COMMENT
The referent is wrong here -- the blocklist is not what's rotating
through the "IPs", and they're IP addresses anyway.
NEW
   By rotating through IP addresses quickly, a spammer would
   always be one step ahead of the blocklists, and the lists
   would lose their effectiveness.

(I similarly suggest that you look around at where else you should be
saying "IP address", "IPv4 address", and "IPv6 address", where the
word "address" is absent now.  It doesn't have to be in every place,
but things would be clearer if it were in most places.)

-- Section 3 --
The second paragraph is a good example of what I noted parenthetically
above: I would use "IP addresses" for all instances of "IPs" here.  In
the second sentence, the comma needs to be a semicolon.  The third
sentence feel awkward, and I suggest this:
OLD
   IPs on this
   whitelist are there because they send email over IPv6 intentionally,
   not because they are part of a botnet and are sending email without
   the computer owner's consent.
NEW
   IP addresses on this
   whitelist are there because they send email over IPv6 intentionally,
   and are not sending email without the computer owner's consent, as
   part of a botnet.

You say "known good IP [addresses]", but say nothing about how they're
known to be good.  Perhaps simply a forward reference to Section 4
would be nice.

In the third paragraph, I suggest not using "content filter" as a
compound verb.  Try rephrasing (perhaps "filter the mail by content").

-- Section 4 --
This seems to say that whitelisting will always be symmetric: "once
one party or both parties have agreed to whitelist each other".  I
know you don't mean to say that, so you might rephrase to be clearer.
In fact, you and I might not even know each other, but I might be
relying on your reputation from some other source when I add you to my
whitelist... and you wouldn't know I had done it nor consider adding
me to your whitelist at all.  Just focus on a receiving end
whitelisting a sending IP address.

-- Section 5 --
At some point, we'd have to look at issues that are specific to IPv6
whitelists, but for now, you should cite the security considerations
in RFC 5782, note that much of that applies here, and note that
v6-specific considerations need to be addressed as the document is
developed.

-- Section 6 --
Expand "PII" on first use.

Second paragraph: "As noted"... where?

-- References --
I would say that RFC 5321 is normative.

You have references to RFCs 1958, 4213, and 5211, with no citations to them.

--
Barry

---

From: "John Levine" <[email-masked]>
Date: 25 May 2012 02:11:16 -0000

[ someone noted limited interest in v6 mail ]

I think the main reason is that nobody in North America or Europe sees
any but hypothetical reasons to accept v6 mail any time soon.  I do,
and I can assure you that 100% of the mail I get on v6 could equally
well have been sent on v4.  If it were up to me, I would put all of my
v6 effort into web services, which loses a lot more with NAT or
proxies than mail does.

There's two basic problems with v6 whitelists: making them and using them.

For using them, we have a version of rbldnsd with basic v6 support,
but nobody has any real idea how well it'll work, because we don't
understand very well how DNSxL traffic caches.  If you're a large
provider and can run rbldnsd or the equivalent on the same LAN and
have the sophistication to fetch or manage the DNSxLs it serves,
caching doesn't matter, but for everyone else it does.  The limited
data I have is utterly unclear about practical v4 DNSBL cache
behavior.  At the very low end, it doesn't cache and doesn't matter,
for some kinds of woodpeckering it does cache which does help, in
between, who knows.

For making them, the problem is how you come up with a registration
system that is simple enough that unsophisticated MTA operators can
use it, but hostile enough that bots can't script it, not unlike the
problem of webmail signups.  If we could figure that out, we could at
least try some experiments.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Martijn Grooten <[email-masked]>
Date: Fri, 25 May 2012 16:21:27 +0000

> least try some experiments.

ipv6whitelist.eu uses a CAPTCHA to prevent automated mass-registration
of IPv6 MTAs.

I'm not a big fan of CAPTCHAs in general, but it in this case it should
prevent botnet spammers from registering all of their IPv6 addresses.
It doesn't stop them registering a handful of addresses and sending
lots of messages per address, but the list is only supposed to be a
first step: don't accept anything that isn't listed and run blacklists,
whitelists and reputation services on the small subset of listed
addresses. It sounds like a reasonable solution to me.

One potential issue is the question of who should run such lists. I
don't think we should want a situation where there are dozens of bigger
and smaller lists like this and where you'd have to register your
address with all of them, just because you don't know which lists
recipients are using.

Martijn.

________________________________

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.