Subject: [domainrep] Updated proposed charter

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 10 Aug 2011 22:20:59 -0700

I've updated the proposed charter at http://www.blackops.org/~msk/domainrep/repute-charter.txt to take into account this week's feedback, including some milestones that I think we could hit given the current interest.  Please review it and let me know if I've missed anything.

-MSK

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Thu, 11 Aug 2011 10:48:56 +0200

Hi,

On 8/11/11 7:20 AM, Murray S. Kucherawy wrote:
>
> I've updated the proposed charter at 
> http://www.blackops.org/~msk/domainrep/repute-charter.txt 
> <http://www.blackops.org/%7Emsk/domainrep/repute-charter.txt> to take 
> into account this week's feedback, including some milestones that I 
> think we could hit given the current interest.  Please review it and 
> let me know if I've missed anything.
>

here's my review of the latest charter:

[...]	"reputation".  A specific requirement is for a common mechanism to
	use in querying reputation-related databases.

s/databases/repositories

The word 'databases' associates (IMHO) too much with database technologies and products, which we want to stay away from.

[...]

	The group will also produce specifications for reporting reputation
	data from end-points (usually end users, such as someone clicking
	a "report spam" button in response to unwanted email, or a
	"thumbs-up" button in an online rating system) to reputation
	data aggregators for use in computing updated reputations.

Excellent rephrased!

[...]

	reputation providers and reputation consumers.  The issues of
	data transparency and redress will also need to be discussed.

Add: privacy (i.e. "The issues of data transparancy, privacy and redress...".

Apart from this, the charter looks fine to me.

/rolf

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 11 Aug 2011 08:53:39 -0400

I read this version of the charter, and I think it is a good basis for
work.  I confess I find the milestones a little optimistic given my
observations of how long things actually take in the IETF, but since
every charter seems to display that effect (and since I have no better
suggestions), I don't object.

A

> _______________________________________________
> domainrep mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/domainrep

-- 
Andrew Sullivan
[email-masked]

---

From: "John Levine" <[email-masked]>
Date: 11 Aug 2011 16:12:58 -0000

>http://www.blackops.org/~msk/domainrep/repute-charter.txt to take into

Seems basically fine.  Please change 

	Reputation systems such as Realtime Block Lists (RBLs, RFC5782)

to

	Reputation systems such as DNS Blacklists and Whitelists
	(DNSBLs and DNSWLs, RFC5782)

DNSBL is the standard term now, RBL is Trend's trademark, and doesn't
describe what they are, anyway.  Many of them make no attempt to be
realtime, e.g., the Spamahaus PBL which lists IP ranges whose owners
have a policy of no direct outgoing mail.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 11 Aug 2011 10:47:42 -0700

> -----Original Message-----
> From: John Levine [mailto:[email-masked]]
> Sent: Thursday, August 11, 2011 9:13 AM
> To: [email-masked]
> Cc: Murray S. Kucherawy
> Subject: Re: [domainrep] Updated proposed charter
> 

Done, and also folded in Rolf's feedback.

-MSK

---

From: "J.D. Falk" <[email-masked]>
Date: Thu, 11 Aug 2011 13:15:13 -0700

> suggestions), I don't object.

+1

--
J.D. Falk
the leading purveyor of industry counter-rhetoric solutions

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 12 Aug 2011 11:26:48 -0700

( With some hope of posting this to the correct list this time... )

Based on:

    <http://www.blackops.org/~msk/domainrep/repute-charter.txt>

I have some questions about the current draft of the charter.  For the moment, 
I'm merely trying to get a better understanding of what is intended:

 >       Determining the trustworthiness of content on the Internet remains a

What is meant by "trustworthiness of content"?

Two examples are that it might mean that it really was created by the purported 
author.  Or it might mean that its contents are "valid" (which might invite some 
discussion about "validity", of course.) There are other possibilities.

 > 	(RFC4871).  However, legitimate and illegitimate users alike can

What is an "illegitimate user"?

 > 	take advantage of these schemes.  What is also required is a
 > 	meaningful assessment of the trustworthiness of the identifier's
 > 	owner.  This in turn permits making a meaningful choice about what
 > 	to do with the associated content.

Is the work of the group intended to cover "what to do with the associated content"?

 > 	The advent of the requirement described above creates a need to have
 > 	reputation data providers make available to consumers data about

Does "consumers" mean end-users, operators of receiving services, or some other 
group?

If it means end-users, how are they expected to employ this information within 
the current context of the tools end-users have?

 > 	An existing, standardized reputation query mechanism is
 > 	Vouch-by-Reference (RFC5518), which provides a simple Boolean
 > 	response concerning the acceptability of different types of mail.
 > 	Other application spaces -- such as Web interactions -- could
 > 	benefit from common reputation query mechanisms, especially those
 > 	for which replies need to be more elaborate.

Given the existence of VBR, why is an additional reputation query mechanism 
needed?  What will be different in the the mechanism and why is the difference 
important?

Perhaps the new mechanism will be identical to VBR, but merely will have the 
meaning of the response be more general than just email?

 > 	This working group will produce a set of documents defining and
 > 	illustrating the requirement and defining mechanisms to satisfy it.
 > 	Two mechanisms are proposed:
 >
 > 	* simple -- a reputation is expressed in a simple manner such as
 > 		an integer
 >
 > 	* extended -- a response can contain more complex information
 > 		useful to an assessor

Who is going to use each of these mechanisms and why?  Are they participating in 
the discussions so far?  Have they expressed interest in implementing the output 
of the working group?

 >
 > 	The mechanisms will be designed to be application-independent, and
 > 	portable between reputation providers.

For this topic, what does 'application-independent' mean?

What does portable between providers mean?

 > 	data aggregators for use in computing updated reputations.

Reporting to whom?

What will be the basis for choosing among the different possible and existing 
models for reporting spam?

The language appears to equate reporting by end-users with some other forms of 
reporting.  Is there really a basis for conflating these?

 > 	can be problematic when not operated properly.  For example, an
 > 	RBL that lists a specific source without justification can do harm

By 'source' I assume the meaning is of an listed problem domain, rather than the 
source of the report that the domain is a problem?

 > 	to a legitimate business, provoking damages and possible litigation.
 > 	This important topic will need to be discussed in the informational
 > 	portions of the work produced here, in terms of advice both to

What is meant by "informational portions of the work"?  What output does that 
refer to?

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 12 Aug 2011 11:45:28 -0700

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Dave CROCKER
> Sent: Friday, August 12, 2011 11:27 AM
> To: [email-masked]

That first sentence makes a very general problem statement.  It could include either or both of those things.

> What is an "illegitimate user"?

Changed to "good and bad actors alike".

> Is the work of the group intended to cover "what to do with the

Specifically, no (that is, I don't believe we should say reputation result X means spam folder, reputation result Y means bounce, reputation result Z means deliver).  The point is to make that information available to someone that wants it in some standardized way.

> Does "consumers" mean end-users, operators of receiving services, or
> some other group?

Either of those.  Any client that wishes to acquire and make use of that information.

> If it means end-users, how are they expected to employ this information
> within the current context of the tools end-users have?

An MUA could conceivably make reputation queries just like an MTA or MDA could.

> needed?  What will be different in the the mechanism and why is the
> difference important?

Specifically, the proposed system is not Boolean in nature.  In the proposed framework, it is possible to make an expression of scale in terms of an assertion, and confidence in that assertion.

> meaning of the response be more general than just email?

It's more flexible than VBR in the sense that it can be applied to more than just that one application, and also in that assertions are scalar.

> the discussions so far?  Have they expressed interest in implementing the output

People tracking the list should feel free to answer on their own behalves.  I know about two implementations of servers, one will use the "simple" method and one will use "extended", and of two client implementations, one of which will implement "simple" and one of which will implement both.

> For this topic, what does 'application-independent' mean?

The framework for doing reputation work in general will work the same way for different applications (email identity reputation, web identity reputation, reputation about reputation servers, reputation about domain registrars, etc.).

> What does portable between providers mean?

This was discussed in the BoF.  If you're using a reputation service provider for evaluating domain names in an email message, you should ideally be able to switch to a different service provider without changing the interpretation of the answers on your side.

>  > 	data aggregators for use in computing updated reputations.

As it says, "to reputation data aggregators".

> reporting.  Is there really a basis for conflating these?

The idea is to specify the protocol that is invoked when one clicks a "Report Spam" button, or equivalent, to report that user action back to a reputation service provider to enrich its data set about the sender of that message.

> source of the report that the domain is a problem?

In the case of RBLs, the source is an IP address.  In the case of a reputation service that refers to domain names in email, the "source" would be the domain name, determined in some defined way (e.g. DKIM signing domain).

> What is meant by "informational portions of the work"?  What output does that

Non-normative portions of the base specifications, and/or an informational document that talks about BCP of either being a producer or consumer of reputation information.

-MSK

---

From: Nathaniel Borenstein <[email-masked]>
Date: Fri, 12 Aug 2011 15:26:03 -0400

On Aug 11, 2011, at 8:53 AM, Andrew Sullivan wrote:

>  I confess I find the milestones a little optimistic given my

I fear the target dates almost have to be unrealistic to motivate people to actually work.

Also, a nit:  I wonder if "feedback" is the right term in the 6th deliverable.  Is an unsolicited opinion feedback?  If not, and if we want the possibility of sending unsolicited opinions, perhaps "evaluation" is a better choice?

But this is way down in the nits.  I'm very happy with the charter as it stands.  -- Nathaniel

---

From: SM <[email-masked]>
Date: Fri, 12 Aug 2011 12:29:09 -0700

Hi Dave,
At 11:26 12-08-2011, Dave CROCKER wrote:
>I have some questions about the current draft of the charter.  For 
>the moment, I'm merely trying to get a better understanding of what 
>is intended:
>
>
>Two examples are that it might mean that it really was created by 
>the purported author.  Or it might mean that its contents are 
>"valid" (which might invite some discussion about "validity", of 
>course.) There are other possibilities.

What is being done is assessing information (the proposed charter 
uses the word "content").  Reputation, for lack of a better metric, 
is used to assign a trust value.

I avoided "validity" for the reason you mentioned above.  For what it 
is worth, you can determine the authenticity of the identifiers 
attached to this message, i.e. are they valid.  That information 
isn't useful unless you can trust it.  You might use a reputation 
value to determine the trust value.

Regards,
-sm

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 12 Aug 2011 12:39:13 -0700

> I fear the target dates almost have to be unrealistic to motivate people to

Since there is no history of short wg charter milestones having that effect and 
no history of much enforcement of milestones, the actual effect of overly 
aggressive milestones is to establish unrealistic expectations.

d/

-- 

   Dave Crocker

---

From: "J.D. Falk" <[email-masked]>
Date: Fri, 12 Aug 2011 13:57:17 -0700

> Specifically, no (that is, I don't believe we should say reputation result X means spam folder, reputation result Y means bounce, reputation result Z means deliver).  The point is to make that info…

Thinking ahead...a Reputation Provider MAY make recommendations regarding the eventual disposition of an item, but such recommendations are outside of the scope of this work.  I'm not sure if that needs to be in the charter.

> Either of those.  Any client that wishes to acquire and make use of that information.

I doubt end users will make use of REPUTE directly, but their software agents could.  Should we define "consumers" broadly as "software agents capable of receiving and processing REPUTE messages"?

> In the case of RBLs, the source is an IP address.  In the case of a reputation service that refers to domain names in email, the "source" would be the domain name, determined in some defined way (e…

Perhaps "identifier" or "source identifier" instead?

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sat, 13 Aug 2011 10:54:50 -0400

On Aug 12, 2011, at 3:39 PM, Dave CROCKER wrote:

> Since there is no history of short wg charter milestones having that effect and no history of much enforcement of milestones, the actual effect of overly aggressive milestones is to establish unrealistic expectations.

As one whose expectations for timing are nearly always unrealistic, I'll defer to anyone who believes they know how to make them realistic.  I'm just observing the way people tend to put things off until a deadline is approaching.

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 15 Aug 2011 10:34:28 +0200

On 12.08.2011 20:45, Murray S. Kucherawy wrote:
>> From: ietf.org On Behalf Of Dave CROCKER
>> Given the existence of VBR, why is an additional reputation query
>> mechanism needed?  What will be different in the the mechanism and why
>> is the difference important?
> 
> Specifically, the proposed system is not Boolean in nature.  In the
> proposed framework, it is possible to make an expression of scale in terms
> of an assertion, and confidence in that assertion.

This difference doesn't seem to be advantageous to consumers.  In fact, I
never saw lists of messages sorted by spam-score.  Consumers would probably
prefer a few discrete values (obtainable using thresholds.)  It must be a
matter of necessity to do continuous values.

> As it says, "to reputation data aggregators".

Yes, the last bullet of out-of-scope items explains that aggregated data is
crunched so as to obtain reputation values.  Although the algorithms are
specifically out of scope, it is their nature that determines the continuous
nature of the output.

Data aggregation is the most striking feature, not found in VBR.  The very
definition of reputation, in the second paragraph of the charter text, is
given using the term "aggregate".  However, the paragraph that explains it,
quoted above, comes far below.  Its position and its wording seem to diminish
the importance of data aggregation, as if it were an optional component.  How
ambiguous, considering its specification comes right after the problem
definition, in Goals and Milestones.

In case aggregation is to be considered a requisite of a reputation system, I
suggest to merge that paragraph with the second paragraph.  For example:

    Such an assessment requires to gather and process information about the
    identifier and/or the owner, which we call raw data.  In the aggregate,
    such data can be called "reputation".  The working group will produce
    specifications for both data-exchange sides of the processing, that is

      * a common mechanism to use in querying reputation-related
        repositories, so as to bring reputation data to "consumers"; and

      * reporting raw data from end-points (usually end users, such as
        someone clicking a "report spam" button in response to unwanted
        email, or a "thumbs-up" button in an online rating system) to
        "aggregators".

Actually, I'm not 100% happy with the second bullet.  I'd move the
parenthesized text down, after the focus for the initial charter on email
messages.

I'm not sure whether the WG is willing to tackle the problem of receiving and
vetting abuse reports.  Aggregators are clearly an abstraction conceived to
insulate abuse reporting.

jm2c

---

From: "J.D. Falk" <[email-masked]>
Date: Mon, 15 Aug 2011 12:55:27 -0500

On Aug 15, 2011, at 3:34 AM, Alessandro Vesely wrote:

> prefer a few discrete values (obtainable using thresholds.)

This hasn't been our experience with the Sender Score (senderscore.org.)  There are some consumers of the data (big mailbox providers) who place different rate limits on senders depending on their score, and they like being able to set their own thresholds.

http://www.returnpath.net/blog/received/2011/07/rate-limiting/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 15 Aug 2011 10:59:34 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Monday, August 15, 2011 1:34 AM
> To: [email-masked]

This seems to fly in the face of the experience provided by Spamassassin, and it's wildly popular.  It definitely offers a score and allows users to define the limit above which something is spam.

> definition, in Goals and Milestones.

There's no intention to diminish its importance, but it is only one piece of the puzzle.  The charter has a lot of other context and background to deliver, as will the ultimate suite of documents this WG would produce.

That said, there will certainly be lots of systems that have proprietary feedback mechanisms.  Thus, I think there's currently a lot less demand to specify this piece than there is the query/response portion.  That may be why it's less dominant.

As for vetting the reports, I think that's a matter for Security Considerations and not of protocol.  But certainly if/when we do tackle the reporting portion of this work, it'll have to be covered.

---

From: Robert Barclay <[email-masked]>
Date: Tue, 16 Aug 2011 08:48:47 -0600

Murray,
Thanks for this, and sorry for being a little late to the game here. I think
this charter makes sense to me. The only piece of it I question a little is
the work to provide feedback to reputation providers. I think this may be a
topic that could be a huge sinkhole and isn't required for the query
mechanism itself to be useful.
Given the wide variety of types of data that might go into calculating a
reputation and the number of different potential sources of that information
if we discuss it at all I think it makes more sense to focus time on the
query mechanisms and the informational document. Those are big enough chunks
of work.

Robert

On Wed, Aug 10, 2011 at 11:20 PM, Murray S. Kucherawy <[email-masked]>wrote:

> I’ve updated the proposed charter at
> account this week’s feedback, including some milestones that I think we
> could hit given the current interest.  Please review it and let me know if
> I’ve missed anything.****
>
> ** **
>
> -MSK****
>