Subject: Re: [domainrep] Comments on draft-ietf-repute-email-identifiers-01

From: SM <[email-masked]>
Date: Tue, 03 Jan 2012 10:13:21 -0800

Hi Murray,
At 23:32 24-12-2011, Murray S. Kucherawy wrote:
>Works for me, except I think it's appropriate to mention the media 
>type because otherwise someone reading this abstract has no context.

Ok.

>I changed it to "This memo specifies a vocabulary for 
>describing...", removing the quotes and changing "defines" to 
>"specifies", to make it clear the other document is the foundational one.

Ok.

> > I suggest reusing material from the Feedback Report Type Values
> > registry instead of the terms in Section 3.1.
> >
> >   Abuse: The email identifier is associated with unsolicited email
> >          or some other kind of email abuse
>
>This seems too general to be a useful assertion.

Ok.

> >   Fraud: The email identifier is associated with some kind of fraud
> >          or phishing activity
>
>Modified the FRAUD definition to say, 'such as "phishing"'.  I'll 
>probably be challenged to define that or refer to a definition of 
>it; I'll try to find one.

 From RFC 5901:

   'The terms "phishing" and "fraud" are used interchangeably in this
    document to characterize broadly-launched social engineering attacks
    in which an electronic identity is misrepresented in an attempt to
    trick individuals into revealing their personal credentials
   (e.g., passwords, account numbers, personal information, ATM PINs, etc.)'

> >   Not-spam: The email identifier is associated with an indication about
> >             messages not considered to be spam
>
>Wouldn't you just assert the same thing here as one minus the SPAM score?

That would be a "good mail" score.  BTW, as there are several 
possibilities (assertions), the value may not be one minus the SPAM score.

>This also seems a little too general.  I prefer the current MALWARE 
>definition.

Ok.

>The email-id vocabulary is a set of keywords and extensions to the 
>base vocabulary defined in the "model" document.  So I believe it 
>makes sense to put it where it is.

Ok.

>IDENTITY and SOURCES are email-id extensions, so moving them to 
>either the model or media-type document won't make sense.  However, 
>if we feel they ought to be made mandatory parts of all 
>vocabularies, then that would make sense.

You are discussing about the protocol and you mentioned what the 
client may do (the second sentence in the paragraph).

>I agree with 2119, but do you really have to read 5598 to implement this?

RFC 5598 is referenced from the Terminology and Definitions 
section.  You are using  "RFC5321.MailFrom" which is more of a RFC 
5598 syntax than a RFC 5321 syntax.  Either RFC 5321 and RFC 5322 
have to be normative (please read those documents to understand this 
document) or you can use RFC 5598.  RFC 6376 would have to be normative too.

As most of the WG participants have probably read the RFCs mentioned 
above, they can easily tell what a signing domain is.  A person 
reading this document only might not have any DKIM background.

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 4 Jan 2012 11:04:47 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of SM
> Sent: Tuesday, January 03, 2012 10:13 AM
> To: [email-masked]
> Subject: Re: [domainrep] Comments on draft-ietf-repute-email-identifiers-01
> 
> >probably be challenged to define that or refer to a definition of it;
> >I'll try to find one.
> 
>  From RFC 5901:
> 
> 

Excellent, thanks.  I've added that as an informative reference for the next version.

> possibilities (assertions), the value may not be one minus the SPAM

I'm having trouble picturing this.  "Good" and "bad" are opposites, so it seems to me that's a scale with each at opposite ends.  Since we've constrained the scale to the range [0, 1], isn't the value of one the same as saying one minus the value of the other?

Certainly other assertions are possible, but they would be orthogonal to this scale, and thus warrant an entirely different assertion.

Can you give some examples of what you're thinking of?

> RFC 5598 is referenced from the Terminology and Definitions section.
> You are using  "RFC5321.MailFrom" which is more of a RFC
> 5598 syntax than a RFC 5321 syntax.  Either RFC 5321 and RFC 5322 have
> to be normative (please read those documents to understand this
> document) or you can use RFC 5598.

OK, fair enough.

> RFC 6376 would have to be normative too.

For the DKIM piece, if you use it, yes.

> above, they can easily tell what a signing domain is.  A person reading
> this document only might not have any DKIM background.

True, but if for example you only want to implement this for SPF, you don't need to be familiar with DKIM.  I think for optional or at least non-core pieces, we go with informative references.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 4 Jan 2012 20:50:42 -0000

>> > >             messages not considered to be spam ...

> I'm having trouble picturing this.  "Good" and "bad" are opposites, so
> it seems to me that's a scale with each at opposite ends.  Since we've
> constrained the scale to the range [0, 1], isn't the value of one the
> same as saying one minus the value of the other?

I get a lot of mail which isn't really spam, but isn't really not spam
either, e.g., I bought something six years ago, they've been sending me
ads every since, but I've never responded to one.

For those of us who remember our undergraduate logic classes, I'm saying
this is not a model with an excluded middle.  The options aren't just Spam
and Not-Spam, they're Spam, Not-Spam, and Other.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 4 Jan 2012 13:02:35 -0800

> From: John Levine [mailto:[email-masked]]
> Sent: Wednesday, January 04, 2012 12:51 PM
> To: [email-masked]
> Cc: Murray S. Kucherawy
> For those of us who remember our undergraduate logic classes, I'm
> saying this is not a model with an excluded middle.  The options aren't
> just Spam and Not-Spam, they're Spam, Not-Spam, and Other.

I think we're talking about two orthogonal assertions then: Spam and Other (where something other than "Other" would be way, way better).

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 04 Jan 2012 13:10:37 -0800

> and Not-Spam, they're Spam, Not-Spam, and Other.

While the concern you have strikes me as valid, your, ummmm, logic does not.

The problem, here, is with the very fluid definition of spam, not with the use 
of a binary scale.  Most folk consider mail of the type you cite as spam.  Or 
they consider it acceptable.

That is, few folk have a model of gradation, but different folk put the 
demarcation in different places.  The underlying issue, then, is that the 
assignment of a spam or not-spam label is highly subjective, for most operations.

This is a bit of subtlety that is almost certainly unproductive to pursue.  We 
aren't going to create more labels here and we aren't going to get a more 
nuanced public discussion, IMO.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "John R. Levine" <[email-masked]>
Date: 4 Jan 2012 16:30:15 -0500

> assignment of a spam or not-spam label is highly subjective, for most 

I didn't explain it very well.  Let's say you have two scores for a 
message, one for spamminess, one for goodness.  My point is that one score 
isn't necessarily the negative of the other.

R's,
John

---

From: SM <[email-masked]>
Date: Wed, 04 Jan 2012 13:43:05 -0800

Hi Murray,
At 11:04 04-01-2012, Murray S. Kucherawy wrote:
>I'm having trouble picturing this.  "Good" and "bad" are opposites, 
>so it seems to me that's a scale with each at opposite ends.  Since 
>we've constrained the scale to the range [0, 1], isn't the value of 
>one the same as saying one minus the value of the other?
>
>Certainly other assertions are possible, but they would be 
>orthogonal to this scale, and thus warrant an entirely different assertion.
>

John Levine explained it better than I could.  BTW, I was thinking in 
terms of scores and not about adding more labels.

Regards,
-sm

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 04 Jan 2012 14:32:55 -0800

On 1/4/2012 1:30 PM, John R. Levine wrote:
> I didn't explain it very well. Let's say you have two scores for a message, one
> for spamminess, one for goodness. My point is that one score isn't necessarily
> the negative of the other.

As an abstract exercise, I can believe that.

However in terms of filtering engine pragmatics, that does not match how I've 
always understood them to operate.

d/

-- 

   Dave Crocker

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 4 Jan 2012 17:46:55 -0500

On Wed, Jan 04, 2012 at 02:32:55PM -0800, Dave CROCKER wrote:
> 
> However in terms of filtering engine pragmatics, that does not match
> how I've always understood them to operate.

I took John's point to be that that might be a problem.

A

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 04 Jan 2012 15:07:10 -0800

> I took John's point to be that that might be a problem.

What I'm not clear on is whether it is an actual problem experienced by the folk 
running real reputation services (either providing or consuming rep services) or 
whether it's more conceptually problematic.

If only the latter, we probably have some challenge at justifying pursuing it. 
It adds complexity, but absent a compelling need.

d/

-- 

   Dave Crocker

---

From: Douglas Otis <[email-masked]>
Date: Wed, 04 Jan 2012 19:01:22 -0800

On 1/4/12 3:07 PM, Dave CROCKER wrote:
> >> However in terms of filtering engine pragmatics, that does not
> >> match how I've always understood them to operate.
>  What I'm not clear on is whether it is an actual problem experienced
>  by the folk running real reputation services (either providing or
>  consuming rep services) or whether it's more conceptually
>  problematic.
>
>  If only the latter, we probably have some challenge at justifying
>  pursuing it. It adds complexity, but absent a compelling need.
Dave,

Whether some identity based upon either an IP address or domain, acted 
in some manner must be predicated upon authentication of said identity's 
involvement with the act of transmitting the message to a specific 
recipient.  Blocking the wrong domain is undesired, unwise, and 
potentially expensive.

Assessing acts based upon DKIM signatures alone will be problematic, 
even for statistical ratings offering shades of gray assessments.  While 
DKIM confirms which domain signed a message's content, it does not 
confirm whether this domain transmitted the message to a specific 
recipient.  It seems this limitation leaves DKIM unsuitable for 
assessing behaviors related with spamming or even the sending of 
malicious content.  Such an assessment requires authenticated outbound 
MTAs as a purely practical matter to include the act of transmission to 
specific recipients.

Perhaps the malware issue might be addressed by asserting conventions 
for labeling whether a message is known to contain malware.  
Unfortunately such exceptions could be used to exploit those who fail to 
heed or understand the warning.  After all, sending malware may occur 
through agreement between specific individuals, but could represent a 
dangerous act when sent to unaware recipients.

A common ploy is to encrypt content to ensure it passes content filters 
where the passphrase is often included within the message body.  Even 
labeling would be difficult to assess based upon the use of DKIM 
signatures, since any intercepted message could be replayed with the 
intent of damaging the domain's reputation.

-Doug