Received: from mout.perfora.net (mout.perfora.net [74.208.4.195]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6DEClRr012415 for ; Fri, 13 Jul 2007 07:12:47 -0700 Received: from [76.160.246.247] (helo=[192.168.1.12]) by mrelay.perfora.net (node=mrus0) with ESMTP (Nemesis), id 0MKp8S-1I9Lsb1Ach-0002tB; Fri, 13 Jul 2007 10:12:24 -0400 Message-ID: <46978845.8070002@solidmatrix.com> Date: Fri, 13 Jul 2007 10:12:21 -0400 From: Yakov Shafranovich Organization: SolidMatrix Technologies, Inc. User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: Marc Perkel Subject: Re: [feedback-report] Abuse Report with no Spam References: <4696E9EC.1010700@perkel.com> In-Reply-To: <4696E9EC.1010700@perkel.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Provags-ID: V01U2FsdGVkX184+1+NpB6zuWA/cTzpWMrnpJDHjreymhsINGt 1c6Boa9bb+BvpWq/g7TaRmdfjxov3ecyyP30xlj7ah7RCdrPZS jdsy6JReZm+MxyExEQYj2e3ORbXWTT8 X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: yakovs@solidmatrix.com Cc: abuse-feedback-report@mipassoc.org X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jul 2007 14:12:52 -0000 Marc Perkel wrote: > OK - Here's a question about abouse reports that don't fit the specs. > I'm now geneating this report to report viruses. I'm able to detect the > presence of viruses without actually receiving the email based only on > the behavior of the virus. What I'm doing is every 6 hours I'm sending a > list of infected computers to abuse. This is the form I'm using now. How > would something like this fit into an ARF model? > ARF is meant for reporting a single email message. For viruses, that would mean sending back the headers of a specific infected message without the body. The current spec lets you do that in section 4, part d. HOWEVER, based on your example what you are describing is not the same thing. First of all, ARF is not intended for aggregate reporting. We have discussed aggregated reporting a while back when Hotmail begun to do it, but decided to pick this problem apart first. Second, reporting virus-like behavior without actual emails is for sure not ARF. What you want to do is report security problems such as virus infected machines, not virus infected emails. For that, there are other draft standards like this one: http://www.cert.org/ietf/inch/inch.html Yakov Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6D2ugLm003910 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 12 Jul 2007 19:56:42 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I9BKo-0007s2-8N on interface=127.0.0.1 for abuse-feedback-report@mipassoc.org; Thu, 12 Jul 2007 19:56:46 -0700 Message-ID: <4696E9EC.1010700@perkel.com> Date: Thu, 12 Jul 2007 19:56:44 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Content-Type: multipart/alternative; boundary="------------060302010303090806040804" X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Subject: [feedback-report] Abuse Report with no Spam X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jul 2007 02:56:45 -0000 This is a multi-part message in MIME format. --------------060302010303090806040804 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit OK - Here's a question about abouse reports that don't fit the specs. I'm now geneating this report to report viruses. I'm able to detect the presence of viruses without actually receiving the email based only on the behavior of the virus. What I'm doing is every 6 hours I'm sending a list of infected computers to abuse. This is the form I'm using now. How would something like this fit into an ARF model? ========= This is an automated email courtesy report from the folks at junkemailfilter.com to alert you about computers on your system that are exhibiting behavior that are likely to be infected with a computer virus. You might want to consider creating a automated script to block port 25 on the IP addresses listed here. We hope this information will help you in determining the source of the problem and shut it down. If you have any questions or feedback about this virus report or are interesting in learning about our spam filtering technology feel free to contact us. If this is a false positive please accept our apologies and let us know so we can fix the problem. Marc Perkel - Fearless Leader Junk Email Filter dot com http://www.junkemailfilter.com support@junkemailfilter.com A total of 43 IP addresses were caught in the last 6 hours. Here is the list: ==== IP LIST BEGIN ==== 168.103.248.37 168.103.53.217 209.180.137.105 209.181.101.107 216.160.51.100 216.160.58.37 63.146.231.50 63.224.156.86 63.224.20.56 63.227.99.48 63.229.114.247 63.229.124.14 65.100.21.211 65.101.29.244 67.42.217.236 70.56.91.76 71.209.173.155 71.209.176.195 71.209.180.122 71.210.64.59 71.211.180.185 71.213.53.14 71.213.74.165 71.214.242.2 71.218.182.36 71.218.83.207 71.219.159.90 71.220.127.74 71.220.130.81 71.220.166.237 71.34.12.210 71.34.160.108 71.35.145.113 71.36.119.219 71.37.237.242 75.161.146.212 75.161.168.86 75.162.239.190 75.163.139.152 75.163.187.101 75.163.92.9 75.166.125.243 75.166.92.193 ===== IP LIST END ===== You might be wondering how we can detect virus infected computers without actually receiving spam from them. The way these computer were caught is that they continually attempted to connect to high numbered fake MX records when low numbered real MX servers were available. Only spammers and virus infected spam bots try to go in the back door first when the front door is open. The IP addresses listed here exhibited that kind of behavior. The above list of IP addresses have been blacklisted on our DNS blacklist at hostkarma.junkemailfilter.com. The listing will automatically clear 3 days after the virus activity stops. For more information about our DNS Black/White/Yellow lists please visit http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists This virus reporting system is still experimental. We hope you will find this information useful. Working together we can beat the spammers. If you have any feedback we would like to hear from you. --------------060302010303090806040804 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit OK - Here's a question about abouse reports that don't fit the specs. I'm now geneating this report to report viruses. I'm able to detect the presence of viruses without actually receiving the email based only on the behavior of the virus. What I'm doing is every 6 hours I'm sending a list of infected computers to abuse. This is the form I'm using now. How would something like this fit into an ARF model?

=========
This is an automated email courtesy report from the folks at junkemailfilter.com to alert you about computers on your system that are exhibiting behavior that are likely to be infected with a computer virus.

You might want to consider creating a automated script to block port 25 on the IP addresses listed here. We hope this information will help you in determining the source of the problem and shut it down. 

If you have any questions or feedback about this virus report or are interesting in learning about our spam filtering technology feel free to contact us. If this is a false positive please accept our apologies and let us know so we can fix the problem. 

Marc Perkel - Fearless Leader
Junk Email Filter dot com
http://www.junkemailfilter.com
support@junkemailfilter.com

A total of 43 IP addresses were caught in the last 6 hours. Here is the list:

==== IP LIST BEGIN ====

168.103.248.37
168.103.53.217
209.180.137.105
209.181.101.107
216.160.51.100
216.160.58.37
63.146.231.50
63.224.156.86
63.224.20.56
63.227.99.48
63.229.114.247
63.229.124.14
65.100.21.211
65.101.29.244
67.42.217.236
70.56.91.76
71.209.173.155
71.209.176.195
71.209.180.122
71.210.64.59
71.211.180.185
71.213.53.14
71.213.74.165
71.214.242.2
71.218.182.36
71.218.83.207
71.219.159.90
71.220.127.74
71.220.130.81
71.220.166.237
71.34.12.210
71.34.160.108
71.35.145.113
71.36.119.219
71.37.237.242
75.161.146.212
75.161.168.86
75.162.239.190
75.163.139.152
75.163.187.101
75.163.92.9
75.166.125.243
75.166.92.193

===== IP LIST END =====

You might be wondering how we can detect virus infected computers without actually receiving spam from them. The way these computer were caught is that they continually attempted to connect to high numbered fake MX records when low numbered real MX servers were available. Only spammers and virus infected spam bots try to go in the back door first when the front door is open. The IP addresses listed here exhibited that kind of behavior.

The above list of IP addresses have been blacklisted on our DNS blacklist at hostkarma.junkemailfilter.com. The listing will automatically clear 3 days after the virus activity stops. For more information about our DNS Black/White/Yellow lists please visit http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists

This virus reporting system is still experimental. We hope you will find this information useful. Working together we can beat the spammers. If you have any feedback we would like to hear from you.

--------------060302010303090806040804-- Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6D2VDCr032434 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Thu, 12 Jul 2007 19:31:14 -0700 Received: (qmail 97209 invoked from network); 13 Jul 2007 02:31:19 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 13 Jul 2007 02:31:19 -0000 Date: 13 Jul 2007 02:31:19 -0000 Message-ID: <20070713023119.88587.qmail@simone.iecc.com> From: John Levine To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Mixed text and mime? In-Reply-To: Organization: Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: prvs=johnl=0707ba2209@iecc.com Cc: X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jul 2007 02:31:18 -0000 >I'm surprised there are that many. If you were to send them ARFs >anyway, do you think they would ignore the complaints or find a way >to read them? I've been sending all my reports as ARF basically as an experiment, and I've found very few places complain. A certain number of ticketing systems still smash or discard attachments, so rather than trying to recognize them all, I've been archiving the spam and put a URL in each complaint that lets them fetch the spam. I realize this doesn't scale for large systems very well. R's, John Received: from rsmtp1.corp.yahoo.com (rsmtp1.corp.yahoo.com [207.126.228.149]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BMR3SW028521 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 15:27:03 -0700 Received: from jdfalk-mac.corp.yahoo.com (jdfalk-mac.corp.yahoo.com [10.72.109.95]) (authenticated bits=0) by rsmtp1.corp.yahoo.com (8.13.8/8.13.6/y.rout) with ESMTP id l6BMRB8O025988 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 15:27:11 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; s=serpent; d=yahoo-inc.com; c=nofws; q=dns; h=message-id:date:from:organization:user-agent:mime-version:to: subject:references:in-reply-to:content-type:content-transfer-encoding; b=C87Rmbqdv1kIYr7BJkr44kt7gUIR0VaqtNTLg373WKIfxC2YYcCWC8X9vzYw5wR5 Message-ID: <46955955.1010006@yahoo-inc.com> Date: Wed, 11 Jul 2007 15:27:33 -0700 From: "J.D. Falk" Organization: Yahoo! User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Mixed text and mime? References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46953B81.6030009@perkel.com> <469546FA.8020301@perkel.com> In-Reply-To: <469546FA.8020301@perkel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: jdfalk@yahoo-inc.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 22:27:10 -0000 On 2007-07-11 14:09, Marc Perkel wrote: > I'm with you - I wish everyone would take this standard format. It's a > good standard. But even big companies often have morons running their > email systems. Being insulting doesn't encourage use of new technology. The number of sites which have implemented ARF is tiny. The number of admins who've even heard of ARF is only slightly larger. It's not a formal standard yet, merely a completed draft in need of friendly, patient evangelism. -- J.D. Falk, Anti-Spam Product Manager Yahoo! Mail Received: from ms-smtp-02.texas.rr.com (ms-smtp-02.texas.rr.com [24.93.47.41]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BLIcOt015617 for ; Wed, 11 Jul 2007 14:18:39 -0700 Received: from [10.0.1.5] (cpe-66-25-157-199.austin.res.rr.com [66.25.157.199]) by ms-smtp-02.texas.rr.com (8.13.6/8.13.6) with ESMTP id l6BLIin1021966; Wed, 11 Jul 2007 16:18:45 -0500 (CDT) In-Reply-To: <469546FA.8020301@perkel.com> References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46953B81.6030009@perkel.com> <469546FA.8020301@perkel.com> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: multipart/alternative; boundary=Apple-Mail-5--276906302 Message-Id: From: Joshua Baer Subject: Re: [feedback-report] Mixed text and mime? Date: Wed, 11 Jul 2007 16:18:43 -0500 To: "Marc Perkel" X-Mailer: Apple Mail (2.752.2) X-Virus-Scanned: Symantec AntiVirus Scan Engine X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: joshua.baer@datranmedia.com Cc: abuse-feedback-report@mipassoc.org X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 21:18:44 -0000 --Apple-Mail-5--276906302 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed I don't think they are morons its just that they are using a CRM software that can't handle the messages. These people probably don't have much ability change that, but then again sometimes those systems don't change unless they _have_ to so we may need to find ways to incentivize them. ~Josh On Jul 11, 2007, at 4:09 PM, Marc Perkel wrote: > I created the list and added them to it because I was sending ARF > format and got complaints. In some cases the messages bounced > refusing email with attachments. > > I'm with you - I wish everyone would take this standard format. > It's a good standard. But even big companies often have morons > running their email systems. > > Joshua Baer wrote: >> I'm surprised there are that many. If you were to send them ARFs >> anyway, do you think they would ignore the complaints or find a >> way to read them? >> >> ~Josh >> >> >> On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote: >> >>> Well, since I started sending ARF a few days ago I had to put these >>> domains on an exception list for plain text. >>> >>> qwest.net >>> rr.com >>> cogeco.net >>> mchsi.com >>> tiscali.nl >>> domeneshop.no >>> chello.nl >>> covad.com >>> speakeasy.net >>> inode.at >>> nauticom.net >>> midco.net >>> >>> I wish ARF would catch on because I want to do this right. >>> >>> Joshua Baer wrote: >>> > I'm not sure I see the harm in sending all ARF. It was designed >>> to be >>> > just as useful to a person as to a computer. Even if I'm not >>> "set up >>> > to interpret it" (which I assume you mean set up to process the >>> > messages automatically), I'd still rather get an ARF message >>> than just >>> > getting a raw message forwarded. >>> > >>> > As Steve said, if they can't handle MIME, they probably can't >>> handle >>> > much of anything. If they can't handle MIME, they can't even >>> view half >>> > the messages that the complaint is about. >>> > >>> > ~Josh >>> > >>> > >>> > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote: >>> > >>> >> On 2007-07-10 15:56, Marc Perkel wrote: >>> >> >>> >>> It's kind of interesting that some abuse folks ask for text >>> mode and >>> >>> some ask for mime as specified in this standard. I'm >>> contemplating >>> >>> doing a combination where I have both. Anyone have any opinions >>> >>> about this? >>> >> >>> >> If the recipient doesn't ask for ARF, don't send them ARF. This >>> >> format is still too new (and too unpublished) to assume that >>> everyone >>> >> will be set up to interpret it. >>> >> >>> >> -- >>> >> J.D. Falk, Anti-Spam Product Manager >>> >> Yahoo! Mail >>> >> _______________________________________________ >>> >> abuse-feedback-report mailing list >>> >> abuse-feedback-report@mipassoc.org >>> >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report >>> > >>> > _______________________________________________ >>> > abuse-feedback-report mailing list >>> > abuse-feedback-report@mipassoc.org >>> > http://mipassoc.org/mailman/listinfo/abuse-feedback-report >>> >> >> >> _______________________________________________ >> abuse-feedback-report mailing list >> abuse-feedback-report@mipassoc.org >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report >> --Apple-Mail-5--276906302 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=ISO-8859-1 I don't think they are morons = its just that they are using a CRM software that can't handle the = messages. These people probably don't have much ability change that, but = then again sometimes those systems don't change unless they _have_ to so = we may need to find ways to incentivize them.

~Josh

On Jul 11, 2007, at 4:09 PM, Marc Perkel wrote:

I = created the list and added them to it because I was sending ARF format = and got complaints. In some cases the messages bounced refusing email = with attachments.

I'm with you - I wish everyone would take = this standard format. It's a good standard. But even big companies often = have morons running their email systems.

Joshua Baer wrote: =
I'm surprised there are that many. If you were to = send them ARFs anyway, do you think they would ignore the complaints or = find a way to read them?

~Josh


On Jul 11, = 2007, at 3:20 PM, Marc Perkel wrote:

Well, since I started sending ARF a few days ago I had to put = these
domains on an exception list for plain text.

= qwest.net
rr.com
cogeco.net
mchsi.com
tiscali.nl
= domeneshop.no
chello.nl
covad.com
speakeasy.net
= inode.at
nauticom.net
midco.net

I wish ARF would = catch on because I want to do this right.

Joshua Baer = wrote:
> I'm not sure I see the harm in sending all ARF. It was = designed to be
> just as useful to a person as to a computer. = Even if I'm not "set up
> to interpret it" (which I assume you = mean set up to process the
> messages automatically), I'd still = rather get an ARF message than just
> getting a raw message = forwarded.
>
> As Steve said, if they can't handle MIME, = they probably can't handle
> much of anything. If they can't = handle MIME, they can't even view half
> the messages that the = complaint is about.
>
> ~Josh
>
>
> = On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:
>
>> On = 2007-07-10 15:56, Marc Perkel wrote:
>>
>>> It's = kind of interesting that some abuse folks ask for text mode and
= >>> some ask for mime as specified in this standard. I'm = contemplating
>>> doing a combination where I have both. = Anyone have any opinions
>>> about this?
>>
= >> If the recipient doesn't ask for ARF, don't send them ARF.=A0 = This
>> format is still too new (and too unpublished) to = assume that everyone
>> will be set up to interpret it.
= >>
>> --
>> J.D. Falk, Anti-Spam Product = Manager
>> Yahoo! Mail
>> = _______________________________________________
>> = abuse-feedback-report mailing list
>> abuse-feedback-report@m= ipassoc.org
>> http:/= /mipassoc.org/mailman/listinfo/abuse-feedback-report
>
= > _______________________________________________
> = abuse-feedback-report mailing list
> abuse-feedback-report@m= ipassoc.org
> http:/= /mipassoc.org/mailman/listinfo/abuse-feedback-report
 = 



_______________________________________________
abuse-feedback-report mailing list
abuse-feedback-report@m=
ipassoc.org
http:/=
/mipassoc.org/mailman/listinfo/abuse-feedback-report

= --Apple-Mail-5--276906302-- Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BL96nk013705 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 14:09:06 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I8jQx-0002WC-9B on interface=127.0.0.1; Wed, 11 Jul 2007 14:09:15 -0700 Message-ID: <469546FA.8020301@perkel.com> Date: Wed, 11 Jul 2007 14:09:14 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: Joshua Baer Subject: Re: [feedback-report] Mixed text and mime? References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46953B81.6030009@perkel.com> In-Reply-To: Content-Type: multipart/alternative; boundary="------------020103030101000307030705" X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Cc: abuse-feedback-report@mipassoc.org X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 21:09:29 -0000 This is a multi-part message in MIME format. --------------020103030101000307030705 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit I created the list and added them to it because I was sending ARF format and got complaints. In some cases the messages bounced refusing email with attachments. I'm with you - I wish everyone would take this standard format. It's a good standard. But even big companies often have morons running their email systems. Joshua Baer wrote: > I'm surprised there are that many. If you were to send them ARFs > anyway, do you think they would ignore the complaints or find a way to > read them? > > ~Josh > > > On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote: > >> Well, since I started sending ARF a few days ago I had to put these >> domains on an exception list for plain text. >> >> qwest.net >> rr.com >> cogeco.net >> mchsi.com >> tiscali.nl >> domeneshop.no >> chello.nl >> covad.com >> speakeasy.net >> inode.at >> nauticom.net >> midco.net >> >> I wish ARF would catch on because I want to do this right. >> >> Joshua Baer wrote: >> > I'm not sure I see the harm in sending all ARF. It was designed to be >> > just as useful to a person as to a computer. Even if I'm not "set up >> > to interpret it" (which I assume you mean set up to process the >> > messages automatically), I'd still rather get an ARF message than just >> > getting a raw message forwarded. >> > >> > As Steve said, if they can't handle MIME, they probably can't handle >> > much of anything. If they can't handle MIME, they can't even view half >> > the messages that the complaint is about. >> > >> > ~Josh >> > >> > >> > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote: >> > >> >> On 2007-07-10 15:56, Marc Perkel wrote: >> >> >> >>> It's kind of interesting that some abuse folks ask for text mode and >> >>> some ask for mime as specified in this standard. I'm contemplating >> >>> doing a combination where I have both. Anyone have any opinions >> >>> about this? >> >> >> >> If the recipient doesn't ask for ARF, don't send them ARF. This >> >> format is still too new (and too unpublished) to assume that everyone >> >> will be set up to interpret it. >> >> >> >> -- >> >> J.D. Falk, Anti-Spam Product Manager >> >> Yahoo! Mail >> >> _______________________________________________ >> >> abuse-feedback-report mailing list >> >> abuse-feedback-report@mipassoc.org >> >> >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report >> > >> > _______________________________________________ >> > abuse-feedback-report mailing list >> > abuse-feedback-report@mipassoc.org >> >> > http://mipassoc.org/mailman/listinfo/abuse-feedback-report >> > > ------------------------------------------------------------------------ > > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report > --------------020103030101000307030705 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit I created the list and added them to it because I was sending ARF format and got complaints. In some cases the messages bounced refusing email with attachments.

I'm with you - I wish everyone would take this standard format. It's a good standard. But even big companies often have morons running their email systems.

Joshua Baer wrote:
I'm surprised there are that many. If you were to send them ARFs anyway, do you think they would ignore the complaints or find a way to read them?

~Josh


On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote:

Well, since I started sending ARF a few days ago I had to put these
domains on an exception list for plain text.

qwest.net
rr.com
cogeco.net
mchsi.com
tiscali.nl
domeneshop.no
chello.nl
covad.com
speakeasy.net
inode.at
nauticom.net
midco.net

I wish ARF would catch on because I want to do this right.

Joshua Baer wrote:
> I'm not sure I see the harm in sending all ARF. It was designed to be
> just as useful to a person as to a computer. Even if I'm not "set up
> to interpret it" (which I assume you mean set up to process the
> messages automatically), I'd still rather get an ARF message than just
> getting a raw message forwarded.
>
> As Steve said, if they can't handle MIME, they probably can't handle
> much of anything. If they can't handle MIME, they can't even view half
> the messages that the complaint is about.
>
> ~Josh
>
>
> On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote:
>
>> On 2007-07-10 15:56, Marc Perkel wrote:
>>
>>> It's kind of interesting that some abuse folks ask for text mode and
>>> some ask for mime as specified in this standard. I'm contemplating
>>> doing a combination where I have both. Anyone have any opinions
>>> about this?
>>
>> If the recipient doesn't ask for ARF, don't send them ARF.  This
>> format is still too new (and too unpublished) to assume that everyone
>> will be set up to interpret it.
>>
>> --
>> J.D. Falk, Anti-Spam Product Manager
>> Yahoo! Mail
>> _______________________________________________
>> abuse-feedback-report mailing list
>> abuse-feedback-report@mipassoc.org
>> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
>
> _______________________________________________
> abuse-feedback-report mailing list
> abuse-feedback-report@mipassoc.org
> http://mipassoc.org/mailman/listinfo/abuse-feedback-report
 



_______________________________________________
abuse-feedback-report mailing list
abuse-feedback-report@mipassoc.org
http://mipassoc.org/mailman/listinfo/abuse-feedback-report
--------------020103030101000307030705-- Received: from ms-smtp-01.texas.rr.com (ms-smtp-01.texas.rr.com [24.93.47.40]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BL1x9x011999 for ; Wed, 11 Jul 2007 14:01:59 -0700 Received: from [10.0.1.5] (cpe-66-25-157-199.austin.res.rr.com [66.25.157.199]) by ms-smtp-01.texas.rr.com (8.13.6/8.13.6) with ESMTP id l6BL18pk012507 for ; Wed, 11 Jul 2007 16:02:05 -0500 (CDT) Mime-Version: 1.0 (Apple Message framework v752.2) In-Reply-To: <2D779176-30EA-43D9-B095-EE9F8A3D7942@word-to-the-wise.com> References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46953B81.6030009@perkel.com> <2D779176-30EA-43D9-B095-EE9F8A3D7942@word-to-the-wise.com> Content-Type: multipart/alternative; boundary=Apple-Mail-3--277905514 Message-Id: <761FEEE1-A78B-438B-BDE7-33D4842769B1@datranmedia.com> From: Joshua Baer Subject: Re: [feedback-report] Mixed text and mime? Date: Wed, 11 Jul 2007 16:02:04 -0500 To: ARF mailing list X-Mailer: Apple Mail (2.752.2) X-Virus-Scanned: Symantec AntiVirus Scan Engine X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: joshua.baer@datranmedia.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 21:02:06 -0000 --Apple-Mail-3--277905514 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed I couldn't agree more - which is one more reason we need to finish defining how you ask for them in a standard way... ~Josh On Jul 11, 2007, at 3:33 PM, Steve Atkins wrote: > On Jul 11, 2007, at 1:20 PM, Marc Perkel wrote: > > > > Well, since I started sending ARF a few days ago I had to put these > > domains on an exception list for plain text. > > > > qwest.net > > rr.com > > cogeco.net > > mchsi.com > > tiscali.nl > > domeneshop.no > > chello.nl > > covad.com > > speakeasy.net > > inode.at > > nauticom.net > > midco.net > > > > I wish ARF would catch on because I want to do this right. > > > > Do what right? > > ARF really isn't intended for non-consensual mail, so sending it to > people who haven't explicitly asked for > it isn't necessarily a great idea. > > Cheers, > Steve > > > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report > --Apple-Mail-3--277905514 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=ISO-8859-1
I couldn't agree more - = which is one more reason we need to finish defining how you ask for them = in a standard way...

~Josh


On Jul 11, 2007, = at 3:33 PM, Steve Atkins wrote:

On Jul 11, 2007, at 1:20 PM, Marc Perkel wrote:


= > Well, since I started sending ARF a few days ago I had to put = these=A0
> domains on an exception list for plain text.
= >
> qwest.net
> rr.com
> cogeco.net
> = mchsi.com
> tiscali.nl
> domeneshop.no
> = chello.nl
> covad.com
> speakeasy.net
> = inode.at
> nauticom.net
> midco.net
>
> I = wish ARF would catch on because I want to do this right.
>
=
Do what right?

ARF really isn't intended for = non-consensual mail, so sending it to=A0
people who haven't = explicitly asked for
it isn't necessarily a great idea.

= Cheers,
=A0=A0 Steve


= _______________________________________________
= abuse-feedback-report mailing list
abuse-feedback-report@m= ipassoc.org
http:/= /mipassoc.org/mailman/listinfo/abuse-feedback-report
 =


= --Apple-Mail-3--277905514-- Received: from ms-smtp-01.texas.rr.com (ms-smtp-01.texas.rr.com [24.93.47.40]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BL12EN011749 for ; Wed, 11 Jul 2007 14:01:02 -0700 Received: from [10.0.1.5] (cpe-66-25-157-199.austin.res.rr.com [66.25.157.199]) by ms-smtp-01.texas.rr.com (8.13.6/8.13.6) with ESMTP id l6BL18pj012507 for ; Wed, 11 Jul 2007 16:01:08 -0500 (CDT) Mime-Version: 1.0 (Apple Message framework v752.2) In-Reply-To: <46953B81.6030009@perkel.com> References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46953B81.6030009@perkel.com> Content-Type: multipart/alternative; boundary=Apple-Mail-2--277962835 Message-Id: From: Joshua Baer Subject: Re: [feedback-report] Mixed text and mime? Date: Wed, 11 Jul 2007 16:01:07 -0500 To: abuse-feedback-report@mipassoc.org X-Mailer: Apple Mail (2.752.2) X-Virus-Scanned: Symantec AntiVirus Scan Engine X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: joshua.baer@datranmedia.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 21:01:12 -0000 --Apple-Mail-2--277962835 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed I'm surprised there are that many. If you were to send them ARFs anyway, do you think they would ignore the complaints or find a way to read them? ~Josh On Jul 11, 2007, at 3:20 PM, Marc Perkel wrote: > Well, since I started sending ARF a few days ago I had to put these > domains on an exception list for plain text. > > qwest.net > rr.com > cogeco.net > mchsi.com > tiscali.nl > domeneshop.no > chello.nl > covad.com > speakeasy.net > inode.at > nauticom.net > midco.net > > I wish ARF would catch on because I want to do this right. > > Joshua Baer wrote: > > I'm not sure I see the harm in sending all ARF. It was designed > to be > > just as useful to a person as to a computer. Even if I'm not "set up > > to interpret it" (which I assume you mean set up to process the > > messages automatically), I'd still rather get an ARF message than > just > > getting a raw message forwarded. > > > > As Steve said, if they can't handle MIME, they probably can't handle > > much of anything. If they can't handle MIME, they can't even view > half > > the messages that the complaint is about. > > > > ~Josh > > > > > > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote: > > > >> On 2007-07-10 15:56, Marc Perkel wrote: > >> > >>> It's kind of interesting that some abuse folks ask for text > mode and > >>> some ask for mime as specified in this standard. I'm contemplating > >>> doing a combination where I have both. Anyone have any opinions > >>> about this? > >> > >> If the recipient doesn't ask for ARF, don't send them ARF. This > >> format is still too new (and too unpublished) to assume that > everyone > >> will be set up to interpret it. > >> > >> -- > >> J.D. Falk, Anti-Spam Product Manager > >> Yahoo! Mail > >> _______________________________________________ > >> abuse-feedback-report mailing list > >> abuse-feedback-report@mipassoc.org > >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report > > > > _______________________________________________ > > abuse-feedback-report mailing list > > abuse-feedback-report@mipassoc.org > > http://mipassoc.org/mailman/listinfo/abuse-feedback-report > --Apple-Mail-2--277962835 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=ISO-8859-1
I'm surprised there are = that many. If you were to send them ARFs anyway, do you think they would = ignore the complaints or find a way to read them?

~Josh


On Jul 11, 2007, = at 3:20 PM, Marc Perkel wrote:

Well, since I started sending ARF a few days ago I had to put = these
domains on an exception list for plain text.

= qwest.net
rr.com
cogeco.net
mchsi.com
tiscali.nl
= domeneshop.no
chello.nl
covad.com
speakeasy.net
= inode.at
nauticom.net
midco.net

I wish ARF would catch = on because I want to do this right.

Joshua Baer wrote:
> = I'm not sure I see the harm in sending all ARF. It was designed to = be
> just as useful to a person as to a computer. Even if I'm not = "set up
> to interpret it" (which I assume you mean set up to = process the
> messages automatically), I'd still rather get an = ARF message than just
> getting a raw message forwarded.
= >
> As Steve said, if they can't handle MIME, they probably = can't handle
> much of anything. If they can't handle MIME, they = can't even view half
> the messages that the complaint is = about.
>
> ~Josh
>
>
> On Jul 11, = 2007, at 1:43 PM, J.D. Falk wrote:
>
>> On 2007-07-10 = 15:56, Marc Perkel wrote:
>>
>>> It's kind of = interesting that some abuse folks ask for text mode and
>>> = some ask for mime as specified in this standard. I'm contemplating
= >>> doing a combination where I have both. Anyone have any = opinions
>>> about this?
>>
>> If the = recipient doesn't ask for ARF, don't send them ARF.=A0 This
>> = format is still too new (and too unpublished) to assume that = everyone
>> will be set up to interpret it.
>>
= >> --
>> J.D. Falk, Anti-Spam Product Manager
= >> Yahoo! Mail
>> = _______________________________________________
>> = abuse-feedback-report mailing list
>> abuse-feedback-report@m= ipassoc.org
>> http:/= /mipassoc.org/mailman/listinfo/abuse-feedback-report
>
= > _______________________________________________
> = abuse-feedback-report mailing list
> abuse-feedback-report@m= ipassoc.org
> http:/= /mipassoc.org/mailman/listinfo/abuse-feedback-report
 =


= --Apple-Mail-2--277962835-- Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BKXZ6s006426 for ; Wed, 11 Jul 2007 13:33:35 -0700 Received: from [10.3.2.25] (184.wordtothewise.com [208.187.80.184]) by m.wordtothewise.com (Postfix) with ESMTP id 6A2E0800C7 for ; Wed, 11 Jul 2007 13:33:44 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v752.3) In-Reply-To: <46953B81.6030009@perkel.com> References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46953B81.6030009@perkel.com> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <2D779176-30EA-43D9-B095-EE9F8A3D7942@word-to-the-wise.com> Content-Transfer-Encoding: 7bit From: Steve Atkins Subject: Re: [feedback-report] Mixed text and mime? Date: Wed, 11 Jul 2007 13:33:41 -0700 To: ARF mailing list X-Mailer: Apple Mail (2.752.3) X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: steve@word-to-the-wise.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 20:33:40 -0000 On Jul 11, 2007, at 1:20 PM, Marc Perkel wrote: > Well, since I started sending ARF a few days ago I had to put these > domains on an exception list for plain text. > > qwest.net > rr.com > cogeco.net > mchsi.com > tiscali.nl > domeneshop.no > chello.nl > covad.com > speakeasy.net > inode.at > nauticom.net > midco.net > > I wish ARF would catch on because I want to do this right. > Do what right? ARF really isn't intended for non-consensual mail, so sending it to people who haven't explicitly asked for it isn't necessarily a great idea. Cheers, Steve Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BKKBYx003718 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 13:20:11 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I8ifZ-0008Uf-NQ on interface=127.0.0.1; Wed, 11 Jul 2007 13:20:18 -0700 Message-ID: <46953B81.6030009@perkel.com> Date: Wed, 11 Jul 2007 13:20:17 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: Joshua Baer Subject: Re: [feedback-report] Mixed text and mime? References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Cc: abuse-feedback-report@mipassoc.org X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 20:20:26 -0000 Well, since I started sending ARF a few days ago I had to put these domains on an exception list for plain text. qwest.net rr.com cogeco.net mchsi.com tiscali.nl domeneshop.no chello.nl covad.com speakeasy.net inode.at nauticom.net midco.net I wish ARF would catch on because I want to do this right. Joshua Baer wrote: > I'm not sure I see the harm in sending all ARF. It was designed to be > just as useful to a person as to a computer. Even if I'm not "set up > to interpret it" (which I assume you mean set up to process the > messages automatically), I'd still rather get an ARF message than just > getting a raw message forwarded. > > As Steve said, if they can't handle MIME, they probably can't handle > much of anything. If they can't handle MIME, they can't even view half > the messages that the complaint is about. > > ~Josh > > > On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote: > >> On 2007-07-10 15:56, Marc Perkel wrote: >> >>> It's kind of interesting that some abuse folks ask for text mode and >>> some ask for mime as specified in this standard. I'm contemplating >>> doing a combination where I have both. Anyone have any opinions >>> about this? >> >> If the recipient doesn't ask for ARF, don't send them ARF. This >> format is still too new (and too unpublished) to assume that everyone >> will be set up to interpret it. >> >> -- >> J.D. Falk, Anti-Spam Product Manager >> Yahoo! Mail >> _______________________________________________ >> abuse-feedback-report mailing list >> abuse-feedback-report@mipassoc.org >> http://mipassoc.org/mailman/listinfo/abuse-feedback-report > > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BJZTRS026684 for ; Wed, 11 Jul 2007 12:35:29 -0700 Received: from [10.3.2.25] (184.wordtothewise.com [208.187.80.184]) by m.wordtothewise.com (Postfix) with ESMTP id ACA44800CE for ; Wed, 11 Jul 2007 12:35:37 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v752.3) In-Reply-To: <46952CBB.5060902@yahoo-inc.com> References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> <46952CBB.5060902@yahoo-inc.com> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Steve Atkins Subject: Re: [feedback-report] Mixed text and mime? Date: Wed, 11 Jul 2007 12:35:34 -0700 To: ARF mailing list X-Mailer: Apple Mail (2.752.3) X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: steve@word-to-the-wise.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 19:35:34 -0000 On Jul 11, 2007, at 12:17 PM, J.D. Falk wrote: > On 2007-07-11 12:00, Joshua Baer wrote: > > >> I'm not sure I see the harm in sending all ARF. It was designed to >> be just as useful to a person as to a computer. Even if I'm not >> "set up to interpret it" (which I assume you mean set up to >> process the messages automatically), I'd still rather get an ARF >> message than just getting a raw message forwarded. >> > > I'm sure that's true in a lot of cases, but it's not safe to assume > that /everyone/ can receive and view ARF. Different clients do all > sorts of wonky things with MIME types they don't recognize, and the > big commercial customer support systems (kana, remedy, etc) are > especially bad about it. > Yup. If they can't handle ARF they probably can't handle message/rfc822, and they won't be useful for handling a large fraction of abuse reports. That doesn't mean there aren't a lot of them out there, of course, but if they can't handle ARF they're unlikely to be able to handle ARF+plain-text either, which is where we started. > > Hopefully that'll change in a few years, after we've actually > published this thing. > It would be fairly easy in many cases for a recipient who cared to receive ARF reports in particular with a plain-text system to do a little MIME cracking on the front-end and put plaintextified versions into their ticketing system, so it doesn't even need to wait on major ticketing system upgrades. Cheers, Steve Received: from rsmtp2.corp.yahoo.com (rsmtp2.corp.yahoo.com [207.126.228.150]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BJGmY0022398 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 12:16:49 -0700 Received: from jdfalk-mac.corp.yahoo.com (jdfalk-mac.corp.yahoo.com [10.72.109.95]) (authenticated bits=0) by rsmtp2.corp.yahoo.com (8.13.8/8.13.6/y.rout) with ESMTP id l6BJGqdD033432 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 12:16:53 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; s=serpent; d=yahoo-inc.com; c=nofws; q=dns; h=message-id:date:from:organization:user-agent:mime-version:to: subject:references:in-reply-to:content-type:content-transfer-encoding; b=QukynOqjhypU+9v70mKx9jNtCNj9kVutexf9Gvo1MRV2t+2o7+jGW3UCjFEHEcnM Message-ID: <46952CBB.5060902@yahoo-inc.com> Date: Wed, 11 Jul 2007 12:17:15 -0700 From: "J.D. Falk" Organization: Yahoo! User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Mixed text and mime? References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: jdfalk@yahoo-inc.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 19:16:55 -0000 On 2007-07-11 12:00, Joshua Baer wrote: > I'm not sure I see the harm in sending all ARF. It was designed to be > just as useful to a person as to a computer. Even if I'm not "set up > to interpret it" (which I assume you mean set up to process the > messages automatically), I'd still rather get an ARF message than > just getting a raw message forwarded. I'm sure that's true in a lot of cases, but it's not safe to assume that /everyone/ can receive and view ARF. Different clients do all sorts of wonky things with MIME types they don't recognize, and the big commercial customer support systems (kana, remedy, etc) are especially bad about it. Hopefully that'll change in a few years, after we've actually published this thing. -- J.D. Falk, Anti-Spam Product Manager Yahoo! Mail Received: from ms-smtp-03.texas.rr.com (ms-smtp-03.texas.rr.com [24.93.47.42]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BIxsL7018079 for ; Wed, 11 Jul 2007 11:59:54 -0700 Received: from [10.0.1.5] (cpe-66-25-157-199.austin.res.rr.com [66.25.157.199]) by ms-smtp-03.texas.rr.com (8.13.6/8.13.6) with ESMTP id l6BJ01LW022201 for ; Wed, 11 Jul 2007 14:00:01 -0500 (CDT) Mime-Version: 1.0 (Apple Message framework v752.2) In-Reply-To: <469524B5.6080809@yahoo-inc.com> References: <46940E9E.1060608@perkel.com> <469524B5.6080809@yahoo-inc.com> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Joshua Baer Subject: Re: [feedback-report] Mixed text and mime? Date: Wed, 11 Jul 2007 14:00:00 -0500 To: abuse-feedback-report@mipassoc.org X-Mailer: Apple Mail (2.752.2) X-Virus-Scanned: Symantec AntiVirus Scan Engine X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: joshua.baer@datranmedia.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 18:59:57 -0000 I'm not sure I see the harm in sending all ARF. It was designed to be just as useful to a person as to a computer. Even if I'm not "set up to interpret it" (which I assume you mean set up to process the messages automatically), I'd still rather get an ARF message than just getting a raw message forwarded. As Steve said, if they can't handle MIME, they probably can't handle much of anything. If they can't handle MIME, they can't even view half the messages that the complaint is about. ~Josh On Jul 11, 2007, at 1:43 PM, J.D. Falk wrote: > On 2007-07-10 15:56, Marc Perkel wrote: > >> It's kind of interesting that some abuse folks ask for text mode >> and some ask for mime as specified in this standard. I'm >> contemplating doing a combination where I have both. Anyone have >> any opinions about this? > > If the recipient doesn't ask for ARF, don't send them ARF. This > format is still too new (and too unpublished) to assume that > everyone will be set up to interpret it. > > -- > J.D. Falk, Anti-Spam Product Manager > Yahoo! Mail > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report Received: from rsmtp2.corp.yahoo.com (rsmtp2.corp.yahoo.com [207.126.228.150]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6BIgg36014359 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 11:42:42 -0700 Received: from jdfalk-mac.corp.yahoo.com (jdfalk-mac.corp.yahoo.com [10.72.109.95]) (authenticated bits=0) by rsmtp2.corp.yahoo.com (8.13.8/8.13.6/y.rout) with ESMTP id l6BIgc1V029530 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Jul 2007 11:42:39 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; s=serpent; d=yahoo-inc.com; c=nofws; q=dns; h=message-id:date:from:organization:user-agent:mime-version:to: subject:references:in-reply-to:content-type:content-transfer-encoding; b=VuxPPfOG3rATA3oi++O7bOnk+w4eArMgHrwqP0bWx8YB8eZrSEbf+07MFsD8fysi Message-ID: <469524B5.6080809@yahoo-inc.com> Date: Wed, 11 Jul 2007 11:43:01 -0700 From: "J.D. Falk" Organization: Yahoo! User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Mixed text and mime? References: <46940E9E.1060608@perkel.com> In-Reply-To: <46940E9E.1060608@perkel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: jdfalk@yahoo-inc.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2007 18:42:46 -0000 On 2007-07-10 15:56, Marc Perkel wrote: > It's kind of interesting that some abuse folks ask for text mode and > some ask for mime as specified in this standard. I'm contemplating doing > a combination where I have both. Anyone have any opinions about this? If the recipient doesn't ask for ARF, don't send them ARF. This format is still too new (and too unpublished) to assume that everyone will be set up to interpret it. -- J.D. Falk, Anti-Spam Product Manager Yahoo! Mail Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6ANFNem027957 for ; Tue, 10 Jul 2007 16:15:24 -0700 Received: from [10.3.2.25] (184.wordtothewise.com [208.187.80.184]) by m.wordtothewise.com (Postfix) with ESMTP id 73CCF800C2 for ; Tue, 10 Jul 2007 16:15:32 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v752.3) In-Reply-To: <46940E9E.1060608@perkel.com> References: <46940E9E.1060608@perkel.com> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Steve Atkins Subject: Re: [feedback-report] Mixed text and mime? Date: Tue, 10 Jul 2007 16:15:30 -0700 To: ARF mailing list X-Mailer: Apple Mail (2.752.3) X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: steve@word-to-the-wise.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 23:15:27 -0000 On Jul 10, 2007, at 3:56 PM, Marc Perkel wrote: > It's kind of interesting that some abuse folks ask for text mode > and some ask for mime as specified in this standard. I'm > contemplating doing a combination where I have both. Anyone have > any opinions about this? If the recipient can't handle MIME, odds are good that they can't do much useful with reports in any format. Spamcop reports are a good example of what happens when the sender doesn't send MIME. The original mail is included inline, as plain text, in the report. If, as is not unusual, the original mail was base64 encoded then there's no way for the recipient of the report to see the content of the original mail without jumping through some horrible hoops or having some overly smart ticketing software. Cheers, Steve Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6AMuMNC024790 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Jul 2007 15:56:22 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I8OdD-0000yX-1m on interface=127.0.0.1 for abuse-feedback-report@mipassoc.org; Tue, 10 Jul 2007 15:56:31 -0700 Message-ID: <46940E9E.1060608@perkel.com> Date: Tue, 10 Jul 2007 15:56:30 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Subject: [feedback-report] Mixed text and mime? X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 22:56:28 -0000 It's kind of interesting that some abuse folks ask for text mode and some ask for mime as specified in this standard. I'm contemplating doing a combination where I have both. Anyone have any opinions about this? Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6AM3Ub7013594 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Jul 2007 15:03:30 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I8No0-0007K9-Mu on interface=127.0.0.1 for abuse-feedback-report@mipassoc.org; Tue, 10 Jul 2007 15:03:36 -0700 Message-ID: <46940238.5000809@perkel.com> Date: Tue, 10 Jul 2007 15:03:36 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Reply-to address References: <20070710215312.22054.qmail@simone.iecc.com> In-Reply-To: <20070710215312.22054.qmail@simone.iecc.com> Content-Type: multipart/alternative; boundary="------------000100040109080705090803" X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 22:03:38 -0000 This is a multi-part message in MIME format. --------------000100040109080705090803 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit John Levine wrote: >> I guess what I'm suggesting is blessing the reply-to as an official >> optional field in the specification in the feedback report section. >> > > I don't see the point of repeating information that's already present > in the ARF report. We could copy every single header field into the > report section. What would be the advantage of doing so? > > R's, > John > The only reason to bless it as an optional field is that in certain cases the reply-to is the actual offending address that you want the abuse department to target. The reply-to is the one that will hurt the scammer the most. And like I said, optional field. --------------000100040109080705090803 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit

John Levine wrote: 
I guess what I'm suggesting is blessing the reply-to as an official
optional field in the specification in the feedback report section.
    

I don't see the point of repeating information that's already present
in the ARF report.  We could copy every single header field into the
report section.  What would be the advantage of doing so?

R's,
John

The only reason to bless it as an optional field is that in certain cases the reply-to is the actual offending address that you want the abuse department to target. The reply-to is the one that will hurt the scammer the most. And like I said, optional field.

--------------000100040109080705090803-- Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6ALr4Zj011768 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Tue, 10 Jul 2007 14:53:05 -0700 Received: (qmail 65654 invoked from network); 10 Jul 2007 21:53:12 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 10 Jul 2007 21:53:12 -0000 Date: 10 Jul 2007 21:53:12 -0000 Message-ID: <20070710215312.22054.qmail@simone.iecc.com> From: John Levine To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Reply-to address In-Reply-To: <4693DEAF.7030306@perkel.com> Organization: Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: prvs=johnl=0704aee2fb@iecc.com Cc: X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 21:53:20 -0000 > I guess what I'm suggesting is blessing the reply-to as an official > optional field in the specification in the feedback report section. I don't see the point of repeating information that's already present in the ARF report. We could copy every single header field into the report section. What would be the advantage of doing so? R's, John Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6AJVqqP012422 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Jul 2007 12:31:52 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I8LRI-0006EB-Pn on interface=127.0.0.1; Tue, 10 Jul 2007 12:32:00 -0700 Message-ID: <4693DEAF.7030306@perkel.com> Date: Tue, 10 Jul 2007 12:31:59 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: "J.D. Falk" Subject: Re: [feedback-report] Reply-to address References: <4693B7DC.8040709@perkel.com> <4693D8CE.1010204@yahoo-inc.com> In-Reply-To: <4693D8CE.1010204@yahoo-inc.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Cc: abuse-feedback-report@mipassoc.org X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 19:32:01 -0000 J.D. Falk wrote: > On 2007-07-10 09:46, Marc Perkel wrote: > >> I'd like to suggest that reporting the reply-to address be part of >> your specification if the reply-to is different than the from >> address. Often fraud spam will have a different reply-to so when the >> from address is shut down then it is replaced. But the reply-to cuts >> the scammer off from the suckers. > > The entire original message is included in the report (or all of the > headers, if you use that option.) So, the information is already > there, and the report generator can choose to send reports to the > domain in the Reply-To: header if they wish. > In cases like yahoo, hotmail, and gmail I've been sending reports to the reply-to if the reply-to is also a big freemail host and the from is one freemail host and the reply-to is different. I guess what I'm suggesting is blessing the reply-to as an official optional field in the specification in the feedback report section. Orininal-Reply-To: scammer@yahoo.com Received: from rsmtp2.corp.yahoo.com (rsmtp2.corp.yahoo.com [207.126.228.150]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6AJ6T41006828 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Jul 2007 12:06:29 -0700 Received: from jdfalk-mac-corp-yahoo-com.local (snvvpn1-10-72-72-c137.corp.yahoo.com [10.72.72.137]) (authenticated bits=0) by rsmtp2.corp.yahoo.com (8.13.8/8.13.6/y.rout) with ESMTP id l6AJ6W3K031558 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 10 Jul 2007 12:06:33 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; s=serpent; d=yahoo-inc.com; c=nofws; q=dns; h=message-id:date:from:organization:user-agent:mime-version:to: subject:references:in-reply-to:content-type:content-transfer-encoding; b=RnrfB7GqyHLFOLTy3mmNMLwxciqfqT0ZT4VRg59byqMc77l+v13A0El7K9RCobln Message-ID: <4693D8CE.1010204@yahoo-inc.com> Date: Tue, 10 Jul 2007 12:06:54 -0700 From: "J.D. Falk" Organization: Yahoo! User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: Marc Perkel , abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Reply-to address References: <4693B7DC.8040709@perkel.com> In-Reply-To: <4693B7DC.8040709@perkel.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: jdfalk@yahoo-inc.com Cc: X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 19:06:47 -0000 On 2007-07-10 09:46, Marc Perkel wrote: > I'd like to suggest that reporting the reply-to address be part of your > specification if the reply-to is different than the from address. Often > fraud spam will have a different reply-to so when the from address is > shut down then it is replaced. But the reply-to cuts the scammer off > from the suckers. The entire original message is included in the report (or all of the headers, if you use that option.) So, the information is already there, and the report generator can choose to send reports to the domain in the Reply-To: header if they wish. -- J.D. Falk, Anti-Spam Product Manager Yahoo! Mail Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l6AGkGkT002887 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 10 Jul 2007 09:46:21 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I8Iqy-0004ib-Rq on interface=127.0.0.1 for abuse-feedback-report@mipassoc.org; Tue, 10 Jul 2007 09:46:21 -0700 Message-ID: <4693B7DC.8040709@perkel.com> Date: Tue, 10 Jul 2007 09:46:20 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Subject: [feedback-report] Reply-to address X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 16:46:27 -0000 I'd like to suggest that reporting the reply-to address be part of your specification if the reply-to is different than the from address. Often fraud spam will have a different reply-to so when the from address is shut down then it is replaced. But the reply-to cuts the scammer off from the suckers. I ogten see this: From: scam@tahoo.com Reply-to: scam@hotmail.com Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l68Gxdfi011255 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 8 Jul 2007 09:59:39 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I7a6t-0001Rb-M6 on interface=127.0.0.1; Sun, 08 Jul 2007 09:59:47 -0700 Message-ID: <46911803.1010300@perkel.com> Date: Sun, 08 Jul 2007 09:59:47 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: Steve Atkins Subject: Re: [feedback-report] ARF reporting tools? What works with Exim References: <20070708162826.8872.qmail@simone.iecc.com> <79891A3C-2B69-4689-81D6-961650569895@word-to-the-wise.com> In-Reply-To: <79891A3C-2B69-4689-81D6-961650569895@word-to-the-wise.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Cc: ARF mailing list X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Jul 2007 16:59:45 -0000 Steve Atkins wrote: > > On Jul 8, 2007, at 9:28 AM, John Levine wrote: > >>> OK - now for my question. What tools are out there to generated these >>> reports. I'm using Exim. I'd rather not have to figure it out from >>> scratch if someone has already done it. >> >> I think we've all rolled our own. The format is intended to be trivial >> to generate. > > There's some sample code at http://wordtothewise.com/resources/arf.html > > It's not something I'd use for long term production use, but it might get > you started. > > Cheers, > Steve > > I figured it out. I coded up a script in Pascal and it's working great. Getting positive feedback from those recipients who appreciate it. Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l68Gj28R008404 for ; Sun, 8 Jul 2007 09:45:02 -0700 Received: from [10.3.2.25] (184.wordtothewise.com [208.187.80.184]) by m.wordtothewise.com (Postfix) with ESMTP id 5E3DC800EE for ; Sun, 8 Jul 2007 09:45:10 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v752.3) In-Reply-To: <20070708162826.8872.qmail@simone.iecc.com> References: <20070708162826.8872.qmail@simone.iecc.com> Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <79891A3C-2B69-4689-81D6-961650569895@word-to-the-wise.com> Content-Transfer-Encoding: 7bit From: Steve Atkins Subject: Re: [feedback-report] ARF reporting tools? What works with Exim Date: Sun, 8 Jul 2007 09:45:09 -0700 To: ARF mailing list X-Mailer: Apple Mail (2.752.3) X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: steve@word-to-the-wise.com X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Jul 2007 16:45:11 -0000 On Jul 8, 2007, at 9:28 AM, John Levine wrote: >> OK - now for my question. What tools are out there to generated these >> reports. I'm using Exim. I'd rather not have to figure it out from >> scratch if someone has already done it. > > I think we've all rolled our own. The format is intended to be > trivial > to generate. There's some sample code at http://wordtothewise.com/resources/arf.html It's not something I'd use for long term production use, but it might get you started. Cheers, Steve Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l68GSOEX004965 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Sun, 8 Jul 2007 09:28:25 -0700 Received: (qmail 98089 invoked from network); 8 Jul 2007 16:28:27 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 8 Jul 2007 16:28:27 -0000 Date: 8 Jul 2007 16:28:26 -0000 Message-ID: <20070708162826.8872.qmail@simone.iecc.com> From: John Levine To: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] ARF reporting tools? What works with Exim In-Reply-To: <468FAC81.1070109@perkel.com> Organization: Mime-Version: 1.0 Content-type: text/plain; charset=iso-8859-1 Content-transfer-encoding: 7bit X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: prvs=johnl=070281fee9@iecc.com Cc: X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 08 Jul 2007 16:28:38 -0000 >OK - now for my question. What tools are out there to generated these >reports. I'm using Exim. I'd rather not have to figure it out from >scratch if someone has already done it. I think we've all rolled our own. The format is intended to be trivial to generate. R's, John Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l67F8fSJ024268 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 7 Jul 2007 08:08:41 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I7Btx-0003ho-GQ on interface=127.0.0.1 for abuse-feedback-report@mipassoc.org; Sat, 07 Jul 2007 08:08:49 -0700 Message-ID: <468FAC81.1070109@perkel.com> Date: Sat, 07 Jul 2007 08:08:49 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Subject: [feedback-report] ARF reporting tools? What works with Exim X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Jul 2007 15:08:53 -0000 OK - now for my question. What tools are out there to generated these reports. I'm using Exim. I'd rather not have to figure it out from scratch if someone has already done it. Received: from darwin.ctyme.com (smtp8.junkemailfilter.com [69.50.231.8]) by sb7.songbird.com (8.12.11.20060308/8.12.11) with ESMTP id l67F5xUb023675 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 7 Jul 2007 08:05:59 -0700 Received: from localhost ([127.0.0.1]) by darwin.ctyme.com with esmtp (Exim 4.67) id 1I7BrJ-0007FL-2j on interface=127.0.0.1 for abuse-feedback-report@mipassoc.org; Sat, 07 Jul 2007 08:06:07 -0700 Message-ID: <468FABDC.2030204@perkel.com> Date: Sat, 07 Jul 2007 08:06:04 -0700 From: Marc Perkel User-Agent: Thunderbird 2.0.0.4 (Windows/20070604) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spamfilter-host: darwin.ctyme.com - http://www.junkemailfilter.com X-SongbirdInformation: support@songbird.com for more information X-Songbird: Clean X-Songbird-From: marc@perkel.com Subject: [feedback-report] Hello - I'm new X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 07 Jul 2007 15:06:05 -0000 Hi everyone. I'm Marc Perkel with Junk Email Filter dot com. Just introducing myself. I started doing some automated abuse reporting and a couple of people who were receiving my reports pointed me here. I'm glad to see some kind of standard being formed. I would like to learn how to set it up. Marc Perkel http://www.junkemailfilter.com