Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7NDJDhT024542 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 23 Aug 2009 06:19:19 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 80872 invoked from network); 23 Aug 2009 13:19:10 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 23 Aug 2009 13:19:10 -0000 Date: Sun, 23 Aug 2009 09:19:08 -0400 (EDT) From: "John R. Levine" To: Alessandro Vesely In-Reply-To: <4A910F8A.4090509@tana.it> Message-ID: References: <4A8DB400.4040301@cybernothing.org> <4A8ED7D9.4080707@cybernothing.org> <4A910F8A.4090509@tana.it> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Sun, 23 Aug 2009 06:19:19 -0700 (PDT) Cc: ARF mailing list Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Aug 2009 13:19:20 -0000 > A different, yet related, question is whether anyone sends them. > I guess we all do AV scanning of mail in transit, and possibly > differ on drop vs reject issues. What about sending an ARF > report? Should it contain the actual virus or just the headers? I have been "denaturing" the virus by changing the first bytes of the base64 to xxxxxx and sending the first 50 lines of the message. In retrospect, that hasn't been very successful. Even though the denatured version is not even executable, I still get back way too many rejections from anti-virus software. One Russian DNSBL keeps listing me for sending viruses, and they told me that even though they know I'm not sending viruses, it's still my fault for triggering their AV software's false alarms. Since I have a public archive of all the spam I report, for the benefit of people whose MUAs or ticketing systems smash the copy of the spam in the report, I should change it just to say it was a virus and leave the link to the archive. R's, John Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7NAPAnA007485 for ; Sun, 23 Aug 2009 03:25:15 -0700 Received: from [192.168.15.125] (wf-salyut.imt.ru [212.16.1.106]) (AUTH: CRAM-MD5 ale@tana.it, TLS: TLS1.0, 256bits, RSA_AES_256_CBC_SHA1) by wmail.tana.it with esmtp; Sun, 23 Aug 2009 11:44:47 +0200 id 00000000005DC031.000000004A910F8F.000008E9 Message-ID: <4A910F8A.4090509@tana.it> Date: Sun, 23 Aug 2009 13:44:42 +0400 From: Alessandro Vesely User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: ARF mailing list References: <4A8DB400.4040301@cybernothing.org> <4A8ED7D9.4080707@cybernothing.org> In-Reply-To: <4A8ED7D9.4080707@cybernothing.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Delayed for 00:40:18 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Sun, 23 Aug 2009 03:25:15 -0700 (PDT) Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Aug 2009 10:25:16 -0000 J.D. Falk wrote: > John R. Levine wrote: > >>>> Keep: abuse, dkim, not-spam, other >>>> Drop: fraud, miscategorized, opt-out, virus >>> -1, the "fraud" and "virus" types convey additional information which >>> may not be easily available otherwise. >> Has anyone ever seen an actual ARF report with a fraud or virus tag? I >> haven't. > > Nor have I. I agree that they'd be useful in theory, but if they aren't > used in the real world.... A different, yet related, question is whether anyone sends them. I guess we all do AV scanning of mail in transit, and possibly differ on drop vs reject issues. What about sending an ARF report? Should it contain the actual virus or just the headers? Received: from mail.ijs.si (mail.ijs.si [IPv6:2001:1470:ff80::25]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LNvlaX004225 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 21 Aug 2009 16:57:56 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@ijs.si Received: from localhost (localhost [IPv6:::1]) by mail.ijs.si (Postfix) with ESMTP id 0EA4C1D1F12 for ; Sat, 22 Aug 2009 01:57:47 +0200 (CEST) X-Virus-Scanned: amavisd-new at ijs.si Received: from mail.ijs.si ([127.0.0.1]) by localhost (mail.ijs.si [127.0.0.1]) (amavisd-new, port 10026) with LMTP id ML-lc+FYv3tM for ; Sat, 22 Aug 2009 01:57:43 +0200 (CEST) Received: from edina.ijs.si (unknown [IPv6:2001:1470:ff80:0:2e0:81ff:fe72:51d]) by mail.ijs.si (Postfix) with ESMTP id 292B11D1C51 for ; Sat, 22 Aug 2009 01:57:43 +0200 (CEST) Received: from siesta.ijs.si (clj15-145.dial-up.arnes.si [212.235.133.145]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by edina.ijs.si (Postfix) with ESMTPSA id 15A6122E869 for ; Sat, 22 Aug 2009 01:57:43 +0200 (CEST) From: Mark Martinec To: abuse-feedback-report@mipassoc.org Date: Sat, 22 Aug 2009 01:57:42 +0200 User-Agent: KMail/1.12.0 (FreeBSD/7.2-RELEASE-p3; KDE/4.3.0; i386; ; ) References: <4A8DB400.4040301@cybernothing.org> <4A8F2029.1060209@cybernothing.org> In-Reply-To: Organization: J. Stefan Institute MIME-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <200908220157.42350.Mark.Martinec+ietf@ijs.si> X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [IPv6:2001:470:1:76:0:ffff:4834:7146]); Fri, 21 Aug 2009 16:57:57 -0700 (PDT) Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 23:57:57 -0000 John R. Levine wrote: > I send ARF reports to abuse@yahoo.com and they seem to process them as > well as they process anything else. Perhaps they do now. The last time I experimented with formats sent to abuse@yahoo.com, I always received some generic response claiming that I must provide the full original message, even though the original message was attached (as ARF or as a normal message/rfc822 attachment). Once I switched to including the message in-line (as per their instructions on the web page) as a plain text, their responses became sensible. J.D. Falk wrote: > Could you ask one of these recipients whether they process your fraud > reports differently from other ARF messages? If they ignore the type field, > then perhaps we could do away with it entirely. Since I don't have any closer contacts there, it's hard to get any personal response, let alone any insider information to questions like this. But I can tell that when initially I was sending them both spam and fraud reports (clearly stating one or the other in the first line, followed by essential data like a sending IP address and DKIM signature confirmation), the fraud reports were (and still are) answered reassuringly, explicitly mentioning fraud: In this particular case, we have taken appropriate action against the Yahoo! account in question that was reported for fraudulent activities, as per our Terms of Service (TOS). while in cases of spam reports they may or may not claim "taking appropriate action". Since some months back, I stopped sending them spam reports, while still sticking with genuine fraud reports. Perhaps it's just my imagination, but I do believe that (clearly marked) fraud reports draw more careful attention then generic/spam reports. Mark Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LMeFdW001287 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 21 Aug 2009 15:40:21 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 52957 invoked from network); 21 Aug 2009 22:40:14 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 21 Aug 2009 22:40:14 -0000 Date: Fri, 21 Aug 2009 18:40:14 -0400 (EDT) From: "John R. Levine" To: "J.D. Falk" In-Reply-To: <4A8F2029.1060209@cybernothing.org> Message-ID: References: <4A8DB400.4040301@cybernothing.org> <200908211912.09131.Mark.Martinec+ietf@ijs.si> <4A8F2029.1060209@cybernothing.org> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 21 Aug 2009 15:40:21 -0700 (PDT) Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 22:40:22 -0000 >> Despite the fact that Yahoo! does not accept attachments in complains >> sent to their abuse address > > ARF was never intended to be forced upon unwilling recipient addresses. I send ARF reports to abuse@yahoo.com and they seem to process them as well as they process anything else. R's, John Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LMVKtZ000958 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Fri, 21 Aug 2009 15:31:26 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from rpco-jdmacbook.rpcorp.local (np40.co.returnpath.net [38.109.196.40]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id n7LMVFYJ024900 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 21 Aug 2009 16:31:17 -0600 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net n7LMVFYJ024900 Message-ID: <4A8F2029.1060209@cybernothing.org> Date: Fri, 21 Aug 2009 16:31:05 -0600 From: "J.D. Falk" User-Agent: Postbox 1.0b15 (Macintosh/2009081714) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org References: <4A8DB400.4040301@cybernothing.org> <200908211912.09131.Mark.Martinec+ietf@ijs.si> In-Reply-To: <200908211912.09131.Mark.Martinec+ietf@ijs.si> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 21 Aug 2009 15:31:26 -0700 (PDT) Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 22:31:27 -0000 Mark Martinec wrote: > Despite the fact that Yahoo! does not accept attachments in complains > sent to their abuse address ARF was never intended to be forced upon unwilling recipient addresses. (Yahoo! /does/ have an inbound ARF processing system, but it's separate from abuse@. I don't know what their current access policy is.) > Perhaps it is just my belief, but I think the abuse reports cleary > marked as "fraud" do attract more attention, are more easily recognized > as valid, and as such acted upon. Could you ask one of these recipients whether they process your fraud reports differently from other ARF messages? If they ignore the type field, then perhaps we could do away with it entirely. -- J.D. Falk Return Path Inc http://www.returnpath.net/ Received: from mail.ijs.si (mail.ijs.si [IPv6:2001:1470:ff80::25]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LHnENj025424 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 21 Aug 2009 10:49:21 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@ijs.si Received: from localhost (localhost [IPv6:::1]) by mail.ijs.si (Postfix) with ESMTP id 5815C1D1C2F for ; Fri, 21 Aug 2009 19:12:16 +0200 (CEST) X-Virus-Scanned: amavisd-new at ijs.si Received: from mail.ijs.si ([127.0.0.1]) by localhost (mail.ijs.si [127.0.0.1]) (amavisd-new, port 10026) with LMTP id vKmz2gkZ8cwf for ; Fri, 21 Aug 2009 19:12:12 +0200 (CEST) Received: from edina.ijs.si (unknown [IPv6:2001:1470:ff80:0:2e0:81ff:fe72:51d]) by mail.ijs.si (Postfix) with ESMTP id 8957B1D1E08 for ; Fri, 21 Aug 2009 19:12:12 +0200 (CEST) Received: from neli.ijs.si (neli.ijs.si [193.2.4.95]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by edina.ijs.si (Postfix) with ESMTPSA id 7BFF222EAE2 for ; Fri, 21 Aug 2009 19:12:09 +0200 (CEST) From: Mark Martinec Organization: J. Stefan Institute To: abuse-feedback-report@mipassoc.org Date: Fri, 21 Aug 2009 19:12:09 +0200 User-Agent: KMail/1.9.10 References: <4A8DB400.4040301@cybernothing.org> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200908211912.09131.Mark.Martinec+ietf@ijs.si> X-Greylist: Delayed for 00:36:53 by milter-greylist-4.0 (sbh17.songbird.com [IPv6:2001:470:1:76:0:ffff:4834:7146]); Fri, 21 Aug 2009 10:49:21 -0700 (PDT) Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 17:49:22 -0000 John R. Levine writes: > >> Keep: abuse, dkim, not-spam, other > >> Drop: fraud, miscategorized, opt-out, virus > > > > -1, the "fraud" and "virus" types convey additional information > > which may not be easily available otherwise. > > Has anyone ever seen an actual ARF report with a fraud or virus tag? I > haven't. My reports just say abuse, like everyone else's. If your ARF > parser can't tell whether a reported message contains a virus, you're not > trying. > > My recollection is that the extra types were added at the insistence of > some ESP types who were under the misconception that it would make systems > sending reports from feedback loops do their list management for them. Despite the fact that Yahoo! does not accept attachments in complains sent to their abuse address (and hence ARF can't currently be used (I'm not sure if it is still so)), our site is sending them abuse reports exclusively for "fraud" type of mail, and this is clearly indicated in our reports. I believe these reports are acted upon, as I do receive a steady trickle of confirmations from their operators in response to each of our reports. Perhaps it is just my belief, but I think the abuse reports cleary marked as "fraud" do attract more attention, are more easily recognized as valid, and as such acted upon. Mark Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LHMfPL024494 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Fri, 21 Aug 2009 10:22:46 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from rpco-jdmacbook.rpcorp.local (np40.co.returnpath.net [38.109.196.40]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id n7LHMceM020745 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 21 Aug 2009 11:22:40 -0600 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net n7LHMceM020745 Message-ID: <4A8ED7D9.4080707@cybernothing.org> Date: Fri, 21 Aug 2009 11:22:33 -0600 From: "J.D. Falk" User-Agent: Postbox 1.0b15 (Macintosh/2009081714) MIME-Version: 1.0 To: ARF mailing list References: <4A8DB400.4040301@cybernothing.org> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 21 Aug 2009 10:22:47 -0700 (PDT) Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 17:22:47 -0000 John R. Levine wrote: >>> Keep: abuse, dkim, not-spam, other >>> Drop: fraud, miscategorized, opt-out, virus >> >> -1, the "fraud" and "virus" types convey additional information which >> may not be easily available otherwise. > > Has anyone ever seen an actual ARF report with a fraud or virus tag? I > haven't. Nor have I. I agree that they'd be useful in theory, but if they aren't used in the real world.... Murray S. Kucherawy wrote: > The opendkim filter produces "fraud" reports for messages that fail the > ADSP test. Would one of the dkim types be more appropriate? -- J.D. Falk Return Path Inc http://www.returnpath.net/ Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LGJGaN022124 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Fri, 21 Aug 2009 09:19:21 -0700 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Fri, 21 Aug 2009 09:19:16 -0700 From: "Murray S. Kucherawy" To: "John R. Levine" Date: Fri, 21 Aug 2009 09:19:14 -0700 Thread-Topic: [feedback-report] remove unused feedback types Thread-Index: AcoiduDBR7jvuc31ToauPhpSq6X4/wABCZsA Message-ID: References: <4A8DB400.4040301@cybernothing.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 21 Aug 2009 09:19:21 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id n7LGJGaN022124 Cc: ARF mailing list Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 16:19:21 -0000 > -----Original Message----- > From: John R. Levine [mailto:johnl@iecc.com] > Sent: Friday, August 21, 2009 8:49 AM > To: Murray S. Kucherawy > Cc: Javier Godoy; ARF mailing list > Subject: RE: [feedback-report] remove unused feedback types > > > The opendkim filter produces "fraud" reports for messages that fail > the ADSP test. > > Any idea how popular it is? You'd have to add its stats to that of dkim-milter, which also has had that feature for some time now. Download stats are available via SourceForge. Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LGHnHG022056 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Fri, 21 Aug 2009 09:17:54 -0700 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Fri, 21 Aug 2009 08:47:17 -0700 From: "Murray S. Kucherawy" To: "John R. Levine" , Javier Godoy Date: Fri, 21 Aug 2009 08:47:16 -0700 Thread-Topic: [feedback-report] remove unused feedback types Thread-Index: AcoiIHDVx1NCvh/GTOqjaz3Wws29ZAAViX2g Message-ID: References: <4A8DB400.4040301@cybernothing.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Greylist: Delayed for 00:30:32 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 21 Aug 2009 09:17:54 -0700 (PDT) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id n7LGHnHG022056 Cc: ARF mailing list Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 16:17:54 -0000 > -----Original Message----- > From: abuse-feedback-report-bounces@mipassoc.org [mailto:abuse- > feedback-report-bounces@mipassoc.org] On Behalf Of John R. Levine > Sent: Thursday, August 20, 2009 9:28 PM > To: Javier Godoy > Cc: ARF mailing list > Subject: Re: [feedback-report] remove unused feedback types > > >> Keep: abuse, dkim, not-spam, other > >> Drop: fraud, miscategorized, opt-out, virus > > > > -1, the "fraud" and "virus" types convey additional information which > may not > > be easily available otherwise. > > Has anyone ever seen an actual ARF report with a fraud or virus tag? I > haven't. My reports just say abuse, like everyone else's. If your ARF > parser can't tell whether a reported message contains a virus, you're > not > trying. The opendkim filter produces "fraud" reports for messages that fail the ADSP test. Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7LFmnAx020614 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 21 Aug 2009 08:48:55 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 64727 invoked from network); 21 Aug 2009 15:48:48 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 21 Aug 2009 15:48:48 -0000 Date: Fri, 21 Aug 2009 11:48:48 -0400 (EDT) From: "John R. Levine" To: "Murray S. Kucherawy" In-Reply-To: Message-ID: References: <4A8DB400.4040301@cybernothing.org> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 21 Aug 2009 08:48:55 -0700 (PDT) Cc: ARF mailing list Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 15:48:55 -0000 > The opendkim filter produces "fraud" reports for messages that fail the ADSP test. Any idea how popular it is? Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener schnitzel, please", said Tom, revealingly. Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7L5SUkx022479 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 20 Aug 2009 22:28:36 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 67921 invoked from network); 21 Aug 2009 04:28:30 -0000 Received: from mail1.iecc.com (208.31.42.56) by mail1.iecc.com with QMQP; 21 Aug 2009 04:28:30 -0000 Date: Fri, 21 Aug 2009 00:28:29 -0400 (EDT) From: "John R. Levine" To: Javier Godoy In-Reply-To: Message-ID: References: <4A8DB400.4040301@cybernothing.org> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Delayed for 00:59:56 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 20 Aug 2009 22:28:36 -0700 (PDT) Cc: ARF mailing list Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 05:28:39 -0000 >> Keep: abuse, dkim, not-spam, other >> Drop: fraud, miscategorized, opt-out, virus > > -1, the "fraud" and "virus" types convey additional information which may not > be easily available otherwise. Has anyone ever seen an actual ARF report with a fraud or virus tag? I haven't. My reports just say abuse, like everyone else's. If your ARF parser can't tell whether a reported message contains a virus, you're not trying. My recollection is that the extra types were added at the insistence of some ESP types who were under the misconception that it would make systems sending reports from feedback loops do their list management for them. R's, John Received: from fich.unl.edu.ar (fich.unl.edu.ar [168.96.132.90]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7L3UUqO015161 for ; Thu, 20 Aug 2009 20:30:35 -0700 X-Spam-Status: No, hits=2.6 required=4.7 tests=AWL: 0.301,BAYES_00: -1.665,FORGED_MUA_OUTLOOK: 4.056, TOTAL_SCORE: 2.692 X-Spam-Level: ** Received: from Javier2 ([201.231.15.116]) (authenticated user rjgodoy@fich.unl.edu.ar) by fich.unl.edu.ar (using TLSv1/SSLv3 with cipher RC4-MD5 (128 bits)); Fri, 21 Aug 2009 00:00:12 -0300 Message-ID: From: "Javier Godoy" To: "J.D. Falk" , References: <4A8DB400.4040301@cybernothing.org> Date: Thu, 20 Aug 2009 23:37:38 -0300 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5512 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512 X-Greylist: Delayed for 00:30:06 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 20 Aug 2009 20:30:36 -0700 (PDT) Subject: Re: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2009 03:30:36 -0000 > It's a pretty safe bet that Return Path is among the top three generators of > ARF messages (counting by message), and we only use the 'abuse' type -- yet > I still see confusion about the others. This leads to interoperability > issues, such as when a feedback consumer assumes that they'll only have to > care about "opt-out" while pretty much all of the feedback providers in the > world only provide "abuse". > > So, to kick off the first argument as we move into the possible creation of > a formal IETF WG, I propose that we: > > Keep: abuse, dkim, not-spam, other > Drop: fraud, miscategorized, opt-out, virus -1, the "fraud" and "virus" types convey additional information which may not be easily available otherwise. fraud: the end user has read the message and found it was a kind of fraud, instead of plain UCE. This kind of abuses might be treated differently when reported. virus: a system could detect that an attachment contains a virus, and remove it. Later, the same system or another, could report this fact. . Regards Javier ----- Original Message ----- From: "J.D. Falk" To: Sent: Thursday, August 20, 2009 5:37 PM Subject: [feedback-report] remove unused feedback types Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id n7KL9PLi028700 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Thu, 20 Aug 2009 14:09:31 -0700 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from rpco-jdmacbook.rpcorp.local (np40.co.returnpath.net [38.109.196.40]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id n7KKbViY001843 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 20 Aug 2009 14:37:33 -0600 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net n7KKbViY001843 Message-ID: <4A8DB400.4040301@cybernothing.org> Date: Thu, 20 Aug 2009 14:37:20 -0600 From: "J.D. Falk" User-Agent: Postbox 1.0b15 (Macintosh/2009081714) MIME-Version: 1.0 To: abuse-feedback-report@mipassoc.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Delayed for 00:31:49 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 20 Aug 2009 14:09:31 -0700 (PDT) Subject: [feedback-report] remove unused feedback types X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2009 21:09:31 -0000 It's a pretty safe bet that Return Path is among the top three generators of ARF messages (counting by message), and we only use the 'abuse' type -- yet I still see confusion about the others. This leads to interoperability issues, such as when a feedback consumer assumes that they'll only have to care about "opt-out" while pretty much all of the feedback providers in the world only provide "abuse". So, to kick off the first argument as we move into the possible creation of a formal IETF WG, I propose that we: Keep: abuse, dkim, not-spam, other Drop: fraud, miscategorized, opt-out, virus And keep the registry, so that new types may be added in the future if a demonstrable need arises. What say you? -- J.D. Falk Return Path Inc http://www.returnpath.net/