Received: from sasl.smtp.pobox.com (b-pb-sasl-quonix.pobox.com [208.72.237.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBVIhVEO023257 for ; Thu, 31 Dec 2009 10:43:37 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@pobox.com Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by b-sasl-quonix.pobox.com (Postfix) with ESMTP id DE2627FBC3 for ; Thu, 31 Dec 2009 13:08:33 -0500 (EST) Received: from b-pb-sasl-quonix. (unknown [127.0.0.1]) by b-sasl-quonix.pobox.com (Postfix) with ESMTP id DAD8A7FBC2 for ; Thu, 31 Dec 2009 13:08:33 -0500 (EST) Received: from cancer.codesimply.com (unknown [70.87.222.20]) by b-sasl-quonix.pobox.com (Postfix) with ESMTPA id A3A717FBC0 for ; Thu, 31 Dec 2009 13:08:33 -0500 (EST) Received: by cancer.codesimply.com (Postfix, from userid 1000) id 33163219A01; Thu, 31 Dec 2009 13:08:32 -0500 (EST) Date: Thu, 31 Dec 2009 13:08:32 -0500 From: Ricardo Signes To: abuse-feedback-report@mipassoc.org Message-ID: <20091231180832.GA17575@cancer.codesimply.com> References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <20091231142119.GA31990@cancer.codesimply.com> <4B3CBED9.6080002@abusix.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) X-Pobox-Relay-ID: 825BB78E-F637-11DE-8146-2B0D0635E987-07314517!b-pb-sasl-quonix.pobox.com X-Virus-Scanned: ClamAV 0.92/10244/Wed Dec 30 23:34:26 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:34:57 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 31 Dec 2009 10:43:37 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2009 18:43:38 -0000 * "John R. Levine" [2009-12-31T11:57:42] > > Adding it and making it not mandatory makes no sense for me. > > Right. Since there's no way to force ARF senders to do anything, this > means that in practice it would be useless. I think "useless" is an overstatement... maybe. After all, I guess I already said I'd have no use for it. This seems like a place where the real solution is education: people need to learn how to track their deliveries properly, and by a plain addr-spec in the headers isn't that. -- rjbs Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBVGvjT7016526 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 31 Dec 2009 08:57:51 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 48693 invoked from network); 31 Dec 2009 16:57:44 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 31 Dec 2009 16:57:22 -0000 Date: 31 Dec 2009 11:57:42 -0500 Message-ID: From: "John R. Levine" To: "Tobias Knecht" In-Reply-To: <4B3CBED9.6080002@abusix.org> References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <20091231142119.GA31990@cancer.codesimply.com> <4B3CBED9.6080002@abusix.org> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10244/Wed Dec 30 23:34:26 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 31 Dec 2009 08:57:51 -0800 (PST) Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2009 16:57:52 -0000 > Adding it and making it not mandatory makes no sense for me. Right. Since there's no way to force ARF senders to do anything, this means that in practice it would be useless. Let's leave it in reserve in case we need a bone to throw to the never-redact or always-redact crowd. R's from snowbound Vermont, John Received: from wp204.webpack.hosteurope.de (wp204.webpack.hosteurope.de [80.237.132.211]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBVFAMg6010273 for ; Thu, 31 Dec 2009 07:10:28 -0800 Received: from p5b337130.dip.t-dialin.net ([91.51.113.48] helo=[192.168.1.100]); authenticated by wp204.webpack.hosteurope.de running ExIM with esmtpa id 1NQMfO-0004al-13; Thu, 31 Dec 2009 16:10:22 +0100 Message-ID: <4B3CBED9.6080002@abusix.org> Date: Thu, 31 Dec 2009 16:10:17 +0100 From: Tobias Knecht Organization: abusix UG =?ISO-8859-1?Q?=28haftungsbeschr=E4nkt=29?= User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 CC: abuse-feedback-report@mipassoc.org References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <20091231142119.GA31990@cancer.codesimply.com> In-Reply-To: <20091231142119.GA31990@cancer.codesimply.com> X-Enigmail-Version: 0.96.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig444EE5012B8F0704F1073BED" X-bounce-key: webpack.hosteurope.de;knut@abusix.org;1262272228;42f0148c; X-Virus-Scanned: ClamAV 0.92/10244/Wed Dec 30 23:34:26 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 31 Dec 2009 07:10:28 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2009 15:10:28 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig444EE5012B8F0704F1073BED Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Ricardo Signes schrieb: > * "Murray S. Kucherawy" [2009-12-30T01:52:06] >>> I did not mean to imply that the X.400 header should be used, rather >>> it is an example. The question is whether it is worthwhile to defined= >>> a header for part 2 of the ARF reports like this: >>> >>> Content-Redacted: Yes >> I think it is. And we don't need to register it because it exists in = a >> format we're defining ourselves, not in the message header proper. >> >> Anyone object, or shall I add this and adjust various wording accordin= gly? >=20 > I think it would be nice to know, although I would be hard pressed to f= eel I > could trust it. I'm not sure how I could use it, either, given the low= level > of trust. If the assumed value is "Yes" and the real value-added versi= on is > "No" added only when it is really promised, then maybe it would be usef= ul for > checking DKIM or other secure data. Adding it and making it not mandatory makes no sense for me. Because you have no continous information. Everybody could do whatever he wants to. And everybody would have to describe what he is redacting. Perhaps somebody is redacting internal header fields that have nothing to do with the mail it self and tells you he is redacting information. Sounds stupd but I'm sure if somebody implementing such a system just with a view on the draft (later rfc) he will do things that way. > Using secure X-headers and other features of the message that have been= > reliably untouched in the past has been much more successful than I thi= nk we > would have been, even had we known the message was pristene. Full ACK. We have this in place at several ISPs in Europe and it works like a charm. > So: yeah, let's include it as a valid, but not mandate it as must-inclu= de, > since it will be hard to know. If nothing else, it can put an end to q= uestions > about whether it exists. See above. Tobias p.s.: Happy New Year. ;-) --------------enig444EE5012B8F0704F1073BED Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAks8vt0ACgkQvB4M5yQyqDfq+wCgzioxDB7WcP/0GhxkMcgLfR53 nNgAoMAcKdMbm5YcdinRV5DDxCsrlY2D =2w0q -----END PGP SIGNATURE----- --------------enig444EE5012B8F0704F1073BED-- Received: from sasl.smtp.pobox.com (b-pb-sasl-sd.pobox.com [64.74.157.63]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBVEwZOK009526 for ; Thu, 31 Dec 2009 06:58:41 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@pobox.com Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by b-pb-sasl-sd.pobox.com (Postfix) with ESMTP id 28EAF9C0F1 for ; Thu, 31 Dec 2009 09:21:22 -0500 (EST) Received: from b-pb-sasl-sd.pobox.com (unknown [127.0.0.1]) by b-pb-sasl-sd.pobox.com (Postfix) with ESMTP id 1F6C49C0F0 for ; Thu, 31 Dec 2009 09:21:22 -0500 (EST) Received: from cancer.codesimply.com (unknown [70.87.222.20]) by b-pb-sasl-sd.pobox.com (Postfix) with ESMTPA id DC28A9C0EF for ; Thu, 31 Dec 2009 09:21:21 -0500 (EST) Received: by cancer.codesimply.com (Postfix, from userid 1000) id 1C2B8219A01; Thu, 31 Dec 2009 09:21:20 -0500 (EST) Date: Thu, 31 Dec 2009 09:21:19 -0500 From: Ricardo Signes To: abuse-feedback-report@mipassoc.org Message-ID: <20091231142119.GA31990@cancer.codesimply.com> References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Message-Flag: Warning: Your computer is current broadcasting an IP address. X-Planet: Planet of the Apes User-Agent: Mutt/1.5.20 (2009-06-14) X-Pobox-Relay-ID: C52F9910-F617-11DE-86CC-DDB8A4293987-07314517!b-pb-sasl-sd.pobox.com X-Virus-Scanned: ClamAV 0.92/10244/Wed Dec 30 23:34:26 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:37:13 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 31 Dec 2009 06:58:41 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2009 14:58:42 -0000 * "Murray S. Kucherawy" [2009-12-30T01:52:06] > > I did not mean to imply that the X.400 header should be used, rather > > it is an example. The question is whether it is worthwhile to defined > > a header for part 2 of the ARF reports like this: > > > > Content-Redacted: Yes > > I think it is. And we don't need to register it because it exists in a > format we're defining ourselves, not in the message header proper. > > Anyone object, or shall I add this and adjust various wording accordingly? I think it would be nice to know, although I would be hard pressed to feel I could trust it. I'm not sure how I could use it, either, given the low level of trust. If the assumed value is "Yes" and the real value-added version is "No" added only when it is really promised, then maybe it would be useful for checking DKIM or other secure data. Using secure X-headers and other features of the message that have been reliably untouched in the past has been much more successful than I think we would have been, even had we known the message was pristene. So: yeah, let's include it as a valid, but not mandate it as must-include, since it will be hard to know. If nothing else, it can put an end to questions about whether it exists. -- rjbs Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBUJiXI4023929 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Wed, 30 Dec 2009 11:44:39 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from [192.168.0.5] (97-122-140-128.hlrn.qwest.net [97.122.140.128]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id nBUJiOrI002697 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Wed, 30 Dec 2009 12:44:28 -0700 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net nBUJiOrI002697 References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> In-Reply-To: Mime-Version: 1.0 (Apple Message framework v1077) Content-Type: text/plain; charset=us-ascii Message-Id: <4C5B79C2-3911-406D-B532-AE24028D868D@cybernothing.org> From: "J.D. Falk" Date: Wed, 30 Dec 2009 12:44:18 -0700 To: ARF mailing list X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10241/Wed Dec 30 09:12:06 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Wed, 30 Dec 2009 11:44:39 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBUJiXI4023929 Subject: [feedback-report] redaction (was Re: Let's get started) X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 19:44:39 -0000 On Dec 30, 2009, at 12:02 AM, John R. Levine wrote: >>> Content-Redacted: Yes >> >> I think it is. And we don't need to register it because it exists in a format we're defining ourselves, not in the message header proper. >> >> Anyone object, or shall I add this and adjust various wording accordingly? > > I don't have any theological objections, but it might be interesting to > ask RR, AOL, and other ARF senders who redact whether they'd be likely to > add it. Of the FBLs we run (including RR), some partners redact messages before sending 'em to us and others require that we redact before generating the outgoing ARF report. It's up to them. I think we'd take a similar approach with this Content-Redacted line: if they redact and are okay with us including the line, we will (and that's what we'll recommend.) But if they say no for some reason, we won't. I'd propose that ARF generators who intentionally redact any content from the original message SHOULD include "Content-Redacted: Yes", and MUST NOT say "Content-Redacted: No" -- but the Content-Redacted is optional whether they redact or not. As for whether to indicate that content was redacted at all...it's almost entirely a political-layer issue: 1. some ARF generators redact content from the original message before generating ARF, usually citing legal/privacy concerns 2. many ARF recipients don't think that's fair 3. years of arguing has not changed the practice Thinking about automated processing when receiving ARF reports...if the report were known to be missing some content, I might not attempt a DKIM check or other hashing on the message part. Other than that...not sure it matters. Truly, I think the primary reason to include this is so that people stop asking us to include it. And I know that's not a good enough reason. -- J.D. Falk Return Path Inc Received: from wp204.webpack.hosteurope.de (wp204.webpack.hosteurope.de [80.237.132.211]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBUFDgS9005984 for ; Wed, 30 Dec 2009 07:13:48 -0800 Received: from p5b337d2b.dip.t-dialin.net ([91.51.125.43] helo=[192.168.1.100]); authenticated by wp204.webpack.hosteurope.de running ExIM with esmtpa id 1NQ0F3-0003tY-Lb; Wed, 30 Dec 2009 16:13:41 +0100 Message-ID: <4B3B6E22.100@abusix.org> Date: Wed, 30 Dec 2009 16:13:38 +0100 From: Tobias Knecht Organization: abusix UG =?ISO-8859-1?Q?=28haftungsbeschr=E4nkt=29?= User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 CC: ARF mailing list References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> <501c18e00912300646r64a0499cpb805cbf583b006a2@mail.gmail.com> In-Reply-To: X-Enigmail-Version: 0.96.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enigEBF470864127951C13DF43E6" X-bounce-key: webpack.hosteurope.de;knut@abusix.org;1262186028;45296fe0; X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Wed, 30 Dec 2009 07:13:48 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 15:13:48 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigEBF470864127951C13DF43E6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable John R. Levine schrieb: >> That is exactly what my reasoning was as well. This flag is not useful= >> for automation but is very useful for troubleshooting and manual >> review. Knowing that the message was redacted helps a lot when looking= >> at problems. >=20 > All the redacted messages I get say "redacted" or something equally=20 > obvious in the places where they've removed user info. Has anyone seen= an=20 > ARF report where it was hard to tell what had been removed? I fully agree with John here. (rare but it happens sometimes ;-) Using the email address for customer allocation or finding the right address to delete from a maillinglist is imho not the best way. Allocation can be done automatically via message-id and logs, which indeed is a pain or by adding an encrypted x-header that contains all relevant data. So I think an additional redacted header is not necessary. Tobias --------------enigEBF470864127951C13DF43E6 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAks7biUACgkQvB4M5yQyqDf/bACcDx+sg3OOwkA3JVFFD/F6L0XB WfgAmwfvkN++DpkIzx8Q5OfKjuK2d1HG =lFPN -----END PGP SIGNATURE----- --------------enigEBF470864127951C13DF43E6-- Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBUF4oYk005511 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 30 Dec 2009 07:04:56 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 9193 invoked from network); 30 Dec 2009 15:04:49 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 30 Dec 2009 15:04:27 -0000 Date: 30 Dec 2009 10:04:48 -0500 Message-ID: From: "John R. Levine" To: "Yakov Shafranovich" In-Reply-To: <501c18e00912300646r64a0499cpb805cbf583b006a2@mail.gmail.com> References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> <501c18e00912300646r64a0499cpb805cbf583b006a2@mail.gmail.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Wed, 30 Dec 2009 07:04:56 -0800 (PST) Cc: ARF mailing list Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 15:04:56 -0000 > That is exactly what my reasoning was as well. This flag is not useful > for automation but is very useful for troubleshooting and manual > review. Knowing that the message was redacted helps a lot when looking > at problems. All the redacted messages I get say "redacted" or something equally obvious in the places where they've removed user info. Has anyone seen an ARF report where it was hard to tell what had been removed? R's, John Received: from ey-out-2122.google.com (ey-out-2122.google.com [74.125.78.26]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBUEkkf9004191 for ; Wed, 30 Dec 2009 06:46:52 -0800 Received: by ey-out-2122.google.com with SMTP id 22so1451551eye.33 for ; Wed, 30 Dec 2009 06:46:45 -0800 (PST) MIME-Version: 1.0 Received: by 10.216.85.132 with SMTP id u4mr3053826wee.191.1262184405615; Wed, 30 Dec 2009 06:46:45 -0800 (PST) In-Reply-To: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> From: Yakov Shafranovich Date: Wed, 30 Dec 2009 09:46:25 -0500 Message-ID: <501c18e00912300646r64a0499cpb805cbf583b006a2@mail.gmail.com> To: Steve Atkins Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Wed, 30 Dec 2009 06:46:52 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBUEkkf9004191 Cc: ARF mailing list Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 14:46:52 -0000 On Wed, Dec 30, 2009 at 9:28 AM, Steve Atkins wrote: > > On Dec 30, 2009, at 2:34 AM, Murray S. Kucherawy wrote: > >>> -----Original Message----- >>> From: Dave CROCKER [mailto:dhc@dcrocker.net] >>> Sent: Tuesday, December 29, 2009 11:25 PM >>> To: Murray S. Kucherawy >>> Cc: Yakov Shafranovich; SM; abuse-feedback-report@mipassoc.org >>> Subject: Re: [feedback-report] Let's get started >>> >>> None of this sounds dangerous, but I'm not quite understanding what a >>> single >>> flag or even a list of header fields is useful for, in practical terms. >>> >>> I could understand having an inline convention for flagging a sequence >>> of bytes >>> as having been redacted.  That tells the receiving processor exactly >>> where text >>> is "missing". > > +1. But not because it'd be useful for automation, rather because it might help avoid the discussions with end users that "redacted@aol.com isn't on my mailing list!". > That is exactly what my reasoning was as well. This flag is not useful for automation but is very useful for troubleshooting and manual review. Knowing that the message was redacted helps a lot when looking at problems. Yakov Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBUESrAt002940 for ; Wed, 30 Dec 2009 06:28:59 -0800 Received: from [10.0.2.2] (pool-71-178-108-139.washdc.east.verizon.net [71.178.108.139]) by m.wordtothewise.com (Postfix) with ESMTP id 07C3F80F30 for ; Wed, 30 Dec 2009 06:28:52 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1077) From: Steve Atkins In-Reply-To: Date: Wed, 30 Dec 2009 09:28:51 -0500 Message-Id: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> To: ARF mailing list X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Wed, 30 Dec 2009 06:28:59 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBUESrAt002940 Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 14:28:59 -0000 On Dec 30, 2009, at 2:34 AM, Murray S. Kucherawy wrote: >> -----Original Message----- >> From: Dave CROCKER [mailto:dhc@dcrocker.net] >> Sent: Tuesday, December 29, 2009 11:25 PM >> To: Murray S. Kucherawy >> Cc: Yakov Shafranovich; SM; abuse-feedback-report@mipassoc.org >> Subject: Re: [feedback-report] Let's get started >> >> None of this sounds dangerous, but I'm not quite understanding what a >> single >> flag or even a list of header fields is useful for, in practical terms. >> >> I could understand having an inline convention for flagging a sequence >> of bytes >> as having been redacted. That tells the receiving processor exactly >> where text >> is "missing". +1. But not because it'd be useful for automation, rather because it might help avoid the discussions with end users that "redacted@aol.com isn't on my mailing list!". >> >> But some sort of "I played with the text" high-level indicator does not >> seem all >> that procedurally useful. >> >> Enlighten me? > > I think my vision is two possible streams within the ADMD receiving the ARF message: one that handles unredacted content (maximum automation) and one that takes messages that admit to redacted content and routes them elsewhere for manual processing. As someone who codes this stuff... nobody who is going to be using that level of automation is going to be relying on the email address of the recipient as recorded in the To: field at all. The cases where FBLs are both useful and conducive to full automation are: 1. Competent bulk mailers (ESPs, commercial mailers, discussion list managers). Here the email address in the To: field, even if it were unredacted, is not sufficient to key the automation on. Instead you want to be able to identify the original recipient, the sender, the source of the email address and the specific mailing. That can be done easily from embedded cookies in the document (VERP, unsubscription links or cookies added explicitly for this purpose). (As a specific example of why the To: field not only isn't needed, but isn't that useful anyway: Many people sign up to mailing lists with email addresses at their vanity, small business or professional domains, but actually read their mail at a consumer ISP. Bob.Evangelist@acm.org subscribes to the list, but all his mail is forwarded to bobhacker42@aol.com. When you get an scomp report from AOL, knowing that the recipient in the To: field is "bobhacker42@aol.com" is completely useless, what you need is the original recipient @acm.org. That information is what you'll extract from the opaque cookie embedded in the message.) 2. Bandwidth providers and consumer ISPs. Here the email address of the recipient is not interesting to key automation on. Instead the automation will be keyed on some aspect of the sender. That's likely to be the originating IP address in some cases, but may well be a magic cookie added by the ISP smarthost in others. I've got Abacus-based code deployed that's handling FBLs in large volumes at both ESPs and ISPs, and the automation handles redacted and non-redacted reports in exactly the same way, not looking at the To: field in either case. There are certainly cases where being able to see the recipients email address in the To: field is useful and redaction is annoying (the typical example is when an ISP receives a FBL about one of their customers who is running a mailing list with some piece of software that doesn't embed cookies, and the customer can't unsub the recipient as they can't identify it) - but they're all individual cases being handled manually after automation has already done it's job. By that point, a flag saying "we've redacted the email address" doesn't really do much of any value. (On an obliquely related note, I do think that including a URL to a webpage that explains everything the consumer of the ARF report needs to know about it would be useful. That page could include explanation of under what conditions they send reports, what, if anything, they redact in the message - and why - and any other associated discussion that might be useful to a human consumer of the report). Cheers, Steve Received: from sss.sindikat.rs (mail.sindikat.rs [82.117.196.254] (may be forged)) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU8A1Xs010479 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 30 Dec 2009 00:10:08 -0800 Received: from moki ([192.168.200.12]) by sss.sindikat.rs (8.14.1/8.14.1) with SMTP id nBU7XDAe008620 for ; Wed, 30 Dec 2009 08:33:13 +0100 Message-ID: <003801ca8922$1054d990$0cc8a8c0@moki> From: "moki" To: Date: Wed, 30 Dec 2009 08:31:12 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0035_01CA892A.71FF02D0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3598 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Scanned: clamav-milter 0.95.1 at sss X-Virus-Status: Clean X-Greylist: Delayed for 00:36:47 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Wed, 30 Dec 2009 00:10:10 -0800 (PST) Subject: [feedback-report] (no subject) X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 08:10:10 -0000 This is a multi-part message in MIME format. ------=_NextPart_000_0035_01CA892A.71FF02D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable >From victim@smtp.example Tue Dec 22 04:11:50 2009=20 Delivery-date: Tue, 22 Dec 2009 04:11:50 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NN0mU-0006QY-5K=20 for victim@smtp.example; Tue, 22 Dec 2009 04:11:50 -0500=20 From: VIAGRA (c) Best Online Store =20 To: victim@smtp.example=20 Subject: User colleen_2434 special 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20
=20 =20 If you are unable to see the message below, click here to view.=20

=20 3D"Please=20

=20
=20 =20 =20 Terms and Conditions of Use  | =20 =20 Privacy Policy  | =20 =20 Unsubscribe
=20
© 2009 Uygogamuil Corporation. All rights reserved.=20
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Tue Dec 22 04:11:50 2009=20 Delivery-date: Tue, 22 Dec 2009 04:11:50 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NN0mU-0006Qa-5E=20 for victim@smtp.example; Tue, 22 Dec 2009 04:11:50 -0500=20 From: VIAGRA (c) Best Online Store =20 To: victim@smtp.example=20 Subject: User colleen special 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20
=20 =20 If you are unable to see the message below, click = here to view.=20

=20 3D"Please=20

=20
=20 =20 =20 Terms and Conditions of Use  | =20 =20 Privacy Policy  | =20 =20 Unsubscribe
=20
© 2009 Oxuymi Corporation. All rights reserved.=20
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Tue Dec 22 06:07:53 2009=20 Delivery-date: Tue, 22 Dec 2009 06:07:53 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NN2an-0001jY-Aq=20 for victim@smtp.example; Tue, 22 Dec 2009 06:07:53 -0500=20 From: VIAGRA (c) Best Online Store =20 To: victim@smtp.example=20 Subject: User anecdotalist.v special 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20
=20 =20 If you are unable to see the message below, click here to = view.=20

=20 3D"Please=20

=20
=20 =20 =20 Terms and Conditions of Use  | =20 =20 Privacy Policy  | =20 =20 Unsubscribe
=20
© 2009 Igipiat Corporation. All rights reserved.=20
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Wed Dec 23 01:16:58 2009=20 Delivery-date: Wed, 23 Dec 2009 01:16:58 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NNKWo-00074I-4O=20 for victim@smtp.example; Wed, 23 Dec 2009 01:16:58 -0500=20 From: VIAGRA (c) Best Online Store =20 To: victim@smtp.example=20 Subject: User grazyna_176 special 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20
=20 =20 If you are unable to see the message below, click here to = view.=20

=20 3D"Please=20

=20
=20 =20 =20 Terms and Conditions of Use  | =20 =20 Privacy Policy  | =20 =20 Unsubscribe
=20
© 2009 Rexiqizak Corporation. All rights reserved.=20
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Thu Dec 24 03:01:08 2009=20 Delivery-date: Thu, 24 Dec 2009 03:01:08 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NNidA-0003k2-Hs=20 for victim@smtp.example; Thu, 24 Dec 2009 03:01:08 -0500=20 From: Generic VIAGRA (c) Best Supplier =20 To: victim@smtp.example=20 Subject: Visitor reviewability.m's personal 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 NEWSLETTER=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20

=20 If you have any difficulty seeing the contents of this=20 e-mail, please click =20 here.

=20
=20 =20 =20 =20 =20 =20 =20
=20
=20 3D"Click=20 =20
=20
=20
=20 Copyright =A9 2009 Teefesoe Inc.
=20 =20 Privacy Policy | =20 Terms of Use | =20 Contact Us |=20 =20 Unsubscribe
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Mon Dec 28 05:13:07 2009=20 Delivery-date: Mon, 28 Dec 2009 05:13:07 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NPCb4-0007jb-WD=20 for victim@smtp.example; Mon, 28 Dec 2009 05:13:07 -0500=20 From: VIAGRA (c) Best Supplier =20 To: victim@smtp.example=20 Subject: Visitor jessenia's personal 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20

=20 If you have any difficulty seeing the contents of this=20 e-mail, please click =20 here.

=20
=20 =20 =20 =20 =20 =20 =20
=20
=20 3D"This=20 =20
=20
=20
=20 Copyright =A9 2009 Faekoc Inc.
=20 =20 Privacy Policy | =20 Terms of Use | =20 Contact Us |=20 =20 Unsubscribe
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Tue Dec 29 06:18:13 2009=20 Delivery-date: Tue, 29 Dec 2009 06:18:13 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NPa5d-0005Zc-8v=20 for victim@smtp.example; Tue, 29 Dec 2009 06:18:13 -0500=20 From: VIAGRA (c) Best Supplier =20 To: victim@smtp.example=20 Subject: Visitor helm's personal 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20

=20 If you have any difficulty seeing the contents of this=20 e-mail, please click =20 here.

=20
=20 =20 =20 =20 =20 =20 =20
=20
=20 3D"This=20 =20
=20
=20
=20 Copyright =A9 2009 Iduut Inc.
=20 =20 Privacy Policy | =20 Terms of Use | =20 Contact Us |=20 =20 Unsubscribe
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Tue Dec 29 08:17:28 2009=20 Delivery-date: Tue, 29 Dec 2009 08:17:28 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NPbx1-0002dk-Rk=20 for victim@smtp.example; Tue, 29 Dec 2009 08:17:28 -0500=20 From: VIAGRA (c) Best Supplier =20 To: victim@smtp.example=20 Subject: Visitor headset's personal 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20

=20 If you have any difficulty seeing the contents of this=20 e-mail, please click =20 here.

=20
=20 =20 =20 =20 =20 =20 =20
=20
=20 3D"This=20 =20
=20
=20
=20 Copyright =A9 2009 Ygizufewifof Inc.
=20 =20 Privacy Policy | =20 Terms of Use | =20 Contact Us |=20 =20 Unsubscribe
=20 =20 =20 -------------------------------------------------------------------------= ------- >From victim@smtp.example Wed Dec 30 01:22:00 2009=20 Delivery-date: Wed, 30 Dec 2009 01:22:00 -0500=20 Received: from [82.117.196.254]=20 by mail.victim.example with esmtps (TLSv1:RC4-MD5:128)=20 (Exim 4.63)=20 (envelope-from )=20 id 1NPrwW-0000bT-9r=20 for victim@smtp.example; Wed, 30 Dec 2009 01:22:00 -0500=20 From: VIAGRA (c) Best Supplier =20 To: victim@smtp.example=20 Subject: Visitor grady's personal 80% OFF=20 MIME-Version: 1.0=20 =20 =20 =20 Newsletter=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20

=20 If you have any difficulty seeing the contents of this=20 e-mail, please click =20 here.

=20
=20 =20 =20 =20 =20 =20 =20
=20
=20 3D"This=20 =20
=20
=20
=20 Copyright =A9 2009 Icudiygoud Inc.
=20 =20 Privacy Policy | =20 Terms of Use | =20 Contact Us |=20 =20 Unsubscribe
=20 =20 =20 ------=_NextPart_000_0035_01CA892A.71FF02D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable


From victim@smtp.example Tue Dec 22 04:= 11:50 2009=20
Delivery-date: Tue, 22 Dec 2009 04:11:50&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NN0mU-0006QY-5K=20
for victim@smtp.example; Tue, 22 Dec 2009&nb= sp;04:11:50 -0500=20
From: VIAGRA (c) Best Online Store <= victim@smtp.example>=20
To: victim@smtp.example=20
Subject: User colleen_2434 special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN" "http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html;&= nbsp;charset=3DUTF-8">=20
<title>Newsletter</title>
</head> =
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing= =3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; fo= nt-size:10px">=20
If you are unable to see the messa= ge below, <a href=3D"http://215428d1fbdcf8f.fezifisat.c= n style=3D"text-decoration:none">click here to vie= w</a>.</span>=20
<br><br><a href=3D"http://011f07472c71.fezifisat.= cn target=3D"_blank">=20
<img alt=3D"Please enable image or click&= nbsp;here" src=3D"http://img706.imageshack.us height=3D"458"&nb= sp;width=3D"662" style=3D"border:0px">=20
</a><br><br>
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; fo= nt-size:10px;">=20
<a href=3D"http://c8a355c7.fezifisat.cn target=3D"_blank= " style=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp;&n= bsp;|&nbsp;=20
<a href=3D"http://179f20.fezifisat.cn target=3D"_blank"&= nbsp;style=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://ef0888d3a669d.fezifisat.cn target=3D"_= blank"  style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Uygogamuil Corporation. = ;All rights reserved.</span>=20
</td></tr>
</table>
</body>=20
</html>



From victim@smtp.example Tue Dec 22 04:= 11:50 2009=20
Delivery-date: Tue, 22 Dec 2009 04:11:50&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NN0mU-0006Qa-5E=20
for victim@smtp.example; Tue, 22 Dec 2009&nb= sp;04:11:50 -0500=20
From: VIAGRA (c) Best Online Store <= victim@smtp.example>=20
To: victim@smtp.example=20
Subject: User colleen special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN" "http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html;&= nbsp;charset=3DUTF-8">=20
<title>Newsletter</title>
</head> =
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing= =3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; fo= nt-size:10px">=20
If you are unable to see the messa= ge below, <a href=3D"http://20d858.fezifisat.cn st= yle=3D"text-decoration:none">click here to view</a&g= t;.</span>=20
<br><br><a href=3D"http://f592987c113.fezifisat.c= n target=3D"_blank">=20
<img alt=3D"Please enable image or click&= nbsp;here" src=3D"http://img685.imageshack.us height=3D"458"&nb= sp;width=3D"658" style=3D"border:0px">=20
</a><br><br>
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; fo= nt-size:10px;">=20
<a href=3D"http://8208fb70f0.fezifisat.cn target=3D"_bla= nk" style=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp;&n= bsp;|&nbsp;=20
<a href=3D"http://a636a98b3cb.fezifisat.cn target=3D"_bl= ank" style=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://23f720cdc46.fezifisat.cn target=3D"_bl= ank"  style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Oxuymi Corporation. All=  rights reserved.</span>=20
</td></tr>
</table>
</body>=20
</html>



From victim@smtp.example Tue Dec 22=  06:07:53 2009=20
Delivery-date: Tue, 22 Dec 2009 06:07:53&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NN2an-0001jY-Aq=20
for victim@smtp.example; Tue, 22 Dec 2009&nb= sp;06:07:53 -0500=20
From: VIAGRA (c) Best Online Store <= victim@smtp.example>=20
To: victim@smtp.example=20
Subject: User anecdotalist.v special 80% OFF= =20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN" "http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html;&= nbsp;charset=3DUTF-8">=20
<title>Newsletter</title>
</head> =
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing= =3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; fo= nt-size:10px">=20
If you are unable to see the messa= ge below, <a href=3D"http://moregren.com style=3D"= text-decoration:none">click here to view</a>.<= /span>=20
<br><br><a href=3D"http://moregren.com targe= t=3D"_blank">=20
<img alt=3D"Please enable image or click&= nbsp;here" src=3D"http://img46.imageshack.us height=3D"440"&nbs= p;width=3D"657" style=3D"border:0px">=20
</a><br><br>
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; fo= nt-size:10px;">=20
<a href=3D"http://moregren.com target=3D"_blank" st= yle=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp;&n= bsp;|&nbsp;=20
<a href=3D"http://moregren.com target=3D"_blank" st= yle=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://moregren.com target=3D"_blank" &n= bsp;style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Igipiat Corporation. Al= l rights reserved.</span>=20
</td></tr>
</table>
</body>=20
</html>



From victim@smtp.example Wed Dec 23=  01:16:58 2009=20
Delivery-date: Wed, 23 Dec 2009 01:16:58&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NNKWo-00074I-4O=20
for victim@smtp.example; Wed, 23 Dec 2009&nb= sp;01:16:58 -0500=20
From: VIAGRA (c) Best Online Store <= victim@smtp.example>=20
To: victim@smtp.example=20
Subject: User grazyna_176 special 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN" "http://www.w3.org>=20
<html><head>=20
<meta http-equiv=3D"Content-Type" content=3D"text/html;&= nbsp;charset=3DUTF-8">=20
<title>Newsletter</title>
</head> =
<body>=20
<table width=3D"100%" cellpadding=3D"0" cellspacing= =3D"0">=20
<tr><td align=3D"center">=20
<span style=3D"font-family:Arial; color:#000000; fo= nt-size:10px">=20
If you are unable to see the messa= ge below, <a href=3D"http://tovar.tut.su style=3D"= text-decoration:none">click here to view</a>.<= /span>=20
<br><br><a href=3D"http://tovar.tut.su targe= t=3D"_blank">=20
<img alt=3D"Please enable image or click&= nbsp;here" src=3D"http://pixfarm.net height=3D"449" width=3D= "659" style=3D"border:0px">=20
</a><br><br>
</td></tr>=20
<tr><td valign=3D"top" align=3D"center">=20
<span style=3D"font-family:Arial; color:#333333; fo= nt-size:10px;">=20
<a href=3D"http://tovar.tut.su target=3D"_blank" st= yle=3D"color:#0065A4;">=20
Terms and Conditions of Use</a>&nbsp;&n= bsp;|&nbsp;=20
<a href=3D"http://tovar.tut.su target=3D"_blank" st= yle=3D"color:#0065A4;" >=20
Privacy Policy</a>&nbsp; |&nbsp;=20
<a href=3D"http://tovar.tut.su target=3D"_blank" &n= bsp;style=3D"color:#0065A4;">=20
Unsubscribe</a><br>=20
<br>&copy; 2009 Rexiqizak Corporation. = All rights reserved.</span>=20
</td></tr>
</table>
</body>=20
</html>



From victim@smtp.example Thu Dec 24=  03:01:08 2009=20
Delivery-date: Thu, 24 Dec 2009 03:01:08&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NNidA-0003k2-Hs=20
for victim@smtp.example; Thu, 24 Dec 2009&nb= sp;03:01:08 -0500=20
From: Generic VIAGRA (c) Best Supplier = <victim@smtp.example>=20
To: victim@smtp.example=20
Subject: Visitor reviewability.m's personal 80%&n= bsp;OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN">=20
<html>
    <head>=20
        <title>NEWSLETT= ER</title>=20
        <meta content= =3D"text/html; charset=3DISO-8859-1" http-equiv=3D"Content-Type= ">=20
    </head>=20
    <body>=20
        <table cellsp= acing=3D"0" cellpadding=3D"0" width=3D"576" align=3D"cente= r" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right:=  #e5e5e5 1px solid; border-top: #e5e5e5 1px=  solid; border-left: #e5e5e5 1px solid; bor= der-bottom: #e5e5e5 1px solid">=20
           &nb= sp;<tbody>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"l= eft" style=3D"padding-right: 9px; padding-left: 9px;&= nbsp;padding-bottom: 14px; padding-top: 8px">=20
           &nb= sp;        <p style=3D"ma= rgin-top: 0px; font-size: 10px; margin-bottom: 0= px; color: #999999; line-height: 12px; font-fami= ly: Verdana">=20
If you have any difficulty seeing the&n= bsp;contents of this=20
e-mail, please click <a target=3D"_blank" = ;style=3D"font-size: 10px; color: #00bdac; line-heigh= t: 12px; font-family: Verdana; text-decoration: = underline" href=3D"http://66.118.165.40>=20
here</a>.</p>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td>=20
           &nb= sp;        <table cellspa= cing=3D"0" cellpadding=3D"0" width=3D"600" border=3D"0">= ;=20
           &nb= sp;           &nbs= p;<tbody>=20
           &nb= sp;           &nbs= p;    <tr>=20
           &nb= sp;           &nbs= p;        <td style=3D"te= xt-align: center">=20
           &nb= sp;           &nbs= p;        <br>=20
<a href=3D"http://66.118.165.40><img alt=3D"Click&= nbsp;on this image" height=3D"449" src=3D"http://img7= 09.imageshack.us width=3D"662" style=3D"border-width: 0px"= >=20
</a>
<br>=20
           &nb= sp;           &nbs= p;        </td>=20
           &nb= sp;           &nbs= p;    </tr>=20
           &nb= sp;           &nbs= p;</tbody>=20
           &nb= sp;        </table>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"c= enter" style=3D"padding-right: 0px; padding-left: 0px= ; font-size: 10px; padding-bottom: 10px; color:&= nbsp;#999999; line-height: 12px; padding-top: 10px;&n= bsp;font-family: Verdana">=20
Copyright =A9 2009 Teefesoe Inc.<br>=20
           &nb= sp;        <a style=3D"fo= nt-size: 10px; color: #00bdac; line-height: 12px= ; font-family: Verdana; text-decoration: underline"&n= bsp;href=3D"http://66.118.165.40>=20
Privacy Policy</a> | <a style=3D"font-si= ze: 10px; color: #00bdac; line-height: 12px;&nbs= p;font-family: Verdana; text-decoration: underline" h= ref=3D"http://66.118.165.40>=20
Terms of Use</a> | <a style=3D"font= -size: 10px; color: #00bdac; line-height: 12px;&= nbsp;font-family: Verdana; text-decoration: underline"&nbs= p;href=3D"http://66.118.165.40>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac;&n= bsp;line-height: 12px; font-family: Verdana; text-dec= oration: underline" href=3D"http://66.118.165.40>=20
Unsubscribe</a></td>=20
           &nb= sp;    </tr>=20
           &nb= sp;</tbody>=20
        </table>=20
    </body>
</html>



From victim@smtp.example Mon Dec 28=  05:13:07 2009=20
Delivery-date: Mon, 28 Dec 2009 05:13:07&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NPCb4-0007jb-WD=20
for victim@smtp.example; Mon, 28 Dec 2009&nb= sp;05:13:07 -0500=20
From: VIAGRA (c) Best Supplier <victim@sm= tp.example>=20
To: victim@smtp.example=20
Subject: Visitor jessenia's personal 80% OFF= =20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN">=20
<html>
    <head>=20
        <title>Newslett= er</title>=20
        <meta content= =3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Type">= =20
    </head>=20
    <body>=20
        <table cellsp= acing=3D"0" cellpadding=3D"0" width=3D"750" align=3D"cente= r" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right:=  #e5e5e5 1px solid; border-top: #e5e5e5 1px=  solid; border-left: #e5e5e5 1px solid; bor= der-bottom: #e5e5e5 1px solid">=20
           &nb= sp;<tbody>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"l= eft" style=3D"padding-right: 9px; padding-left: 9px;&= nbsp;padding-bottom: 14px; padding-top: 8px">=20
           &nb= sp;        <p style=3D"ma= rgin-top: 0px; font-size: 10px; margin-bottom: 0= px; color: #999999; line-height: 12px; font-fami= ly: Verdana">=20
If you have any difficulty seeing the&n= bsp;contents of this=20
e-mail, please click <a target=3D"_blank" = ;style=3D"font-size: 10px; color: #00bdac; line-heigh= t: 12px; font-family: Verdana; text-decoration: = underline" href=3D"http://bb2a04ce7.xotafabuc.cn>=20
here</a>.</p>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td>=20
           &nb= sp;        <table cellspa= cing=3D"0" cellpadding=3D"0" width=3D"750" border=3D"0">= ;=20
           &nb= sp;           &nbs= p;<tbody>=20
           &nb= sp;           &nbs= p;    <tr>=20
           &nb= sp;           &nbs= p;        <td style=3D"te= xt-align: center">=20
           &nb= sp;           &nbs= p;        <br>=20
<a href=3D"http://6f84.xotafabuc.cn><img alt=3D"Th= is picture is blocked. Click to unblock&nbs= p;now" height=3D"330" src=3D"http://a7b.xotafabuc.cn width= =3D"546" style=3D"border-width: 0px">=20
</a>
<br>=20
           &nb= sp;           &nbs= p;        </td>=20
           &nb= sp;           &nbs= p;    </tr>=20
           &nb= sp;           &nbs= p;</tbody>=20
           &nb= sp;        </table>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"c= enter" style=3D"padding-right: 0px; padding-left: 0px= ; font-size: 10px; padding-bottom: 10px; color:&= nbsp;#999999; line-height: 12px; padding-top: 10px;&n= bsp;font-family: Verdana">=20
Copyright =A9 2009 Faekoc Inc.<br>=20
           &nb= sp;        <a style=3D"fo= nt-size: 10px; color: #00bdac; line-height: 12px= ; font-family: Verdana; text-decoration: underline"&n= bsp;href=3D"http://39d75058.xotafabuc.cn>=20
Privacy Policy</a> | <a style=3D"font-si= ze: 10px; color: #00bdac; line-height: 12px;&nbs= p;font-family: Verdana; text-decoration: underline" h= ref=3D"http://947d73d26.xotafabuc.cn>=20
Terms of Use</a> | <a style=3D"font= -size: 10px; color: #00bdac; line-height: 12px;&= nbsp;font-family: Verdana; text-decoration: underline"&nbs= p;href=3D"http://538e87.xotafabuc.cn>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac;&n= bsp;line-height: 12px; font-family: Verdana; text-dec= oration: underline" href=3D"http://ce3.xotafabuc.cn>=20
Unsubscribe</a></td>=20
           &nb= sp;    </tr>=20
           &nb= sp;</tbody>=20
        </table>=20
    </body>
</html>



From victim@smtp.example Tue Dec 29=  06:18:13 2009=20
Delivery-date: Tue, 29 Dec 2009 06:18:13&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NPa5d-0005Zc-8v=20
for victim@smtp.example; Tue, 29 Dec 2009&nb= sp;06:18:13 -0500=20
From: VIAGRA (c) Best Supplier <victim@sm= tp.example>=20
To: victim@smtp.example=20
Subject: Visitor helm's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN">=20
<html>
    <head>=20
        <title>Newslett= er</title>=20
        <meta content= =3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Type">= =20
    </head>=20
    <body>=20
        <table cellsp= acing=3D"0" cellpadding=3D"0" width=3D"750" align=3D"cente= r" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right:=  #e5e5e5 1px solid; border-top: #e5e5e5 1px=  solid; border-left: #e5e5e5 1px solid; bor= der-bottom: #e5e5e5 1px solid">=20
           &nb= sp;<tbody>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"l= eft" style=3D"padding-right: 9px; padding-left: 9px;&= nbsp;padding-bottom: 14px; padding-top: 8px">=20
           &nb= sp;        <p style=3D"ma= rgin-top: 0px; font-size: 10px; margin-bottom: 0= px; color: #999999; line-height: 12px; font-fami= ly: Verdana">=20
If you have any difficulty seeing the&n= bsp;contents of this=20
e-mail, please click <a target=3D"_blank" = ;style=3D"font-size: 10px; color: #00bdac; line-heigh= t: 12px; font-family: Verdana; text-decoration: = underline" href=3D"http://student.tmhs.tcc.edu.tw>=20
here</a>.</p>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td>=20
           &nb= sp;        <table cellspa= cing=3D"0" cellpadding=3D"0" width=3D"750" border=3D"0">= ;=20
           &nb= sp;           &nbs= p;<tbody>=20
           &nb= sp;           &nbs= p;    <tr>=20
           &nb= sp;           &nbs= p;        <td style=3D"te= xt-align: center">=20
           &nb= sp;           &nbs= p;        <br>=20
<a href=3D"http://student.tmhs.tcc.edu.tw><img alt= =3D"This picture is blocked. Click to unblo= ck now" height=3D"432" src=3D"http://img44.imageshack.us&n= bsp;width=3D"688" style=3D"border-width: 0px">=20
</a>
<br>=20
           &nb= sp;           &nbs= p;        </td>=20
           &nb= sp;           &nbs= p;    </tr>=20
           &nb= sp;           &nbs= p;</tbody>=20
           &nb= sp;        </table>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"c= enter" style=3D"padding-right: 0px; padding-left: 0px= ; font-size: 10px; padding-bottom: 10px; color:&= nbsp;#999999; line-height: 12px; padding-top: 10px;&n= bsp;font-family: Verdana">=20
Copyright =A9 2009 Iduut Inc.<br>=20
           &nb= sp;        <a style=3D"fo= nt-size: 10px; color: #00bdac; line-height: 12px= ; font-family: Verdana; text-decoration: underline"&n= bsp;href=3D"http://student.tmhs.tcc.edu.tw>=20
Privacy Policy</a> | <a style=3D"font-si= ze: 10px; color: #00bdac; line-height: 12px;&nbs= p;font-family: Verdana; text-decoration: underline" h= ref=3D"http://student.tmhs.tcc.edu.tw>=20
Terms of Use</a> | <a style=3D"font= -size: 10px; color: #00bdac; line-height: 12px;&= nbsp;font-family: Verdana; text-decoration: underline"&nbs= p;href=3D"http://student.tmhs.tcc.edu.tw>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac;&n= bsp;line-height: 12px; font-family: Verdana; text-dec= oration: underline" href=3D"http://student.tmhs.tcc.edu.tw> =
Unsubscribe</a></td>=20
           &nb= sp;    </tr>=20
           &nb= sp;</tbody>=20
        </table>=20
    </body>
</html>



From victim@smtp.example Tue Dec 29=  08:17:28 2009=20
Delivery-date: Tue, 29 Dec 2009 08:17:28&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NPbx1-0002dk-Rk=20
for victim@smtp.example; Tue, 29 Dec 2009&nb= sp;08:17:28 -0500=20
From: VIAGRA (c) Best Supplier <victim@sm= tp.example>=20
To: victim@smtp.example=20
Subject: Visitor headset's personal 80% OFF =
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN">=20
<html>
    <head>=20
        <title>Newslett= er</title>=20
        <meta content= =3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Type">= =20
    </head>=20
    <body>=20
        <table cellsp= acing=3D"0" cellpadding=3D"0" width=3D"750" align=3D"cente= r" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right:=  #e5e5e5 1px solid; border-top: #e5e5e5 1px=  solid; border-left: #e5e5e5 1px solid; bor= der-bottom: #e5e5e5 1px solid">=20
           &nb= sp;<tbody>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"l= eft" style=3D"padding-right: 9px; padding-left: 9px;&= nbsp;padding-bottom: 14px; padding-top: 8px">=20
           &nb= sp;        <p style=3D"ma= rgin-top: 0px; font-size: 10px; margin-bottom: 0= px; color: #999999; line-height: 12px; font-fami= ly: Verdana">=20
If you have any difficulty seeing the&n= bsp;contents of this=20
e-mail, please click <a target=3D"_blank" = ;style=3D"font-size: 10px; color: #00bdac; line-heigh= t: 12px; font-family: Verdana; text-decoration: = underline" href=3D"http://web143.mis02.de>=20
here</a>.</p>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td>=20
           &nb= sp;        <table cellspa= cing=3D"0" cellpadding=3D"0" width=3D"750" border=3D"0">= ;=20
           &nb= sp;           &nbs= p;<tbody>=20
           &nb= sp;           &nbs= p;    <tr>=20
           &nb= sp;           &nbs= p;        <td style=3D"te= xt-align: center">=20
           &nb= sp;           &nbs= p;        <br>=20
<a href=3D"http://web143.mis02.de><img alt=3D"This=  picture is blocked. Click to unblock = now" height=3D"437" src=3D"http://img139.imageshack.us wid= th=3D"696" style=3D"border-width: 0px">=20
</a>
<br>=20
           &nb= sp;           &nbs= p;        </td>=20
           &nb= sp;           &nbs= p;    </tr>=20
           &nb= sp;           &nbs= p;</tbody>=20
           &nb= sp;        </table>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"c= enter" style=3D"padding-right: 0px; padding-left: 0px= ; font-size: 10px; padding-bottom: 10px; color:&= nbsp;#999999; line-height: 12px; padding-top: 10px;&n= bsp;font-family: Verdana">=20
Copyright =A9 2009 Ygizufewifof Inc.<br>=20
           &nb= sp;        <a style=3D"fo= nt-size: 10px; color: #00bdac; line-height: 12px= ; font-family: Verdana; text-decoration: underline"&n= bsp;href=3D"http://web143.mis02.de>=20
Privacy Policy</a> | <a style=3D"font-si= ze: 10px; color: #00bdac; line-height: 12px;&nbs= p;font-family: Verdana; text-decoration: underline" h= ref=3D"http://web143.mis02.de>=20
Terms of Use</a> | <a style=3D"font= -size: 10px; color: #00bdac; line-height: 12px;&= nbsp;font-family: Verdana; text-decoration: underline"&nbs= p;href=3D"http://web143.mis02.de>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac;&n= bsp;line-height: 12px; font-family: Verdana; text-dec= oration: underline" href=3D"http://web143.mis02.de>=20
Unsubscribe</a></td>=20
           &nb= sp;    </tr>=20
           &nb= sp;</tbody>=20
        </table>=20
    </body>
</html>



From victim@smtp.example Wed Dec 30=  01:22:00 2009=20
Delivery-date: Wed, 30 Dec 2009 01:22:00&nbs= p;-0500=20
Received: from [82.117.196.254]=20
by mail.victim.example with esmtps (TLSv1:RC4-MD5= :128)=20
(Exim 4.63) =
(envelope-from <victim@smtp.example>)=20
id 1NPrwW-0000bT-9r=20
for victim@smtp.example; Wed, 30 Dec 2009&nb= sp;01:22:00 -0500=20
From: VIAGRA (c) Best Supplier <victim@sm= tp.example>=20
To: victim@smtp.example=20
Subject: Visitor grady's personal 80% OFF=20
MIME-Version: 1.0=20

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML&nb= sp;4.01 Transitional//EN">=20
<html>
    <head>=20
        <title>Newslett= er</title>=20
        <meta content= =3D"text/html; charset=3DUTF-8" http-equiv=3D"Content-Type">= =20
    </head>=20
    <body>=20
        <table cellsp= acing=3D"0" cellpadding=3D"0" width=3D"750" align=3D"cente= r" bgcolor=3D"#ffffff" border=3D"0" style=3D"border-right:=  #e5e5e5 1px solid; border-top: #e5e5e5 1px=  solid; border-left: #e5e5e5 1px solid; bor= der-bottom: #e5e5e5 1px solid">=20
           &nb= sp;<tbody>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"l= eft" style=3D"padding-right: 9px; padding-left: 9px;&= nbsp;padding-bottom: 14px; padding-top: 8px">=20
           &nb= sp;        <p style=3D"ma= rgin-top: 0px; font-size: 10px; margin-bottom: 0= px; color: #999999; line-height: 12px; font-fami= ly: Verdana">=20
If you have any difficulty seeing the&n= bsp;contents of this=20
e-mail, please click <a target=3D"_blank" = ;style=3D"font-size: 10px; color: #00bdac; line-heigh= t: 12px; font-family: Verdana; text-decoration: = underline" href=3D"http://shlapka.by.ru>=20
here</a>.</p>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td>=20
           &nb= sp;        <table cellspa= cing=3D"0" cellpadding=3D"0" width=3D"750" border=3D"0">= ;=20
           &nb= sp;           &nbs= p;<tbody>=20
           &nb= sp;           &nbs= p;    <tr>=20
           &nb= sp;           &nbs= p;        <td style=3D"te= xt-align: center">=20
           &nb= sp;           &nbs= p;        <br>=20
<a href=3D"http://shlapka.by.ru><img alt=3D"This&n= bsp;picture is blocked. Click to unblock no= w" height=3D"441" src=3D"http://img199.imageshack.us width= =3D"684" style=3D"border-width: 0px">=20
</a>
<br>=20
           &nb= sp;           &nbs= p;        </td>=20
           &nb= sp;           &nbs= p;    </tr>=20
           &nb= sp;           &nbs= p;</tbody>=20
           &nb= sp;        </table>=20
           &nb= sp;        </td>=20
           &nb= sp;    </tr>=20
           &nb= sp;    <tr>=20
           &nb= sp;        <td align=3D"c= enter" style=3D"padding-right: 0px; padding-left: 0px= ; font-size: 10px; padding-bottom: 10px; color:&= nbsp;#999999; line-height: 12px; padding-top: 10px;&n= bsp;font-family: Verdana">=20
Copyright =A9 2009 Icudiygoud Inc.<br>=20
           &nb= sp;        <a style=3D"fo= nt-size: 10px; color: #00bdac; line-height: 12px= ; font-family: Verdana; text-decoration: underline"&n= bsp;href=3D"http://shlapka.by.ru>=20
Privacy Policy</a> | <a style=3D"font-si= ze: 10px; color: #00bdac; line-height: 12px;&nbs= p;font-family: Verdana; text-decoration: underline" h= ref=3D"http://shlapka.by.ru>=20
Terms of Use</a> | <a style=3D"font= -size: 10px; color: #00bdac; line-height: 12px;&= nbsp;font-family: Verdana; text-decoration: underline"&nbs= p;href=3D"http://shlapka.by.ru>=20
Contact Us</a> |=20
<a style=3D"font-size: 10px; color: #00bdac;&n= bsp;line-height: 12px; font-family: Verdana; text-dec= oration: underline" href=3D"http://shlapka.by.ru>=20
Unsubscribe</a></td>=20
           &nb= sp;    </tr>=20
           &nb= sp;</tbody>=20
        </table>=20
    </body>
</html>=20

------=_NextPart_000_0035_01CA892A.71FF02D0-- Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU7geXV008595 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Tue, 29 Dec 2009 23:42:46 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Tue, 29 Dec 2009 23:42:40 -0800 From: "Murray S. Kucherawy" To: Dave CROCKER Date: Tue, 29 Dec 2009 23:42:40 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: AcqJI1GlXOgASI9wT9uRo+T1469dgQAADstw Message-ID: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> <4B3B03C9.5060803@bbiw.net> In-Reply-To: <4B3B03C9.5060803@bbiw.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 23:42:46 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBU7geXV008595 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:42:46 -0000 > -----Original Message----- > From: Dave CROCKER [mailto:dcrocker@bbiw.net] > Sent: Tuesday, December 29, 2009 11:40 PM > To: Murray S. Kucherawy > Cc: abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > To emphasize this: Your scenario sounds reasonable. But each feature > in a > global standard is expensive. So, I'm not trying to challenge the > /idea/ of > what you want to do, but rather am looking for a cost/benefit > consensus. I'm simply shaping Yakov's idea a little. I'd also like some feedback from others, especially those that currently redact data (or anyone that would benefit from them labeling their ARFs as such). Received: from [192.168.1.104] (adsl-68-122-42-50.dsl.pltn13.pacbell.net [68.122.42.50]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU7e5Rc008451 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 29 Dec 2009 23:40:11 -0800 Message-ID: <4B3B03C9.5060803@bbiw.net> Date: Tue, 29 Dec 2009 23:39:53 -0800 From: Dave CROCKER Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0 MIME-Version: 1.0 To: "Murray S. Kucherawy" References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Tue, 29 Dec 2009 23:40:11 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:40:11 -0000 On 12/29/2009 11:34 PM, Murray S. Kucherawy wrote: >> But some sort of "I played with the text" high-level indicator does not >> seem all that procedurally useful. >> >> Enlighten me? > > I think my vision is two possible streams within the ADMD receiving the ARF > message: one that handles unredacted content (maximum automation) and one > that takes messages that admit to redacted content and routes them elsewhere > for manual processing. wow. that's pretty scenario-specific, to build into a standard. We could probably think of lots of other, reasonable specific scenarios that would require special support. I think that such choices for a standard should require vigorous community agreement about its importance to include. To emphasize this: Your scenario sounds reasonable. But each feature in a global standard is expensive. So, I'm not trying to challenge the /idea/ of what you want to do, but rather am looking for a cost/benefit consensus. d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU7YfMr007992 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Tue, 29 Dec 2009 23:34:46 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Tue, 29 Dec 2009 23:34:40 -0800 From: "Murray S. Kucherawy" To: "dcrocker@bbiw.net" Date: Tue, 29 Dec 2009 23:34:39 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: AcqJITpoxg0XTyVITcS5S2ah4X0DyAAAStsA Message-ID: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> <4B3B0046.1040005@dcrocker.net> In-Reply-To: <4B3B0046.1040005@dcrocker.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 23:34:46 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBU7YfMr007992 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:34:46 -0000 > -----Original Message----- > From: Dave CROCKER [mailto:dhc@dcrocker.net] > Sent: Tuesday, December 29, 2009 11:25 PM > To: Murray S. Kucherawy > Cc: Yakov Shafranovich; SM; abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > None of this sounds dangerous, but I'm not quite understanding what a > single > flag or even a list of header fields is useful for, in practical terms. > > I could understand having an inline convention for flagging a sequence > of bytes > as having been redacted. That tells the receiving processor exactly > where text > is "missing". > > But some sort of "I played with the text" high-level indicator does not > seem all > that procedurally useful. > > Enlighten me? I think my vision is two possible streams within the ADMD receiving the ARF message: one that handles unredacted content (maximum automation) and one that takes messages that admit to redacted content and routes them elsewhere for manual processing. Received: from ns1.qubic.net (ns1.qubic.net [208.69.177.116]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU7UWK3007643 for ; Tue, 29 Dec 2009 23:30:37 -0800 Authentication-Results: sbh17.songbird.com; dkim=neutral (verification failed) header.i=@resistor.net Received: from subman.resistor.net ([10.0.0.1]) (authenticated bits=0) by ns1.qubic.net (8.14.4.Beta0/8.14.4.Beta0) with ESMTP id nBU7UIGi004341 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 29 Dec 2009 23:30:25 -0800 (PST) Message-Id: <6.2.5.6.2.20091229230023.031bcc00@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Tue, 29 Dec 2009 23:30:07 -0800 To: "Murray S. Kucherawy" From: SM In-Reply-To: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 23:30:37 -0800 (PST) Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:30:37 -0000 Hi Murray, At 22:52 29-12-2009, Murray S. Kucherawy wrote: >I think it is. And we don't need to register it because it exists >in a format we're defining ourselves, not in the message header proper. > >Anyone object, or shall I add this and adjust various wording accordingly? Steve Atkins posted a FAQ about some ARF related questions yesterday. If whether redaction is allowed is out of scope, there is no need to define a "header" for it. It's not worth the bother telling senders what they can or cannot do as ARF is about defining a reporting format. The question could be discussed in the informational document. Regards, -sm Received: from [192.168.1.104] (adsl-68-122-42-50.dsl.pltn13.pacbell.net [68.122.42.50]) (authenticated bits=0) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU7P6Ya007260 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 29 Dec 2009 23:25:12 -0800 Message-ID: <4B3B0046.1040005@dcrocker.net> Date: Tue, 29 Dec 2009 23:24:54 -0800 From: Dave CROCKER Organization: Brandenburg InternetWorking User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0 MIME-Version: 1.0 To: "Murray S. Kucherawy" References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.17]); Tue, 29 Dec 2009 23:25:13 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: dcrocker@bbiw.net List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:25:13 -0000 On 12/29/2009 11:10 PM, Murray S. Kucherawy wrote: >> -----Original Message----- From: Yakov Shafranovich >> [mailto:yakov@shaftek.org] Sent: Tuesday, December 29, 2009 8:16 PM To: SM >> Cc: Murray S. Kucherawy; abuse-feedback-report@mipassoc.org Subject: Re: >> [feedback-report] Let's get started >> >> Content-Redacted: Yes > > Perhaps rather than a Boolean value, the proposed header field could list the > names of message header fields that contain redacted data. None of this sounds dangerous, but I'm not quite understanding what a single flag or even a list of header fields is useful for, in practical terms. I could understand having an inline convention for flagging a sequence of bytes as having been redacted. That tells the receiving processor exactly where text is "missing". But some sort of "I played with the text" high-level indicator does not seem all that procedurally useful. Enlighten me? d/ -- Dave Crocker Brandenburg InternetWorking bbiw.net Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU7AgsF006222 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Tue, 29 Dec 2009 23:10:47 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Tue, 29 Dec 2009 23:10:41 -0800 From: "Murray S. Kucherawy" To: Yakov Shafranovich , SM Date: Tue, 29 Dec 2009 23:10:40 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: AcqJBsm4IBr2Pd7mTFGDBwdk4tcszgAGEpAg Message-ID: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> In-Reply-To: <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 23:10:47 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBU7AgsF006222 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:10:47 -0000 > -----Original Message----- > From: Yakov Shafranovich [mailto:yakov@shaftek.org] > Sent: Tuesday, December 29, 2009 8:16 PM > To: SM > Cc: Murray S. Kucherawy; abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > Content-Redacted: Yes Perhaps rather than a Boolean value, the proposed header field could list the names of message header fields that contain redacted data. Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU75A8F005836 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Tue, 29 Dec 2009 23:05:15 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Tue, 29 Dec 2009 23:05:09 -0800 From: "Murray S. Kucherawy" To: "John R. Levine" Date: Tue, 29 Dec 2009 23:05:08 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: AcqJHgB/+xLuRfu3SReAmR8fkdAjdgAAGBPg Message-ID: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 23:05:15 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBU75A8F005836 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:05:15 -0000 > -----Original Message----- > From: John R. Levine [mailto:johnl@iecc.com] > Sent: Tuesday, December 29, 2009 11:02 PM > To: Murray S. Kucherawy > Cc: abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > >> Content-Redacted: Yes > > > > I think it is. And we don't need to register it because it exists in > a format we're defining ourselves, not in the message header proper. > > > > Anyone object, or shall I add this and adjust various wording > accordingly? > > I don't have any theological objections, but it might be interesting to > ask RR, AOL, and other ARF senders who redact whether they'd be likely > to > add it. Well, they're on the list and (at least occasionally) participating. Fellas? Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU727fb005614 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 29 Dec 2009 23:02:13 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 28525 invoked from network); 30 Dec 2009 07:02:06 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 30 Dec 2009 07:01:44 -0000 Date: 30 Dec 2009 02:02:06 -0500 Message-ID: From: "John R. Levine" To: "Murray S. Kucherawy" In-Reply-To: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 23:02:13 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 07:02:14 -0000 >> Content-Redacted: Yes > > I think it is. And we don't need to register it because it exists in a format we're defining ourselves, not in the message header proper. > > Anyone object, or shall I add this and adjust various wording accordingly? I don't have any theological objections, but it might be interesting to ask RR, AOL, and other ARF senders who redact whether they'd be likely to add it. R's, John Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU6q7g3004887 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Tue, 29 Dec 2009 22:52:12 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Tue, 29 Dec 2009 22:52:06 -0800 From: "Murray S. Kucherawy" To: Yakov Shafranovich , SM Date: Tue, 29 Dec 2009 22:52:06 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: AcqJBsm4IBr2Pd7mTFGDBwdk4tcszgAFabPw Message-ID: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> In-Reply-To: <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10240/Tue Dec 29 19:44:54 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 22:52:12 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBU6q7g3004887 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 06:52:12 -0000 > -----Original Message----- > From: Yakov Shafranovich [mailto:yakov@shaftek.org] > Sent: Tuesday, December 29, 2009 8:16 PM > To: SM > Cc: Murray S. Kucherawy; abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > [...] > I did not mean to imply that the X.400 header should be used, rather > it is an example. The question is whether it is worthwhile to defined > a header for part 2 of the ARF reports like this: > > Content-Redacted: Yes I think it is. And we don't need to register it because it exists in a format we're defining ourselves, not in the message header proper. Anyone object, or shall I add this and adjust various wording accordingly? Received: from mail-ew0-f217.google.com (mail-ew0-f217.google.com [209.85.219.217]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU4FvLT029105 for ; Tue, 29 Dec 2009 20:16:02 -0800 Received: by ewy9 with SMTP id 9so976799ewy.11 for ; Tue, 29 Dec 2009 20:15:56 -0800 (PST) MIME-Version: 1.0 Received: by 10.216.87.140 with SMTP id y12mr3937378wee.4.1262146556137; Tue, 29 Dec 2009 20:15:56 -0800 (PST) In-Reply-To: <6.2.5.6.2.20091229164614.0324cba8@resistor.net> References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> <6.2.5.6.2.20091229164614.0324cba8@resistor.net> From: Yakov Shafranovich Date: Tue, 29 Dec 2009 23:15:36 -0500 Message-ID: <501c18e00912292015n41760fffu5504cdf5ce3baece@mail.gmail.com> To: SM Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV 0.92/10239/Tue Dec 29 17:04:05 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 20:16:03 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBU4FvLT029105 Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 04:16:03 -0000 On Tue, Dec 29, 2009 at 7:56 PM, SM wrote: > Hi Murray, > >>The specific header field you give is defined in RFC2156 but >>unfortunately there's no description of what specifically it >>covers.  RFC4021 says it has to do with an incomplete body though, >>which is generally not the case here. > > It's not a good idea to bring back X.400. > I did not mean to imply that the X.400 header should be used, rather it is an example. The question is whether it is worthwhile to defined a header for part 2 of the ARF reports like this: Content-Redacted: Yes Yakov Received: from ns1.qubic.net (ns1.qubic.net [208.69.177.116]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBU1U2jc020701 for ; Tue, 29 Dec 2009 17:30:08 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@resistor.net Received: from subman.resistor.net ([10.0.0.1]) (authenticated bits=0) by ns1.qubic.net (8.14.4.Beta0/8.14.4.Beta0) with ESMTP id nBU0ux1i024323 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 29 Dec 2009 16:57:06 -0800 (PST) Message-Id: <6.2.5.6.2.20091229164614.0324cba8@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Tue, 29 Dec 2009 16:56:47 -0800 To: "Murray S. Kucherawy" From: SM In-Reply-To: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Virus-Scanned: ClamAV 0.92/10238/Tue Dec 29 08:11:02 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:32:52 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 17:30:08 -0800 (PST) Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2009 01:30:08 -0000 Hi Murray, At 15:46 29-12-2009, Murray S. Kucherawy wrote: >I don't know of one, which is in fact why I changed the word >"standard" to "typical". There are the "Resent-" mail headers. There isn't a standardized forwarding prefix. >The specific header field you give is defined in RFC2156 but >unfortunately there's no description of what specifically it >covers. RFC4021 says it has to do with an incomplete body though, >which is generally not the case here. It's not a good idea to bring back X.400. Regards, -sm Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBTNkg6o015246 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO) for ; Tue, 29 Dec 2009 15:46:47 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Tue, 29 Dec 2009 15:46:42 -0800 From: "Murray S. Kucherawy" To: Yakov Shafranovich Date: Tue, 29 Dec 2009 15:46:41 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: AcqHx7ZQjfgfv3AfQKCOow0mygCxuQBGBuKA Message-ID: References: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> In-Reply-To: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10238/Tue Dec 29 08:11:02 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 15:46:47 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBTNkg6o015246 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Dec 2009 23:46:48 -0000 > -----Original Message----- > From: Yakov Shafranovich [mailto:yakov@shaftek.org] > Sent: Monday, December 28, 2009 6:12 AM > To: Murray S. Kucherawy > Cc: abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > [...] > 1. Were we planning on putting the Domain Keys stuff into a companion > draft instead of the main document? Then the following from section > 1.1 should be removed: > > "To advise providers that certify or otherwise make assertions about > mail of recipient disagreement with the assertions." Yep, it was a reference to the now-removed DKIM support. Removed this text. > 2. Section 1.1: > "To inform email service providers or other primarily outbound > senders that there may be issues regarding their mail; these > issues include (but are not limited to) reports that the mail may > be considered to be "spam" by a recipient of the message; > " > This may be too generic, perhaps we should narrow this specifically to > abuse and related issues? Fair enough. I've inserted the word "abuse" before the first "issues", and that seems to cover it. > 3. Section 2.f.: > "which the report is being generated and MAY include only a typical > forwarding prefix" > > Is there an existing standard we need to reference that covers > forwarding? I don't know of one, which is in fact why I changed the word "standard" to "typical". Anyone else know of one? > 4. Section 4 - spelling error in "report types": > > "Implementations using new rpeort types" Fixed. > 5. Section 6.6 - redaction: > > Do we need a new header that indicates to the report recipient that > the message was redacted? There is a header "Incomplete-Copy" in RFC > 4021 which has a similar purpose for X400/email mappings. I'd be fine with including such in the second MIME part that contains ARF-specific header fields. Anyone else have a thought on this? The specific header field you give is defined in RFC2156 but unfortunately there's no description of what specifically it covers. RFC4021 says it has to do with an incomplete body though, which is generally not the case here. > 6. A general question that was once raised on the mailing list - do we > need to take into account RFC 3864 and the message header field > registries? I don't think so because we're not registering header fields that are used in header blocks of messages. The header fields we're defining are part of the message body (a MIME part, in particular). DSN (RFC3464), for example, did no header field registrations; all of the header fields it created are defined there, and it even created its own registries for values of a few of them. I think that's a pretty good analogy for what we're doing with ARF. Thanks for the review! -MSK Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBTHcnmF030073 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 29 Dec 2009 09:38:55 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 30111 invoked from network); 29 Dec 2009 17:38:49 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 29 Dec 2009 17:38:27 -0000 Date: 29 Dec 2009 12:38:48 -0500 Message-ID: From: "John R. Levine" To: "ARF mailing list" In-Reply-To: <4B39E589.3000101@abusix.org> References: <1262064346.24817.34.camel@darkstar.netcore.co.in> <4B39E589.3000101@abusix.org> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10238/Tue Dec 29 08:11:02 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 09:38:56 -0800 (PST) Subject: Re: [feedback-report] Software for auto-sending ARF reports X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Dec 2009 17:38:56 -0000 >> I was wondering if there was some software that would directly send an >> ARF report to the network administrator from whom the spam hit my >> servers >> It would be ideal if such a software has a MUA plugin, for thundebird >> outlook express etc. So that we dont have to educate the clients on >> properly forwarding the spam as attachment etc There are plenty of MUA plugins to report spam. But they don't work, because the MUA does not have enough information to reliably identify the source of the spam. Mail managers I know generally discard such reports unread, because they're almost always wrong. I have some perl scripts on my mail server that do automated ARF reporting, but they depend on the exact format of my MTA's Received: headers to figure out the actual source IP address, and to know which of the domain names in the headers are real. They also use a large manually maintained set of IP ranges to deal with the large fraction of spam that comes from hosts without usable names. It would make much more sense for the MUA to return the spam report to the MTA from which it picked up the mail, and for the spam reports to be aggregated and sent out from the MTA, since the report software can be tuned for the MTA's own header formats. We've been discussing this over on the ASRG list. See http://wiki.asrg.sp.am R's, John Received: from wp204.webpack.hosteurope.de (wp204.webpack.hosteurope.de [80.237.132.211]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBTBvciq010380 for ; Tue, 29 Dec 2009 03:57:43 -0800 Received: from p57946c43.dip.t-dialin.net ([87.148.108.67] helo=[192.168.1.100]); authenticated by wp204.webpack.hosteurope.de running ExIM with esmtpa id 1NPa60-00007l-0o; Tue, 29 Dec 2009 12:18:36 +0100 Message-ID: <4B39E589.3000101@abusix.org> Date: Tue, 29 Dec 2009 12:18:33 +0100 From: Tobias Knecht Organization: abusix UG =?ISO-8859-15?Q?=28haftungsbeschr=E4nkt=29?= User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: ARF mailing list References: <1262064346.24817.34.camel@darkstar.netcore.co.in> In-Reply-To: <1262064346.24817.34.camel@darkstar.netcore.co.in> X-Enigmail-Version: 0.96.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig73809A4E0ED9610B4683AA32" X-bounce-key: webpack.hosteurope.de;knut@abusix.org;1262087864;acf29c99; X-Virus-Scanned: ClamAV 0.92/10236/Mon Dec 28 18:19:29 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:39:01 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 03:57:44 -0800 (PST) Subject: Re: [feedback-report] Software for auto-sending ARF reports X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Dec 2009 11:57:44 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig73809A4E0ED9610B4683AA32 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable Hi Ram, http://abusix.mycodebasehq.com/slingshot-public This could be the thing you are looking for. We do not provide any outlook or thunderbird plugin. But I know about this one. http://spamcomplaint.net/ Tobias ram schrieb: > Hi, >=20 > As an anti spam solutions provider we quiet some FN reports. Currently= > I do not make much use of these reports.=20 > I have written some ( badly maintained :-( ) perl scripts to parse thes= e > mails and extract data for feeding bayes , or domain extraction etc > We also manually go thru these reports sometimes.=20 > I was wondering if there was some software that would directly send an > ARF report to the network administrator from whom the spam hit my > servers > It would be ideal if such a software has a MUA plugin, for thundebird > outlook express etc. So that we dont have to educate the clients on > properly forwarding the spam as attachment etc >=20 > Strangely enough, I cant seem to find any software to do this , while > according to me this would be *very* useful for everyone.=20 >=20 >=20 >=20 > Thanks > Ram >=20 >=20 >=20 >=20 >=20 >=20 > -----------------------------------------------------------------------= - >=20 > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report --------------enig73809A4E0ED9610B4683AA32 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAks55YkACgkQvB4M5yQyqDeiPQCgrVzhi0Ic8RChdYB2G4or1SY+ xxsAnApZgbH47f20Und15+sznrwCECIP =d4kR -----END PGP SIGNATURE----- --------------enig73809A4E0ED9610B4683AA32-- Received: from relay.exacttouch.com (sweepmail41.exacttouch.com [202.162.254.41]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBTAF3wD004167 for ; Tue, 29 Dec 2009 02:15:08 -0800 Received: from darkstar.netcore.co.in (unknown [59.163.11.66]) by relay.exacttouch.com (Postfix) with ESMTP id 1B90AD08CA2 for ; Tue, 29 Dec 2009 10:55:48 +0530 (IST) Received: from [192.168.2.105] (unknown [192.168.2.105]) by darkstar.netcore.co.in (Postfix) with ESMTP id 64BBD66831B for ; Tue, 29 Dec 2009 10:55:46 +0530 (IST) From: ram To: ARF mailing list Content-Type: multipart/alternative; boundary="=-JELDecGebcYGyyBQSByF" Date: Tue, 29 Dec 2009 10:55:46 +0530 Message-Id: <1262064346.24817.34.camel@darkstar.netcore.co.in> Mime-Version: 1.0 X-Mailer: Evolution 2.12.3 (2.12.3-4.fc8) X-Virus-Scanned: ClamAV 0.92/10236/Mon Dec 28 18:19:29 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 01:09:59 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Tue, 29 Dec 2009 02:15:08 -0800 (PST) Subject: [feedback-report] Software for auto-sending ARF reports X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Dec 2009 10:15:09 -0000 --=-JELDecGebcYGyyBQSByF Content-Type: text/plain Content-Transfer-Encoding: 7bit Hi, As an anti spam solutions provider we quiet some FN reports. Currently I do not make much use of these reports. I have written some ( badly maintained :-( ) perl scripts to parse these mails and extract data for feeding bayes , or domain extraction etc We also manually go thru these reports sometimes. I was wondering if there was some software that would directly send an ARF report to the network administrator from whom the spam hit my servers It would be ideal if such a software has a MUA plugin, for thundebird outlook express etc. So that we dont have to educate the clients on properly forwarding the spam as attachment etc Strangely enough, I cant seem to find any software to do this , while according to me this would be *very* useful for everyone. Thanks Ram --=-JELDecGebcYGyyBQSByF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Hi,

As an anti spam solutions provider we quiet some FN reports.  Currently I do not make much use of these reports.
I have written some ( badly maintained :-( ) perl scripts to parse these mails and extract data for feeding bayes , or domain extraction etc
We also manually go thru these reports sometimes.
I was wondering if there was some software that would directly send an ARF report to the network administrator from whom the spam hit my servers
It would be ideal if such a software has a MUA plugin, for thundebird outlook express etc. So that we dont have to educate the clients on properly forwarding the spam as attachment etc

Strangely enough, I cant seem to find any software to do this , while according to me this would be *very* useful for everyone.



Thanks
Ram



--=-JELDecGebcYGyyBQSByF-- Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSKNdqw021908 for ; Mon, 28 Dec 2009 12:23:45 -0800 Received: from [10.0.2.2] (pool-71-178-108-139.washdc.east.verizon.net [71.178.108.139]) by m.wordtothewise.com (Postfix) with ESMTP id D950F4F8247 for ; Mon, 28 Dec 2009 12:23:38 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1077) From: Steve Atkins In-Reply-To: <7CFC7026-6152-4C88-B947-FF9318A05CE4@cybernothing.org> Date: Mon, 28 Dec 2009 15:23:37 -0500 Message-Id: <527C5D7F-687B-4CBE-B684-A0D5900013AF@word-to-the-wise.com> References: <3243DC6A-81EA-45E9-A467-77A3420E75CE@word-to-the-wise.com> <7CFC7026-6152-4C88-B947-FF9318A05CE4@cybernothing.org> To: ARF mailing list X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10232/Mon Dec 28 09:56:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 12:23:45 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBSKNdqw021908 Subject: Re: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 20:23:45 -0000 On Dec 28, 2009, at 1:51 PM, J.D. Falk wrote: > On Dec 28, 2009, at 6:41 AM, Steve Atkins wrote: > >> My view is that ARF is a container format. As long as the message/rfc822 part makes some pretense to be an email, leaving the details of that as part of the agreement between the creator and the consumer of the feedback loop fits into that, and conveniently leaves the question of whether the creator has falsified any of the data out of scope of the ARF format itself. > > I like this angle; it points the blame squarely to the redactor (rather than the RFC authors) and may move the conversation from "redaction should be outlawed!" to "if you don't like that an ARF stream is redacted, you can stop receiving it." Exactly. > >> Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless. > > But if we don't discuss it in the draft initially, we'll have to discuss it within the WG every freakin' time someone new gets annoyed by redacted ARF messages. That's a flaw with new people not skimming the archives (or non-new people forgetting history). Though I don't think I've seen it pop up that often. Maybe we need a WG FAQ? Q: Are ARF creators allowed to modify the email in the message/rfc822 section of the report? A: We don't care. Out of scope. Q: Should ARF creators do anything special when they modify the message/rfc822 section of the report from the original? A: We don't care. Out of scope. Q: But I can't identify what the email was!!!? A1: We don't care. Out of scope. A2: OK, OK. Read up on VERP and cookies and don't you have an unsubscribe link in the message somewhere too? Q: But I'm an ISP, getting feedback reports about all my customers, and they claim the mail shouldn't have been sent as part of a FBL, and they'd prove that if they just had the recipient address!!!!! A1: We don't care. Out of scope. A2: OK, OK. Ask the creator of the FBL what they'd like you to do. Q: But that means that AOL are meanies, who are sending reports about email that THEY NEVER ACTUALLY RECEIVED!!!! A1: We don't care. Out of scope. A2: So don't sign up for scomp then. Oh, and we still don't care. It's still out of scope. Cheers, Steve Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSJMsiQ017332 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Mon, 28 Dec 2009 11:23:00 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from rpco-crivera.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id nBSIoOeZ025764 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Mon, 28 Dec 2009 11:51:01 -0700 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net nBSIoOeZ025764 References: <3243DC6A-81EA-45E9-A467-77A3420E75CE@word-to-the-wise.com> In-Reply-To: <3243DC6A-81EA-45E9-A467-77A3420E75CE@word-to-the-wise.com> Mime-Version: 1.0 (Apple Message framework v1077) Content-Type: text/plain; charset=us-ascii Message-Id: <7CFC7026-6152-4C88-B947-FF9318A05CE4@cybernothing.org> From: "J.D. Falk" Date: Mon, 28 Dec 2009 11:51:01 -0700 To: ARF mailing list X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10232/Mon Dec 28 09:56:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:32:27 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 11:23:01 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBSJMsiQ017332 Subject: Re: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 19:23:01 -0000 On Dec 28, 2009, at 6:41 AM, Steve Atkins wrote: > My view is that ARF is a container format. As long as the message/rfc822 part makes some pretense to be an email, leaving the details of that as part of the agreement between the creator and the consumer of the feedback loop fits into that, and conveniently leaves the question of whether the creator has falsified any of the data out of scope of the ARF format itself. I like this angle; it points the blame squarely to the redactor (rather than the RFC authors) and may move the conversation from "redaction should be outlawed!" to "if you don't like that an ARF stream is redacted, you can stop receiving it." > Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless. But if we don't discuss it in the draft initially, we'll have to discuss it within the WG every freakin' time someone new gets annoyed by redacted ARF messages. -- J.D. Falk Return Path Inc Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSJMsiO017332 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Mon, 28 Dec 2009 11:23:00 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from rpco-crivera.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id nBSIoOeY025764 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Mon, 28 Dec 2009 11:50:26 -0700 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net nBSIoOeY025764 References: In-Reply-To: Mime-Version: 1.0 (Apple Message framework v1077) Content-Type: text/plain; charset=us-ascii Message-Id: <6BA3FD37-EA99-4F20-85E8-685E137B7AE3@cybernothing.org> From: "J.D. Falk" Date: Mon, 28 Dec 2009 11:50:18 -0700 To: abuse-feedback-report@mipassoc.org X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10232/Mon Dec 28 09:56:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:32:27 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 11:23:00 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBSJMsiO017332 Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 19:23:00 -0000 On Dec 28, 2009, at 1:44 AM, Murray S. Kucherawy wrote: > An initial run at removing all of the stuff in ARF that's not actually in use today can be found, along with diffs to the currently published version, at http://www.blackops.org/~msk/arf. I believe this draft accurately reflects current reality. Ship it! -- J.D. Falk Return Path Inc Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSGYxOJ004444 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 28 Dec 2009 08:35:05 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 64302 invoked from network); 28 Dec 2009 15:34:58 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 28 Dec 2009 15:34:36 -0000 Date: 28 Dec 2009 10:34:57 -0500 Message-ID: From: "John R. Levine" To: "Steve Atkins" In-Reply-To: <3243DC6A-81EA-45E9-A467-77A3420E75CE@word-to-the-wise.com> References: <3243DC6A-81EA-45E9-A467-77A3420E75CE@word-to-the-wise.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10229/Mon Dec 28 05:39:40 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 01:00:00 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 08:35:05 -0800 (PST) Cc: ARF mailing list Subject: Re: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 16:35:05 -0000 > Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless. Agreed. The current language is fine, people who redact are not going to add an extra header saying so. R's, John Received: from todzilla.mail.rr.com (todzilla.mail.rr.com [24.28.207.21]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSF5XZe030296 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 28 Dec 2009 07:05:39 -0800 Received: from todzilla.mail.rr.com (localhost [127.0.0.1]) by todzilla.mail.rr.com (8.14.3/8.14.3) with ESMTP id nBSE2K9j013131 for ; Mon, 28 Dec 2009 09:02:20 -0500 Received: (from therr@localhost) by todzilla.mail.rr.com (8.14.3/8.14.3/Submit) id nBSE2JUi013127 for abuse-feedback-report@mipassoc.org; Mon, 28 Dec 2009 09:02:19 -0500 X-Authentication-Warning: todzilla.mail.rr.com: therr set sender to therr@postmaster.rr.com using -f Date: Mon, 28 Dec 2009 09:02:19 -0500 From: Todd Herr To: abuse-feedback-report@mipassoc.org Message-ID: <20091228140219.GB13044@todzilla.mail.rr.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-08-17) X-Virus-Scanned: ClamAV 0.92/10229/Mon Dec 28 05:39:40 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 01:03:13 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 07:05:39 -0800 (PST) Subject: Re: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 15:05:41 -0000 On Sun, Dec 27, 2009 at 10:03:11PM -0800, Murray S. Kucherawy wrote: > In starting to edit the ARF draft per the proposed charter, I think > the ARF spec should say something about the practice of redacting > portions of a message about which an ARF message is being generated. > I know there are strong feelings on each side of the debate. However, > I don't want to get into a debate about MUSTs or MUST NOTs, although > maybe that is indeed appropriate (we can debate that as well). > > My thoughts for now are that the spec should say that an ARF > generator SHOULD NOT redact any data as that impedes the usefulness > of the report, but then the Security Considerations section should > discuss why some ADMDs might decide to do so anyway, and how receivers > might react to them doing so, and what measures they can take to > archive the redacted information so that they can chase down complaints. > > Comments? We redact, and here's the stock answer we give to those who complain about our practice of doing so: ------------------------------------------------------------- Road Runner is the High Speed Data service provided to its customers by Time Warner Cable. Our lawyers are of the opinion that we are required, by the provisions of the 1984 US Cable Privacy Act that speak to our customers' personally identifiable information, to remove our customers' email addresses from any and all feedback loop reports we send. While we appreciate your frustration regarding this, we cannot do any more about it at this time. We encourage senders to use the Message-ID, X- headers, VERPs, or the body of the message itself to identify the customer who complained about your mail. We will pass along in the feedback loop reports everything about your mail exactly as we receive it from our customers, save for our redacting every occurrence of our customers' email addresses. The Cable Privacy Act can be found online at this URL: http://epic.org/privacy/cable_tv/ctpa.html If your mailing is not using Variable Envelope Return Paths (VERPs), you might want to read more about them here: http://en.wikipedia.org/wiki/VERP Thank you. ------------------------------------------------------------- You may find some of the above text useful in building the more general sections of the Security Considerations section. -- Todd Herr Principal Engineer and Postmaster V: 703.345.2447 Road Runner Email Operations M: 571.287.0366 therr@postmaster.rr.com AIM: RRMailToddHerr Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSEcv1W028249 for ; Mon, 28 Dec 2009 06:39:02 -0800 Received: from [10.0.2.2] (pool-71-178-108-139.washdc.east.verizon.net [71.178.108.139]) by m.wordtothewise.com (Postfix) with ESMTP id 57C0C80F6F for ; Mon, 28 Dec 2009 05:41:10 -0800 (PST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Apple Message framework v1077) From: Steve Atkins In-Reply-To: Date: Mon, 28 Dec 2009 08:41:07 -0500 Message-Id: <3243DC6A-81EA-45E9-A467-77A3420E75CE@word-to-the-wise.com> References: To: ARF mailing list X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10229/Mon Dec 28 05:39:40 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:57:46 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 06:39:02 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBSEcv1W028249 Subject: Re: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 14:39:03 -0000 On Dec 28, 2009, at 1:03 AM, Murray S. Kucherawy wrote: > In starting to edit the ARF draft per the proposed charter, I think the ARF spec should say something about the practice of redacting portions of a message about which an ARF message is being generated. I know there are strong feelings on each side of the debate. However, I don’t want to get into a debate about MUSTs or MUST NOTs, although maybe that is indeed appropriate (we can debate that as well). > > My thoughts for now are that the spec should say that an ARF generator SHOULD NOT redact any data as that impedes the usefulness of the report, but then the Security Considerations section should discuss why some ADMDs might decide to do so anyway, and how receivers might react to them doing so, and what measures they can take to archive the redacted information so that they can chase down complaints. > > Comments? You might want to reread the last time this came up. My view is that ARF is a container format. As long as the message/rfc822 part makes some pretense to be an email, leaving the details of that as part of the agreement between the creator and the consumer of the feedback loop fits into that, and conveniently leaves the question of whether the creator has falsified any of the data out of scope of the ARF format itself. Also, discussing it will add significant complexity to the document without adding value nor affecting the behaviour of any implementors one jot. They're going to do what they do regardless. Cheers, Steve Received: from mail-ew0-f217.google.com (mail-ew0-f217.google.com [209.85.219.217]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSEDTrK025660 for ; Mon, 28 Dec 2009 06:13:34 -0800 Received: by ewy9 with SMTP id 9so1841088ewy.11 for ; Mon, 28 Dec 2009 06:13:28 -0800 (PST) MIME-Version: 1.0 Received: by 10.216.88.202 with SMTP id a52mr5498327wef.101.1262009608325; Mon, 28 Dec 2009 06:13:28 -0800 (PST) In-Reply-To: References: From: Yakov Shafranovich Date: Mon, 28 Dec 2009 09:13:08 -0500 Message-ID: <501c18e00912280613m7a1e4de9g9b9245ca9a844be7@mail.gmail.com> To: "Murray S. Kucherawy" Content-Type: text/plain; charset=windows-1252 X-Virus-Scanned: ClamAV 0.92/10227/Mon Dec 28 02:00:39 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 06:13:35 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBSEDTrK025660 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 14:13:35 -0000 I am not sure if SHOULD NOT is too strong, I think that section 6.6 as defined now is pretty clear. I do wonder if we need a header indicating redaction. 2009/12/28 Murray S. Kucherawy : > In starting to edit the ARF draft per the proposed charter, I think the ARF > spec should say something about the practice of redacting portions of a > message about which an ARF message is being generated.  I know there are > strong feelings on each side of the debate.  However, I don’t want to get > into a debate about MUSTs or MUST NOTs, although maybe that is indeed > appropriate (we can debate that as well). > > > > My thoughts for now are that the spec should say that an ARF generator > SHOULD NOT redact any data as that impedes the usefulness of the report, but > then the Security Considerations section should discuss why some ADMDs might > decide to do so anyway, and how receivers might react to them doing so, and > what measures they can take to archive the redacted information so that they > can chase down complaints. > > > > Comments? > > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report > > Received: from mail-ew0-f217.google.com (mail-ew0-f217.google.com [209.85.219.217]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBSEBtL5025509 for ; Mon, 28 Dec 2009 06:12:00 -0800 Received: by ewy9 with SMTP id 9so1839763ewy.11 for ; Mon, 28 Dec 2009 06:11:54 -0800 (PST) MIME-Version: 1.0 Received: by 10.216.87.20 with SMTP id x20mr5262344wee.158.1262009513167; Mon, 28 Dec 2009 06:11:53 -0800 (PST) In-Reply-To: References: From: Yakov Shafranovich Date: Mon, 28 Dec 2009 09:11:33 -0500 Message-ID: <501c18e00912280611t2114f4d5nd4e13d7f1d13eff9@mail.gmail.com> To: "Murray S. Kucherawy" Content-Type: text/plain; charset=ISO-8859-1 X-Virus-Scanned: ClamAV 0.92/10227/Mon Dec 28 02:00:39 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 06:12:01 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 14:12:01 -0000 Murray, Thanks for your hard work. Some comments: 1. Were we planning on putting the Domain Keys stuff into a companion draft instead of the main document? Then the following from section 1.1 should be removed: "To advise providers that certify or otherwise make assertions about mail of recipient disagreement with the assertions." 2. Section 1.1: "To inform email service providers or other primarily outbound senders that there may be issues regarding their mail; these issues include (but are not limited to) reports that the mail may be considered to be "spam" by a recipient of the message; " This may be too generic, perhaps we should narrow this specifically to abuse and related issues? 3. Section 2.f.: "which the report is being generated and MAY include only a typical forwarding prefix" Is there an existing standard we need to reference that covers forwarding? 4. Section 4 - spelling error in "report types": "Implementations using new rpeort types" 5. Section 6.6 - redaction: Do we need a new header that indicates to the report recipient that the message was redacted? There is a header "Incomplete-Copy" in RFC 4021 which has a similar purpose for X400/email mappings. 6. A general question that was once raised on the mailing list - do we need to take into account RFC 3864 and the message header field registries? Yakov On Mon, Dec 28, 2009 at 3:44 AM, Murray S. Kucherawy wrote: > An initial run at removing all of the stuff in ARF that's not actually in use today can be found, along with diffs to the currently published version, at http://www.blackops.org/~msk/arf. > > I've also copied some text that went into RFC5451 after one of the SecDir reviews to discuss extensibility, and added a bit more text in Security Considerations about the idea of omitting data from ARFs for privacy reasons. > > There was some other minor copy editing as well. > > Soliciting your comments. > > -MSK > > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report > Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBS9Ekc5000516 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO) for ; Mon, 28 Dec 2009 01:14:52 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Mon, 28 Dec 2009 00:44:13 -0800 From: "Murray S. Kucherawy" To: "abuse-feedback-report@mipassoc.org" Date: Mon, 28 Dec 2009 00:44:14 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: Acp5y4OL973C1PM1T0W/yg+ySE+qRQNziFMg Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10226/Sun Dec 27 16:44:33 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:33 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 28 Dec 2009 01:14:52 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBS9Ekc5000516 Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 09:14:52 -0000 An initial run at removing all of the stuff in ARF that's not actually in use today can be found, along with diffs to the currently published version, at http://www.blackops.org/~msk/arf. I've also copied some text that went into RFC5451 after one of the SecDir reviews to discuss extensibility, and added a bit more text in Security Considerations about the idea of omitting data from ARFs for privacy reasons. There was some other minor copy editing as well. Soliciting your comments. -MSK Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBS6XjjU020515 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO) for ; Sun, 27 Dec 2009 22:33:50 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Sun, 27 Dec 2009 22:03:12 -0800 From: "Murray S. Kucherawy" To: "abuse-feedback-report@mipassoc.org" Date: Sun, 27 Dec 2009 22:03:11 -0800 Thread-Topic: On redacting data from ARF messages Thread-Index: AcqHg2+yru4YT1DtTziFKxJT/fgJMA== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10226/Sun Dec 27 16:44:33 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:33 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Sun, 27 Dec 2009 22:33:50 -0800 (PST) Subject: [feedback-report] On redacting data from ARF messages X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 06:33:50 -0000 --_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable In starting to edit the ARF draft per the proposed charter, I think the ARF= spec should say something about the practice of redacting portions of a me= ssage about which an ARF message is being generated. I know there are stro= ng feelings on each side of the debate. However, I don't want to get into = a debate about MUSTs or MUST NOTs, although maybe that is indeed appropriat= e (we can debate that as well). My thoughts for now are that the spec should say that an ARF generator SHOU= LD NOT redact any data as that impedes the usefulness of the report, but th= en the Security Considerations section should discuss why some ADMDs might = decide to do so anyway, and how receivers might react to them doing so, and= what measures they can take to archive the redacted information so that th= ey can chase down complaints. Comments? --_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

In starting to edit the ARF draft per the proposed cha= rter, I think the ARF spec should say something about the practice of redacting portions of a message about which an ARF message is being generated.  = I know there are strong feelings on each side of the debate.  However, I= don’t want to get into a debate about MUSTs or MUST NOTs, although maybe that is indeed appropriate (we can debate that as well).

 

My thoughts for now are that the spec should say that = an ARF generator SHOULD NOT redact any data as that impedes the usefulness of the report, but then the Security Considerations section should discuss why som= e ADMDs might decide to do so anyway, and how receivers might react to them d= oing so, and what measures they can take to archive the redacted information so = that they can chase down complaints.

 

Comments?

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E8A284EXCHC2corpclo_-- Received: from web112109.mail.gq1.yahoo.com (web112109.mail.gq1.yahoo.com [67.195.23.96]) by sbh17.songbird.com (8.13.8/8.13.8) with SMTP id nBS56FoZ014841 for ; Sun, 27 Dec 2009 21:06:20 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@yahoo.com Received: (qmail 56653 invoked by uid 60001); 28 Dec 2009 04:06:15 -0000 Message-ID: <242982.55795.qm@web112109.mail.gq1.yahoo.com> X-YMail-OSG: E5JtszwVM1kI7iDXnrtb.xMBS5yFHeF7z6iNXOS_P29.9XEaOhWkCT7w2bKEuWvtqMG3IckO8M6OBYA7JfYlTxERVvl4Nf7i1GF9NC8xjbGqsmRd8.BL3RqRAo.BtyXLv.49pu.OIVNw_ufKobl3QHj7uvBU_ts0srG97hZEuhnA_UE3x_ujAsue5Hs039ZUOo6PNkfT3vZOQvF_IvG3lPJJ0px7FiIAc6b1_nZ7Vn7ILjDXfRAlTdeoZNxt0H2mCJvw.D_tVu.2.PVplGVWpY9ui0NlYbucEgjuwl4- Received: from [76.89.197.242] by web112109.mail.gq1.yahoo.com via HTTP; Sun, 27 Dec 2009 20:06:15 PST X-RocketSRV: showStationery=1261973098677@dclient.mail.yahoo.com, 1261973098676@dclient.mail.yahoo.com X-Mailer: YahooMailRC/240.3 YahooMailWebService/0.8.100.260964 Date: Sun, 27 Dec 2009 20:06:14 -0800 (PST) From: loretta lotito To: abuse-feedback-report@mipassoc.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1829281109-1261973175=:55795" X-Virus-Scanned: ClamAV 0.92/10226/Sun Dec 27 16:44:33 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 01:00:00 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Sun, 27 Dec 2009 21:06:20 -0800 (PST) Subject: [feedback-report] list X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Dec 2009 05:06:21 -0000 --0-1829281109-1261973175=:55795 Content-Type: text/plain; charset=us-ascii Hello! --0-1829281109-1261973175=:55795 Content-Type: multipart/related; boundary="0-87600532-1261973175=:55795" --0-87600532-1261973175=:55795 Content-Type: text/html; charset=us-ascii
Hello!

--0-87600532-1261973175=:55795 Content-Type: image/gif; name="--static--piratelife_rb.gif" Content-Transfer-Encoding: base64 Content-Id: <1261973098677@dclient.mail.yahoo.com> Content-Disposition: inline R0lGODlhfgB5APf1AHR0dGtra2xsbGdnZ3BwcGlpaXFxcWZmZmhoaAEBAXV1 dW1tbWVlZW9vb2pqam5ubtbW1t3d3XJyctvb297e3tra2tzc3NLS0tnZ2dDQ 0OHh4dHR0c/Pz+Dg4NTU1NPT09/f39jY2M7Ozubm5svLywMDA9fX1ysrK+Li 4gICAgcHB+jo6M3NzWFhYczMzAYGBsbGxunp6TIyMtXV1eTk5AQEBGRkZMnJ yeXl5ePj4zs7O0RERAkJCRISEiEhIQsLCy0tLUFBQUhISFtbWzMzM2BgYGNj YwwMDAUFBTg4ODc3N8rKyhgYGCAgIF5eXhMTEx8fHxYWFsHBwWJiYj8/P+vr 6zAwMDExMS4uLiIiIr6+vsLCwl9fX1paWnZ2dlxcXE5OTj4+Pjw8PD09PSws LMfHxxERETk5OVVVVV1dXUZGRioqKg8PDzQ0NFlZWRcXFw4ODr29vcTExOfn 51FRUUBAQDY2NlBQUMjIyBUVFcXFxSYmJiMjI1dXV+7u7ikpKUdHRxAQEDU1 Nb+/v8DAwMPDw7i4uBkZGVRUVDo6OkpKSgoKCiUlJRoaGggICOrq6k9PTx4e Hry8vCcnJ0xMTBwcHOzs7O3t7Xd3d0JCQktLSyQkJFhYWFJSUi8vL01NTRsb GxQUFElJSVZWVkNDQ1NTUw0NDbe3t7W1tR0dHZ+fnygoKLu7u0VFRbq6unt7 e6urq3h4eLm5uX9/f4WFhbGxsXl5ea2traenp7a2toODg35+foqKivDw8Hx8 fKioqJqamp2dnX19faqqqrOzs6amprS0tKysrIKCgq6uro2NjZmZmZSUlIaG hpaWloeHh6mpqYSEhIGBge/v77KyspycnJCQkIuLi46OjvHx8Y+Pj6SkpJeX l56enoyMjHp6epGRkbCwsKGhoaCgoImJiYiIiJWVlfLy8q+vr6KioqOjo5OT k5iYmKWlpZubm4CAgPPz8/v7+/f395KSknNzc////wAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAACH5BAEAAPUALAAAAAB+AHkAAAj/AOsJHEiwoMGD CAuqMGPmSSQlVHQouiKDCKiEGDNq3Mixo8eNVjiNArNASgh0O8DcAdTpo8uX MGO6XKOoyBcJeDQUalBNEUuZQIMKfUmTWzJahuINKsaNkpA7Q6NKnTpwzZ0h bpSJg1UrlhBIlMBQHUsWJpk7nwDtKAaDWR81YMBoKku3bsY9kDoFYKaMjpdg 61QhCmK3sGGBR+hAYsYsU9pPvGyJopTisOWyprpoGuVE5R06dMKAugPnsump LybxWc2nyaojA8Gc+APk0OnbZA/ZQVQEwZQAhGWWKI37diVEaBY46LOgAYIF aICqUFT8diAEBx7Q+yLAuQOoMhN8/9FR3bSjAQcI0HOygEABA3SCdgETpbzl GghsLAgwpMUAIws4sQhQQdAhln2HdQEJHWm4AYkbX6CRRn0yiXEHGk8gaFgP PDzByR2RrIHFDwPGlMAZbvThxhgaHhYJGHQoUc8YPITXChe9CeDGDy0mVIIK Qr2xhyZoxNeEjDK1wIUTDChwhxo19mjQC0kE9cQai2SSRh9N1BNEIDIJ0UUX RTQwBSWf1CBlQaZQJ5MPf6TAyBqfaKJDApW0IZMjn3TiBhphTEIHFiVIWUMT bhSAACQx9YDFH/WUAIgplIRxAhD1KEFETC+ggUgpdvhQjyBArNFjGwHsIkwB nHzyEhOeXP/Rg0AynFAPGGqUIARsYUD6Eh8OGtHEGT0cIkMjfCDYBBqvvEIF mKmAl1EJR6iAhBVqXJGHQDVgYSsSkAhRTyOJCASEGKEQlAAbPDiSQEKKjOLG EGiwsUM9q5yQBYUDIWFaAg68MspFAu1ByUY82DGENM0qYIsvCnjByy7S0KIN LZjE8s4rsXjhyy6YAAAAPQ7sYIcMhR7EAxqZ1GFDK3vwIaMYZKyybT1wnCHI u5YhoUMWBJlBCSJjlKtRELygokUctyigSgauDBJBBCPgQMMK2VRxyRZf1DIB BBtwwIu/GP2hRhA7NNBnPYmQUQ8Qq3jigyij+MBzcUwoOUUBV3D/1MgUugiA xRWkeAHOKSgkPsIjfpwjzwcI1IMFL1LUwg0pGslgBxlBEHACGKnUswOPQAjg zRBqIEjGAwxwZ4VHPLyLhSP1kEFHOVpMgEIHNODgCiRkX7EbIxq9IAgjWQTx QCOAyIiFGgIUgwELdCSRbHlRoOfGFHN99MIZ7/YQyAubDGCLAA+AQbxAfJC3 qUZHtNEGKDs4kIUYaRhBgDXcyOHBNmSgAtDKU4MWMOAAaRiCS5rgq0aYQSBo cFNBxNADJmBKI1DYA42owIVddIMdJiAAFNTACSFEoh6+ss8oOmGDIrDoI2MA Uz1k8MASoM4gNThDPc5AnIy0hgoneIAs/7C2DQrEoh5MeJ2UwIAGJ5QiQx4J xAvrQYRZlSAN9yoIKKyQBR1uJBCr+EIwNqABHJyDGIYwQD1SoAPYtOgKnkBA F+rQN4+cYYD1aMML1uiE4BCECIwIQ5Q0woQ+CGMLFzABBUZAAl6IwlyCaJEP xJACAUBCB1SoDEfYUAeeHaFKkXJCJgpSgjPI4IIaOcEvcqENSZBgAxCwwAwI kK56qKAOarLPD8aggicgAA1JqMMbOpKILglkEkpMgSgLkodPgLIGbzjECTRJ EBUIwQCsGAYwToEHDrAgDr6gxM3qcYX1VScBSjhhG7hQACoooY4aCUUY7paI B66xBXUoSCuCwP8GRpBCB22AggwJsgdfuOIObOgDPeYBDGy8QgkqYEIkBRIF 8pDSNHZA0g66EABGAMEOHFEDFAbSiCkmwAhhGEgJDjEFAZQjF8UQV0FSQAYH yMIPVXCVDK7whiQgQqY1qAPt6pGAOkQpBXsIAr8ME4l51sMRo5iCAyLxBxkM NCGMoAJBqLBULpSCCXZIQzluUYYZQMADF/BGLQXCiB1MARy4uAU4NhG/LuWt e5KbxECsAIUEUAERm+ihYX6QCFNA0gELCMQVapaRVFCCbPXwgQzqwQMoCIIK 0nBGLkhggcRRIAQz2MAGJCGterxhEQlQgWqB1IQxuC0UDHCVQEIxxTf/dEEY rABGI0yzg5ESNROHQIADVCADJogBI3lQgyNS8IQ3ZKEFRmhGMHLBgc5WIQYr wIEGQGABDEDgAxnIAC9KlBAfEAFTbygAowYiBh6wQRDIkBoFICANHh1mpwOJ RBsc4YAGlGASxnVjPZBwhFRYoQ4nGIIApiCMaoTDEHr4gAlAkDgajGAOK1jB CHKgAQpMIAQe2MAFauGJjKxhDSVmQgEOJBAy2KAaGxgBDShQgQnAoBSHOcQo BxIEOCwiAAF4gQ+aMAlTCYQHoIhEExQBjFycQgowwAMLRCzhCVCgjCt4RBWu u2HuYiC0HJBCFzLSBgMjkQFdaEICgDCKX1Tg/7o02F0EKhCBX+CRKgkg2yJ2 0EMogNQUAXBADdgggyOkdEqzcIUkBlEIGNyABRnwQAisjIIRxMAS08DpCmjQ gTlD4AIcIEEs7maQBBAhFW57A+ta8AAt5OAS113BHGiw3QlgwAMBgOxUUmCH PxB3EwSpw6wC0YAxo7MeVLBnQUhxizgw2tFTljSlLW2JXmia054GNQe0IWAc EsEHGYqCEXZxig7EYA4x0BqXc9CB7lZAEsclSwpW0QrMVWWy9TDDAhgAJEHA IRIgNcgeVKGFQWwB2hmo8pVxkGVLrNvLYBOBCHAROoSoYBXNBQI9DDEBDtNg Doyz9iNm3ekKQMAEyP+YVVl08Aw3gIkNYchlDwQgANhksARByCVBePCMOGhB Cnq4gQs48AEI0LkDORhBhmVNaw+DeAMiYEEuRIWQFGTBEwA4xQwsMIEI8A7k lxA5yT0NgThEpywycEYypLGDVhhWIDMPAI/yEEkrmHMgCYiFIeIgBTnggQQc uMAMJk0BpOPg8HGGOHhZ4IJT4BuHViBAMljwgQtAAAMWoLDSq+DwGGy43d79 wAfAAcWxvEECUUOHBJLAMzMIQO6RokIJnmDRgrQAFYtu9BKmXHQMRAAEGkic BjoAggh8eAagJsESZHH2glwhAMeAgQtIIALBE14DFl4BdmXc4eNf4AKGyCf/ WY6wAFhIARUP6IYAIMWGAsB+hhkKwzALkolcSEILBydBBqqPeQyYAPMUQAEo oAHd9WkZwAJLUAaE8AUEkQJJQAftoAV6IAdlsHsJZ3SZpwE5cHg4wGHcVQEm AF4SFznjpw3BcAPq0Amn4AG3cAAyYAMCUCIeVQ+HcGgEEQTJwApxsAVSQA3m gAxdoAaisAOiUAT00ALNwA7UMHQcYAIXIAIkAANlkAYEwQRBUASwQAgG52hD Z31dBwIdEHzDV3wVAFqg5gIbEABlkQBOMAuwcA0LMA6XdwGw8ABOoElsoFX1 oAPjJBBhgAuuoAXGsAB2AAekVjsDIBCOAAVWEAQN/4AJzkAMxkAIN+AEpeYG ySAFQFcG1HeBIVABFhABAUgBEWABZfhd+wd4BUAXL0AFRLAKdXANHuABE0AD FYALkGBPOlAaTDBFAnEG4hAH1OAGe3QQZLAAB5EAgZAKVFAKvtASBsEGmMAK hNBoN0B9G/ABM/B/NTYBE1AB/jcDIugCj7aKdGEKbRAFUMAJN2B0FIADvUAB wSADNTAJVKcDS7UG3XAMDJgQQPAAKZMQNWBfBmEHqsCDFCh0HJCNHnByIfCQ JmACZ3UBB0gCeOACJEgXSqAElZAI3dBdEaABI3AJ5wABvrADoHQIvmgGyxCD GPGPQAITJUAAi7YFelAGQv8nAhlwAR5gAiDIk1EoB4VACD6nBXiAjHVhBpDg A4GwABwAil+3An5QAc/gBUokBtdTD3kgAMD2kg9QjDBBCrhACNV4k0InYjAg CcFADgagCLRwDMMAC7BwC+TQCZrQBYJFFlRAGH3gDiDZASiQdBewDB0QB7Hg A7uUSz9wQhkRRGCJEWzwBCeQl3mADUtDCAfnAlswDACACFbQA2QTADngB72Q DfAAAZxQD0kwVHShApTgA5MQAKgwZxZAASCAA+swABowDSNADA5wBljgEYCA AI+pLm8ABZqQCIKQBY0QkAMhALinBXKgBcBwAHtwiKqJB35AmtUGA2HwPnWh Akn/0AY6oANOQAggYJsgoAqgEAYa4AeX8AghUAwDsFscwQUHEJCDdgKJsAC7 gA56gAfXYBsIsRasoAW4QA+AkBBmIA5+YAmwtgJV8AuoRBcl0Dd8YCd0oAqG UAsAICpjgAHnRoATIAfK0Ac+QE0J8QVTYAZ5EARDYA2/4AIhsEjbFQEXoAuV gBB8sAysEA170AJZhBAAEANGqmGchgmsSRdAABuhsAM+UAQ2sAmaNAm5sAIo EAIwUAvBAACiIAZ1QJAzBQd/wADIMA6DgAE4EAOXcG60RoYTsAELQF7V1Azm ICpdIFMIMQQhMAdVw24aoAd4RRdrMFFwUApTQABsQBBG//ALv7AN0NCCUfID OkdUPbAbs+AOejADlYZd2oddc9CBHUAB7lYGX+CcA4EA0DgEenoQRCACtHaj dDYOe2AXNaAEVBcFnNACUcAEMuAGDwANW+ABFqCBqtCH9cAGRIAI36AKkuAC GJCeYbiBWcZ5XJZ43eWThrBjBREE9smqGLEHW6ABU2OKJjADGUAPlVoWJ4AG k0AEBNAMz2AIHiCVl2AJI9BhFFAGmFNVglAA2HAMUuACHzCLl2dl2EdtfjAN EdqBZHiuJuAMvkUQSaBy4JoQoAANFIABGBACZ5WNqHAwZdEDeyAEfSAOuKAF EIACDQehluB5KPCBADAJO0AJs/9QCzdwA0uAjb2HsB93adOQDQ2bAw8rjiQg AKhKB0wgEBeLEI7gDLI0A2iVAVAnBcKwVMLxA42gCGDQAg4ADNSwBSTwAV1X eJ0adn7wCF1Wm7ewo/XwAliwDWWAB0ugkz17ZRZ2adtpCY+QXTE7Z+fKk9QA SgOhBN/aqjjEC2CzAeG1AVrwDTvQAmqAnS6RAFYgA03AB0lwDbrnApAmbZrH pgyrtkRrinrQBwSxA6ewBBbohV63gSC3ZY/geW+arR8QNiJgCzEpEJqwtPXQ tAdRArpwgCzAAUuwDEpQA5WgBp6gV0GhomuwDDCAcD2JsAynZX2LAyjgdBAQ DTr3AtH/oLOQxpM++XsJi2GgKqoeFnpQxwHGQLheUkvAexCvkLMsIAkFMH86 oAk1QArrGhRIQAtyEKAucIG+B5g4MAcKLKqeZgLhYEwCQQdbsAQuIAIb0JAY 0HVh2Dsj0MHqa4pmyAFQeAOxAFlksKi/i7gG8QpycAPEUAAEiQYlNgluIxUl MAuEQIHUx5OT5nWBSQNxNqrH5wFSMKQzQgwk0ImC55O1CXyBmQOJQ3zG510h xgEusLPQAJ5AYLELihG2IAe1MACV2gKi0ooqGhQ3/GyPZsBfCIajWorsKwLm KBBNMAzKN3TZCAGf2MQd0MfER4q2ZgJTC4V4UAaDUAQDQQb2/zQEj4QRr2AM w0UQT9ACN1NmUnEE3qCJOmy3egyKoch1p3i7UacLAfkExXADf1e8PNnJExCK U1OK3xiOFCkCV1wGegAD2EAcVkA2iHAAlCsQREAL0aBy+UUJxQgHvhgUbZAO ZNlo+td7XrddHcZ1T2fFLrAAdxMK6lDIFKyTPLmNHNuNFQCOIXCut+tNFgkD ciAHwyAjL6AEPAMJA3DGA+EDiYAAekgQYgAIAWkH8ycUXBAO9zfBhnAM0JAM 1WAL9EAAsxALzgALO7gE7UsMSCIQT9AOZRBl3Uy1BXtyJvCQ5QwBUkuR6HwD ZSAHW0AIqMAF9dAD+FYCBdDIBnEEmf/wBEKwu+xFBZCVB0oUFD+AFK4gBXEA C5iQBonQAjZgT0TgCGFwCD0FCUOADdbQByq6CbgwgRpdwQt5AQXrATMgtR4g eoxb0rZcCFKgBVqgRozQlUcgAalzEEnQBIvgRQRxBInQBpCVAGGA0zGxB+kg C7VgDVwABlhQRQ6AAMZ0BTxwBW57ZHQqEHVwDIWwBXKQ1cVLtSL2fd831lFH AiatB2Y9CJIQB8rAA56Awk+goAdhBZtyBI1NUmtABo+JBXcWE2DADF4gBJXQ CIKQB+SRBjYgfk3ABG9A1wnRCqcwCJhZ2ThJAp4rAhwQ3dItcdO3BIUM2lIw CHHACqxQDXz/AD4CwQQA8NYEAQpJUBmRMLF7ZQZM8Jh5UGIzxREpkAIlgAST AAQ88gKZQFigKQo2EBx8AGykwNcGkQaGcH/LHXQkcNlUmwHe5ALVjcowgN3a zQqy4AqqoAlZyQSqTRCmkAlRsge1TUX1EAW6VgJKoEkqgAWAoN4FUQlXoANK 4gQJ1AedUApooCJpMApc0AmckD/iBwcgpQSrgBEJYAun4Ap8Z9Z6IAmogAqS aAzGgApxQMF1m84orYXbLQunYAiqQIwDkQcG0MUCUQJ2YJ/1kAWMiXefcAJi oAOlVw+eYAaH8AmcAAab8Mv1EAqVQAZFsAAGIAEKMOiErgAAYOgK/4AJCGAE 4lcPYRAFgdDoB7EIzaBopzAMytAAotACATAFoPAET9ADQKAIQuAG18AMw4DW W2DWRCkLhoAKhqAMMv02DkDme0h1AoEF3VYPpkAHDoCfAVAKVlACPtAHRuAE nzDiCUEEC0APzv7s0P7sCpAf8fa2VZIEb3cQTbAMqAAMDNAGxCEE9DAABG5L PLAJVzAKDUALqgAL4eDqrj4LBCoQQRAArZDIj/eLxSniCeADQnAAA/AFvOEE dODiCZEAbxAFYNAAItPwIhPt9KAAA9AFfSAGQRAEYSDwSRCcCGEH1jAAKSQQ O4AJAzBIGOEIoLAJd9AH5GAO3pCaBEEKA/8A81DA8fmVzwPRBgPCCFfgBEaA AEXQBZ1g8giRAHawA6XgAAMwAA3wAE7/9A9gAA5PDwBgAF7rAE+/AL7RAneA 63iHBkrgnHlwHM4x7x1hCnAgBrVKEGqAAGoIBUBAalFACvBNEDrwB3TABQxg A1OQCK0gXFxgKxmhAj3g8wiAAEuf+IlvBAxQAAvwAARAAAZgA5H/AEoP8O7n AC2wpESF5rluAwjQAqKfBnn6ESlQB2esBgFQAKtgZAPBBIxA2wTxA2JQBA7w 86PQB1rFCG0gA0VwAENwBY9tEGOwAJjgBcif/MkPAAQgAAWAHgDv8wOAAAKg HiPTAAKwTBmhAwv/8BsF4ABFMAXGvRGC0JWpawADYPPhbSp1EJOpUBOIbwM7 8AQ8cAYv8AJqUBkvkAWtABBhKtUjWJAgEh9KxNg40PDAgAEICkwMIGDBgwYE DNAbIICeBAICEBxgMMABA00GVRbUYaCIAAcFGCCQsdJmwR+ZaqwMwsDGEYNv 1tR7IqMGETcIEDQo9SdBvVCC4NT7Y+WmTUeHKlFaYIDA1wYPFgggG7MAggEO ixRpOKDAAgL0AACQkOYqSwJpGggoQJLI3ZVEJq3koeZtoIKVThAcI6oLAgEE 7qwRlEUHFUibAvFphQSwzU0O5o4GoMC0aS9eFJAO4ECBXNL05BboBDhM/4MW RowUSdPlyueCPXY8NZglUREJAvgQjNKGR6o1boYwLCXER6UzYrD0aASEzJ4f wAsekZEEzBcG6dWvZ/CWgAS5ChYU8ALgowSvXwk8GKAoSR42AjHDjB+IMyMU QAqQQAIE2BCPMTMMeqGNM3pg64BSxkiEkym+cGAvA5JrAwkVHOHhwatUiOKN Q7gQYEEY75OgAQdIYqCtA2zoy8YbHYKIgdxsYKiAALhQgxJFNOmihSlscEIU H7LIAopD3ojiyitBaQKKSJQAAwomxLiDEkTc+CKA1siyyAEDXoONngBCQfFB FQ6ISza5HiDAvti8yoiLATSCj7TRviptNa/aBP9JzwaAbGEAAyJ9QM0Fxgpg gQYyQlOjAbhwwgGQLnoAzgIMmM8+PA0IYKo5P/tBiAZQlQ0ABu7EE8/RDDDi Vl4BqOgBI+I6oAAjDODzAQQWoCc1ejSSDSQHlAK1ATQfGO0B0Qx4YFgBGjjg Ul1m2QUBWekxgBPiWr1qjSGs5ZUeBuB791YFBligXFwLsMWXeAFAABMB3PUX pAIaUCAAyApWAAEvMMFkL0gPvheAAZDRxZdvbGggml0mbeAZTIiUFYACFFH3 rjGMiPVdAw6Yt1d78Z21AEwWCMA+A9JaGYCx8GNAAQf0fMAGkmkRRhhMAjjg G12QKcK1AprRxVu+zkL/IGcBbAiA1wfQOPFkmzw5wNh5CSD35VsZ2GheAAhw 4N5bbZUtzVhVrRYAkZQagMGSCogMb4okwHltc+XC1QBITAH7plKUZbuBAmTm tWXJca3c8rlmHc1wPmGbazXOL+dVgiK+XnylLtx8F28GRAfAW9HRln122mmn +IzTb3JC9V65OID31QOIvHbiizf+XQGK2Cn3laYAflYHPnU92diPt/54A4aA gnmbiJ5X1wJEk51Wwq83/3wJbFCC++5lVoCBisR/ue3Wz7ff+ra7wJ39lYzA F2/nteZyJBve/Qw4vmZ1ign8swkXnjcFgwlQdjYo3wHNdxrTfCQjDHLAF4Lw /wIG2mQIz2udrwr4roMN4Hlos4/gXrcAB8QFJF4RAJpseEMc4hAiO4QIAkaR iSBsL4Q3oYPj0panAVROAsUaIABCJIGKmOoLnPhCGr6QhD9ggQgyIAIQTvBF MIZRjF8kwySOsIgfpPEHi/DMEAGDhRPKhgFyaYAKVwcAGwhAcg8ASUUWgAZF 3AEIUAAFElLgRkQ+KAVp0OMRX2fHW82lPU6kB4gIAKQiJEIHguiBgxL5SXX1 4A6NlCMdISkXAgRgCi0IWAAQ0QdSMOIPPWgjKG0JtiOM4gCZKsAU6HiAGXrr AIAIww6aAKBbJpN/ebjCGb7AxAeQwgqesAIRngBCZThmE5GAAIAXJNAEbYYT lERwQhWzIE50plOd62RnO935TnjGU57zpGc97XlPfOZTn/vkZz/9mc2AAAA7 --0-87600532-1261973175=:55795 Content-Type: image/gif; name="--static--piratelife_tl.gif" Content-Transfer-Encoding: base64 Content-Id: <1261973098676@dclient.mail.yahoo.com> Content-Disposition: inline R0lGODlhggFEAPezAIWFhZycnAsLC1lZWS0tLaenp5CQkCIiIhYWFmRkZEND Q3p6ek5OTm9vbzg4OAEBAbGxsQoKCqqqqqGhoQYGBggICAMDA5eXl6ysrKio qK+vr3JyckJCQhQUFAUFBVRUVA0NDVBQUDs7O0tLSxEREXl5eWtrawICAhMT EzIyMj09PR8fHyQkJBsbGw8PD01NTZ6enpWVlS8vLwcHBysrK0BAQB0dHZqa moyMjHV1dS4uLiwsLBAQEAQEBJiYmKKiopmZmaWlpQwMDBgYGAkJCXd3d1dX V4uLi62trTY2Nq6urjk5OTQ0NCkpKTExMYODg6OjoxkZGSoqKnx8fBcXF52d nYiIiGlpaV9fXzMzM2JiYpOTkyYmJj4+PigoKB4eHqurqxISEmFhYUdHR2dn Z6mpqYSEhFhYWH5+foeHh3h4eJKSkhoaGoaGhlVVVbCwsFZWVk9PT1paWm1t bQ4ODiUlJSEhIaSkpERERG5ubpubmxwcHHt7e5GRkVNTU15eXjc3N4qKiklJ SXZ2dlxcXIKCgmZmZmpqaiAgID8/P42NjTo6OmhoaI6OjiMjI3BwcDw8PFFR UaCgoEVFRaamppaWljU1NX19fYCAgGNjY4+Pj0hISIGBgXR0dEpKSpSUlFtb WxUVFV1dXScnJ2BgYEFBQUZGRkxMTGxsbImJiZ+fn1JSUmVlZTAwMHFxcXNz c39/f7KysgAAAP///wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAACH5BAEAALMALAAAAACCAUQAAAj/AGcJHEiwoMGD CBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWr WCuEYZGlRhYdjihgHUu2LEQeIdpUKROrrVsgrGyYnUvXLAcYbvPqlXCmrt+/ UUfoHax3gwfAiBMXxUO4sdtBDxRLnqwzBZK2EBwT/kC5s2eYQvBm+CNB82AN Bz6rXq3wRAWNcdoKYmCa8CHWuHPPqiDGAsYHVmJRCnOh9uALhzESmaG7+dMH NzxhRFEaS4vMxvNioILRgokwzsMz/0WTgcdFFrEyRMCSXa+GLxj/+Igsvv5R wSXoUyQQi1AHDO3l9d5FCsSChX0IFsUGgKxYtEMsS3Dg1g1mTDAYBkf8oJcS e1jkBRgQjJLgiEI90VYkFR0QiwixxWIEEbLQkUBeJbQQowl5SdBBRS7oEUsM J5AopE8qYFYDRQjEUkNsc8jipJOptPXECU9aoEksGxRAiRAU9VBIW3AMKeZO HlTSFgZOTOTBBCOEEEsdTzqpRVsixCnLC7HIEMAFQU6UR1sTkDDmoDg54FYQ iPgZiZsd2JlDWx/YSYAECNyxAEVwuDUCoZzahIlbVbAh0RAHrBKLC3EeAIYG sQBRQZwrBP/AW2oSCeKWJsnZhIABAQjQ6YgHsNrWFhFI9ICJQzwZBRAQ0EBI LCbEqYIEgk6UwhtuWZLTALEUgMBnBwygwK8MzegWH2I9xIGZsXQSyhAvqBIL H7Lo0BYjJFAAiIVWQJLuQytA4dYRfd5U4AAVIaBAAgAEAMDDCzDw7VEMI1xA LAgTFO64UwkwQMYvRVCcW2r08FAgOQJIpywRaBjLHTfodeRDYQCRVwoKIRBA AgIh4MAACXzMAK0eHbAAANw2MJEA5jq2gK8mOcAxQlD/7FCBsQAQCwECVTzL xSAXhEABBggkgM8ff+wA1BhJrVDVYS+kAAANCLBA1jLRgK1bOfj/1pApjWVA gpNfElYGfA5FcEReaCxEWywBXEzYAhNzFIBeDkREwOUFAK3XAAxcXADXJV3e VgGoPwyAAQ27VcBDpscyENZak37Q2JBrTVgAcVMUO+oFqM767w8dcLEBndPE bV6GOZTEE9i5FYMsFTwgB2EGSPGQBZdotwJDy7vVKwINuE707Ww79C3WbaW/ kPFtKeBkXgY4aWi354f0eGO8ugXAQ7qT3UBitxDy6cUADgidWwzgvoEcoIEH 2R/2Yve/ggjAdgUpX1sw+BAFcFAjJzCDXtTgt4YcgBQZcMsPpgCDLcTMLRAo ggj+xZAITEEvbnBI02LBgCfdrS29oloA/5Q2EQ3GgnIOMQAQBTA//z1Jcpci CX/awgAB6MVXSsSbQwJIEC4yRC8IsF9eomiQbmVuIVPkoRXzgsW2VLCLsTBA 5QYSvg/2DIKzUFHWUpO/iyBAXnkxQUSkAAbNYGAJEXGBifKCiVyhMS8EeJIe 29I7ATDAdHMcyAXfFjsGMoR9C3hS7BrwpACeESH5U1EAxjWAAtRNbm0hYhbb 0jM3IgQB7tPdG2fhxYXMMgBxit3WxPbDrNlxdrEUyCwFmCQtCkQBvxsAAdhW x4MIYIgFUcAAFiDMOHYkBdFrCxkKphASoEAWbnKMCASin/d9Qi8XAEHxIBmn AAZxFh67W+x4Zv8QrckRIduUXBzxOEC3JOBJs+yhkwJYNoTQZo73i0UCJFeA BJzSIMuDWgBfJxCtBcCa2ISjM3lpS4YEEABxKqZEB8Kw0+Wld3RsX0ddNxCP sjRr3bRd+AxiSUwOBHfd6mQfMdIixlVLIXiYAAtkUYM0CDQ9feiCLEBRAhom ZBFB0MsdhpqQNW4wTuEbZh6hqLsAzBGarpMm1OZ2uQQcIIBTu11eDrpQtyhU FgGMRQMJoEEijnWBevGrQcrX0FnM8o3Ls+Al2zJHI4p0lwk5KVjHOJAsFsBj bolrBr2pTP/FVICzkKiT9vfRz4I2n5AzKEGKKQCtcfQjmRgMENKkkCX/xKIR FpAFHmhQCjiMYAyeOOcYWtXOg3jgWXoJQhM0R88npZGHNW2LASbJz1nMqHWQ FEgaByCL/XFVIBGNYykzK8rsgjcBl4sd1MKKAAKYMiFgi25byPg4s20ztW2p Lkk5KxDHmtSJTwpraWcRPlmk8Zhfw5h8jziQ+uIzd7Lw6i7ZRzr4HbGslQug k7QZkgc8YjAQ4ExCUhCLNyDABWsQQwlw4IdDMIILssBBLMiwkCHktS0/8IJE Jrm1OD2XjBq27MRE213xEcQt3N2pQsIaizDiFcCy0IvtjLg/kE2Su2nMJEEu ZzuGEsQADbXw0YCYYSCKtLAKOexk82JaA7sF/8FcXjCawRzdAri5pAIJH9t0 N13VzjSWCviuRnqwSL3MgTkHeRAEbCALFNTBCSpoBSRCQQEK4GUSCtlBFQYz ARFJ5LmRdG5eCkArDZsriFZ0WIQ9OxAkP1mmCWEyd2UhUJTe2S2VS6MDWFtL SspCyQipXWXZPMAB85m6N6WlfAesEIau+XQNdossJolgYXfWLVse8AXbe1iC hK/MbZGFkP+cl1WKxIaEsYKoDIKeWDTBTrBi1cwOEoLLwLNDEwG1j6/YNSR3 K2yuvfUuXV3MhYQ3FvKLMpT1QpDtRrS6dv21dBVyt1Mu02z8eWOQTzex5aG5 aQ2RbHlZPQv2TfvNCf+p+LCxjc+M92wBWQyA6XYZ0S5L+9RVeyrLQ2IBVBBm AogsiAtKs4EH4IEDSWACEXQgBVlkKhY4M8gQSkCYNWj5IRIMtZOeO+AdDsB9 2yZAt1vt6wAK2quMbaIbt56XXW7Xqwwwm6uBHUHIEfGpAjHdKU29RIH8kNke D/kCn4R26OYZ1wdOCG1CivdZ6F3u8Xu1293CtqZxK3kEsaQRlT2SDzRGFMW9 QlsMMQYOdIETEagBIFiQ1QAUqyAqsNBg2mCeirAPY/t2i1+NqN+Xx3zmP3V1 AK8u0q8qfL5sR3Lm3QLzPR7Z1/5NCOfyTuxWxtXy/17tzmfx94YIk4myODj/ 0fZ3a0FP3/HVL0BcXW26185if5XzOkEFMEuTcEBlepnCUWdBAU605QImMAIj oACnsAEq0wUFAQI4QhgbgGgVIUGzJkaZNRA/VFgVBXkIJ3nPh3sBhGDP1Fz0 M1p5cT5oZwAcdGWyAHI5owATI0wJIX8FoYJ+t33S11zNZGYDcT/1k3gJoTAt SGwHIXzQFm0bNBC8dxB8RTpldRKWkEKYMQWKEAs+oGMD0QFO2Bh5UBBeMDKD oQUZsXkRmIJslGzVFQBkxH5DKBBucQCvJlY9CIJ5kXyc12uwpjFzR4Nvw28H cYT9tH0yqBDCFGpoF3efRUrX1BYXlYdjGIRU1Ia2/1NzFDhxAnGB15YAmAU5 KFEHPtIWMUAApFBif8A2ChBOY/QvEfAHmfEKRZAXZcABGpFXpDRe+aVJwsQ6 CEd2HJiGoRVHbDhJiahJX3d8dhZ+UnZr7pdHbnFGoTMxByZxbSFoBaEXhGgQ FTgQlLhferVgDYE5TjJJzIaNkCM5grUQ0oiE5SZMtFJN/bZSeXcpArB5ZINr KEEFKNMWQcAEpVAaF8AEAyEDJRADMAADFxADBuAGJiMQKmAzekAAUcCFaWAH GnGIUGZhl4VMgyFYEdeBh+c6AURGm3VQWURKu6IXoeRV3+hVaxULtCJBDLBD 06gQz6VgB2EuZRhFEok/5P9GUHQYS08ygZqkUpBTRQ8RkzD1VMs0NeFzRjcZ R1ozLptnUNOkEjMQW5gRAohwQ7GQBygwEBZABETQAyU0CynQBrEgAR/gAl0g MGX5AWFpEXYzGOAHV4olUC/JdehIYHpRUYJWPg2ga0DpPwRgedMoQcEjc7jI iy/VEAqgcxXZShOzlLbIMZvnSTdJaglxAMuEP7fWQCPJjh3EmL7imAJxAI/z PxqkXyo1Lrene2p4UI9TkS7BBDHgFpewB7EXCxMwCQ5IEBWgAPV4BR0gBSLk RtAIERZ2QA5gRJoFjHFmjfSTF3GlQN7CEEAVP7RBNnSTV//TNNOJfnlJNEYj U5v/M1KodGP+4wBKxDGrmUz2dTFkNJl4JEGjtgD345HZhHkmZJ5uhJ63OBCb w1GhQ0a3Z5n4pEBUZI0AkAA+EwBoNhIV8HoGEQFi4BZl8AIdwB6xcAEfAKEg 8AIjAwArQAIb4BZv4AZteRF3U1Hb1E1ZQ3wKQZq2dJoGYUDF+Uyg8y1vlT8X pABsQwBR6UD21EATNTEHYIYMYToOg12UpUkGangaQ2ftyWAJAURBo6QIR0kb gaQPw6L2+UnpBXYD0Jwl94woYQEDAAOS8AIJkQVb4BZm4AUs8CixUAUhIE/p dAGJEAEjoJaxgAM04BFzcz4HQABSQwAu2hD/KRABWhME/3A3kGURvEKCBPAx CvCL+BSmbig2BYGZDRqDvZdHB4BLG4SZMBURkZp5kyoulsoQb6mTGlOjHCED biEBtXcQFWAEV/gIiHAAcwAoomADK5ACFeAALwQ5L3CQB0EFL6AC5EQuXXUS h/pf4oKJGOGqCaMTFEAAURgLq1qFCaAEbaEEG8AFX5AAAKIBj7ADFOAEczAB UCAH8pQQTSB7RWBVzloUU6REn6obIGAmXpgQD0AFOtAEagBDfCADLRAJL3QB RsACHbCbBwECktAWYIAK8XqvSLGYMmkfgICbFysQHlAHCmAIfXAZaUADKQAL eXEEk9ACkJAGbrEFCSACLpAQEv+SHtqDsTrrEz0wm64wCw8gAirmA3kJAHUi AK3QCfYWC3oAByuQBEVQGjg2CJvQAgbRPbGwCTu7tTJxAEUAAGRABOzEJbNw s4PAA3IQTjFgAknQAVTQBSXwAznABDpwBXfgFmCwAUzAAiPQCHmhBIGQAIKw XE3AKgBQXFybuCgRAUQbCx+wCKmwOlCAA2dQASMqhUvgCCPwARzgCAhAA6DQ BksbC2vABbOAAi/gtzHrB3YQmLMpPjUQBTGjARApdDYQrYqbuxaxAnzDBYOB BhZAdZAiCzzwAmqQVW4xAYWwCjIQlg+wA1ewaW2hAYOQBChgAw7AATQAAiow sS4iC1H/YAMHIAUyYAc74AMSkAOvobvsqxFhILUQgAKXmxdcMAMuswOnAEM3 gAkf4ARkmxARkARa0AcqEwRkoAMRtgZuYQgPUAQYoAHYITjbmkPtW8EXsTww QAEuEAJGYAqWoAMyQAezsDhlgAJYYAKEkAgtYK8M8QBDMAaHIGN9WgFyagaz 4AeDYQUiwDcW3MMV4QR+EAVGMAYIUbAawAId0QE0EAI8IKuxEAezIAcAkAYA sAZQ8AlfwAhuEQI+3MUTAQhkgEdFEguNAxKL0BaJUBAnIAR00AFZkAFIwAfr 68V03BAQWxAesDjQIgAPEAEQihEVIGNKsG4FIQRtIAhDYLV1XLzIGBEFjRsA fTABE4BvE9ECimwDuiNICGEDfcHInnwRJKBSEkDIEQEClKAEOGAFUgsAYvvJ rgwSWXAFAKAF30MRHiC8bQEDZ8DCr9zLMnECS3AGbiAC/+vL7BsQADs= --0-87600532-1261973175=:55795-- --0-1829281109-1261973175=:55795-- Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBHKaa1w020016 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 17 Dec 2009 12:36:42 -0800 Received: from sjc-office-nat-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 16676A94442; Thu, 17 Dec 2009 19:59:14 +0000 (UTC) Message-ID: <4B2A8D91.80606@mail-abuse.org> Date: Thu, 17 Dec 2009 11:59:13 -0800 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091204 Thunderbird/3.0 MIME-Version: 1.0 To: asrg@irtf.org, ARF mailing list References: <20091216014800.GA29103@gsp.org> <20091216120742.GA28622@gsp.org> <20091216185904.3B9032421D@panix5.panix.com> <4B296458.5070603@mail-abuse.org> <16C1C8A4-D223-435B-93BC-A9D44F5965A1@guppylake.com> <20091217182526.192832421D@panix5.panix.com> <01C75B49-E78B-4293-B5EC-B2690B7ECFD9@guppylake.com> In-Reply-To: <01C75B49-E78B-4293-B5EC-B2690B7ECFD9@guppylake.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.92/10196/Thu Dec 17 10:24:30 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:37:23 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 17 Dec 2009 12:36:42 -0800 (PST) Subject: Re: [feedback-report] [Asrg] Adding a spam button to MUAs X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Dec 2009 20:36:42 -0000 On 12/17/09 10:34 AM, Nathaniel Borenstein wrote: > There's a difference between having an "A or B" bit, and having > separate "A" and "B" bits that may be muddled. If you don't know the > right way to interpret the two bits, then the single bit is > potentially much less misleading. > > But as I said, this is something that could really be resolved by > empirical study, and I'd prefer not to trust my intuition or anyone > else's if we can figure out the facts about how people would actually > use two buttons. If the error rate is low enough, then two buttons > will make sense, but I've rarely managed to underestimate the > competence of the average user. Two buttons is way more than twice > as confusing as one, in this case. -- Nathaniel > > On Dec 17, 2009, at 1:25 PM, Seth wrote: > >> Nathaniel Borenstein wrote: >>> On Dec 17, 2009, at 11:27 AM, Ian Eiloart wrote: >> >>>> Twitter seems to think that users are smart enough to >>>> distinguish between "unwanted" and "spam". They give you a >>>> button for each. It's an important distinction that most people >>>> can make. >>> >>> Twitter isn't always right, and my intuition differs from yours >>> on this one. Fortunately it's something that could be resolved >>> empirically. I'd like to see such a study, because it wouldn't >>> take very many users who *can't* properly make that distinction >>> to render the two-button solution counterproductive. I'd rather >>> have one bit of meaningful data than two bits of muddled data. >>> -- Nathaniel >> >> One button is the "OR" of the two buttons, so there's no less >> information available. Given enough data, it should be easy to >> get pretty accurate statistics on how reliable _each_ user is, and >> the unreliable ones can be mapped into the one-button treatment. Agreed. After all, can users recognize an auto-response in Chinese, or know the difference between real or spoofed DSNs? Of course not. All that can be determined from user feedback metrics is that 'X' number of messages from some source were "unwanted". Filters can be trained at removing "unwanted" for specific users based upon their feedback, however this information's usefulness is limited without knowing overall source volumes, and whether messages might have been either foreign language auto-responses, or valid DSNs. Having "unwanted" considered equivalent of "spam-trap" feedback will create a number of complaints, especially when dealing with a diverse range of users. Spam-trap email-addresses do not solicit email and are good at excluding auto-responses and valid DSN. This allows spam-trap feedback be applied over a larger range of users with less regard to overall source volume. Unfortunately, since no provider is able to ensure all customers are not 0wned, even "spam-trap" feedback can benefit when overall volume is shared. Our process consolidates metrics for all activity seen from each specific source and evaluates related metrics in a non-linear fashion. Offering this information within ARF feedback would not entail a sizable increase in report size to include a field of "source activity rate" as a method to share the number of message events (good or bad) seen over some number of seconds. Volume metrics added to an ARF report might look something like: IP-Activity: [source-IP], [#messages], [#seconds]; DKIM-Activity: [d=], [#messages], [#seconds]; Such as IP-Activity: 192.0.2.128,34566,86400; DKIM-Activity: example.com,4013,86400; When metrics are passed through a feedback conduit, each source should be qualified as representing spam-trap feedback, or user feedback, where feedback metrics from multiple sources would be consolidated into at least two separate categories. -Doug Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBENZ8xm002938 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Mon, 14 Dec 2009 15:35:14 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Mon, 14 Dec 2009 15:04:36 -0800 From: "Murray S. Kucherawy" To: Steve Atkins , ARF mailing list Date: Mon, 14 Dec 2009 15:03:46 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: Acp8/Z0gFMQ5sJrLQNiKu+6tDl7jfgAFBNUW Message-ID: References: , <4B22DD8D.6020102@isode.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10170/Mon Dec 14 13:49:13 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:32 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 14 Dec 2009 15:35:14 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBENZ8xm002938 Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2009 23:35:14 -0000 In the context of an ARF WG, I'd be fine with doing the ARF-specific part within the WG and advancing the DKIM extensions via an individual submission or via the DKIM WG (if it will take up the work). ________________________________________ From: abuse-feedback-report-bounces@mipassoc.org [abuse-feedback-report-bounces@mipassoc.org] On Behalf Of Steve Atkins [steve@word-to-the-wise.com] Sent: Monday, December 14, 2009 12:02 PM To: ARF mailing list Subject: Re: [feedback-report] Let's get started On Dec 14, 2009, at 11:11 AM, John R. Levine wrote: >> I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so. > > Both are fine with me. The stuff in (2) really needs something other than > ARF (INCH-lite, apparently) +1 > but (3) is a report about a single message. Kinda. (3) is two almost entirely separate things. One part is a new ARF subtype that allows sending feedback about a single message. But the other part is an extension to RFC 4871 that has almost nothing to do with ARF (but which could be part of point (4)). The first part is something it seems perfectly reasonable to move ahead with right away. The second part (hacking on DKIM key records) is out of scope for ARF - though certainly something to be discussed if we go ahead with the can-o-worms in point (4). Treating the two parts of point 3 entirely separately might help the ARF-related half avoid being bogged down by the likely prolonged discussions that'll likely provoke. Cheers, Steve >>> >>> >>> 3) The group will specify the integration of ARF into DKIM DNS key records, with >>> draft-kucherawy-dkim-reporting as its input. It contains extensions >>> to DKIM that are related to ARF as a means of reporting DKIM-related failures >>> which include phishing ("fraud") and as such are relevant to the ARF effort. >>> The group will produce Proposed Standard track specification for these >>> ARF and DKIM extensions. >>> >>> >> I would be much happier if the item 2 (and possibly 3) is done once the >> WG completes 1 and 4 and recharters. >> Any objections? >> >>> 4) The group will finally consider a means for publishing the address >>> to which ARF reports should be sent. Not all ARF participants wish to use >>> abuse@(domain), which is the current standard (RFC2142) , as the place to send >>> automated ARF-formatted reports. The group will either conclude that the industry >>> should continue to use this de facto standard (and thus no specification is appropriate), >>> or will produce a Proposed Standard track document identifying the means by which >>> that address should be advertised. >>> >>> The group may consider re-chartering to cover related work, such as further extensions, >>> once these deliverables have been achieved. >>> _______________________________________________ abuse-feedback-report mailing list abuse-feedback-report@mipassoc.org http://mipassoc.org/mailman/listinfo/abuse-feedback-report Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBELmwv8028953 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 14 Dec 2009 13:49:04 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 99543 invoked from network); 14 Dec 2009 21:48:58 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 14 Dec 2009 21:48:36 -0000 Date: 14 Dec 2009 16:48:57 -0500 Message-ID: From: "John R. Levine" To: "Steve Atkins" In-Reply-To: References: , <4B22DD8D.6020102@isode.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10169/Mon Dec 14 09:50:19 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 14 Dec 2009 13:49:05 -0800 (PST) Cc: ARF mailing list Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2009 21:49:05 -0000 > > The first part is something it seems perfectly reasonable to move ahead with right away. The second part (hacking on DKIM key records) is out of scope for ARF - though certainly something to be discussed if we go ahead with the can-o-worms in point (4). > > Treating the two parts of point 3 entirely separately might help the ARF-related half avoid being bogged down by the likely prolonged discussions that'll likely provoke. +1 Received: from m.wordtothewise.com (fruitbat.wordtothewise.com [208.187.80.135]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBEKccG3024990 for ; Mon, 14 Dec 2009 12:38:43 -0800 Received: from platter.wordtothewise.com (184.wordtothewise.com [208.187.80.184]) by m.wordtothewise.com (Postfix) with ESMTP id 4E81281019 for ; Mon, 14 Dec 2009 12:02:24 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1077) From: Steve Atkins In-Reply-To: Date: Mon, 14 Dec 2009 12:02:21 -0800 Message-Id: References: , <4B22DD8D.6020102@isode.com> To: ARF mailing list X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10169/Mon Dec 14 09:50:19 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:36:13 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 14 Dec 2009 12:38:43 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBEKccG3024990 Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2009 20:38:44 -0000 On Dec 14, 2009, at 11:11 AM, John R. Levine wrote: >> I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so. > > Both are fine with me. The stuff in (2) really needs something other than > ARF (INCH-lite, apparently) +1 > but (3) is a report about a single message. Kinda. (3) is two almost entirely separate things. One part is a new ARF subtype that allows sending feedback about a single message. But the other part is an extension to RFC 4871 that has almost nothing to do with ARF (but which could be part of point (4)). The first part is something it seems perfectly reasonable to move ahead with right away. The second part (hacking on DKIM key records) is out of scope for ARF - though certainly something to be discussed if we go ahead with the can-o-worms in point (4). Treating the two parts of point 3 entirely separately might help the ARF-related half avoid being bogged down by the likely prolonged discussions that'll likely provoke. Cheers, Steve >>> >>> >>> 3) The group will specify the integration of ARF into DKIM DNS key records, with >>> draft-kucherawy-dkim-reporting as its input. It contains extensions >>> to DKIM that are related to ARF as a means of reporting DKIM-related failures >>> which include phishing ("fraud") and as such are relevant to the ARF effort. >>> The group will produce Proposed Standard track specification for these >>> ARF and DKIM extensions. >>> >>> >> I would be much happier if the item 2 (and possibly 3) is done once the >> WG completes 1 and 4 and recharters. >> Any objections? >> >>> 4) The group will finally consider a means for publishing the address >>> to which ARF reports should be sent. Not all ARF participants wish to use >>> abuse@(domain), which is the current standard (RFC2142) , as the place to send >>> automated ARF-formatted reports. The group will either conclude that the industry >>> should continue to use this de facto standard (and thus no specification is appropriate), >>> or will produce a Proposed Standard track document identifying the means by which >>> that address should be advertised. >>> >>> The group may consider re-chartering to cover related work, such as further extensions, >>> once these deliverables have been achieved. >>> Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBEJBrCm018857 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 14 Dec 2009 11:11:59 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 77630 invoked from network); 14 Dec 2009 19:11:53 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 14 Dec 2009 19:11:31 -0000 Date: 14 Dec 2009 14:11:52 -0500 Message-ID: From: "John R. Levine" To: "Murray S. Kucherawy" In-Reply-To: References: , <4B22DD8D.6020102@isode.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10169/Mon Dec 14 09:50:19 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 14 Dec 2009 11:11:59 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2009 19:12:00 -0000 > I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so. Both are fine with me. The stuff in (2) really needs something other than ARF (INCH-lite, apparently) but (3) is a report about a single message. R's, John > ________________________________________ > From: Alexey Melnikov [alexey.melnikov@isode.com] > Sent: Friday, December 11, 2009 4:02 PM > To: Murray S. Kucherawy > Cc: abuse-feedback-report@mipassoc.org > Subject: Re: [feedback-report] Let's get started > > The charter text seems reasonable in general (I might send some minor > editorial comments separately). One meta-comment below: > > Murray S. Kucherawy wrote: > >> Thus, the working group's specific tasks are as follows: >> >> 1) The group will first produce a Proposed Standard track specification of ARF. >> This will document current use, removing any portions that are not implemented and/or >> not required for a minimum implementation (to be published later as extensions). >> This will include not only the format of an ARF message, but must also include >> appropriate documentation of security considerations and creation of IANA registries >> for elements of ARF to support future extensions, as well as informational sections >> conveying current best practises. >> >> 2) The following possilble reporting extensions have been proposed and will be considered >> possible for publication as extensions to the base specification: >> >> a) drop boxes (detection of a mailbox used to receive things like stolen >> credit cards) >> b) botnet detection (i.e. reporting of traffic that appears to have come >> from a bot, regardless of content) >> c) SSH attacks >> d) FTP attacks >> e) Web server attacks >> f) mail sent to a honeypot or spam trap >> g) malware connections to sinkholes >> h) DDoS reports >> i) portions of the pre-IETF verison of the specification that were removed in (1) >> above to produce a minimal base document >> j) others that may be proposed within the allotted timeframe >> >> 3) The group will specify the integration of ARF into DKIM DNS key records, with >> draft-kucherawy-dkim-reporting as its input. It contains extensions >> to DKIM that are related to ARF as a means of reporting DKIM-related failures >> which include phishing ("fraud") and as such are relevant to the ARF effort. >> The group will produce Proposed Standard track specification for these >> ARF and DKIM extensions. >> >> > I would be much happier if the item 2 (and possibly 3) is done once the > WG completes 1 and 4 and recharters. > Any objections? > >> 4) The group will finally consider a means for publishing the address >> to which ARF reports should be sent. Not all ARF participants wish to use >> abuse@(domain), which is the current standard (RFC2142) , as the place to send >> automated ARF-formatted reports. The group will either conclude that the industry >> should continue to use this de facto standard (and thus no specification is appropriate), >> or will produce a Proposed Standard track document identifying the means by which >> that address should be advertised. >> >> The group may consider re-chartering to cover related work, such as further extensions, >> once these deliverables have been achieved. >> >> > >> >> > > _______________________________________________ > abuse-feedback-report mailing list > abuse-feedback-report@mipassoc.org > http://mipassoc.org/mailman/listinfo/abuse-feedback-report > Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener schnitzel, please", said Tom, revealingly. Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBEINS34015508 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Mon, 14 Dec 2009 10:23:34 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Mon, 14 Dec 2009 09:52:51 -0800 From: "Murray S. Kucherawy" To: Alexey Melnikov Date: Mon, 14 Dec 2009 09:52:21 -0800 Thread-Topic: [feedback-report] Let's get started Thread-Index: Acp6vmdqiwMGRxGiQy21ESs8pYCvZACJ8hS7 Message-ID: References: , <4B22DD8D.6020102@isode.com> In-Reply-To: <4B22DD8D.6020102@isode.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10165/Mon Dec 14 07:47:56 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:37 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Mon, 14 Dec 2009 10:23:34 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBEINS34015508 Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2009 18:23:36 -0000 I'd be fine pushing (2) into a later iteration of the working group, but I'd like to move ahead with (3) unless there's heavy resistance to doing so. ________________________________________ From: Alexey Melnikov [alexey.melnikov@isode.com] Sent: Friday, December 11, 2009 4:02 PM To: Murray S. Kucherawy Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Let's get started The charter text seems reasonable in general (I might send some minor editorial comments separately). One meta-comment below: Murray S. Kucherawy wrote: > Thus, the working group's specific tasks are as follows: > > 1) The group will first produce a Proposed Standard track specification of ARF. > This will document current use, removing any portions that are not implemented and/or > not required for a minimum implementation (to be published later as extensions). > This will include not only the format of an ARF message, but must also include > appropriate documentation of security considerations and creation of IANA registries > for elements of ARF to support future extensions, as well as informational sections > conveying current best practises. > > 2) The following possilble reporting extensions have been proposed and will be considered > possible for publication as extensions to the base specification: > > a) drop boxes (detection of a mailbox used to receive things like stolen > credit cards) > b) botnet detection (i.e. reporting of traffic that appears to have come > from a bot, regardless of content) > c) SSH attacks > d) FTP attacks > e) Web server attacks > f) mail sent to a honeypot or spam trap > g) malware connections to sinkholes > h) DDoS reports > i) portions of the pre-IETF verison of the specification that were removed in (1) > above to produce a minimal base document > j) others that may be proposed within the allotted timeframe > > 3) The group will specify the integration of ARF into DKIM DNS key records, with > draft-kucherawy-dkim-reporting as its input. It contains extensions > to DKIM that are related to ARF as a means of reporting DKIM-related failures > which include phishing ("fraud") and as such are relevant to the ARF effort. > The group will produce Proposed Standard track specification for these > ARF and DKIM extensions. > > I would be much happier if the item 2 (and possibly 3) is done once the WG completes 1 and 4 and recharters. Any objections? > 4) The group will finally consider a means for publishing the address > to which ARF reports should be sent. Not all ARF participants wish to use > abuse@(domain), which is the current standard (RFC2142) , as the place to send > automated ARF-formatted reports. The group will either conclude that the industry > should continue to use this de facto standard (and thus no specification is appropriate), > or will produce a Proposed Standard track document identifying the means by which > that address should be advertised. > > The group may consider re-chartering to cover related work, such as further extensions, > once these deliverables have been achieved. > > > > Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBCAolbi022828 for ; Sat, 12 Dec 2009 02:50:52 -0800 Received: from mach-4.tana.it (mach-4.tana.it [194.243.254.189]) (AUTH: CRAM-MD5 ale@tana.it, TLS: TLS1.0, 256bits, RSA_AES_256_CBC_SHA1) by wmail.tana.it with esmtp; Sat, 12 Dec 2009 11:10:28 +0100 id 00000000005DC031.000000004B236C14.00007A76 Message-ID: <4B236C7A.5090600@tana.it> Date: Sat, 12 Dec 2009 11:12:10 +0100 From: Alessandro Vesely User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: "abuse-feedback-report@mipassoc.org" References: <20091210233914.GC52676@server.thinkof.de> <20091211063549.GD52676@server.thinkof.de> <4B220894.9070309@abusix.org> <4B22CF41.4060502@isode.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.92/10155/Sat Dec 12 01:50:02 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:40:17 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Sat, 12 Dec 2009 02:50:53 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Dec 2009 10:50:53 -0000 John R. Levine wrote: > Also, from a purely technical point of view, ARF is multitype/report which > means that it always has one (1) email message attached. Trying to use it > for something other than mail reports really would be driving nails with a > screwdriver. It may be worth noting that ARF is by maibox providers for mailbox providers, which explains why it has been crafted that way. Mailbox providers reporting, say, port scans to their connection providers, much like mailbox users reporting mail abuse, should follow whatever rules and tools the relevant provider provides. Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBC02UHa018565 for ; Fri, 11 Dec 2009 16:02:36 -0800 Received: from [172.16.2.183] (shiny.isode.com [62.3.217.250]) by rufus.isode.com (submission channel) via TCP with ESMTPA id ; Sat, 12 Dec 2009 00:02:29 +0000 Message-ID: <4B22DD8D.6020102@isode.com> Date: Sat, 12 Dec 2009 00:02:21 +0000 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 X-Accept-Language: en-us, en To: "Murray S. Kucherawy" References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.92/10153/Fri Dec 11 06:10:27 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 11 Dec 2009 16:02:36 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Dec 2009 00:02:36 -0000 The charter text seems reasonable in general (I might send some minor editorial comments separately). One meta-comment below: Murray S. Kucherawy wrote: > Thus, the working group's specific tasks are as follows: > > 1) The group will first produce a Proposed Standard track specification of ARF. > This will document current use, removing any portions that are not implemented and/or > not required for a minimum implementation (to be published later as extensions). > This will include not only the format of an ARF message, but must also include > appropriate documentation of security considerations and creation of IANA registries > for elements of ARF to support future extensions, as well as informational sections > conveying current best practises. > > 2) The following possilble reporting extensions have been proposed and will be considered > possible for publication as extensions to the base specification: > > a) drop boxes (detection of a mailbox used to receive things like stolen > credit cards) > b) botnet detection (i.e. reporting of traffic that appears to have come > from a bot, regardless of content) > c) SSH attacks > d) FTP attacks > e) Web server attacks > f) mail sent to a honeypot or spam trap > g) malware connections to sinkholes > h) DDoS reports > i) portions of the pre-IETF verison of the specification that were removed in (1) > above to produce a minimal base document > j) others that may be proposed within the allotted timeframe > > 3) The group will specify the integration of ARF into DKIM DNS key records, with > draft-kucherawy-dkim-reporting as its input. It contains extensions > to DKIM that are related to ARF as a means of reporting DKIM-related failures > which include phishing ("fraud") and as such are relevant to the ARF effort. > The group will produce Proposed Standard track specification for these > ARF and DKIM extensions. > > I would be much happier if the item 2 (and possibly 3) is done once the WG completes 1 and 4 and recharters. Any objections? > 4) The group will finally consider a means for publishing the address > to which ARF reports should be sent. Not all ARF participants wish to use > abuse@(domain), which is the current standard (RFC2142) , as the place to send > automated ARF-formatted reports. The group will either conclude that the industry > should continue to use this de facto standard (and thus no specification is appropriate), > or will produce a Proposed Standard track document identifying the means by which > that address should be advertised. > > The group may consider re-chartering to cover related work, such as further extensions, > once these deliverables have been achieved. > > > > Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBBNVukL016925 for ; Fri, 11 Dec 2009 15:32:01 -0800 Received: from [172.16.2.183] (shiny.isode.com [62.3.217.250]) by rufus.isode.com (submission channel) via TCP with ESMTPA id ; Fri, 11 Dec 2009 23:01:26 +0000 Message-ID: <4B22CF41.4060502@isode.com> Date: Fri, 11 Dec 2009 23:01:21 +0000 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 X-Accept-Language: en-us, en To: "John R. Levine" References: <20091210233914.GC52676@server.thinkof.de> <20091211063549.GD52676@server.thinkof.de> <4B220894.9070309@abusix.org> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.92/10153/Fri Dec 11 06:10:27 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:28 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 11 Dec 2009 15:32:02 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 23:32:02 -0000 John R. Levine wrote: >>Sad enough that some of them can not remember that conversation 1 and >>half month later. :-( >> >> >Hmmn. Would that be a conversation in which someone pointed out that the >IESG would never accept an overgrown ARF that tried to reinvent INCH so it >would be a waste of time to do? > > It is not clear to me that IESG has any preferences one way or another. >Reporting other kinds of abuse is a reasonable thing to do. Trying to do >it in ARF, which is specifically a format for reporting a single mail >message is not. You're trying to hammer nails with a screwdriver. > >We're aware of the perception that INCH is "too complicated", but you >can't solve that by breaking ARF. We're aware that there is a misguided >effort in Germany to cram every other kind of abuse report into ARF. But >that still doesn't make it a good idea. > > -- IETF Application Area Director, Internet Messaging Team Lead, JID: same as my email address Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBBN8TOl015711 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 11 Dec 2009 15:08:35 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 74111 invoked from network); 11 Dec 2009 23:08:29 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 11 Dec 2009 23:08:06 -0000 Date: 11 Dec 2009 18:08:28 -0500 Message-ID: From: "John R. Levine" To: "Alexey Melnikov" In-Reply-To: <4B22CF41.4060502@isode.com> References: <20091210233914.GC52676@server.thinkof.de> <20091211063549.GD52676@server.thinkof.de> <4B220894.9070309@abusix.org> <4B22CF41.4060502@isode.com> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10153/Fri Dec 11 06:10:27 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 11 Dec 2009 15:08:35 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 23:08:36 -0000 >> Hmmn. Would that be a conversation in which someone pointed out that the >> IESG would never accept an overgrown ARF that tried to reinvent INCH so it >> would be a waste of time to do? >> > It is not clear to me that IESG has any preferences one way or another. I was under the impression that INCH was a political football, so something that looks like quasi-INCH could be an issue. Also, from a purely technical point of view, ARF is multitype/report which means that it always has one (1) email message attached. Trying to use it for something other than mail reports really would be driving nails with a screwdriver. Given how complex INCH is, it might well be worthwhile to make subset profiles and tools to help people use it but that's not part of an ARF effort. R's, John Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBBMmEoV014483 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Fri, 11 Dec 2009 14:48:20 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@cybernothing.org Received: from [10.0.3.110] (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5) with ESMTP id nBBMHnEj008194 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Fri, 11 Dec 2009 15:17:51 -0700 X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net nBBMHnEj008194 References: In-Reply-To: Mime-Version: 1.0 (Apple Message framework v1077) Content-Type: text/plain; charset=windows-1252 Message-Id: <4D02C98E-41FF-4C71-B1EC-E2CCE75D52F2@cybernothing.org> From: "J.D. Falk" Date: Fri, 11 Dec 2009 15:17:43 -0700 To: abuse-feedback-report@mipassoc.org X-Mailer: Apple Mail (2.1077) X-Virus-Scanned: ClamAV 0.92/10153/Fri Dec 11 06:10:27 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:23 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 11 Dec 2009 14:48:20 -0800 (PST) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by sbh17.songbird.com id nBBMmEoV014483 Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 22:48:21 -0000 On Dec 10, 2009, at 11:09 AM, Murray S. Kucherawy wrote: > The first thing on our to-do list is to trim the fat from the current draft, meaning remove all the report types and other things that aren’t currently in use. I believe I heard someone say that only “abuse” is currently in use, and I suspect other than OpenDKIM and its antecedent, nobody’s implemented the DKIM reporting stuff yet. If everyone concurs, I’ll push out a proposed update to the list that removes all but “abuse” while still leaving room for the rest to be re-added in later drafts as extensions. I concur. One of the reasons ARF has been successful is that it is simple -- and it's even simpler in practice than in the draft. Standardizing that simplicity (and not adding any unnecessary complexities) will be of great benefit to the community. -- J.D. Falk Return Path Inc Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBBECq2Z013336 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 11 Dec 2009 06:12:58 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 12148 invoked from network); 11 Dec 2009 14:12:52 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 11 Dec 2009 14:12:29 -0000 Date: 11 Dec 2009 09:12:51 -0500 Message-ID: From: "John R. Levine" To: "Tobias Knecht" In-Reply-To: <4B220894.9070309@abusix.org> References: <20091210233914.GC52676@server.thinkof.de> <20091211063549.GD52676@server.thinkof.de> <4B220894.9070309@abusix.org> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10150/Fri Dec 11 03:44:56 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 11 Dec 2009 06:12:58 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 14:13:00 -0000 > Sad enough that some of them can not remember that conversation 1 and > half month later. :-( Hmmn. Would that be a conversation in which someone pointed out that the IESG would never accept an overgrown ARF that tried to reinvent INCH so it would be a waste of time to do? Reporting other kinds of abuse is a reasonable thing to do. Trying to do it in ARF, which is specifically a format for reporting a single mail message is not. You're trying to hammer nails with a screwdriver. We're aware of the perception that INCH is "too complicated", but you can't solve that by breaking ARF. We're aware that there is a misguided effort in Germany to cram every other kind of abuse report into ARF. But that still doesn't make it a good idea. R's, John Received: from vwp0043.webpack.hosteurope.de (vwp0043.webpack.hosteurope.de [87.230.60.50]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBB9VG3l022818 for ; Fri, 11 Dec 2009 01:31:21 -0800 Received: from p5794697b.dip.t-dialin.net ([87.148.105.123] helo=[192.168.1.100]); authenticated by vwp0043.webpack.hosteurope.de running ExIM with esmtpa id 1NJ1G0-0003gJ-3C; Fri, 11 Dec 2009 09:53:48 +0100 Message-ID: <4B220894.9070309@abusix.org> Date: Fri, 11 Dec 2009 09:53:40 +0100 From: Tobias Knecht Organization: abusix UG =?ISO-8859-1?Q?=28haftungsbeschr=E4nkt=29?= User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 CC: "abuse-feedback-report@mipassoc.org" References: <20091210233914.GC52676@server.thinkof.de> <20091211063549.GD52676@server.thinkof.de> In-Reply-To: <20091211063549.GD52676@server.thinkof.de> X-Enigmail-Version: 0.96.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig5C430D40B9585E5856D05E10" X-bounce-key: webpack.hosteurope.de;knut@abusix.org;1260523881;0423697b; X-Virus-Scanned: ClamAV 0.92/10149/Thu Dec 10 14:26:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:37:27 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Fri, 11 Dec 2009 01:31:21 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 09:31:23 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig5C430D40B9585E5856D05E10 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Markus, > So I guess paragraph 2) of "arf-charter v06.txt" is dead and buried. It is not. ;-) Not for me, probably you and many others. I talked to severall people at maawg in Philladelphia and all of them agreed about an ARF Version 2, that is giving space for all other kinds of abusive behavior. Sad enough that some of them can not remember that conversation 1 and half month later. :-( And you are absolutley right, that we should discuss the possibilities and the basics of this integration now, so extensions or ARF Version 2 will be more easy to implement. I fully agree Murrays arf-charter v06! Thanks, Tobias --=20 | Tobias Knecht | abusix UG (haftungsbeschraenkt) | tk@abusix.org | http://abusix.org | Postfach 210127 | 76151 Karlsruhe | Germany | --- | Register of Companies(Handelsregister): HRB 707959 | District of Court(Amtsgericht) Mannheim/Germany | Registered Office: Karlsruhe/Germany | CEO: Tobias Knecht --------------enig5C430D40B9585E5856D05E10 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAksiCJoACgkQvB4M5yQyqDfc/QCgyRk9SISWuwvxRdXvG3PQWKAF oaMAnRCDNNyt/giJ0M/RxW6gyICTCFZg =g9LZ -----END PGP SIGNATURE----- --------------enig5C430D40B9585E5856D05E10-- Received: from ns1.qubic.net (ns1.qubic.net [208.69.177.116]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBB750KJ011111 for ; Thu, 10 Dec 2009 23:05:06 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@resistor.net Received: from subman.resistor.net ([10.0.0.1]) (authenticated bits=0) by ns1.qubic.net (8.14.4.Beta0/8.14.4.Beta0) with ESMTP id nBB6QiEA027245 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 10 Dec 2009 22:26:51 -0800 (PST) Message-Id: <6.2.5.6.2.20091210215420.03e18b48@resistor.net> X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6 Date: Thu, 10 Dec 2009 22:21:37 -0800 To: "Murray S. Kucherawy" From: SM In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Virus-Scanned: ClamAV 0.92/10149/Thu Dec 10 14:26:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:38:05 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 10 Dec 2009 23:05:06 -0800 (PST) Cc: abuse-feedback-report@mipassoc.org Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 07:05:06 -0000 Hi Murray, At 10:09 10-12-2009, Murray S. Kucherawy wrote: >Does everyone agree with that? Are there any other changes that the >group should consider for the next draft? "conveying current best practises" should be conveying current best practices "following possilble reporting extensions" should be following possible reporting extensions "portions of the pre-IETF verison" should be portions of the pre-IETF version "The working group should consider such factors as: * implementer experience There is also "ability to achieve broad implementation" in that list. What is the "implementer experience" for? Under the specific tasks, you listed: c) SSH attacks d) FTP attacks e) Web server attacks as possible reporting extensions. These do not look like reporting extensions unless you plan to write a standard specifically for SSH attacks, etc. Maybe you plan to have a reporting extension for brute force attacks. Or better, to consider reporting extensions for the following types of abuse. Regards, -sm Received: from server.thinkof.de (server.thinkof.de [195.49.139.13]) by sbh17.songbird.com (8.13.8/8.13.8) with SMTP id nBB6ZouS008843 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 10 Dec 2009 22:35:57 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (768-bit key) header.i=@maexotic.de Received: (qmail 43509 invoked by uid 1013); 11 Dec 2009 06:35:49 -0000 Date: Fri, 11 Dec 2009 07:35:49 +0100 From: Markus Stumpf To: "abuse-feedback-report@mipassoc.org" Message-ID: <20091211063549.GD52676@server.thinkof.de> References: <20091210233914.GC52676@server.thinkof.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i Organization: maexotic.de, Muenchen, Germany X-PGP-Fingerprint: 2139 A8A9 1B36 6416 EA81 543A 8786 8F21 921A 98EF X-Virus-Scanned: ClamAV 0.92/10149/Thu Dec 10 14:26:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 10 Dec 2009 22:35:59 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 06:35:59 -0000 On Thu, Dec 10, 2009 at 08:13:47PM -0500, John R. Levine wrote: > Can we please not have this utterly unproductive argument again? This is fine for me. I didn't follow the result of the discussion about the extensions too closely (my fault) and as the topics appeared on "arf-charter v06.txt" again I tought I might also throw that in. So I guess paragraph 2) of "arf-charter v06.txt" is dead and buried. The remaining topics would then be a) make the exsiting ARF format a standard b) define a way to integrate ARF with DKIM to o signal acceptance of ARF format reports o publish an email address where the reports are to be sent to \Maex Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBB1Dnj3014231 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 10 Dec 2009 17:13:54 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 32095 invoked from network); 11 Dec 2009 01:13:48 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 11 Dec 2009 01:13:26 -0000 Date: 10 Dec 2009 20:13:47 -0500 Message-ID: From: "John R. Levine" To: "Markus Stumpf" In-Reply-To: <20091210233914.GC52676@server.thinkof.de> References: <20091210233914.GC52676@server.thinkof.de> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10149/Thu Dec 10 14:26:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 10 Dec 2009 17:13:55 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 01:13:55 -0000 Can we please not have this utterly unproductive argument again? ARF is a way to send in a report about one (1) e-mail message. It is not for anything else. It cannot be for anything else. In particular, it is not a generic abuse reporting system. If you want INCH, you know where to find it. If you don't believe me, please review the endless debate on this topic so we don't have to have it again. On Fri, 11 Dec 2009, Markus Stumpf wrote: > On Thu, Dec 10, 2009 at 10:09:08AM -0800, Murray S. Kucherawy wrote: >> c) SSH attacks >> d) FTP attacks >> e) Web server attacks > > I guess attack types are to unspecific in general. > A lot of attacks are eg. password breaking attacks which apply to > a lot of protocols like ssh, ftp, http, pop3, imap, smtp (auth), ldap, ... > So I guess it would be more useful to have something like > "password breakin" as type for the template and a "protocol" field for > more specific information. > > Same for port scans. I'd use this as the type and the protocols probed > as an additional information. > > This probably also helps in merging incidents. One could use > "port scan" and group it by source IP address with additional > information about protocols/services and the IP address range > probed. Grouping by protocol would cause more indicent reports > to be generated. > > \Maex Received: from server.thinkof.de (server.thinkof.de [195.49.139.13]) by sbh17.songbird.com (8.13.8/8.13.8) with SMTP id nBB0dHU6011907 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 10 Dec 2009 16:39:24 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (768-bit key) header.i=@maexotic.de Received: (qmail 7635 invoked by uid 1013); 10 Dec 2009 23:39:14 -0000 Date: Fri, 11 Dec 2009 00:39:14 +0100 From: Markus Stumpf To: "abuse-feedback-report@mipassoc.org" Message-ID: <20091210233914.GC52676@server.thinkof.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i Organization: maexotic.de, Muenchen, Germany X-PGP-Fingerprint: 2139 A8A9 1B36 6416 EA81 543A 8786 8F21 921A 98EF X-Virus-Scanned: ClamAV 0.92/10149/Thu Dec 10 14:26:20 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 01:00:01 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 10 Dec 2009 16:39:24 -0800 (PST) Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 00:39:25 -0000 On Thu, Dec 10, 2009 at 10:09:08AM -0800, Murray S. Kucherawy wrote: > c) SSH attacks > d) FTP attacks > e) Web server attacks I guess attack types are to unspecific in general. A lot of attacks are eg. password breaking attacks which apply to a lot of protocols like ssh, ftp, http, pop3, imap, smtp (auth), ldap, ... So I guess it would be more useful to have something like "password breakin" as type for the template and a "protocol" field for more specific information. Same for port scans. I'd use this as the type and the protocols probed as an additional information. This probably also helps in merging incidents. One could use "port scan" and group it by source IP address with additional information about protocols/services and the IP address range probed. Grouping by protocol would cause more indicent reports to be generated. \Maex Received: from gal.iecc.com (gal.iecc.com [208.31.42.53]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBAK3oXk028260 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Thu, 10 Dec 2009 12:03:56 -0800 Authentication-Results: sbh17.songbird.com; dkim=pass (1024-bit key) header.i=@iecc.com Received: (qmail 32569 invoked from network); 10 Dec 2009 19:03:50 -0000 Received: (ofmipd 208.31.42.62) with (DHE-RSA-AES256-SHA encrypted) SMTP; 10 Dec 2009 19:03:28 -0000 Date: 10 Dec 2009 14:03:49 -0500 Message-ID: From: "John R. Levine" To: "Murray S. Kucherawy" In-Reply-To: References: User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) Cleverness: None detected MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: ClamAV 0.92/10147/Thu Dec 10 09:07:02 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 01:00:00 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 10 Dec 2009 12:03:57 -0800 (PST) Cc: "abuse-feedback-report@mipassoc.org" Subject: Re: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2009 20:03:57 -0000 > The first thing on our to-do list is to trim the fat from the current > draft, meaning remove all the report types and other things that aren't > currently in use. I believe I heard someone say that only "abuse" is > currently in use, and I suspect other than OpenDKIM and its antecedent, > nobody's implemented the DKIM reporting stuff yet. My reports occasionally say "virus" when they see the base64 encoding of an EXE or ZIP header in the spam. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener schnitzel, please", said Tom, revealingly. Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by sbh17.songbird.com (8.13.8/8.13.8) with ESMTP id nBAIdifN021529 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=FAIL) for ; Thu, 10 Dec 2009 10:39:49 -0800 Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Thu, 10 Dec 2009 10:09:09 -0800 From: "Murray S. Kucherawy" To: "abuse-feedback-report@mipassoc.org" Date: Thu, 10 Dec 2009 10:09:08 -0800 Thread-Topic: Let's get started Thread-Index: Acp5w93csfpGZxY+TXWTbogqRd6m2w== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/mixed; boundary="_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_" MIME-Version: 1.0 X-Virus-Scanned: ClamAV 0.92/10147/Thu Dec 10 09:07:02 2009 on sbh17.songbird.com X-Virus-Status: Clean X-Greylist: Delayed for 00:30:35 by milter-greylist-4.0 (sbh17.songbird.com [72.52.113.70]); Thu, 10 Dec 2009 10:39:49 -0800 (PST) Subject: [feedback-report] Let's get started X-BeenThere: abuse-feedback-report@mipassoc.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Public forum for discussion on the feedback-report draft List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2009 18:39:50 -0000 --_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_ Content-Type: multipart/alternative; boundary="_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_" --_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hey everyone, As the IESG is discussing the logistics around formation of the ARF working= group based on the current charter, there doesn't seem to be any reason wh= y we can't forge ahead with the proposed work. So given the current propos= ed charter (attached) and the current ARF draft (draft-shafranovich-feedbac= k-report-08), I propose we get rolling. We can shift into the context of d= oing the work as an IETF working group if and when that becomes official. The first thing on our to-do list is to trim the fat from the current draft= , meaning remove all the report types and other things that aren't currentl= y in use. I believe I heard someone say that only "abuse" is currently in = use, and I suspect other than OpenDKIM and its antecedent, nobody's impleme= nted the DKIM reporting stuff yet. If everyone concurs, I'll push out a pr= oposed update to the list that removes all but "abuse" while still leaving = room for the rest to be re-added in later drafts as extensions. Does everyone agree with that? Are there any other changes that the group = should consider for the next draft? --_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hey everyone,

 

As the IESG is discussing the logistics around formati= on of the ARF working group based on the current charter, there doesn’t see= m to be any reason why we can’t forge ahead with the proposed work.  = So given the current proposed charter (attached) and the current ARF draft (draft-shafranovich-feedback-report-08), I propose we get rolling.  We= can shift into the context of doing the work as an IETF working group if and wh= en that becomes official.

 

The first thing on our to-do list is to trim the fat f= rom the current draft, meaning remove all the report types and other things tha= t aren’t currently in use.  I believe I heard someone say that onl= y “abuse” is currently in use, and I suspect other than OpenDKIM and its antecedent, nobody’s implemented the DKIM reporting stuff yet.  If everyone concurs, I’ll push out a proposed update to the list that removes all= but “abuse” while still leaving room for the rest to be re-added in later drafts as extensions.

 

Does everyone agree with that?  Are there any oth= er changes that the group should consider for the next draft?

--_000_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_-- --_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_ Content-Type: text/plain; name="arf-charter v06.txt" Content-Description: arf-charter v06.txt Content-Disposition: attachment; filename="arf-charter v06.txt"; size=6089; creation-date="Thu, 24 Sep 2009 10:46:47 GMT"; modification-date="Thu, 24 Sep 2009 10:48:11 GMT" Content-Transfer-Encoding: base64 ICAgV29ya2luZyBHcm91cCBOYW1lOg0KICAgICAgICBBYnVzZSBSZXBvcnRpbmcgRm9ybWF0IChB UkYpDQoNCiAgIElFVEYgQXJlYToNCiAgICAgICAgQXBwbGljYXRpb25zIEFyZWENCg0KICAgQ2hh aXIocyk6DQogICAgICAgIFRCRA0KDQogICBBcHBsaWNhdGlvbnMgQXJlYSBEaXJlY3RvcihzKToN CiAgICAgICAgTGlzYSBEdXNzZWF1bHQgPExpc2EuRHVzc2VhdWx0QG1lc3NhZ2luZ2FyY2hpdGVj dHMuY29tPg0KICAgICAgICBBbGV4ZXkgTWVsbmlrb3YgPGFsZXhleS5tZWxuaWtvdkBpc29kZS5j b20+DQoNCiAgIFJlc3BvbnNpYmxlIEFyZWEgRGlyZWN0b3I6DQogICAgICAgIFRCRA0KDQogICBN YWlsaW5nIExpc3RzOg0KICAgICAgICBHZW5lcmFsIERpc2N1c3Npb246IGFidXNlLWZlZWRiYWNr LXJlcG9ydEBtaXBhc3NvYy5vcmcNCiAgICAgICAgVG8gU3Vic2NyaWJlOiBodHRwOi8vbWlwYXNz b2Mub3JnL21haWxtYW4vbGlzdGluZm8vYWJ1c2UtZmVlZGJhY2stcmVwb3J0DQogICAgICAgIEFy Y2hpdmU6IGh0dHA6Ly9taXBhc3NvYy5vcmcvbWFpbG1hbi9saXN0aW5mby9hYnVzZS1mZWVkYmFj ay1yZXBvcnQNCg0KICAgRGVzY3JpcHRpb24gb2YgV29ya2luZyBHcm91cDoNCglNZXNzYWdpbmcg YW50aS1hYnVzZSBvcGVyYXRpb25zIGJldHdlZW4gaW5kZXBlbmRlbnQgc2VydmljZXMgb2Z0ZW4g cmVxdWlyZXMNCglzZW5kaW5nIHJlcG9ydHMgb24gb2JzZXJ2ZWQgZnJhdWQsIHNwYW0gdmlydXMg b3Igb3RoZXIgYWJ1c2UgYWN0aXZpdHkuICBBDQoJc3RhbmRhcmRpemVkIHJlcG9ydCBmb3JtYXQg ZW5hYmxlcyBhdXRvbWF0ZWQgcHJvY2Vzc2luZy4gIFRoZSBBYnVzZSBSZXBvcnRpbmcNCglGb3Jt YXQgKEFSRikgc3BlY2lmaWNhdGlvbiBoYXMgZ2FpbmVkIHN1ZmZpY2llbnQgcG9wdWxhcml0eSB0 byB3YXJyYW50IGZvcm1hbA0KCWNvZGlmaWNhdGlvbiwgdG8gZW5zdXJlIGFuZCBlbmNvdXJhZ2Ug ZnV0dXJlIGludGVyb3BlcmFiaWxpdHkgd2l0aCBuZXcNCglpbXBsZW1lbnRhdGlvbnMuICBUaGUg cHJpbWFyeSBmdW5jdGlvbiBvZiB0aGlzIHdvcmtpbmcgZ3JvdXAgd2lsbCBiZSB0byBzb2xpY2l0 DQoJcmV2aWV3IGFuZCByZWZpbmVtZW50IG9mIHRoZSBleGlzdGluZyBzcGVjaWZpY2F0aW9uLg0K DQoJQVJGIHdhcyBkZXZlbG9wZWQgYnkgYSBtZXNzYWdpbmcgdHJhZGUgb3JnYW5pemF0aW9uIGlu ZGVwZW5kZW50IG9mIHRoZSBJRVRGLA0KCWFuZCB1c2VzIGEgZm9ybWF0IHNpbWlsYXIgdG8gYSBE ZWxpdmVyeSBTdGF0dXMgTm90aWZpY2F0aW9uIChEU04sIFJGQzM0NjQpDQoJdG8gcmVwb3J0IGZy YXVkLCBzcGFtLCB2aXJ1c2VzIG9yIG90aGVyIGFidXNpdmUgYWN0aXZpdHkgaW4gdGhlIGVtYWls IHN5c3RlbS4NCglUaGUgYmFzaWMgZm9ybWF0IGlzIGFtZW5hYmxlIHRvIHByb2Nlc3NpbmcgYnkg aHVtYW5zIG9yIHNvZnR3YXJlLCB3aXRoIHRoZQ0KCWxhdHRlciByZXF1aXJpbmcgdGhlIGZvcm1h dCB0byBiZSBzdGFuZGFyZGl6ZWQsIHRvIHBlcm1pdCBpbnRlcm9wZXJhYmlsaXR5DQoJYmV0d2Vl biBhdXRvbWF0ZWQgc2VydmljZXMsIHBhcnRpY3VsYXJseSB3aXRob3V0IHByaW9yIGFycmFuZ2Vt ZW50Lg0KDQoJQVJGIGFzIGluaXRpYWxseSBkZWZpbmVkIGlzIGFscmVhZHkgaW4gd2lkZXNwcmVh ZCB1c2UgYXQgbGFyZ2UgSVNQcywgc28NCglpbnRlcm9wZXJhYmlsaXR5IGNhbiBiZSBkZW1vbnN0 cmF0ZWQuICBTb21lIHRvb2xzIGFscmVhZHkgZXhpc3QNCglmb3IgcHJvY2Vzc2luZyBBUkYgbWVz c2FnZXMsIGEgZmV3IG9mIHdoaWNoIGFyZSBvcGVuIHNvdXJjZS4gIEluIG9yZGVyIHRvDQoJcHJl c2VydmUgdGhlIGluc3RhbGxlZCBiYXNlLCB0aGUgd29ya2luZyBncm91cCB3aWxsIG1ha2UgdGhl IG1pbmltdW0gY2hhbmdlcw0KCW5lY2Vzc2FyeSB0byB0aGUgZXhpc3Rpbmcgc3BlY2lmaWNhdGlv biBhbmQgd2lsbCBzZWVrIHRvIGhhdmUgYmFja3dhcmQNCgljb21wYXRpYmlsaXR5LiAgRnVydGhl cm1vcmUsIHNvbWUgZXh0ZW5zaW9ucyB0byB0aGUgY3VycmVudCBwcm9wb3NhbCBhcmUNCglvZiBp bnRlcmVzdCB0byB0aGUgY29tbXVuaXR5LCBzdWNoIGFzIHRoZSBtZWFucyBmb3IgYW4gb3BlcmF0 b3IgdG8gYWR2ZXJ0aXNlDQoJYW4gZW1haWwgYWRkcmVzcyB0byB3aGljaCBhYnVzZSByZXBvcnRz IHVzaW5nIEFSRiBzaG91bGQgYmUgc2VudC4gIFRoZQ0KCXdvcmtpbmcgZ3JvdXAgd2lsbCB0YWtl IG9uIHRoZSB0YXNrIG9mIGNvbnNpZGVyaW5nIGFuZCBzcGVjaWZ5aW5nIHN1Y2ggYSBtZWNoYW5p c20uDQoNCglUaGUgaW5pdGlhbCBwcm9wb3NhbCBpcyBwdWJsaXNoZWQgYXMgZHJhZnQtc2hhZnJh bm92aWNoLWZlZWRiYWNrLXJlcG9ydCwNCglhbmQgdGhpcyB3aWxsIHByb3ZpZGUgdGhlIHdvcmtp bmcgZ3JvdXAncyBzdGFydGluZyBwb2ludC4NCg0KCVRoZSB3b3JraW5nIGdyb3VwIHNob3VsZCBj b25zaWRlciBzdWNoIGZhY3RvcnMgYXM6DQoJKiBpbXBsZW1lbnRlciBleHBlcmllbmNlDQoJKiBp bnRlcm5hdGlvbmFsaXphdGlvbg0KCSogZXhpc3RpbmcgdXNlcyBvZiBBUkYNCgkqIGFiaWxpdHkg dG8gYWNoaWV2ZSBicm9hZCBpbXBsZW1lbnRhdGlvbiBhbmQgaW50ZXJvcGVyYWJpbGl0eQ0KCSog YWJpbGl0eSB0byBhZGRyZXNzIGJyb2FkZXIgdXNlIGNhc2VzIHRoYW4gbWF5IGhhdmUgYmUgY29u dGVtcGxhdGVkIGJ5IHRoZSBvcmlnaW5hbA0KCSAgYXV0aG9ycw0KCSogb3ZlcmxhcCB3aXRoIHRo ZSBJTkNIIHdvcmtpbmcgZ3JvdXAncyB3b3JrIChlLmcuIFJGQzUwNzApOyBpdCBpcyB1bmNsZWFy IHdoZXRoZXINCgkgIHN1Y2ggb3ZlcmxhcCBpcyBhcHByb3ByaWF0ZSBvciBzaG91bGQgYmUgYXZv aWRlZA0KDQogICAgICAgIFRodXMsIHRoZSB3b3JraW5nIGdyb3VwJ3Mgc3BlY2lmaWMgdGFza3Mg YXJlIGFzIGZvbGxvd3M6DQoNCgkxKSBUaGUgZ3JvdXAgd2lsbCBmaXJzdCBwcm9kdWNlIGEgUHJv cG9zZWQgU3RhbmRhcmQgdHJhY2sgc3BlY2lmaWNhdGlvbiBvZiBBUkYuDQoJICAgVGhpcyB3aWxs IGRvY3VtZW50IGN1cnJlbnQgdXNlLCByZW1vdmluZyBhbnkgcG9ydGlvbnMgdGhhdCBhcmUgbm90 IGltcGxlbWVudGVkIGFuZC9vcg0KCSAgIG5vdCByZXF1aXJlZCBmb3IgYSBtaW5pbXVtIGltcGxl bWVudGF0aW9uICh0byBiZSBwdWJsaXNoZWQgbGF0ZXIgYXMgZXh0ZW5zaW9ucykuDQoJICAgVGhp cyB3aWxsIGluY2x1ZGUgbm90IG9ubHkgdGhlIGZvcm1hdCBvZiBhbiBBUkYgbWVzc2FnZSwgYnV0 IG11c3QgYWxzbyBpbmNsdWRlDQoJICAgYXBwcm9wcmlhdGUgZG9jdW1lbnRhdGlvbiBvZiBzZWN1 cml0eSBjb25zaWRlcmF0aW9ucyBhbmQgY3JlYXRpb24gb2YgSUFOQSByZWdpc3RyaWVzDQoJICAg Zm9yIGVsZW1lbnRzIG9mIEFSRiB0byBzdXBwb3J0IGZ1dHVyZSBleHRlbnNpb25zLCBhcyB3ZWxs IGFzIGluZm9ybWF0aW9uYWwgc2VjdGlvbnMNCgkgICBjb252ZXlpbmcgY3VycmVudCBiZXN0IHBy YWN0aXNlcy4NCg0KCTIpIFRoZSBmb2xsb3dpbmcgcG9zc2lsYmxlIHJlcG9ydGluZyBleHRlbnNp b25zIGhhdmUgYmVlbiBwcm9wb3NlZCBhbmQgd2lsbCBiZSBjb25zaWRlcmVkDQoJICAgcG9zc2li bGUgZm9yIHB1YmxpY2F0aW9uIGFzIGV4dGVuc2lvbnMgdG8gdGhlIGJhc2Ugc3BlY2lmaWNhdGlv bjoNCg0KCSAgIGEpIGRyb3AgYm94ZXMgKGRldGVjdGlvbiBvZiBhIG1haWxib3ggdXNlZCB0byBy ZWNlaXZlIHRoaW5ncyBsaWtlIHN0b2xlbg0KCSAgICAgIGNyZWRpdCBjYXJkcykNCgkgICBiKSBi b3RuZXQgZGV0ZWN0aW9uIChpLmUuIHJlcG9ydGluZyBvZiB0cmFmZmljIHRoYXQgYXBwZWFycyB0 byBoYXZlIGNvbWUNCgkgICAgICBmcm9tIGEgYm90LCByZWdhcmRsZXNzIG9mIGNvbnRlbnQpDQoJ ICAgYykgU1NIIGF0dGFja3MNCgkgICBkKSBGVFAgYXR0YWNrcw0KCSAgIGUpIFdlYiBzZXJ2ZXIg YXR0YWNrcw0KCSAgIGYpIG1haWwgc2VudCB0byBhIGhvbmV5cG90IG9yIHNwYW0gdHJhcA0KCSAg IGcpIG1hbHdhcmUgY29ubmVjdGlvbnMgdG8gc2lua2hvbGVzDQoJICAgaCkgRERvUyByZXBvcnRz DQoJICAgaSkgcG9ydGlvbnMgb2YgdGhlIHByZS1JRVRGIHZlcmlzb24gb2YgdGhlIHNwZWNpZmlj YXRpb24gdGhhdCB3ZXJlIHJlbW92ZWQgaW4gKDEpDQoJICAgICAgYWJvdmUgdG8gcHJvZHVjZSBh IG1pbmltYWwgYmFzZSBkb2N1bWVudA0KCSAgIGopIG90aGVycyB0aGF0IG1heSBiZSBwcm9wb3Nl ZCB3aXRoaW4gdGhlIGFsbG90dGVkIHRpbWVmcmFtZQ0KDQoJMykgVGhlIGdyb3VwIHdpbGwgc3Bl Y2lmeSB0aGUgaW50ZWdyYXRpb24gb2YgQVJGIGludG8gREtJTSBETlMga2V5IHJlY29yZHMsIHdp dGgNCgkgICBkcmFmdC1rdWNoZXJhd3ktZGtpbS1yZXBvcnRpbmcgYXMgaXRzIGlucHV0LiAgSXQg Y29udGFpbnMgZXh0ZW5zaW9ucw0KCSAgIHRvIERLSU0gdGhhdCBhcmUgcmVsYXRlZCB0byBBUkYg YXMgYSBtZWFucyBvZiByZXBvcnRpbmcgREtJTS1yZWxhdGVkIGZhaWx1cmVzDQoJICAgd2hpY2gg aW5jbHVkZSBwaGlzaGluZyAoImZyYXVkIikgYW5kIGFzIHN1Y2ggYXJlIHJlbGV2YW50IHRvIHRo ZSBBUkYgZWZmb3J0Lg0KCSAgIFRoZSBncm91cCB3aWxsIHByb2R1Y2UgUHJvcG9zZWQgU3RhbmRh cmQgdHJhY2sgc3BlY2lmaWNhdGlvbiBmb3IgdGhlc2UNCgkgICBBUkYgYW5kIERLSU0gZXh0ZW5z aW9ucy4NCg0KCTQpIFRoZSBncm91cCB3aWxsIGZpbmFsbHkgY29uc2lkZXIgYSBtZWFucyBmb3Ig cHVibGlzaGluZyB0aGUgYWRkcmVzcw0KCSAgIHRvIHdoaWNoIEFSRiByZXBvcnRzIHNob3VsZCBi ZSBzZW50LiAgTm90IGFsbCBBUkYgcGFydGljaXBhbnRzIHdpc2ggdG8gdXNlDQoJICAgYWJ1c2VA KGRvbWFpbiksIHdoaWNoIGlzIHRoZSBjdXJyZW50IHN0YW5kYXJkIChSRkMyMTQyKSAsIGFzIHRo ZSBwbGFjZSB0byBzZW5kDQoJICAgYXV0b21hdGVkIEFSRi1mb3JtYXR0ZWQgcmVwb3J0cy4gIFRo ZSBncm91cCB3aWxsIGVpdGhlciBjb25jbHVkZSB0aGF0IHRoZSBpbmR1c3RyeQ0KCSAgIHNob3Vs ZCBjb250aW51ZSB0byB1c2UgdGhpcyBkZSBmYWN0byBzdGFuZGFyZCAoYW5kIHRodXMgbm8gc3Bl Y2lmaWNhdGlvbiBpcyBhcHByb3ByaWF0ZSksDQoJICAgb3Igd2lsbCBwcm9kdWNlIGEgUHJvcG9z ZWQgU3RhbmRhcmQgdHJhY2sgZG9jdW1lbnQgaWRlbnRpZnlpbmcgdGhlIG1lYW5zIGJ5IHdoaWNo DQoJICAgdGhhdCBhZGRyZXNzIHNob3VsZCBiZSBhZHZlcnRpc2VkLg0KDQoJVGhlIGdyb3VwIG1h eSBjb25zaWRlciByZS1jaGFydGVyaW5nIHRvIGNvdmVyIHJlbGF0ZWQgd29yaywgc3VjaCBhcyBm dXJ0aGVyIGV4dGVuc2lvbnMsDQoJb25jZSB0aGVzZSBkZWxpdmVyYWJsZXMgaGF2ZSBiZWVuIGFj aGlldmVkLg0KDQogICBHb2FscyBhbmQgTWlsZXN0b25lczoNCglKYW4gMTAJSXNzdWUgZmlyc3Qg V0ctYmFzZWQgSW50ZXJuZXQtRHJhZnQgZGVmaW5pbmcgQVJGDQoJTWFyIDEwCUFjaGlldmUgY29u c2Vuc3VzIG9uIGFueSBXRy1iYXNlZCBjaGFuZ2VzIHRvIEFSRg0KCUFwciAxMAlTdWJtaXQgQVJG IElEIHRvIElFU0cgZm9yIHB1YmxpY2F0aW9uDQoJQXVnIDEwCUlzc3VlIFdHLWJhc2VkIElEcyBk ZWZpbmluZyB1c2VmdWwgZXh0ZW5zaW9ucw0KCU5vdiAxMAlBY2hpZXZlIGNvbnNlbnN1cyBvbiBl eHRlbnNpb24gZHJhZnRzDQoJRGVjIDEwCVN1Ym1pdCBleHRlbnNpb24gSURzIHRvIElFU0cgZm9y IHB1YmxpY2F0aW9uDQoJSmFuIDExCUlzc3VlIGZpcnN0IFdHLWJhc2VkIElEIGZvciBES0lNIHJl cG9ydGluZyBleHRlbnNpb25zDQoJTWFyIDExCUFjaGlldmUgY29uc2Vuc3VzIG9uIERLSU0gcmVw b3J0aW5nIGV4dGVuc2lvbnMgZHJhZnQNCglBcHIgMTEJU3VibWl0IERLSU0gcmVwb3J0aW5nIElE IHRvIElFU0cgZm9yIHB1YmxpY2F0aW9uDQoJSnVuIDExCUlzc3VlIGZpcnN0IFdHLWJhc2VkIElE IGZvciBhZHZlcnRpc2luZyB0aGUgQVJGIGFkZHJlc3MNCglTZXAgMTEJQWNoaWV2ZSBjb25zZW5z dXMgb24gQVJGIGFkZHJlc3MgYWR2ZXJ0aXNpbmcgZHJhZnQNCglPY3QgMTEJU3VibWl0IEFSRiBh ZGRyZXNzIGFkdmVydGlzaW5nIElEIHRvIElFU0cgZm9yIHB1YmxpY2F0aW9uDQo= --_004_BB012BD379D7B046ABE1472D8093C61C01C1E896EEEXCHC2corpclo_--