From barryleiba.mailing.lists@gmail.com  Thu Jun  3 13:41:50 2010
Return-Path: <barryleiba.mailing.lists@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E8F113A68DB; Thu,  3 Jun 2010 13:41:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.086
X-Spam-Level: 
X-Spam-Status: No, score=-3.086 tagged_above=-999 required=5 tests=[AWL=0.913,  BAYES_50=0.001, GB_I_INVITATION=-2, GB_I_LETTER=-2]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oul4NLBTFsLz; Thu,  3 Jun 2010 13:41:49 -0700 (PDT)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 8252A3A6781; Thu,  3 Jun 2010 13:41:48 -0700 (PDT)
Received: by fxm6 with SMTP id 6so410142fxm.31 for <multiple recipients>; Thu, 03 Jun 2010 13:41:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:reply-to :in-reply-to:references:date:message-id:subject:from:to:content-type :content-transfer-encoding; bh=yU1z7ZPkm8KzIsS8Z7YmUVhXftzUi4Wp3odRrrUVr+Y=; b=iJogPigFaCulAXu2/gZjNt9gKET9QtTqBcWR89IRLJeCM5OwaOw2qmYQ9UU47pyQFr U0sOqfMZLC/da52q181OZeiZisEm2HV0RF5pbB12az+9Ul9AU4iURoMRQeNKtjip1vEE /j31yYTnX26dGSp0ePfNDc4HQ4s5KogbxTGGA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:content-type:content-transfer-encoding; b=cXz8W6yIRny5Y93HWxu4IA+FydgbGhgpCCKOA6E5Q+ZY5Co0GjyKJr6ntMQrtN3GwG zCdYtlEVOV7wGfZykXqARhkSY75CMeDFDPJB29gtHGDEhBTTAMch0Ij7ynjiYaxyi5u2 HpsVcPpIybKCko2O+gFl8Wapcn5p7bHvsmHyA=
MIME-Version: 1.0
Received: by 10.223.24.133 with SMTP id v5mr10902935fab.46.1275597691957; Thu,  03 Jun 2010 13:41:31 -0700 (PDT)
Received: by 10.223.122.141 with HTTP; Thu, 3 Jun 2010 13:41:31 -0700 (PDT)
In-Reply-To: <20100603194905.138023A6A09@core3.amsl.com>
References: <20100603194905.138023A6A09@core3.amsl.com>
Date: Thu, 3 Jun 2010 16:41:31 -0400
Message-ID: <AANLkTinayJ5yrFaYas8c8GUw5uZFlIwFaXBbdOQzCv3N@mail.gmail.com>
From: Barry Leiba <barryleiba.mailing.lists@gmail.com>
To: vwrap@ietf.org, marf@ietf.org, morg@ietf.org, ietf-dkim@mipassoc.org
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable
Subject: [marf] Fwd: IETF 78 - Meeting and Sponsorship Information
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: barryleiba@computer.org
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Jun 2010 20:41:51 -0000

Working-group denizens: see the note below, and notice, in particular,
the sponsorship opportunities available at this and other IETF
meetings.  If a company you're associated with might have an interest
in sponsoring IETF activities, please put the appropriate parties in
contact.

And I hope to see many of you in Maastricht.

Barry, as chair, passing on information from above

---------- Forwarded message ----------
From: IETF Secretariat <ietf-secretariat@ietf.org>
Date: Thu, Jun 3, 2010 at 3:49 PM
Subject: IETF 78 - Meeting and Sponsorship Information
To: IETF Announcement list <ietf-announce@ietf.org>


78th IETF Meeting
Maastricht, Netherlands
July 25-30, 2010

1. Sponsorship Opportunities
2. Registration Types
3. Visas and Letters of Invitation
4. Accommodations & Breakfast Information
5. IETF 79 (Beijing) Visa Information

1) Sponsorship Opportunities
There are still sponsorship opportunities and benefits for high profile
company/organizational exposure at the upcoming IETF meeting in
Maastricht, Netherlands from July 25-30, 2010. All sponsorship fees go
directly to fund the operations of the IETF. See the options at:
http://www.ietf.org/meeting/78/index.html =93Sponsorship Opportunities=94
under =93General=94. Each of the sponsorship options provide extended and
repeat exposure at this weeklong meeting.

Please contact Drew Dvorshak, dvorshak@isoc.org, with any questions
and/or to reserve your organization=92s spot. Thanks in advance for
supporting the critical work of the IETF!

2) Register online at: http://www.ietf.org/meetings/78/

3) Letters of Invitation and Visas
Letters of Invitation
After you complete the meeting registration process, you will be given the
option to request a letter of invitation. You can request the Letter of
Invitation as soon as you finish registration, or at a later time by
following the link provided in the confirmation email.

Visas
Please check the Netherlands Ministry of Foreign Affairs site
(http://www.minbuza.nl/en/Services/Consular_Services/Visa) for list of
countries with visa exemptions.

We recommend you give yourself at least one month to complete the visa
process.

4) Accommodations & Breakfast Information
http://www.ietf.org/meeting/78/hotel.html

5) If you want to start planning for your trip to IETF 79 in Beijing, we
have visa information online here:
http://www.ietf.org/meeting/79/visa.html

Only 52 days until IETF 78!


_______________________________________________
IETF-Announce mailing list
IETF-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/ietf-announce

From msk@cloudmark.com  Mon Jun 21 12:42:16 2010
Return-Path: <msk@cloudmark.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 72A043A68D0 for <marf@core3.amsl.com>; Mon, 21 Jun 2010 12:42:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.911
X-Spam-Level: 
X-Spam-Status: No, score=-0.911 tagged_above=-999 required=5 tests=[AWL=-0.726, BAYES_40=-0.185]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cExWqLwYYBvn for <marf@core3.amsl.com>; Mon, 21 Jun 2010 12:42:15 -0700 (PDT)
Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by core3.amsl.com (Postfix) with ESMTP id 9F4463A6821 for <marf@ietf.org>; Mon, 21 Jun 2010 12:42:15 -0700 (PDT)
Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Mon, 21 Jun 2010 12:42:23 -0700
From: "Murray S. Kucherawy" <msk@cloudmark.com>
To: Message Abuse Report Format working group <marf@ietf.org>
Date: Mon, 21 Jun 2010 12:42:22 -0700
Thread-Topic: [marf] draft-jdfalk-marf-reporting-discovery
Thread-Index: AcryFdjJXa0e75mURY23ZgtyQHLp+gfY3X7Q
Message-ID: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>
References: <D913CFC0-7E0D-4C7C-A2CD-42F3B55051F9@cybernothing.org> <AANLkTimkcST27IBgRRXytvJqSGvI10EFV1NxVanQUS4v@mail.gmail.com> <4CCC2CE0-4742-434C-9CC0-090E056AA810@cybernothing.org>
In-Reply-To: <4CCC2CE0-4742-434C-9CC0-090E056AA810@cybernothing.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Jun 2010 19:42:16 -0000

We have in our charter the work of considering mechanisms for doing feedbac=
k reporting discovery, so this is most certainly on-topic.  That doesn't me=
an we need to specify something; a possible output of the working group is =
to decide that this is not something that should be specified.

Given that it's on-topic, is there rough consensus that JD's draft is a goo=
d starting point for discussion?  In that case, I believe the next step is =
we should make it a working group document and then begin discussing it.

We've also got the DKIM reporting extensions document as an active working =
group item, and a meeting coming up at the end of next month, so we should =
try re-engage discussion on these topics.

-MSK [as co-chair]

I'll make an effort to post a review of my own of the reporting discovery o=
ne shortly.

-MSK [as participant]


From johnl@iecc.com  Mon Jun 21 21:06:21 2010
Return-Path: <johnl@iecc.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E48D3A6936 for <marf@core3.amsl.com>; Mon, 21 Jun 2010 21:06:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.71
X-Spam-Level: 
X-Spam-Status: No, score=-9.71 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xX9uQ9U0D+RJ for <marf@core3.amsl.com>; Mon, 21 Jun 2010 21:06:20 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id A3BB63A684B for <marf@ietf.org>; Mon, 21 Jun 2010 21:06:19 -0700 (PDT)
Received: (qmail 62183 invoked from network); 22 Jun 2010 04:01:35 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 22 Jun 2010 04:01:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; olt=johnl@user.iecc.com; bh=FZnMIkC+YP71yr7vhBXSSLVoKRL2fTxx50Tb4+2mPa8=; b=hI2FrE8AfPRh50PEVivE3NQFo3dBugUxY9D4YRvJlma740KeSux7ZftSgWukrtPx/LtSkYW8i3A/kGTWFHcvDe3EscnqJUIJf1TF0n+M3otoE2tAWA5x7s3f+MVXL9twW8M5dF1fnGQE5pn4gPFjtiSkq+BAZMHEw5cY8q7Lnxg=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; bh=FZnMIkC+YP71yr7vhBXSSLVoKRL2fTxx50Tb4+2mPa8=; b=bgItUZvUT6bA0CBbmmdqUqKkG29uBsbGSj9chuf2PeG4newk5ngxR0g8pIpp8CvnyAoACxSIajdHoJC3CaHgPridiR58TJqQ6e/eXBpdz/7L090aMe2VtyHHGOFzBEwVcrSpOadMDHMvT0xCb6QkgB5j/COK47tjWMuhyK6MAt0=
Date: 22 Jun 2010 04:06:25 -0000
Message-ID: <20100622040625.97472.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>
Organization: 
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Jun 2010 04:06:21 -0000

>Given that it's on-topic, is there rough consensus that JD's draft is
>a good starting point for discussion?

It's fine as far as it goes, but it sure would be nice to have some
expressions of interest by large senders or receivers to give us a
hint about what sorts of discovery they want to do so we know we're
not wasting our time.

R's,
John

From sm@resistor.net  Mon Jun 21 22:50:23 2010
Return-Path: <sm@resistor.net>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD3EB3A6933 for <marf@core3.amsl.com>; Mon, 21 Jun 2010 22:50:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.89
X-Spam-Level: 
X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[AWL=0.709,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zWR3qssYM0bZ for <marf@core3.amsl.com>; Mon, 21 Jun 2010 22:49:58 -0700 (PDT)
Received: from ns1.qubic.net (ns1.qubic.net [208.69.177.116]) by core3.amsl.com (Postfix) with ESMTP id 690B23A686D for <marf@ietf.org>; Mon, 21 Jun 2010 22:49:58 -0700 (PDT)
Received: from SUBMAN.resistor.net ([10.0.0.1]) (authenticated bits=0) by ns1.qubic.net (8.14.5.Alpha0/8.14.5.Alpha0) with ESMTP id o5M5nfLe000349 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 21 Jun 2010 22:49:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1277185803; x=1277272203; bh=HuWeZbYpYavU7tq7uVs5KnNELGwbLhFd7NDboHmnD9A=; h=Message-Id:Date:To:From:Subject:Cc:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=4UyDs7blH9saD7aWht+QX7s01g8FaxQYRiemUAOURdDbqVco6Qw5bzV904/0up1Qr ZoMWBaPJa2Aqfu7nb/W5dGpMvp7tZQ2M/5lx33/7nlg02ijnCtRu3SelqgRyWEn+Zm 4NwxcsgXB6REvMuGqCcBhEqY4DO+0tc4R8yJU1pw=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1277185803; x=1277272203; bh=HuWeZbYpYavU7tq7uVs5KnNELGwbLhFd7NDboHmnD9A=; h=Message-Id:Date:To:From:Subject:Cc:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=gTBahOmLXxVRREGsgWn2fWbL4dsXajrr9lOD3rMFpUnSJv9tMgYhMMBfrFmTk+Ywm nJ+rg3ZX+HoujOQQYmujjAAcHmEp8BVYyhQ6f/63DRU7jLdmpW5VKWb4FKDTRUrmfj HFEv5doTzxk0K/XeTaPa6ey1I1iB2f7uQ46qfb7M=
DomainKey-Signature: a=rsa-sha1; s=mail; d=resistor.net; c=simple; q=dns; b=BCeeCvs3D4t9lvOaUor6h+26yRkbDgRICuzr4YvyDqZ7RpGdFmVTiw/e53sxk7Tkr cMJDjjgOc7GvaK9mIgQLYc9baU3Ri2X5zy4xYP3o181u0LS+RH2BH+onOfM+e2hdZWc 8z7RsjWe/ZcPzeAiTwjxayHE2XAy6ngt1cdpK6Q=
Message-Id: <6.2.5.6.2.20100621224048.07089c78@resistor.net>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6
Date: Mon, 21 Jun 2010 22:47:48 -0700
To: "Murray S. Kucherawy" <msk@cloudmark.com>
From: SM <sm@resistor.net>
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cl oudmark.com>
References: <D913CFC0-7E0D-4C7C-A2CD-42F3B55051F9@cybernothing.org> <AANLkTimkcST27IBgRRXytvJqSGvI10EFV1NxVanQUS4v@mail.gmail.com> <4CCC2CE0-4742-434C-9CC0-090E056AA810@cybernothing.org> <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Jun 2010 05:50:24 -0000

Hi Murray,
At 12:42 21-06-10, Murray S. Kucherawy wrote:
>We have in our charter the work of considering mechanisms for doing 
>feedback reporting discovery, so this is most certainly 
>on-topic.  That doesn't mean we need to specify something; a 
>possible output of the working group is to decide that this is not 
>something that should be specified.

I'm fine with this WG taking on 
draft-jdfalk-marf-reporting-discovery-01 as long as the intended 
status is Experimental.  That's different from what item 4 of the WG 
Charter says but it has the advantage of lowering the bar for publication.

Regards,
-sm 


From jdfalk-lists@cybernothing.org  Tue Jun 22 09:54:24 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A93113A68A9 for <marf@core3.amsl.com>; Tue, 22 Jun 2010 09:54:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.099
X-Spam-Level: 
X-Spam-Status: No, score=-4.099 tagged_above=-999 required=5 tests=[BAYES_50=0.001, RCVD_IN_BSP_OTHER=-0.1, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SlHLlswekAny for <marf@core3.amsl.com>; Tue, 22 Jun 2010 09:54:23 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 7EF593A67AB for <marf@ietf.org>; Tue, 22 Jun 2010 09:54:23 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5MGsSUp022123 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Tue, 22 Jun 2010 10:54:30 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5MGsSUp022123
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=cybernothing.org; s=satori; t=1277225670; bh=poeVNukxv+Ph93MyLdYwgMkaqJPgaDVbvFc76e1l 2Qk=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=fHUwK9w9S3lrGvEj /jeN+8pSXiboZxnA6RMZjFoseJNFekRv+RjMnpJIBBE8rYhBzjrlJeGDFoZYAZFtReY ophn9fC0mqcAVPCu3ka7874ERRL6rbT8QVyPhhaEOt6i2R06UIM+gryclqr7L35qk6+ HmV5JPDViOlWyL40/GYo0=
References: <20100622040625.97472.qmail@joyce.lan>
In-Reply-To: <20100622040625.97472.qmail@joyce.lan>
Mime-Version: 1.0 (Apple Message framework v1078)
Content-Type: text/plain; charset=us-ascii
Message-Id: <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Tue, 22 Jun 2010 10:54:23 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1078)
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Jun 2010 16:54:24 -0000

On Jun 21, 2010, at 10:06 PM, John Levine wrote:

>> Given that it's on-topic, is there rough consensus that JD's draft is
>> a good starting point for discussion?
>=20
> It's fine as far as it goes, but it sure would be nice to have some
> expressions of interest by large senders or receivers to give us a
> hint about what sorts of discovery they want to do so we know we're
> not wasting our time.

Well, I can tell you that the largest Feedback Generator is very =
interested.  But, nobody appears particularly desperate for it.

I realized a few weeks ago that I'd neglected to fully describe the most =
immediately interesting use case: verification of consumers.  =
Specifically, when a Feedback Consumer requests feedback via the current =
mechanisms (which are almost invariably web forms leading to a manual =
approval process), the Feedback Generator can use the relevant =
advertisement to ensure that the feedback would be going to the correct =
place.


On Jun 21, 2010, at 11:47 PM, SM wrote:

> I'm fine with this WG taking on =
draft-jdfalk-marf-reporting-discovery-01 as long as the intended status =
is Experimental.  That's different from what item 4 of the WG Charter =
says but it has the advantage of lowering the bar for publication.

What's the process for moving from Experimental to Proposed Standard =
once the experiment is complete?

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc





From sm@resistor.net  Tue Jun 22 11:56:38 2010
Return-Path: <sm@resistor.net>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF66F3A6943 for <marf@core3.amsl.com>; Tue, 22 Jun 2010 11:56:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.906
X-Spam-Level: 
X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[AWL=0.693,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RHBAsgmdZDar for <marf@core3.amsl.com>; Tue, 22 Jun 2010 11:56:37 -0700 (PDT)
Received: from ns1.qubic.net (ns1.qubic.net [208.69.177.116]) by core3.amsl.com (Postfix) with ESMTP id 9D6603A68CE for <marf@ietf.org>; Tue, 22 Jun 2010 11:56:37 -0700 (PDT)
Received: from SUBMAN.resistor.net ([10.0.0.1]) (authenticated bits=0) by ns1.qubic.net (8.14.5.Alpha0/8.14.5.Alpha0) with ESMTP id o5MIuB2v012429 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 22 Jun 2010 11:56:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1277232996; x=1277319396; bh=aqa2gYIM9d8BVNNSrSg0K39RSZtGng5wgIx4SC/IxXg=; h=Message-Id:Date:To:From:Subject:Cc:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=w2v6U/8Us1JAdk/27HxYFOcpDWUJdpPotMBkc4FTvE5HhiEa2iGKpuJhfYGS8Btsb myAY084RMCRfPjAmbCOYCA4M8PaCFH4PY2sGlDmMADH3ABEYALaMikq4okF2RPfLHN TbTtsv47uNwoi09j9zT10VHpe1FTYn60aRUsyAj8=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1277232996; x=1277319396; bh=aqa2gYIM9d8BVNNSrSg0K39RSZtGng5wgIx4SC/IxXg=; h=Message-Id:Date:To:From:Subject:Cc:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=yi0QCpkfyeuRnEtI7CsbVdorgSVtb4pr3yXDG5bktqSS7tTaUPzS6Il4jWvQczabq GqKgmE2ObTcTeh3a1OMntfG0s2z6lcXm6Pu7SMzlM6wJrR0ZvwtYw91LaQdmDI3LIf hp2q0Uk/6hVBxu2WjTJQlrrt1RJCktqfzn8hfAo0=
DomainKey-Signature: a=rsa-sha1; s=mail; d=resistor.net; c=simple; q=dns; b=MCVWpMdgnPHp3SXLKsa5eWrIr7GccSNjAm4UD/pZnS0PZxb6say0b9mu3ib9Zo+wC qOBYVc44Bv3hAWcI9pk+Y4zlOkWY6TYLSDuPfshlzbWtC9rhXQAZ0eegfefte6s5t4S c8jvBCbZHVSQdjxNfO3aRjbRuMtFd5XIm+CFgdU=
Message-Id: <6.2.5.6.2.20100622114236.07390908@resistor.net>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6
Date: Tue, 22 Jun 2010 11:55:55 -0700
To: "J.D. Falk" <jdfalk-lists@cybernothing.org>
From: SM <sm@resistor.net>
In-Reply-To: <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Jun 2010 18:56:38 -0000

Hi JD,
At 09:54 22-06-10, J.D. Falk wrote:
>What's the process for moving from Experimental to Proposed Standard 
>once the experiment is complete?

According to the MARF Charter, this I-D is for Item 4 which should be 
submitted in September 2011.  draft-jdfalk-marf-reporting-discovery 
could be adopted as WG work published as Experimental before the WG 
gets into a discussion about RFC 2142.  The WG then gets into that 
discussion and determines which alternative is the best.  If it is 
draft-jdfalk-marf-reporting-discovery, the WG can propose moving the 
draft to Proposed Status, with some changes if necessary.

Regards,
-sm 


From msk@cloudmark.com  Tue Jun 22 12:03:39 2010
Return-Path: <msk@cloudmark.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 308423A6964 for <marf@core3.amsl.com>; Tue, 22 Jun 2010 12:03:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.328
X-Spam-Level: 
X-Spam-Status: No, score=-2.328 tagged_above=-999 required=5 tests=[AWL=0.271,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VzY6a0QzqYBk for <marf@core3.amsl.com>; Tue, 22 Jun 2010 12:03:38 -0700 (PDT)
Received: from ht2-outbound.cloudmark.com (ht2-outbound.cloudmark.com [72.5.239.36]) by core3.amsl.com (Postfix) with ESMTP id 0A3AB3A687A for <marf@ietf.org>; Tue, 22 Jun 2010 12:03:38 -0700 (PDT)
Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by spite.corp.cloudmark.com ([172.22.1.72]) with mapi; Tue, 22 Jun 2010 12:03:45 -0700
From: "Murray S. Kucherawy" <msk@cloudmark.com>
To: SM <sm@resistor.net>, "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Tue, 22 Jun 2010 12:03:44 -0700
Thread-Topic: [marf] draft-jdfalk-marf-reporting-discovery
Thread-Index: AcsSPKtpUb1hvQdOQ7KTC551bxSK6wAAJyaw
Message-ID: <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net>
In-Reply-To: <6.2.5.6.2.20100622114236.07390908@resistor.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Jun 2010 19:03:39 -0000

> -----Original Message-----
> From: marf-bounces@ietf.org [mailto:marf-bounces@ietf.org] On Behalf Of
> SM
> Sent: Tuesday, June 22, 2010 11:56 AM
> To: J.D. Falk
> Cc: Message Abuse Report Format working group
> Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
>=20
> According to the MARF Charter, this I-D is for Item 4 which should be
> submitted in September 2011.  draft-jdfalk-marf-reporting-discovery
> could be adopted as WG work published as Experimental before the WG
> gets into a discussion about RFC 2142.  The WG then gets into that
> discussion and determines which alternative is the best.  If it is
> draft-jdfalk-marf-reporting-discovery, the WG can propose moving the
> draft to Proposed Status, with some changes if necessary.

I'd support that approach.

I would also support the idea of posting the draft, conducting the experime=
nt with that draft as the basis and updating it as needed, and only seeking=
 advancement by the IESG once the experiment is concluded and the document =
updated based on the results.

I don't think we're required to do it either way, so it's really up to the =
WG to decide how it wants to proceed.

A separate question is whether or not we want to make this a WG document.  =
So far I hear a couple of votes for but none against.

From johnl@iecc.com  Tue Jun 22 15:42:15 2010
Return-Path: <johnl@iecc.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1AF5A3A6A26 for <marf@core3.amsl.com>; Tue, 22 Jun 2010 15:42:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.155
X-Spam-Level: 
X-Spam-Status: No, score=-9.155 tagged_above=-999 required=5 tests=[AWL=-0.556, BAYES_50=0.001, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lTr7RiPe0U-O for <marf@core3.amsl.com>; Tue, 22 Jun 2010 15:42:08 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id 0A2FD28C131 for <marf@ietf.org>; Tue, 22 Jun 2010 15:41:57 -0700 (PDT)
Received: (qmail 4323 invoked from network); 22 Jun 2010 22:37:11 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 22 Jun 2010 22:37:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; olt=johnl@user.iecc.com; bh=Dzj0UFy6Xs/0mU1RzmtFVEbOvoi494abo+/9wC9m0OA=; b=dnhXq2Bl4qngiH0XVPPMNxnU/f99ezMKAucBGYU2N6WHKxmT3Ay46usYsWyDxHZA19npVumMJXAx2rF+7J67Oo51bE83M9OAxjxAvUe8XtfO/BRqibJm+Jvg8M8FXiq8hiwrYgRxMBhuyVoOZAviVyIVctthvL0HNF6jmJPb9Cs=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; bh=Dzj0UFy6Xs/0mU1RzmtFVEbOvoi494abo+/9wC9m0OA=; b=y9EhMfFFfNNMZDnB+bw0TPBXNNaHno2aawBMWScOKsCXYffBKVJPq9HrBZZYAU92sJieZU5DBYlggi0mMMQXMChgkTXyatD8Mwhui3tzxDDbOTVRd0CzX+44TAGHzt5wAHml3FrxCgCQF7ljS8Bp6tAMWme+70CDKkctU+zfKAQ=
Date: 22 Jun 2010 22:42:01 -0000
Message-ID: <20100622224201.68542.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>
Organization: 
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Jun 2010 22:42:15 -0000

>I realized a few weeks ago that I'd neglected to fully describe the
>most immediately interesting use case: verification of consumers.
>Specifically, when a Feedback Consumer requests feedback via the
>current mechanisms (which are almost invariably web forms leading to
>a manual approval process), the Feedback Generator can use the
>relevant advertisement to ensure that the feedback would be going to
>the correct place.

It's certainly a question that's worth thinking about, but it'll be a
challenging security analysis.

For example, how do you identify which of the thousands of domains
that send and receive through gmail's mail servers can claim abuse
reports?

And if we're trying to identify the party that controls an IP address,
we're deep into the maze of twisty passages of no return.  There are
lots of ideas, but they're either provisioning nightmares like adding
an extra rDNS record for every IP, or kludges like asking the contact
for the ASN that routes the address.

We don't need to answer these now, but we need to answer them before
we can claim to have something useful.

R's,
John



From macfisherman@gmail.com  Tue Jun 22 18:15:39 2010
Return-Path: <macfisherman@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9EA5E3A6891 for <marf@core3.amsl.com>; Tue, 22 Jun 2010 18:15:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.669
X-Spam-Level: 
X-Spam-Status: No, score=-3.669 tagged_above=-999 required=5 tests=[AWL=-1.071, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WZi45S2Ib4mK for <marf@core3.amsl.com>; Tue, 22 Jun 2010 18:15:37 -0700 (PDT)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 011193A676A for <marf@ietf.org>; Tue, 22 Jun 2010 18:15:36 -0700 (PDT)
Received: by vws15 with SMTP id 15so167658vws.31 for <marf@ietf.org>; Tue, 22 Jun 2010 18:15:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=U3W9maAnRaJuL8tDyxb7cFUS0XI+y7+fYfs6vzJNgkg=; b=UdlO3XO8Xfsc7qIGI1o1wG3P7xVM34FIUjddQs/MvzciVvAZC4l5DDdUqAeX04rY8n QuNHXGluuoxKSLYmLYjoP2P0OM5SCSrBJ0yq71BRIO86ucDKmfTuqqTrDEROv7DqWepc +/yBcqk/H06T4ntmc/vKySLVAH0L7vQcJqghs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Abn1cT3SKWB1FYmS3eF8lvTXL6yPB8/QSXTEGOimyklaq+undELs+S8IdMUp857pCa FZmpfsgm3/qcg0cnhiR1IXmqNo6OLO5UjYHu/WSgQgrXn1ou5GLX2FcgT6zFWqnk1L7y 3m8noNvjpUko9+0MPpsrWt32hm9+ps7KZ1wa4=
MIME-Version: 1.0
Received: by 10.224.124.39 with SMTP id s39mr4425679qar.199.1277255741190;  Tue, 22 Jun 2010 18:15:41 -0700 (PDT)
Received: by 10.229.251.81 with HTTP; Tue, 22 Jun 2010 18:15:41 -0700 (PDT)
In-Reply-To: <20100622040625.97472.qmail@joyce.lan>
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com> <20100622040625.97472.qmail@joyce.lan>
Date: Tue, 22 Jun 2010 21:15:41 -0400
Message-ID: <AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>
From: Jeff Macdonald <macfisherman@gmail.com>
To: John Levine <johnl@taugh.com>
Content-Type: multipart/alternative; boundary=00c09f923340bdb1aa0489a846ac
Cc: marf@ietf.org
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 01:15:39 -0000

--00c09f923340bdb1aa0489a846ac
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Jun 22, 2010 at 12:06 AM, John Levine <johnl@taugh.com> wrote:

> >Given that it's on-topic, is there rough consensus that JD's draft is
> >a good starting point for discussion?
>
> It's fine as far as it goes, but it sure would be nice to have some
> expressions of interest by large senders or receivers to give us a
> hint about what sorts of discovery they want to do so we know we're
> not wasting our time.
>

Hmmm... as a sender, I'd rather have the 'advertisement' in the message
itself. I imagine we are trying to avoid DOS, but allowing MAIL FROM lookups
seems to suggest otherwise. So I guess my first question is why not include
a pointer to the information in the message itself? I've seen abuse headers
in messages in the past.


-- 
Jeff Macdonald
Ayer, MA

--00c09f923340bdb1aa0489a846ac
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 22, 2010 at 12:06 AM, John Levine <span dir=3D"ltr">&lt;<a href=
=3D"mailto:johnl@taugh.com">johnl@taugh.com</a>&gt;</span> wrote:<br><div c=
lass=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class=3D"im">&gt;Given that it&#39;s on-topic, is there rough consensu=
s that JD&#39;s draft is<br>
&gt;a good starting point for discussion?<br>
<br>
</div>It&#39;s fine as far as it goes, but it sure would be nice to have so=
me<br>
expressions of interest by large senders or receivers to give us a<br>
hint about what sorts of discovery they want to do so we know we&#39;re<br>
not wasting our time.<br></blockquote><div><br></div><div>Hmmm... as a send=
er, I&#39;d rather have the &#39;advertisement&#39; in the message itself. =
I imagine we are trying to avoid DOS, but allowing MAIL FROM lookups seems =
to suggest otherwise. So I guess my first question is why not include a poi=
nter to the information in the message itself? I&#39;ve seen abuse headers =
in messages in the past.</div>
<div><br></div></div><br>-- <br>Jeff Macdonald<br>Ayer, MA<br><br><br>

--00c09f923340bdb1aa0489a846ac--

From dotis@mail-abuse.org  Tue Jun 22 18:19:16 2010
Return-Path: <dotis@mail-abuse.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EBE23A68DC for <marf@core3.amsl.com>; Tue, 22 Jun 2010 18:19:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.608
X-Spam-Level: 
X-Spam-Status: No, score=-4.608 tagged_above=-999 required=5 tests=[AWL=-0.609, BAYES_50=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EG2eEpw96VSr for <marf@core3.amsl.com>; Tue, 22 Jun 2010 18:19:12 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id 7008C3A676A for <marf@ietf.org>; Tue, 22 Jun 2010 18:19:12 -0700 (PDT)
Received: from US-DOUGLASO-MB.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id BB1C0A94468 for <marf@ietf.org>; Wed, 23 Jun 2010 01:19:14 +0000 (UTC)
Message-ID: <4C216112.6070402@mail-abuse.org>
Date: Tue, 22 Jun 2010 18:19:14 -0700
From: Douglas Otis <dotis@mail-abuse.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4
MIME-Version: 1.0
To: marf@ietf.org
References: <20100622224201.68542.qmail@joyce.lan>
In-Reply-To: <20100622224201.68542.qmail@joyce.lan>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 01:19:17 -0000

On 6/22/10 3:42 PM, John Levine wrote:
> And if we're trying to identify the party that controls an IP address,
> we're deep into the maze of twisty passages of no return.  There are
> lots of ideas, but they're either provisioning nightmares like adding
> an extra rDNS record for every IP, or kludges like asking the contact
> for the ASN that routes the address.
>    
It seems that reverse DNS has caused a significant level of wasted 
resources and is unlikely to get any better when IPv6 use starts, which 
tends to make publishing and monitoring this space difficult at best.  
Determining who represents the ASN for an address can be done by 
checking for the most specific BGP announcement.  Since not everyone 
receives and processes a range of BGP feeds, Team Cymru offers a lookup 
service, feed by that process.  A process that also shows which space 
represents a bogon. :^)

http://www.team-cymru.org/Services/ip-to-asn.html

Their service offers the following:
  BGP Origin ASN
  BGP Peer ASN
  BGP Prefix
  Prefix Allocation date
  ASN Allocation date
  ASN Description

This is approximately the process we use when deciding who to contact 
before blocking a CIDR.  Since the Autonomous System is in control of 
the address space, they are held accountable for emitted abuse.  One 
might imagine they should even want to receive reports of abuse to 
mitigate issues before third-party services feel they need to block 
their space.   When that happens, then clearly someone is not doing 
their job.  They know who their customers are, they can see the traffic, 
and can stop malicious or abusive traffic when needed.  It seems rather 
dangerous to allow just anyone to advertise they handle feedback for 
unrelated domains.

-Doug

From vesely@tana.it  Wed Jun 23 01:04:18 2010
Return-Path: <vesely@tana.it>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 615793A695F for <marf@core3.amsl.com>; Wed, 23 Jun 2010 01:04:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.397
X-Spam-Level: 
X-Spam-Status: No, score=-2.397 tagged_above=-999 required=5 tests=[AWL=-0.278, BAYES_50=0.001, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245,  RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xToMdNcwh8kQ for <marf@core3.amsl.com>; Wed, 23 Jun 2010 01:04:17 -0700 (PDT)
Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 1938E3A694E for <marf@ietf.org>; Wed, 23 Jun 2010 01:04:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tana.it; s=test; t=1277280263; bh=oOp+iGS9fZsb8sU77hgTPTwqH7MDNvFvYrGmfnMGLv0=; l=1277; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=C8vFpHpV04c4bqGD7j5j63GTpREdkWgI1grQX9Yes2AND5LcRcVv5fQQwzsEO4l08 bxO01DkUYt4BapWy7MKL9QOi3WbEzO76botj+nxHrYNHgJ0z/nrMH3Vr1HDFWD+mfW U3e8UA8islZlVAWMo1TDHJSAmJjFGditxP9jvEak=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Wed, 23 Jun 2010 10:04:23 +0200 id 00000000005DC046.000000004C21C007.00003DC8
Message-ID: <4C21C007.1090909@tana.it>
Date: Wed, 23 Jun 2010 10:04:23 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: marf@ietf.org
References: <20100622224201.68542.qmail@joyce.lan>
In-Reply-To: <20100622224201.68542.qmail@joyce.lan>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 08:04:18 -0000

On 23/Jun/10 00:42, John Levine wrote:
>>I realized a few weeks ago that I'd neglected to fully describe the
>>most immediately interesting use case: verification of consumers.
>>Specifically, when a Feedback Consumer requests feedback via the
>>current mechanisms (which are almost invariably web forms leading to
>>a manual approval process), the Feedback Generator can use the
>>relevant advertisement to ensure that the feedback would be going to
>>the correct place.
>
> It's certainly a question that's worth thinking about, but it'll be a
> challenging security analysis.
>
> For example, how do you identify which of the thousands of domains
> that send and receive through gmail's mail servers can claim abuse
> reports?

You mean how do /they/ identify it?  Large mailbox providers have 
their own FBL assessment criteria.  Often, they explain the 
subscription process in some detail.  However, they don't publish the 
list of domains they've accepted, AFAIK.  Why?

Perhaps, if they published something like a VBR record for the domains 
they consider worth, then small and medium providers can just trust 
that, and decide on the fly whether they want to send feedback through 
the same loop, in case they get complaints from their users.


From johnl@iecc.com  Wed Jun 23 09:38:40 2010
Return-Path: <johnl@iecc.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A98DC3A6AAE for <marf@core3.amsl.com>; Wed, 23 Jun 2010 09:38:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.177
X-Spam-Level: 
X-Spam-Status: No, score=-10.177 tagged_above=-999 required=5 tests=[AWL=1.022, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j+F2aVM9FiAc for <marf@core3.amsl.com>; Wed, 23 Jun 2010 09:38:39 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id 234993A6887 for <marf@ietf.org>; Wed, 23 Jun 2010 09:38:39 -0700 (PDT)
Received: (qmail 12852 invoked from network); 23 Jun 2010 16:33:55 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 23 Jun 2010 16:33:55 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; olt=johnl@user.iecc.com; bh=TbB45I/Wrkx5EsuC0kyPkjTJZ2kQSjyvw6I04PTJbZ8=; b=uCyt6HCHfQYlvZ4ml06siFZ99V2mq2NfD/P52is0N04lgKsDBcx4aUCQ5lA9KBgTXB80wLrJws16yum9smuYG01SvfM9r2cD9hQyB8gJ8QHfqlrBEaplc2obiIheMCOiYkJg7bxzkDJ9bDg03N/vqDtYoyeB9trbt/PKvI/lBN8=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; bh=TbB45I/Wrkx5EsuC0kyPkjTJZ2kQSjyvw6I04PTJbZ8=; b=fLcwKY1dhp5CFVXRiQDpgMUvMXO/1XgoXVKet2gKWRSHUBVk08hpx70LdEVjdOF2X4+i2iz36qszYSQNcZHqEeVLUsfQrYFdAJVomDPzjP0ert4rLLmiUNLl8GLpyGQNZyDtO8zUl/Q2RZvgWUdOw9SV8/PPwfHZMUzLN13C3p0=
Date: 23 Jun 2010 16:38:45 -0000
Message-ID: <20100623163845.30637.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <4C21C007.1090909@tana.it>
Organization: 
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Cc: vesely@tana.it
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 16:38:40 -0000

>> For example, how do you identify which of the thousands of domains
>> that send and receive through gmail's mail servers can claim abuse
>> reports?
>
>You mean how do /they/ identify it?

Let's say you're an ISP.  You get a note from postmaster@example.com
saying to please send any FBL reports about his mail to
abuse-fbl@example.com, from this IP range which really is the IP range
that he uses, except that it's also the range that Google and all
their customers use, too.  How do you know to reject the request from
from example.com but accept a similar one from postmaster@google.com?

The same problem applies on web hosts with shared IPs.  example.com
may well send and receive all its mail on some set of IPs, but the
right party to receive FBL messages is the web hosting company.

R's,
John

From vesely@tana.it  Wed Jun 23 11:13:00 2010
Return-Path: <vesely@tana.it>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 585263A6AEA for <marf@core3.amsl.com>; Wed, 23 Jun 2010 11:13:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.028
X-Spam-Level: *
X-Spam-Status: No, score=1.028 tagged_above=-999 required=5 tests=[AWL=-3.641,  BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4, SARE_SPOOF_COM2COM=2.536, SARE_SPOOF_COM2OTH=2.536, SPOOF_COM2COM=2.272, SPOOF_COM2OTH=2.044]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G0BcipPpJm0b for <marf@core3.amsl.com>; Wed, 23 Jun 2010 11:12:58 -0700 (PDT)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 633EA3A6AE6 for <marf@ietf.org>; Wed, 23 Jun 2010 11:12:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tana.it; s=test; t=1277316785; bh=eatgkP1aHPCYB4nTvoWpSHJdLbSZF724Z/Xq+d97B6U=; l=1769; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=NC3xFOFBSSiCiX85/MWYltrdw60tNyHGoa6xF6+yrKDyQ5AZsp2Zj+9EpjB4xBMtk BYpdPFNQAVNcwp9B9Q81u/XdDdrRUwNTYRi8en2PX3th9zYbFueqMY1C2DeKJQN5Sm HtujFSM/pH6gma1tySEvcKQ25eI9N8fiuMC1DC0Y=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Wed, 23 Jun 2010 20:13:05 +0200 id 00000000005DC04B.000000004C224EB1.000054C2
Message-ID: <4C224EB1.2040703@tana.it>
Date: Wed, 23 Jun 2010 20:13:05 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: John Levine <johnl@taugh.com>, marf@ietf.org
References: <20100623163845.30637.qmail@joyce.lan>
In-Reply-To: <20100623163845.30637.qmail@joyce.lan>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [marf]  FBL subscriptions
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 18:13:01 -0000

On 23/Jun/10 18:38, John Levine wrote:
> Let's say you're an ISP.  You get a note from postmaster@example.com
> saying to please send any FBL reports about his mail to
> abuse-fbl@example.com, from this IP range which really is the IP range
> that he uses, except that it's also the range that Google and all
> their customers use, too.  How do you know to reject the request from
> from example.com but accept a similar one from postmaster@google.com?
>
> The same problem applies on web hosts with shared IPs.  example.com
> may well send and receive all its mail on some set of IPs, but the
> right party to receive FBL messages is the web hosting company.

There are two points about that:

1. *How to accept/reject FBL subscriptions*

Apparently, it is necessary to carry out lots of checks related to the 
underlying networking infrastructure, as described above.

2. *How to auto-subscribe senders on the fly*

I'm a tiny mailbox provider, and I get no FBL-subscription requests. 
However, a user of mines reported a message from user@example.com: 
Was it really from that domain?  Should I forward it?  Where's their 
abuse-box?

If the message passed dkim or spf checks, I'd conclude it was really 
from them.  Furthermore, if I know that google did subscribe them to 
their FBL, e.g. looking up example.com._fbl.google.com, I may conclude 
that they are good guys, and, under suitable assumptions, learn both 
their abuse-box address and its ARF semantics --in case this WG is 
really going to deliver a format with variable semantics, which I 
still hope it won't.

This second point implies that Google (or Yahoo!, AOL, etc.) have 
their own FBL and that would want to share its subscribers and 
semantics.  Would they?


From jdfalk-lists@cybernothing.org  Wed Jun 23 12:02:54 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 140903A6885 for <marf@core3.amsl.com>; Wed, 23 Jun 2010 12:02:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.966
X-Spam-Level: 
X-Spam-Status: No, score=-4.966 tagged_above=-999 required=5 tests=[AWL=-0.867, BAYES_50=0.001, RCVD_IN_BSP_OTHER=-0.1, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rwHQiLO0GRbB for <marf@core3.amsl.com>; Wed, 23 Jun 2010 12:02:52 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 974813A6B01 for <marf@ietf.org>; Wed, 23 Jun 2010 12:02:50 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5NJ2uu9018450 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Wed, 23 Jun 2010 13:02:57 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5NJ2uu9018450
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277319778; bh=BEJ7n0Kz/sShu/pbYoRTxmxw+HAKdVWfplKX9WqqF u0=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=HvVoa5Qua5L+MFex 2VoK92Vgjn2GD0dIk1xPnsaUsJyTGiOGD49oqj0Q9TZIsyZXa89JQOe2jJQeRrJ6Sof gss/GiEqLzw4OoxJG8Rp4LLDNmTDN1ViOipTEl2HVgJLhfbNKiDnF7AVZB8IFHxoYvm Fq3bhVUdCwAi1H508nvkc=
References: <20100622224201.68542.qmail@joyce.lan>
In-Reply-To: <20100622224201.68542.qmail@joyce.lan>
Mime-Version: 1.0 (Apple Message framework v1078)
Content-Type: text/plain; charset=us-ascii
Message-Id: <8628A3F3-D988-4A9E-A07B-4E3DC3F75C26@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Wed, 23 Jun 2010 13:02:50 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1078)
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 19:02:54 -0000

On Jun 22, 2010, at 4:42 PM, John Levine wrote:

> It's certainly a question that's worth thinking about, but it'll be a
> challenging security analysis.
>=20
> For example, how do you identify which of the thousands of domains
> that send and receive through gmail's mail servers can claim abuse
> reports?

If the feedback is based on the DKIM d=3D domain, that's easy.  If it's =
based on the IP, then I'd hope that the feedback generator would see =
that it's google and laugh at the request.  This is likely more of a =
best practice than a discovery protocol issue, though.

> And if we're trying to identify the party that controls an IP address,
> we're deep into the maze of twisty passages of no return.  There are
> lots of ideas, but they're either provisioning nightmares like adding
> an extra rDNS record for every IP, or kludges like asking the contact
> for the ASN that routes the address.

Yep.  I dove into the shallower end of that mess in the draft; I'm =
surprised nobody has commented on it yet.

> We don't need to answer these now, but we need to answer them before
> we can claim to have something useful.

There's not much point in the MARF WG trying to devise the One True =
Perfect Practice for auditing feedback loop requests, because the =
feedback generators will still do whatever they (and their lawyers) feel =
like.

I'm hopeful (actually, I'm fairly certain) that a reporting-discovery =
record will be a useful additional data point they can add to their =
proprietary practices, but we don't have to replace those practices =
entirely.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc

From dotis@mail-abuse.org  Wed Jun 23 12:24:59 2010
Return-Path: <dotis@mail-abuse.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2037C28C15E for <marf@core3.amsl.com>; Wed, 23 Jun 2010 12:24:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.133
X-Spam-Level: 
X-Spam-Status: No, score=0.133 tagged_above=-999 required=5 tests=[AWL=-5.256,  BAYES_50=0.001, RCVD_IN_DNSWL_MED=-4, SARE_SPOOF_COM2COM=2.536,  SARE_SPOOF_COM2OTH=2.536, SPOOF_COM2COM=2.272, SPOOF_COM2OTH=2.044]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z5wNK3H28NlD for <marf@core3.amsl.com>; Wed, 23 Jun 2010 12:24:58 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id 4F5283A6B06 for <marf@ietf.org>; Wed, 23 Jun 2010 12:24:58 -0700 (PDT)
Received: from US-DOUGLASO-MB.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 5E3F3A94677 for <marf@ietf.org>; Wed, 23 Jun 2010 19:25:01 +0000 (UTC)
Message-ID: <4C225F8C.9050801@mail-abuse.org>
Date: Wed, 23 Jun 2010 12:25:00 -0700
From: Douglas Otis <dotis@mail-abuse.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4
MIME-Version: 1.0
To: marf@ietf.org
References: <20100623163845.30637.qmail@joyce.lan> <4C224EB1.2040703@tana.it>
In-Reply-To: <4C224EB1.2040703@tana.it>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] FBL subscriptions
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jun 2010 19:24:59 -0000

On 6/23/10 11:13 AM, Alessandro Vesely wrote:
> On 23/Jun/10 18:38, John Levine wrote:
>> Let's say you're an ISP.  You get a note from postmaster@example.com
>> saying to please send any FBL reports about his mail to
>> abuse-fbl@example.com, from this IP range which really is the IP range
>> that he uses, except that it's also the range that Google and all
>> their customers use, too.  How do you know to reject the request from
>> from example.com but accept a similar one from postmaster@google.com?
>>
>> The same problem applies on web hosts with shared IPs.  example.com
>> may well send and receive all its mail on some set of IPs, but the
>> right party to receive FBL messages is the web hosting company.
>
> There are two points about that:
>
> 1. *How to accept/reject FBL subscriptions*
>
> Apparently, it is necessary to carry out lots of checks related to the 
> underlying networking infrastructure, as described above.
>
> 2. *How to auto-subscribe senders on the fly*
>
> I'm a tiny mailbox provider, and I get no FBL-subscription requests. 
> However, a user of mines reported a message from user@example.com: Was 
> it really from that domain?  Should I forward it?  Where's their 
> abuse-box?
>
> If the message passed dkim or spf checks, I'd conclude it was really 
> from them.
In the case of DKIM, a valid signature authenticates the domain handling 
the messages.  In the case of SPF,  a "pass" only indicates a server 
issuing the message was authorized.  The same server might also carry 
mail for thousands of other domains, which is not uncommon.  In 
addition, there is no assurance a return-path or purportedly responsible 
address is bound to any of these possible sources, where it is not 
uncommon for these elements not to be bound to a specific source.  Even 
when one element is bound, which one?  After all both schemes are able 
to can make use of the same record.

When acceptance of a message becomes dependent upon DNS operation, which 
may happen for nearly any acceptance scheme.  Attacking DNS could then 
divert a specific subset of email to a FBL.  The diversion might include 
otherwise legitimate and sensitive email.
> Furthermore, if I know that google did subscribe them to their FBL, 
> e.g. looking up example.com._fbl.google.com, I may conclude that they 
> are good guys, and, under suitable assumptions, learn both their 
> abuse-box address and its ARF semantics --in case this WG is really 
> going to deliver a format with variable semantics, which I still hope 
> it won't.
Expecting a large provider to list their customers seems like a 
non-starter.  Nor would be clear the customers even wished to be listed.
> This second point implies that Google (or Yahoo!, AOL, etc.) have 
> their own FBL and that would want to share its subscribers and 
> semantics.  Would they?
The tpa-label scheme offers a safe solution in the case of the provider 
using DKIM, for then sending feedback to the From domain, when signed by 
the large provider.

The tpa-label indicates the From domain has authorized the larger 
provider that adds their own signature.  (Before a larger domain is 
authorized by using a tpa-label, it should be confirmed that use of a 
 From email-address depends upon proof of ownership, such as clicking on 
a pingback message, which is common.)   A valid third-party signature in 
conjunction with a tpa-label offers a fairly noise-free criteria for 
issuing feedback to the From domain.  When the From domain is troubled 
by the level of feedback, they are able to remove the corresponding 
tpa-label, which is also likely the safest choice.

-Doug


From jdfalk-lists@cybernothing.org  Wed Jun 23 17:57:20 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 85F3D3A6902 for <marf@core3.amsl.com>; Wed, 23 Jun 2010 17:57:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.11
X-Spam-Level: 
X-Spam-Status: No, score=-5.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f5wfaIn2LXde for <marf@core3.amsl.com>; Wed, 23 Jun 2010 17:57:19 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 6D1853A68B5 for <marf@ietf.org>; Wed, 23 Jun 2010 17:57:19 -0700 (PDT)
Received: from [192.168.0.5] (97-122-131-202.hlrn.qwest.net [97.122.131.202]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5O0vNUi024543 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Wed, 23 Jun 2010 18:57:26 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5O0vNUi024543
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277341046; bh=7PCOM8RHpGntfTOowxzanx0ZXEOW7K0ukByr9VUhU cU=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=Pptfcq2iyTRmzmzh zvpyj+hlKWSk4E8ftOTXQr7bwMl06mB3TuD/XGzEMWR4m2JkeQvNT01MsbPRJ3we7uo Gbq5YgNMD7xsOpNUjW4EW+2FwkQjYdpc2lJmfDgz/exnTQBXRJc3fLYGJy8nD4Jez1P A6GLp76kWpQJsTk7/O0ms=
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com> <20100622040625.97472.qmail@joyce.lan> <AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>
In-Reply-To: <AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Wed, 23 Jun 2010 18:57:18 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 00:57:20 -0000

On Jun 22, 2010, at 7:15 PM, Jeff Macdonald wrote:

> On Tue, Jun 22, 2010 at 12:06 AM, John Levine <johnl@taugh.com> wrote:
> >Given that it's on-topic, is there rough consensus that JD's draft is
> >a good starting point for discussion?
>=20
> It's fine as far as it goes, but it sure would be nice to have some
> expressions of interest by large senders or receivers to give us a
> hint about what sorts of discovery they want to do so we know we're
> not wasting our time.
>=20
> Hmmm... as a sender, I'd rather have the 'advertisement' in the =
message itself. I imagine we are trying to avoid DOS, but allowing MAIL =
FROM lookups seems to suggest otherwise. So I guess my first question is =
why not include a pointer to the information in the message itself? I've =
seen abuse headers in messages in the past.

Consider the case where a European ISP can't (or believes they can't, =
correctly or otherwise) block outbound port 25, but would like to get =
reports about inappropriate mail sent from those machines.  They have no =
ability to insert a header.

Consider a hosting company or even a mailbox provider where a machine =
gets 0wned, and the bad guys can insert -- or remove -- any headers they =
please.

The vast majority of feedback messages, by volume, aren't complaints =
about mail from ESPs and other good (or mostly good) senders.  They =
aren't from confused people on John Levine's mailing lists.  Most of the =
email that users complaint about is straight-up evil spam.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc





From jdfalk-lists@cybernothing.org  Wed Jun 23 18:01:43 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 582813A6902 for <marf@core3.amsl.com>; Wed, 23 Jun 2010 18:01:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.161
X-Spam-Level: 
X-Spam-Status: No, score=-1.161 tagged_above=-999 required=5 tests=[AWL=-3.950, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SARE_SPOOF_COM2COM=2.536, SARE_SPOOF_COM2OTH=2.536, SPOOF_COM2COM=2.272, SPOOF_COM2OTH=2.044]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eNzXBGw7z4hA for <marf@core3.amsl.com>; Wed, 23 Jun 2010 18:01:42 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 8A9603A69F4 for <marf@ietf.org>; Wed, 23 Jun 2010 18:01:42 -0700 (PDT)
Received: from [192.168.0.5] (97-122-131-202.hlrn.qwest.net [97.122.131.202]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5O11ls8024788 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Wed, 23 Jun 2010 19:01:49 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5O11ls8024788
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277341310; bh=PdFREV+moC9q7aZILWrDNgpQr5pb2h+HX/8zER/mO /M=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=W3CP+esq15bbc1BQ iCX4xYY/rTog8Cx3RnCgbMcGnlPkvD9juuh1D/1bJYD5VQ4iRm0x3tqz3/gT2guyuVB K23IhaZk+rM11qtxcqwGtyUjL4w6+tvbDsFgL3km2EPlQKng6BcwPor7yU7FX6iwrzv jBUbSO7tk8e4ISZxdT85I=
References: <20100623163845.30637.qmail@joyce.lan> <4C224EB1.2040703@tana.it>
In-Reply-To: <4C224EB1.2040703@tana.it>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <BE8062F0-DB61-4FE4-BB43-F075A65FE9BF@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Wed, 23 Jun 2010 19:01:41 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] FBL subscriptions
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 01:01:43 -0000

On Jun 23, 2010, at 12:13 PM, Alessandro Vesely wrote:

> There are two points about that:
>=20
> 1. *How to accept/reject FBL subscriptions*
>=20
> Apparently, it is necessary to carry out lots of checks related to the =
underlying networking infrastructure, as described above.

That's how it works today.

> 2. *How to auto-subscribe senders on the fly*
>=20
> I'm a tiny mailbox provider, and I get no FBL-subscription requests. =
However, a user of mines reported a message from user@example.com: Was =
it really from that domain?  Should I forward it?  Where's their =
abuse-box?
>=20
> If the message passed dkim or spf checks, I'd conclude it was really =
from them.  Furthermore, if I know that google did subscribe them to =
their FBL, e.g. looking up example.com._fbl.google.com, I may conclude =
that they are good guys, and, under suitable assumptions, learn both =
their abuse-box address and its ARF semantics --in case this WG is =
really going to deliver a format with variable semantics, which I still =
hope it won't.
>=20
> This second point implies that Google (or Yahoo!, AOL, etc.) have =
their own FBL and that would want to share its subscribers and =
semantics.  Would they?

If I understand correctly, you're asking if the big ISPs would publish a =
list of domains which have subscribed to their feedback loops?  =
Seems...unlikely.  And besides, unsolicited feedback can already go to =
abuse@, though few have had good luck using ARF while doing that.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc


From macfisherman@gmail.com  Wed Jun 23 18:41:58 2010
Return-Path: <macfisherman@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 434DC3A68F2 for <marf@core3.amsl.com>; Wed, 23 Jun 2010 18:41:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.834
X-Spam-Level: 
X-Spam-Status: No, score=-1.834 tagged_above=-999 required=5 tests=[AWL=-1.835, BAYES_50=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EpNsfHbcUdRh for <marf@core3.amsl.com>; Wed, 23 Jun 2010 18:41:56 -0700 (PDT)
Received: from mail-gx0-f172.google.com (mail-gx0-f172.google.com [209.85.161.172]) by core3.amsl.com (Postfix) with ESMTP id 634553A68CB for <marf@ietf.org>; Wed, 23 Jun 2010 18:41:56 -0700 (PDT)
Received: by gxk8 with SMTP id 8so1244387gxk.31 for <marf@ietf.org>; Wed, 23 Jun 2010 18:42:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type :content-transfer-encoding; bh=vlTx8XIqXcYbfdVUIY3pSOWPvwRrTftzIEAR9J/oUVk=; b=Teczi+x3YTmCbLgiYcE/7KRWwijT0EwbXM/iLk6ADrku5lJuzEm1VqNvxPolWOKZEr PJ8b821yT/sJ3dLZ31V8yvhUpH4ekd6s4S2KawUpR3J6LbD0axOEbLeCcaf5F7Bmmgcu W5w+hhXT2Dvcm0mZxYMe4PLwW52K66+Yh0aqM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=FOGMMo9fjxYffvjU7vbqONcrJC7gddG5rJKZAcbWjk0VGWYQziucMdeBATvG4Iz8/o y2X5RG8D2vYqrXzGW+tnsnAzzQNTmWTdRW9pJM4Nd0EzVjTFsBu9/ZBUsFCGzhZzCjGu zALOIGNRhW28RhhDSbUnKoGLY5bRHQDrPeYpA=
MIME-Version: 1.0
Received: by 10.229.182.3 with SMTP id ca3mr4723803qcb.11.1277343720627; Wed,  23 Jun 2010 18:42:00 -0700 (PDT)
Received: by 10.229.251.81 with HTTP; Wed, 23 Jun 2010 18:42:00 -0700 (PDT)
In-Reply-To: <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com> <20100622040625.97472.qmail@joyce.lan> <AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com> <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>
Date: Wed, 23 Jun 2010 21:42:00 -0400
Message-ID: <AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com>
From: Jeff Macdonald <macfisherman@gmail.com>
To: Message Abuse Report Format working group <marf@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 01:41:58 -0000

On Wed, Jun 23, 2010 at 8:57 PM, J.D. Falk
<jdfalk-lists@cybernothing.org> wrote:
> On Jun 22, 2010, at 7:15 PM, Jeff Macdonald wrote:
>
>> On Tue, Jun 22, 2010 at 12:06 AM, John Levine <johnl@taugh.com> wrote:
>> >Given that it's on-topic, is there rough consensus that JD's draft is
>> >a good starting point for discussion?
>>
>> It's fine as far as it goes, but it sure would be nice to have some
>> expressions of interest by large senders or receivers to give us a
>> hint about what sorts of discovery they want to do so we know we're
>> not wasting our time.
>>
>> Hmmm... as a sender, I'd rather have the 'advertisement' in the message =
itself. I imagine we are trying to avoid DOS, but allowing MAIL FROM lookup=
s seems to suggest otherwise. So I guess my first question is why not inclu=
de a pointer to the information in the message itself? I've seen abuse head=
ers in messages in the past.
>
> Consider the case where a European ISP can't (or believes they can't, cor=
rectly or otherwise) block outbound port 25, but would like to get reports =
about inappropriate mail sent from those machines. =A0They have no ability =
to insert a header.

sure, the IP method helps in that case.


> Consider a hosting company or even a mailbox provider where a machine get=
s 0wned, and the bad guys can insert -- or remove -- any headers they pleas=
e.

sure, and the bad guys can put whatever MAIL FROM they want:

"and/or in the DNS domain matching the one
   present in the [SMTP] MAIL commands it issues when sending mail"


did I misunderstand that?


> The vast majority of feedback messages, by volume, aren't complaints abou=
t mail from ESPs and other good (or mostly good) senders.

So commentary was asked from large senders. I apologize for thinking
that an ESP that has a monthly magnitude 7+ at times as reported by
SenderBase is not considered as such. I saw several options in the
draft that one can choose to find the advertisement. As an ESP/Sender,
I see value in having such headers as an option.

> They aren't from confused people on John Levine's mailing lists. =A0Most =
of the email that users complaint about is straight-up evil spam.

I'd think any sender would like to know how others view their email
stream, and any responsible sender would treat all feedback, no matter
how small, as a sign that things could be improved.

My two cents.



--=20
Jeff Macdonald
Ayer, MA

From dotis@mail-abuse.org  Wed Jun 23 19:52:28 2010
Return-Path: <dotis@mail-abuse.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3AAB73A6909 for <marf@core3.amsl.com>; Wed, 23 Jun 2010 19:52:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Level: 
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[AWL=-0.211,  BAYES_50=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OtGES680mW6G for <marf@core3.amsl.com>; Wed, 23 Jun 2010 19:52:27 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id 502743A683C for <marf@ietf.org>; Wed, 23 Jun 2010 19:52:27 -0700 (PDT)
Received: from US-DOUGLASO-MB.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 9AAC4A94558 for <marf@ietf.org>; Thu, 24 Jun 2010 02:52:32 +0000 (UTC)
Message-ID: <4C22C870.5030001@mail-abuse.org>
Date: Wed, 23 Jun 2010 19:52:32 -0700
From: Douglas Otis <dotis@mail-abuse.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: marf@ietf.org
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com> <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>
In-Reply-To: <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 02:52:28 -0000

On 6/23/10 5:57 PM, J.D. Falk wrote:
> On Jun 22, 2010, at 7:15 PM, Jeff Macdonald wrote:
> Consider the case where a European ISP can't (or believes they can't, correctly or otherwise) block outbound port 25, but would like to get reports about inappropriate mail sent from those machines.  They have no ability to insert a header.
>
> Consider a hosting company or even a mailbox provider where a machine gets 0wned, and the bad guys can insert -- or remove -- any headers they please.
>
> The vast majority of feedback messages, by volume, aren't complaints about mail from ESPs and other good (or mostly good) senders.  They aren't from confused people on John Levine's mailing lists.  Most of the email that users complaint about is straight-up evil spam.
>    
Agreed. But most evil spam is being emitted from compromised systems.  
And as ISPs and ESP start blocking port 25, the amount of spam sent from 
compromised accounts also steadily grows, at times rather dramatically 
for some of the larger providers.  Yikes!

The only solution for determining where to send abuse feedback must be 
based upon the AS associated with a particular source IP address, (the 
AS determined by the most specific BGP announcement).  This information 
must be kept current, because this is how Internet traffic is routed.

Sincerely, organizations like MAAWG could run a BGP process, similar to 
that offered by Team Cymru.  Then use the resulting information to offer 
a forwarding service based upon the source IP address contained within 
the MARF report itself. :^)

Such a service would give the organization offering the service 
authoritative insight into which Autonomous Systems are:
  1) poorly managed, or
  2) fail to inform customers of serious problems, or
  3) justify negligence on money -
     a) adequate monitoring or network controls are too expensive,
     b) increased traffic and "special" customers are too profitable.

J.D.  This comment is not aimed at you, and I am sure you have heard 
much of this before.

<rant>
Holding unauthenticated components of a transaction accountable is truly 
a waste of time, and should be considered both a disingenuous and a 
misleading effort.  This is not a problem solved by taxing or fining end 
users or domain name holders through rating systems based upon dubious 
information.  Bad actors will always find a way around contrived rating 
systems that ignore what authentication really means.

Only those who manage Autonomous Systems are really in a position to 
identify and curb abuse, both swiftly and directly.  Some illicit 
organizations are becoming their own ISP and name registry.  Being 
"clever" often ignores which Autonomous Systems need to take action, or 
be cut-off.  Being "clever" often ignores which Autonomous System is 
involved, and drives the problem deeper.  Internet related organizations 
need to find ways to take _effective_ action.  Any strategy that moves 
away from holding Autonomous Systems accountable, represents a step in 
the wrong direction.
</rant>

I hope you did not find the rant offensive. It was not meant to offend.

-Doug









Only the Autonomous System offering the routes are able to monitor the 
activity, to know who's system or account has been compromised, and is 
able to take




From johnl@iecc.com  Thu Jun 24 07:41:03 2010
Return-Path: <johnl@iecc.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE2D73A6802 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 07:41:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.218
X-Spam-Level: 
X-Spam-Status: No, score=-9.218 tagged_above=-999 required=5 tests=[AWL=-0.619, BAYES_50=0.001, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v5En3ZIkG2mz for <marf@core3.amsl.com>; Thu, 24 Jun 2010 07:41:02 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id 460EC3A67F9 for <marf@ietf.org>; Thu, 24 Jun 2010 07:41:02 -0700 (PDT)
Received: (qmail 42359 invoked from network); 24 Jun 2010 14:36:19 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 24 Jun 2010 14:36:19 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; olt=johnl@user.iecc.com; bh=HVcDwpz8wCZ446myUhc2V0ObYce520lyEldp+Q/WtI8=; b=tmkdnNmUySU5vGLDr5EgmbvLiEEgxuIaWF7kphT/cBDsjcNrR2H0fNRhnC/+cFDRV5NrqKWCkKHiGFBIT5l48AqzapnTg+FQwYHlA7ulQK8BahNbspxQaO1QEUEBHzIHGnVBAnbtxH9TNlQT42o7J2QTvvbXy1ssOmtU9C8Vgmc=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; bh=HVcDwpz8wCZ446myUhc2V0ObYce520lyEldp+Q/WtI8=; b=cx5V0JhFVQhKZhd3ZqBfZDkmUBrUcNMIpGmFZCWxSQGwYn5Faka0w+3NuQHo+JZZCrR+rDT+5GIG4uLhnZXpFdO0o7RVspDBijDwLbIfXM5ZwO812UgJJ6aR+3mzO8VvpBRhpriWlkCJp7ZVC7YJXnIXWBnaj+9OadXcB50Pakc=
Date: 24 Jun 2010 14:41:09 -0000
Message-ID: <20100624144109.51739.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <BE8062F0-DB61-4FE4-BB43-F075A65FE9BF@cybernothing.org>
Organization: 
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Subject: Re: [marf] FBL subscriptions
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 14:41:04 -0000

> And besides, unsolicited feedback can already go to abuse@, though
> few have had good luck using ARF while doing that.

I must be few. (Well, I use contact info from abuse.net rather than
just abuse@.)), I'm quite surprised at how well it works.  To the
extent that I get responses at all, they mostly understand what I sent
and do something reasonable.

R's,
John


From jdfalk-lists@cybernothing.org  Thu Jun 24 09:42:27 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2972A3A6A26 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 09:42:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.943
X-Spam-Level: 
X-Spam-Status: No, score=-4.943 tagged_above=-999 required=5 tests=[AWL=-0.304, BAYES_00=-2.599, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y+SqaKCsvXGF for <marf@core3.amsl.com>; Thu, 24 Jun 2010 09:42:25 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 3EE313A6A31 for <marf@ietf.org>; Thu, 24 Jun 2010 09:42:25 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5OGgVHS009328 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Thu, 24 Jun 2010 10:42:32 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5OGgVHS009328
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277397753; bh=1U9iclCLcHrbPnyRoKncEcPimmfwSgqCvl4hBgKtk aE=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=WrDHrskZNu7lRAlD l9MWauU2UXahFwLGjefXR2E7vUjlZIih8oJHJ9Nz9qejS7gux5gpML4d1Fipdx00P8I crTAtgz/AxwrO2CH6Az9WyShCldsZsbbvBILtoDOvZKbEEYA6o6PmLlhVOz5kRTKuOJ KVpe+jj58zXlpcywOF5Rk=
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com> <20100622040625.97472.qmail@joyce.lan> <AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com> <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org> <AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com>
In-Reply-To: <AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Thu, 24 Jun 2010 10:42:25 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 16:42:27 -0000

On Jun 23, 2010, at 7:42 PM, Jeff Macdonald wrote:

>> Consider a hosting company or even a mailbox provider where a machine =
gets 0wned, and the bad guys can insert -- or remove -- any headers they =
please.
>=20
> sure, and the bad guys can put whatever MAIL FROM they want:
>=20
> "and/or in the DNS domain matching the one
>   present in the [SMTP] MAIL commands it issues when sending mail"
>=20
> did I misunderstand that?

That was mostly an attempt to work with SPF.  It could be removed, =
and/or we could add even stronger language about authentication =
identifiers.  Any other thoughts on this from the group?

>> The vast majority of feedback messages, by volume, aren't complaints =
about mail from ESPs and other good (or mostly good) senders.
>=20
> So commentary was asked from large senders. I apologize for thinking
> that an ESP that has a monthly magnitude 7+ at times as reported by
> SenderBase is not considered as such. I saw several options in the
> draft that one can choose to find the advertisement. As an ESP/Sender,
> I see value in having such headers as an option.

No need to get combative.  This draft isn't an attempt to list all =
possible ways to request feedback.  There can be other methods, =
including the header that would work so well for your employer, in other =
drafts.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc

From jdfalk-lists@cybernothing.org  Thu Jun 24 09:46:15 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B09A93A6803 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 09:46:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.892
X-Spam-Level: 
X-Spam-Status: No, score=-4.892 tagged_above=-999 required=5 tests=[AWL=-0.253, BAYES_00=-2.599, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id txRdZqBU6zKJ for <marf@core3.amsl.com>; Thu, 24 Jun 2010 09:46:14 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id A84C53A6806 for <marf@ietf.org>; Thu, 24 Jun 2010 09:46:14 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5OGkKk2009389 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Thu, 24 Jun 2010 10:46:22 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5OGkKk2009389
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277397982; bh=AQ0z0VHv9Vq+/9kxD6hCY5scI+gnVFm87ItZUNUVZ 1g=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=UgfqOwLeZOUWITP3 BhXIVAmFS12QZBXlz62sGWoyN+FCs65c5/XCUPa4ASr5+SpnRiKRmDSCGUh/NA1z05o y+FwfoU1kR6tvo522WR1983Z8PVmVQsY8EiQpW5TBIetxuAlIljX0NjE38vIF8gmI/O WTEXZe9Hj0rGcjCJL1vbU=
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com> <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org> <4C22C870.5030001@mail-abuse.org>
In-Reply-To: <4C22C870.5030001@mail-abuse.org>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <34334128-C0FD-420A-B8B3-7AF0767C66DB@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Thu, 24 Jun 2010 10:46:15 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 16:46:15 -0000

On Jun 23, 2010, at 8:52 PM, Douglas Otis wrote:

> The only solution for determining where to send abuse feedback must be =
based upon the AS associated with a particular source IP address, (the =
AS determined by the most specific BGP announcement).  This information =
must be kept current, because this is how Internet traffic is routed.

Routing feedback reports by ASN is certainly interesting, and I know =
some feedback loop systems do (or soon will) support it...but, is there =
an obvious standard place for an ASN's administrator to advertise their =
feedback recipient address & policies?  I know someone could create a =
proprietary system, but that's not task for this WG.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc


From macfisherman@gmail.com  Thu Jun 24 11:11:39 2010
Return-Path: <macfisherman@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3296A3A68F9 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 11:11:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.522
X-Spam-Level: 
X-Spam-Status: No, score=-2.522 tagged_above=-999 required=5 tests=[AWL=0.077,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tkb21kEs6zPC for <marf@core3.amsl.com>; Thu, 24 Jun 2010 11:11:37 -0700 (PDT)
Received: from mail-gy0-f172.google.com (mail-gy0-f172.google.com [209.85.160.172]) by core3.amsl.com (Postfix) with ESMTP id 2444D3A6889 for <marf@ietf.org>; Thu, 24 Jun 2010 11:11:37 -0700 (PDT)
Received: by gyh4 with SMTP id 4so4904530gyh.31 for <marf@ietf.org>; Thu, 24 Jun 2010 11:11:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type :content-transfer-encoding; bh=9hzPyyZCde5hO/RyTD4enXl9ZRVqyoFLDC/6ejMGkkk=; b=pAl6s9S29JGa6tbK+m4bGHus4ZrMzEiSsoAS2BldAeFaZw2bQFVqIm51+ymwK+4FSl nwDUK+KWuP+JDVxH0XeuGykub/nBFaJ9Koq2KILOXwA26U39rVBS1AlbBoMsjcV1n8Ht t1FTimddYLV83v1AhXScOn7UfuyrRJxG7WeMo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; b=i4mfq4KTnGHI4GZlpa8IQFVy5kpVVRQdLcSaV8xnqR2uu0Tr5Np2T4ZIrjvLzINO8b ylBCJOlZxLLOMn65ijBZV3I2qYPOAsTmKXzw7WOAb1rbtRcaJowxVdJjn8COM7pqP0FY 9YwxvHjRDnAobCVFPdsmt3GCJ6zUyynQOQ+VM=
MIME-Version: 1.0
Received: by 10.229.223.210 with SMTP id il18mr5499884qcb.251.1277403101727;  Thu, 24 Jun 2010 11:11:41 -0700 (PDT)
Received: by 10.229.251.81 with HTTP; Thu, 24 Jun 2010 11:11:41 -0700 (PDT)
In-Reply-To: <82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org>
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com> <20100622040625.97472.qmail@joyce.lan> <AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com> <B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org> <AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com> <82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org>
Date: Thu, 24 Jun 2010 14:11:41 -0400
Message-ID: <AANLkTim255qEjfyXL2TbHeDyqOcjHtzpEwoaP8UTvOL7@mail.gmail.com>
From: Jeff Macdonald <macfisherman@gmail.com>
To: Message Abuse Report Format working group <marf@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 18:11:39 -0000

On Thu, Jun 24, 2010 at 12:42 PM, J.D. Falk
<jdfalk-lists@cybernothing.org> wrote:

> No need to get combative. =A0This draft isn't an attempt to list all poss=
ible ways to request feedback. =A0There can be other methods, including the=
 header that would work so well for your employer, in other drafts.

I don't really think this would just benefit my employer. I can see
shared hosting environments finding this being useful as well. But if
the focus of the draft is advertisement via DNS, then perhaps I can
offer a slightly different title:


Advertising and Discovering Willingness to Provide or Receive ARF
Reports via DNS


--=20
Jeff Macdonald
Ayer, MA

From dotis@mail-abuse.org  Thu Jun 24 14:21:52 2010
Return-Path: <dotis@mail-abuse.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2D21C3A69DA for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:21:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.55
X-Spam-Level: 
X-Spam-Status: No, score=-2.55 tagged_above=-999 required=5 tests=[AWL=-1.845,  BAYES_50=0.001, FB_WORD2_END_DOLLAR=3.294, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xcYAY5XX4aa7 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:21:50 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id DB1CB3A69D0 for <marf@ietf.org>; Thu, 24 Jun 2010 14:21:50 -0700 (PDT)
Received: from US-DOUGLASO-MB.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id D5E90A94620 for <marf@ietf.org>; Thu, 24 Jun 2010 21:21:53 +0000 (UTC)
Message-ID: <4C23CC71.2090706@mail-abuse.org>
Date: Thu, 24 Jun 2010 14:21:53 -0700
From: Douglas Otis <dotis@mail-abuse.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: marf@ietf.org
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>	<B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>	<4C22C870.5030001@mail-abuse.org> <34334128-C0FD-420A-B8B3-7AF0767C66DB@cybernothing.org>
In-Reply-To: <34334128-C0FD-420A-B8B3-7AF0767C66DB@cybernothing.org>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 21:21:52 -0000

On 6/24/10 9:46 AM, J.D. Falk wrote:
>  On Jun 23, 2010, at 8:52 PM, Douglas Otis wrote:
>
> > The only solution for determining where to send abuse feedback must
> > be based upon the AS associated with a particular source IP
> > address, (the AS determined by the most specific BGP announcement).
> > This information must be kept current, because this is how Internet
> > traffic is routed.
>
>  Routing feedback reports by ASN is certainly interesting, and I know
>  some feedback loop systems do (or soon will) support it...but, is
>  there an obvious standard place for an ASN's administrator to
>  advertise their feedback recipient address & policies? I know
>  someone could create a proprietary system, but that's not task for
>  this WG.

J.D.,

ICANN requires accredited registrars to collect and provide free public 
access to the name of the registered domain name and its nameservers and 
registrar, the date the domain was created and when its registration 
expires, and the contact information for the Registered Name Holder, the 
technical contact, and the administrative contact.

The GNSO Council approved a resolution asking ICANN Staff to pursue cost 
estimates for six WHOIS study areas recommended by members of the ICANN 
community and ICANN's Government Advisory Committee.

On 23 March 2010 staff provided a report to the GNSO Council with our 
analysis of these proposals. An RFP for a third WHOIS study on Proxy and 
Privacy “Abuse” was posted on 20 May 2010. At least, this seems headed 
in the right direction and clearly needs to conclude with such a service.

Of those that receive our feedback, many only want the highest ranking 
issues when the issue becomes severe. A feature able to rate-limit or 
collapse information might initially be needed for any type of feedback 
scheme, but this would imply that it is being done as a conduit. It 
would seem that MAAWG would be in a good position to take on this task, 
to then report on the collected information.

http://www.potaroo.net/tools/asn32/
offers the following info:

** advertised as 16b 32b

AFRINIC 370 1
APNIC 4112 40
ARIN 13646 9
RIPE NCC 14586 288
LACNIC 1310 60
-----------------------------
(34422) 34024 398

Clearly, resolving IP to AS still needs to determine where feedback is 
accepted for the 34+K AS entities. When acting as a conduit, it remains 
possible to collect statistics for all submissions, even for those not 
forwarded. The number of known sources might be in the millions, but 
could be constrained to just members of the organization.


I consider Dave Rand to be an authority on this issue. Here is his reply:
.---
There is no standard place for abuse reporting, but there is a place to 
register information related to the ASN, and it can be added there. This 
is either the ARIN record or the RIPE/or other registry record for the 
ASN proper. For example:

IP address Status CC Route ASN Path
97.107.131.96 USA 97.107.128.0/20 8001 6461 6461 8001


ASN Name
8001 NET-ACCESS-CORP - Net Access Corporation


CC Country name
USA UNITED STATES

myhost$ nwhois 8001

OrgName: Net Access Corporation
OrgID: NAC-53
Address: 9 Mt. Pleasant Tpk.
City: Denville
StateProv: NJ
PostalCode: 07834
Country: US

ASNumber: 8001
ASName: NET-ACCESS-CORP
ASHandle: AS8001
Comment:
RegDate: 1996-08-22
Updated: 1998-05-18

RTechHandle: AR97-ARIN
RTechName: Rubenstein, Alex
RTechPhone: +1-973-590-5101
RTechEmail: alex@nac.net
'---

-Doug


From msk@cloudmark.com  Thu Jun 24 14:36:35 2010
Return-Path: <msk@cloudmark.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1CE4C3A69B5 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:36:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.779
X-Spam-Level: 
X-Spam-Status: No, score=-1.779 tagged_above=-999 required=5 tests=[AWL=-0.669, BAYES_05=-1.11]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iL7T03+vs33G for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:36:33 -0700 (PDT)
Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by core3.amsl.com (Postfix) with ESMTP id 108F328C0D7 for <marf@ietf.org>; Thu, 24 Jun 2010 14:36:32 -0700 (PDT)
Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Thu, 24 Jun 2010 14:36:41 -0700
From: "Murray S. Kucherawy" <msk@cloudmark.com>
To: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Thu, 24 Jun 2010 14:36:40 -0700
Thread-Topic: Poll: Importing draft-jdfalk-marf-reporting-discovery
Thread-Index: AcsSPKtpUb1hvQdOQ7KTC551bxSK6wAAJyawAGm1WeA=
Message-ID: <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 21:36:35 -0000

> -----Original Message-----
> From: marf-bounces@ietf.org [mailto:marf-bounces@ietf.org] On Behalf Of M=
urray S. Kucherawy
> Sent: Tuesday, June 22, 2010 12:04 PM
> To: SM; J.D. Falk
> Cc: Message Abuse Report Format working group
> Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
>=20
> A separate question is whether or not we want to make this a WG
> document.  So far I hear a couple of votes for but none against.

So let me make this a more explicit statement and a question:

Does the WG consider this draft a good basis for discussion?  We have this =
as our fourth charter item, so it is certainly within scope.  And clearly p=
eople are up for discussing it, as is evidenced by this thread.

If the answer is "yes", which is what I expect (and as a participant, that'=
s my vote), then we should make it a working group document, even if later =
on we decide this is not something that should be formally specified.  Note=
 that a "yes" here doesn't mean you agree with all of the document in its c=
urrent form; rather, you are agreeing that it is a reasonable place to star=
t the conversation.  The WG can revise the document via the consensus proce=
ss once we've done that.

If not, we should figure out how we do want to address that fourth charter =
item, and begin working on that path instead.

Please state your position for the record.

Thanks,
Murray [as co-chair]


From yakov@shaftek.org  Thu Jun 24 14:44:01 2010
Return-Path: <yakov@shaftek.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C33CE3A6967 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:44:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.118
X-Spam-Level: 
X-Spam-Status: No, score=-0.118 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XyzQLu2V70eQ for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:44:00 -0700 (PDT)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by core3.amsl.com (Postfix) with ESMTP id 6680F3A6994 for <marf@ietf.org>; Thu, 24 Jun 2010 14:44:00 -0700 (PDT)
Received: by wwb22 with SMTP id 22so965321wwb.31 for <marf@ietf.org>; Thu, 24 Jun 2010 14:44:03 -0700 (PDT)
Received: by 10.227.69.142 with SMTP id z14mr9895841wbi.195.1277415843337;  Thu, 24 Jun 2010 14:44:03 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.216.2.148 with HTTP; Thu, 24 Jun 2010 14:43:43 -0700 (PDT)
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>  <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
From: Yakov Shafranovich <yakov@shaftek.org>
Date: Thu, 24 Jun 2010 17:43:43 -0400
Message-ID: <AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com>
To: "Murray S. Kucherawy" <msk@cloudmark.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 21:44:01 -0000

I think it is a good place as any to start discussion as one of the
proposals on advertising ARF receivers.

HOWEVER, we might need to step back first and look at what possible
options there are before committing to a specific one. I think that
SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may
be some of them. Perhaps a draft covering possible advertising
mechanisms may be in order.

Yakov

On Thu, Jun 24, 2010 at 5:36 PM, Murray S. Kucherawy <msk@cloudmark.com> wr=
ote:
>> -----Original Message-----
>> From: marf-bounces@ietf.org [mailto:marf-bounces@ietf.org] On Behalf Of =
Murray S. Kucherawy
>> Sent: Tuesday, June 22, 2010 12:04 PM
>> To: SM; J.D. Falk
>> Cc: Message Abuse Report Format working group
>> Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
>>
>> A separate question is whether or not we want to make this a WG
>> document. =A0So far I hear a couple of votes for but none against.
>
> So let me make this a more explicit statement and a question:
>
> Does the WG consider this draft a good basis for discussion? =A0We have t=
his as our fourth charter item, so it is certainly within scope. =A0And cle=
arly people are up for discussing it, as is evidenced by this thread.
>
> If the answer is "yes", which is what I expect (and as a participant, tha=
t's my vote), then we should make it a working group document, even if late=
r on we decide this is not something that should be formally specified. =A0=
Note that a "yes" here doesn't mean you agree with all of the document in i=
ts current form; rather, you are agreeing that it is a reasonable place to =
start the conversation. =A0The WG can revise the document via the consensus=
 process once we've done that.
>
> If not, we should figure out how we do want to address that fourth charte=
r item, and begin working on that path instead.
>
> Please state your position for the record.
>
> Thanks,
> Murray [as co-chair]
>
> _______________________________________________
> marf mailing list
> marf@ietf.org
> https://www.ietf.org/mailman/listinfo/marf
>

From msk@cloudmark.com  Thu Jun 24 14:49:24 2010
Return-Path: <msk@cloudmark.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EDD913A69B5 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:49:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.476
X-Spam-Level: 
X-Spam-Status: No, score=-2.476 tagged_above=-999 required=5 tests=[AWL=0.123,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nwe7imlxkuF7 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 14:49:21 -0700 (PDT)
Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by core3.amsl.com (Postfix) with ESMTP id B449D3A69D9 for <marf@ietf.org>; Thu, 24 Jun 2010 14:49:18 -0700 (PDT)
Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Thu, 24 Jun 2010 14:49:27 -0700
From: "Murray S. Kucherawy" <msk@cloudmark.com>
To: Yakov Shafranovich <yakov@shaftek.org>
Date: Thu, 24 Jun 2010 14:49:26 -0700
Thread-Topic: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
Thread-Index: AcsT5l6ajIVmqpJ8RxOgMWCaGHxHPAAAJhIg
Message-ID: <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com>
In-Reply-To: <AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 21:49:24 -0000

> -----Original Message-----
> From: Yakov Shafranovich [mailto:yakov@shaftek.org]
> Sent: Thursday, June 24, 2010 2:44 PM
> To: Murray S. Kucherawy
> Cc: J.D. Falk; Message Abuse Report Format working group
> Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-
> discovery
>=20
> I think it is a good place as any to start discussion as one of the
> proposals on advertising ARF receivers.
>=20
> HOWEVER, we might need to step back first and look at what possible
> options there are before committing to a specific one. I think that
> SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may
> be some of them. Perhaps a draft covering possible advertising
> mechanisms may be in order.

I'll count that as a "yes", given your first paragraph.  As I said, we're f=
ree to modify the draft according to what you said in the second based on c=
onsensus.


From MAdkins05@aol.com  Thu Jun 24 15:22:09 2010
Return-Path: <MAdkins05@aol.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2826B3A68C3 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:22:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.002
X-Spam-Level: 
X-Spam-Status: No, score=0.002 tagged_above=-999 required=5 tests=[BAYES_50=0.001, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0jhqZ1lTmWi for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:22:03 -0700 (PDT)
Received: from imr-da02.mx.aol.com (imr-da02.mx.aol.com [205.188.105.144]) by core3.amsl.com (Postfix) with ESMTP id 2CB4E3A69D2 for <marf@ietf.org>; Thu, 24 Jun 2010 15:22:02 -0700 (PDT)
Received: from imo-da03.mx.aol.com (imo-da03.mx.aol.com [205.188.169.201]) by imr-da02.mx.aol.com (8.14.1/8.14.1) with ESMTP id o5OMKoFR002480; Thu, 24 Jun 2010 18:20:50 -0400
Received: from MAdkins05@aol.com by imo-da03.mx.aol.com  (mail_out_v42.9.) id e.e6c.14a82d4 (37092); Thu, 24 Jun 2010 18:20:15 -0400 (EDT)
Received: from smtprly-mc03.mx.aol.com (smtprly-mc03.mx.aol.com [64.12.95.99]) by cia-db07.mx.aol.com (v129.4) with ESMTP id MAILCIADB072-d3dc4c23da1e382; Thu, 24 Jun 2010 18:20:15 -0400
Received: from Webmail-m105 (webmail-m105.sim.aol.com [64.12.224.159]) by smtprly-mc03.mx.aol.com (v129.4) with ESMTP id MAILSMTPRLYMC036-d3dc4c23da1e382; Thu, 24 Jun 2010 18:20:14 -0400
References: <20100622040625.97472.qmail@joyce.lan><22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org><6.2.5.6.2.20100622114236.07390908@resistor.net><BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com><BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com><AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
To: msk@cloudmark.com, yakov@shaftek.org
Date: Thu, 24 Jun 2010 18:20:14 -0400
X-AOL-IP: 66.220.144.27
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
X-MB-Message-Source: WebUI
Received: from 66.220.144.27 by Webmail-m105.sysops.aol.com (64.12.224.159) with HTTP (WebMailUI); Thu, 24 Jun 2010 18:20:14 -0400
MIME-Version: 1.0
From: madkins05@aol.com
X-MB-Message-Type: User
Content-Type: multipart/alternative;  boundary="--------MB_8CCE2028D812600_9A8_5E04_Webmail-m105.sysops.aol.com"
X-Mailer: AOL Webmail 32131-STANDARD
Message-Id: <8CCE2028D7A01BF-9A8-2DF3@Webmail-m105.sysops.aol.com>
X-AOL-SENDER: MAdkins05@aol.com
Cc: marf@ietf.org
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:22:09 -0000

----------MB_8CCE2028D812600_9A8_5E04_Webmail-m105.sysops.aol.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="us-ascii"


 If you are going to put together a list of potential discovery options,=
 you might want to start by collecting a list of current approval criteria=
.  That would give you an idea of how acceptable the various discovery opt=
ions would be.

=20


=20

=20

-----Original Message-----
From: Murray S. Kucherawy <msk@cloudmark.com>
To: Yakov Shafranovich <yakov@shaftek.org>
Cc: Message Abuse Report Format working group <marf@ietf.org>
Sent: Thu, Jun 24, 2010 2:49 pm
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery


> -----Original Message-----

> From: Yakov Shafranovich [mailto:yakov@shaftek.org]

> Sent: Thursday, June 24, 2010 2:44 PM

> To: Murray S. Kucherawy

> Cc: J.D. Falk; Message Abuse Report Format working group

> Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-

> discovery

>=20

> I think it is a good place as any to start discussion as one of the

> proposals on advertising ARF receivers.

>=20

> HOWEVER, we might need to step back first and look at what possible

> options there are before committing to a specific one. I think that

> SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may

> be some of them. Perhaps a draft covering possible advertising

> mechanisms may be in order.



I'll count that as a "yes", given your first paragraph.  As I said, we're=
 free=20

to modify the draft according to what you said in the second based on cons=
ensus.



_______________________________________________

marf mailing list

marf@ietf.org

https://www.ietf.org/mailman/listinfo/marf


=20

----------MB_8CCE2028D812600_9A8_5E04_Webmail-m105.sysops.aol.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"

<font color=3D'black' size=3D'2' face=3D'arial'><font color=3D"black" face=
=3D"arial" size=3D"2">

<div> If you are going to put together a list of potential discovery optio=
ns, you might want to start by collecting a list of current approval crite=
ria.&nbsp; That would give you an idea of how acceptable the various disco=
very options would be.<br>

</div>



<div> <br>

</div>



<div style=3D"clear: both;"></div>



<div> <br>

</div>



<div> <br>

</div>



<div style=3D"font-family: helvetica,arial; font-size: 10pt; color: black;=
">-----Original Message-----<br>

From: Murray S. Kucherawy &lt;msk@cloudmark.com&gt;<br>

To: Yakov Shafranovich &lt;yakov@shaftek.org&gt;<br>

Cc: Message Abuse Report Format working group &lt;marf@ietf.org&gt;<br>

Sent: Thu, Jun 24, 2010 2:49 pm<br>

Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery<=
br>

<br>








<div id=3D"AOLMsgPart_0_3fb8b051-2cec-493b-848b-9d111d8267b8" style=3D"mar=
gin: 0px; font-family: Tahoma,Verdana,Arial,Sans-Serif; font-size: 12px;=
 color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">

<pre style=3D"font-size: 9pt;"><tt>&gt; -----Original Message-----<br>

&gt; From: Yakov Shafranovich [<a href=3D"mailto:yakov@shaftek.org?">mailt=
o:yakov@shaftek.org</a>]<br>

&gt; Sent: Thursday, June 24, 2010 2:44 PM<br>

&gt; To: Murray S. Kucherawy<br>

&gt; Cc: J.D. Falk; Message Abuse Report Format working group<br>

&gt; Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-<br>

&gt; discovery<br>

&gt; <br>

&gt; I think it is a good place as any to start discussion as one of the<b=
r>

&gt; proposals on advertising ARF receivers.<br>

&gt; <br>

&gt; HOWEVER, we might need to step back first and look at what possible<b=
r>

&gt; options there are before committing to a specific one. I think that<b=
r>

&gt; SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may<=
br>

&gt; be some of them. Perhaps a draft covering possible advertising<br>

&gt; mechanisms may be in order.<br>

<br>

I'll count that as a "yes", given your first paragraph.  As I said, we're=
 free <br>

to modify the draft according to what you said in the second based on cons=
ensus.<br>

<br>

_______________________________________________<br>

marf mailing list<br>

<a href=3D"mailto:marf@ietf.org">marf@ietf.org</a><br>

<a href=3D"https://www.ietf.org/mailman/listinfo/marf" target=3D"_blank">h=
ttps://www.ietf.org/mailman/listinfo/marf</a><br>

</tt></pre>
</div>

 <!-- end of AOLMsgPart_0_3fb8b051-2cec-493b-848b-9d111d8267b8 -->

</div>

</font></font>

----------MB_8CCE2028D812600_9A8_5E04_Webmail-m105.sysops.aol.com--

From jdfalk-lists@cybernothing.org  Thu Jun 24 15:26:27 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B8BC3A69D2 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:26:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.706
X-Spam-Level: 
X-Spam-Status: No, score=-3.706 tagged_above=-999 required=5 tests=[AWL=-1.367, BAYES_00=-2.599, MANGLED_SPAM=2.3, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f8jagVGY7NDy for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:26:26 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id E03C53A69B5 for <marf@ietf.org>; Thu, 24 Jun 2010 15:26:25 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5OMQWwL016273 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Thu, 24 Jun 2010 16:26:33 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5OMQWwL016273
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277418393; bh=hwu6xgm32vzdqlfqWnGfqt8Th/978a1/8wjlQArTn I4=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=R2lImzfyC+M+9h0G XPud/7L8L3s0JkY31FKOhmPkdL1UvowuW5+VFdMWe7g+Z5P1IJiwQGwgexUz0TUBATn WqUA/wndyfUSjI6XZ0mKQyWiAx+dL3GT29JnPYH/6wbnGIjWOfa7OerKq9Hfnc4PraA 5Q/POtVBhyyXAF8q/qn0A=
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com>
In-Reply-To: <AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <12A0409F-3C12-4C9A-A61A-3C341AA35E28@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Thu, 24 Jun 2010 16:26:26 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: [marf] other options (was Re: Poll: Importing draft-jdfalk-marf-reporting-discovery)
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:26:27 -0000

On Jun 24, 2010, at 3:43 PM, Yakov Shafranovich wrote:

> I think it is a good place as any to start discussion as one of the
> proposals on advertising ARF receivers.
>=20
> HOWEVER, we might need to step back first and look at what possible
> options there are before committing to a specific one. I think that
> SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may
> be some of them. Perhaps a draft covering possible advertising
> mechanisms may be in order.

The ASRG already did that, though they didn't publish it as a draft:

http://wiki.asrg.sp.am/wiki/Adding_a_junk_button_to_MUAs

They were focused on MUA submissions, but I think similar logic applies =
-- and, indeed, I reviewed this document carefully when devising my =
draft.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc





From jdfalk-lists@cybernothing.org  Thu Jun 24 15:27:14 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CFA003A69D2 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:27:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.685
X-Spam-Level: 
X-Spam-Status: No, score=-4.685 tagged_above=-999 required=5 tests=[AWL=-0.046, BAYES_00=-2.599, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rzU6lABsktcE for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:27:14 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 0B4F33A68C3 for <marf@ietf.org>; Thu, 24 Jun 2010 15:27:13 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5OMQWwM016273 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Thu, 24 Jun 2010 16:27:22 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5OMQWwM016273
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277418442; bh=sGh/Ck4bowA2HZLbKtX4DqaU1G/cJAgVudyi1l7eQ oU=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=ZPrpYn3dlvAoLVcG 28LYecWP3eRmjHpb9LEMyHwqybs0M4XtSmLM5ipYZmeqURkmp12Lk87DgpBSDfqPB7O VUoh27R1RSITpI5UArCVQ8klKP84H5dT76+zhQR+aI+pi/MP+UfVkdfeCnNvO1SSkKt nWKpSO5E1Uq96RIEvVb5o=
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <FA00793D-2B41-4243-95A7-8A837266BEA6@cybernothing.org>
Content-Transfer-Encoding: 7bit
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Thu, 24 Jun 2010 16:27:21 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:27:14 -0000

On Jun 24, 2010, at 3:36 PM, Murray S. Kucherawy wrote:

> Please state your position for the record.

I support making draft-jdfalk-marf-reporting-discovery a WG document.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc





From jdfalk-lists@cybernothing.org  Thu Jun 24 15:35:06 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AC28E3A6867 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:35:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.68
X-Spam-Level: 
X-Spam-Status: No, score=-4.68 tagged_above=-999 required=5 tests=[AWL=-0.041,  BAYES_00=-2.599, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5-8IEDtbs19I for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:35:03 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id E01493A68C1 for <marf@ietf.org>; Thu, 24 Jun 2010 15:35:02 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5OMZ9q0016489 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Thu, 24 Jun 2010 16:35:10 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5OMZ9q0016489
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277418911; bh=f4CLKXkXi3IVGiU4FtqqkvtpkX1xh5pW/qiaCjyj8 Yg=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=fmh0xF2wwNq3Rm53 xUCs9KxpKNVWSmm+3uP09A2XZNoAJU1UA/4j5SbFIxDuwBF8RmTHIwD1z51pmiYilwz SaC2GibLLb0xqX9br2R5IASmjRnWRn3PgFRkAb+LFY4qWE4RGN2f1kyoyCQImzCmnNz 3RQC1KcgF/aj+QR+QcO28=
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>	<B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>	<4C22C870.5030001@mail-abuse.org> <34334128-C0FD-420A-B8B3-7AF0767C66DB@cybernothing.org> <4C23CC71.2090706@mail-abuse.org>
In-Reply-To: <4C23CC71.2090706@mail-abuse.org>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <2221EAF0-6606-4E96-BA37-7EFA63C9B76C@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Thu, 24 Jun 2010 16:35:03 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:35:06 -0000

On Jun 24, 2010, at 3:21 PM, Douglas Otis wrote:

> I consider Dave Rand to be an authority on this issue. Here is his =
reply:
> .---
> There is no standard place for abuse reporting, but there is a place =
to register information related to the ASN, and it can be added there. =
This is either the ARIN record or the RIPE/or other registry record for =
the ASN proper.

Makes sense, and I think it could be a worthy effort...but with all =
those different agencies involved it sounds like it'd be outside of this =
WG's charter, and likely outside of the IETF entirely.

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc


From dotis@mail-abuse.org  Thu Jun 24 15:35:28 2010
Return-Path: <dotis@mail-abuse.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8BD413A69D2 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:35:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.389
X-Spam-Level: 
X-Spam-Status: No, score=-5.389 tagged_above=-999 required=5 tests=[AWL=1.210,  BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XHKygIi25zH4 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:35:27 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id BBACC3A6867 for <marf@ietf.org>; Thu, 24 Jun 2010 15:35:27 -0700 (PDT)
Received: from US-DOUGLASO-MB.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id CAB49A944C9 for <marf@ietf.org>; Thu, 24 Jun 2010 22:35:29 +0000 (UTC)
Message-ID: <4C23DDB1.4020108@mail-abuse.org>
Date: Thu, 24 Jun 2010 15:35:29 -0700
From: Douglas Otis <dotis@mail-abuse.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: marf@ietf.org
References: <20100622040625.97472.qmail@joyce.lan>	<22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>	<6.2.5.6.2.20100622114236.07390908@resistor.net>	<BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>	<BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>	<AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:35:28 -0000

On 6/24/10 2:49 PM, Murray S. Kucherawy wrote:
>> -----Original Message-----
>> From: Yakov Shafranovich [mailto:yakov@shaftek.org]
>> Sent: Thursday, June 24, 2010 2:44 PM
>> To: Murray S. Kucherawy
>> Cc: J.D. Falk; Message Abuse Report Format working group
>> Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-
>> discovery
>>
>> I think it is a good place as any to start discussion as one of the
>> proposals on advertising ARF receivers.
>>
>> HOWEVER, we might need to step back first and look at what possible
>> options there are before committing to a specific one. I think that
>> SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may
>> be some of them. Perhaps a draft covering possible advertising
>> mechanisms may be in order.
>>      
> I'll count that as a "yes", given your first paragraph.  As I said, we're free to modify the draft according to what you said in the second based on consensus.
>    
I'd say that it depends.  The discovery process needs to be highly 
conservative.   Determining where feedback is to be sent MUST NOT be 
based upon an IP address where the destination unrelated to the 
corresponding AS.

A domain offering an IP address authorization must be considered of no 
value when not found within an originating header or return-path 
parameter.  In which case, there is already a discovery convention 
covering this type of situation, abuse@<originating-domain>.

Do not rely on any unauthenticated relationship, as this runs a risk 
leaking sensitive information to unknown entities.  If it can happen, it 
will happen.  Murphy is always right.

-Doug




From sm@resistor.net  Thu Jun 24 15:54:15 2010
Return-Path: <sm@resistor.net>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F3D73A6902 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:54:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.047
X-Spam-Level: 
X-Spam-Status: No, score=-2.047 tagged_above=-999 required=5 tests=[AWL=0.552,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7EOdHNfymeIk for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:54:14 -0700 (PDT)
Received: from ns1.qubic.net (ns1.qubic.net [208.69.177.116]) by core3.amsl.com (Postfix) with ESMTP id 462EF3A6867 for <marf@ietf.org>; Thu, 24 Jun 2010 15:54:14 -0700 (PDT)
Received: from SUBMAN.resistor.net ([10.0.0.1]) (authenticated bits=0) by ns1.qubic.net (8.14.5.Alpha0/8.14.5.Alpha0) with ESMTP id o5OMrmbG020320 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 24 Jun 2010 15:54:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=opendkim.org; s=mail2010; t=1277420056; x=1277506456; bh=CPz9TGneGeD22F/oM/OI8TcFEwg+g1gkU6jFaVAMfnA=; h=Message-Id:Date:To:From:Subject:Cc:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=VIh5x/5w6uSxgszvPxoTPNYFG+VULKmH+QR+cB4VJFzjdRlOXzzpjTN7TzyXAQewg Ua57EPl5d7WQEGNskQxpR/sMX9DgdyyQSkbsw8tKLVMblPrbflDhr57t30oBV55xXk Tveik+Io7iPsi6mohc1UQg+/XizhgOT2MUwf6ZwI=
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=resistor.net; s=mail; t=1277420056; x=1277506456; bh=CPz9TGneGeD22F/oM/OI8TcFEwg+g1gkU6jFaVAMfnA=; h=Message-Id:Date:To:From:Subject:Cc:In-Reply-To:References: Mime-Version:Content-Type:Cc; b=W36lfDwE+W9TIGAIHnWyrEPRTz/41/Ou25UhXGbd8VEJ662ZjW5MKwZ5iQN3JqQ+9 hPTWkBbO4EzYWWyVruPveSNLWDrvEMnw87eL9qIDkaeeeF2Apm5MNkkfEUXurLahsL aVbuObOwuWvJjFJcmpx+h8zPp2z85EkTzPrKiKVU=
DomainKey-Signature: a=rsa-sha1; s=mail; d=resistor.net; c=simple; q=dns; b=hJpS84c0fB7o1MlRqXnX5fZKd1XNtDmGs3fdurfRIROmDlyg5fnxAXl+xAYtyic1H aqc6rPtXu2/CeMgl109X/MUbmoVd6SjmOs8/5/yTC1Ivo2PvFC0+rbAWhUeICbI6yHk ecL/rbajgOjZlz7ckNi2P5oifKr3XRr1U6t0kDQ=
Message-Id: <6.2.5.6.2.20100624155117.0bce0f70@resistor.net>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6
Date: Thu, 24 Jun 2010 15:53:19 -0700
To: "Murray S. Kucherawy" <msk@cloudmark.com>
From: SM <sm@resistor.net>
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cl oudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing  draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:54:15 -0000

At 14:36 24-06-10, Murray S. Kucherawy wrote:
>So let me make this a more explicit statement and a question:
>
>Does the WG consider this draft a good basis for discussion?  We 
>have this as our fourth charter item, so it is certainly within 
>scope.  And clearly people are up for discussing it, as is evidenced 
>by this thread.

Yes.

>If not, we should figure out how we do want to address that fourth 
>charter item, and begin working on that path instead.

If there are any other proposals, I suggest submitting them as an I-D.

Regards,
-sm 


From msk@cloudmark.com  Thu Jun 24 15:58:17 2010
Return-Path: <msk@cloudmark.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 005313A67CF for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:58:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.484
X-Spam-Level: 
X-Spam-Status: No, score=-2.484 tagged_above=-999 required=5 tests=[AWL=0.115,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8WQnKt44oCEU for <marf@core3.amsl.com>; Thu, 24 Jun 2010 15:58:15 -0700 (PDT)
Received: from ht1-outbound.cloudmark.com (ht1-outbound.cloudmark.com [72.5.239.35]) by core3.amsl.com (Postfix) with ESMTP id E49393A6844 for <marf@ietf.org>; Thu, 24 Jun 2010 15:58:15 -0700 (PDT)
Received: from EXCH-C2.corp.cloudmark.com ([172.22.1.74]) by malice.corp.cloudmark.com ([172.22.1.71]) with mapi; Thu, 24 Jun 2010 15:58:24 -0700
From: "Murray S. Kucherawy" <msk@cloudmark.com>
To: SM <sm@resistor.net>
Date: Thu, 24 Jun 2010 15:58:23 -0700
Thread-Topic: [marf] Poll: Importing  draft-jdfalk-marf-reporting-discovery
Thread-Index: AcsT8C2jvGXT+4TWQn2dgXlpLGcBJAAAH+UQ
Message-ID: <BB012BD379D7B046ABE1472D8093C61C01F4890D5C@EXCH-C2.corp.cloudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <6.2.5.6.2.20100624155117.0bce0f70@resistor.net>
In-Reply-To: <6.2.5.6.2.20100624155117.0bce0f70@resistor.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing  draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 22:58:17 -0000

> -----Original Message-----
> From: SM [mailto:sm@resistor.net]
> Sent: Thursday, June 24, 2010 3:53 PM
> To: Murray S. Kucherawy
> Cc: Message Abuse Report Format working group; J.D. Falk
> Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-
> discovery
>=20
> At 14:36 24-06-10, Murray S. Kucherawy wrote:
> >So let me make this a more explicit statement and a question:
> >
> >Does the WG consider this draft a good basis for discussion?  We
> >have this as our fourth charter item, so it is certainly within
> >scope.  And clearly people are up for discussing it, as is evidenced
> >by this thread.
>=20
> Yes.

+1

> >If not, we should figure out how we do want to address that fourth
> >charter item, and begin working on that path instead.
>=20
> If there are any other proposals, I suggest submitting them as an I-D.

Super-duper +1.

-MSK [as participant]


From steve@wordtothewise.com  Thu Jun 24 16:06:11 2010
Return-Path: <steve@wordtothewise.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B90053A69FF for <marf@core3.amsl.com>; Thu, 24 Jun 2010 16:06:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.599
X-Spam-Level: 
X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=-2.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zeOem4GLXjmu for <marf@core3.amsl.com>; Thu, 24 Jun 2010 16:06:10 -0700 (PDT)
Received: from m.wordtothewise.com (b.wordtothewise.com [208.187.80.136]) by core3.amsl.com (Postfix) with ESMTP id A7ADB3A69DC for <marf@ietf.org>; Thu, 24 Jun 2010 16:06:10 -0700 (PDT)
Received: from platter.wordtothewise.com (184.wordtothewise.com [208.187.80.184]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: steve) by m.wordtothewise.com (Postfix) with ESMTPSA id E37052DFD7 for <marf@ietf.org>; Thu, 24 Jun 2010 16:07:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wordtothewise.com; s=1.wttw; t=1277420829; bh=N6pgLFK3RFEbxxTq933LKpScflzasTQ5yUq60TQlML4=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date: Content-Transfer-Encoding:Message-Id:References:To; b=mum/YSGnQszG6wecrUIPamtblXYto1Yoo8EF7odxeELif8bAMi/CCTmjkL2WNAdUp hBVSDXP+tYu56t72H39KJTuCndJkY4csZH7Yv/pIAmN5Ft7aDB64GusyqCHHuEYSzh dzhgUHmQWuSBDYIzGqr+Ceuh+25GDUI9PUPEtZBc=
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1081)
From: Steve Atkins <steve@wordtothewise.com>
In-Reply-To: <FA00793D-2B41-4243-95A7-8A837266BEA6@cybernothing.org>
Date: Thu, 24 Jun 2010 16:06:17 -0700
Content-Transfer-Encoding: 7bit
Message-Id: <318B3ADA-1600-434D-9525-AA081CDB0457@wordtothewise.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <FA00793D-2B41-4243-95A7-8A837266BEA6@cybernothing.org>
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 23:06:11 -0000

On Jun 24, 2010, at 3:27 PM, J.D. Falk wrote:

> On Jun 24, 2010, at 3:36 PM, Murray S. Kucherawy wrote:
> 
>> Please state your position for the record.
> 
> I support making draft-jdfalk-marf-reporting-discovery a WG document.

+1

Cheers,
  Steve


From macfisherman@gmail.com  Thu Jun 24 16:47:53 2010
Return-Path: <macfisherman@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 81D9E3A69FA for <marf@core3.amsl.com>; Thu, 24 Jun 2010 16:47:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.542
X-Spam-Level: 
X-Spam-Status: No, score=-2.542 tagged_above=-999 required=5 tests=[AWL=0.058,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r2Y3ue11zskF for <marf@core3.amsl.com>; Thu, 24 Jun 2010 16:47:46 -0700 (PDT)
Received: from mail-vw0-f44.google.com (mail-vw0-f44.google.com [209.85.212.44]) by core3.amsl.com (Postfix) with ESMTP id 256AC3A69F9 for <marf@ietf.org>; Thu, 24 Jun 2010 16:47:46 -0700 (PDT)
Received: by vws2 with SMTP id 2so503722vws.31 for <marf@ietf.org>; Thu, 24 Jun 2010 16:47:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=7qBBMRNmtmCh6lO3DRwMDSbweYKIDjGzHX+6eUcp51c=; b=lVoxNWp2Y/ZU+TEPxnGaqjrwVzrE0ze1G0L9tFkrPRtJ2qKA9vS9bO8E+GWStr93MM Vofotx/xorGMPPji+QfZ9GqkI3rzt4kIrZWG9s8Nszom33O41myiQVSFGhW8uCSwsQRY qbLSP/YjdyyTfTb5jxyH6b+DMGOf8vVi018Wk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=D20zAHJPQ6+kN/CqFBZmDJLJRkDnQra92BDF+06tFmq9p8eg0+kDZWE694YZ0xS4Nc NUWH4z0IRCJi/uxCWlgT2OMvtThAEjEno+g7hnNppkrWeVbhH9bCWgqKkVNgZIydMFjN Ll28VWNm+ORiapa2xSBQoTNdgle/Aqs4FCjeU=
MIME-Version: 1.0
Received: by 10.229.187.212 with SMTP id cx20mr5942238qcb.30.1277423270462;  Thu, 24 Jun 2010 16:47:50 -0700 (PDT)
Received: by 10.229.251.81 with HTTP; Thu, 24 Jun 2010 16:47:50 -0700 (PDT)
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>
Date: Thu, 24 Jun 2010 19:47:50 -0400
Message-ID: <AANLkTin7XIhO5YylS0FUKr974XYpND2C-5AwJX9Fl5Ib@mail.gmail.com>
From: Jeff Macdonald <macfisherman@gmail.com>
To: "Murray S. Kucherawy" <msk@cloudmark.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 23:47:53 -0000

On Thu, Jun 24, 2010 at 5:36 PM, Murray S. Kucherawy <msk@cloudmark.com> wrote:

> Does the WG consider this draft a good basis for discussion?

-- 
Jeff Macdonald
Ayer, MA

From barryleiba.mailing.lists@gmail.com  Thu Jun 24 16:57:45 2010
Return-Path: <barryleiba.mailing.lists@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 59C2A3A698D for <marf@core3.amsl.com>; Thu, 24 Jun 2010 16:57:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.21
X-Spam-Level: 
X-Spam-Status: No, score=-2.21 tagged_above=-999 required=5 tests=[AWL=0.389,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tPTfYD2GEpZP for <marf@core3.amsl.com>; Thu, 24 Jun 2010 16:57:44 -0700 (PDT)
Received: from mail-ew0-f44.google.com (mail-ew0-f44.google.com [209.85.215.44]) by core3.amsl.com (Postfix) with ESMTP id 5BF943A6966 for <marf@ietf.org>; Thu, 24 Jun 2010 16:57:44 -0700 (PDT)
Received: by ewy26 with SMTP id 26so622113ewy.31 for <marf@ietf.org>; Thu, 24 Jun 2010 16:57:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:reply-to :in-reply-to:references:date:message-id:subject:from:to:cc :content-type; bh=GuGp3og9IAuY4+MzrVFM/0cwhkWNfg7Eici/EhoUJs0=; b=sgvJVV/rktBlksGz0bpla3HKCrW9LD7qg2JPaHbFUNkjpZecylniD1gnwrWnt3lDGx hbXoS5zr1gdOz17lnLaO3Apza9cmw1aHjSoUfMgoP9y8yVowx/um2d/C0NrEQiyaGwDA wruzTfTb3rHLySDG2H1QaM4n8qpbThIgXizTA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; b=YcbGq8gCUF2PAwOohJGwmMaajTwjJtYLfTqRfhMmJwcKWtzbhdP1g2/1X2UfexqFT+ Unvb7GeLZ6Jiymy2NZlsFP65rxEj1iYfSfzU96MUEaGPBtMgDjJzsjx1/TUjBQHUz8sh kMvSnO4A5LubbNmlFWBB9xV8qNAGagptk7HhA=
MIME-Version: 1.0
Received: by 10.213.101.212 with SMTP id d20mr1566143ebo.2.1277423868661; Thu,  24 Jun 2010 16:57:48 -0700 (PDT)
Received: by 10.213.34.197 with HTTP; Thu, 24 Jun 2010 16:57:48 -0700 (PDT)
In-Reply-To: <AANLkTin7XIhO5YylS0FUKr974XYpND2C-5AwJX9Fl5Ib@mail.gmail.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <AANLkTin7XIhO5YylS0FUKr974XYpND2C-5AwJX9Fl5Ib@mail.gmail.com>
Date: Thu, 24 Jun 2010 19:57:48 -0400
Message-ID: <AANLkTikKdcET0JZtHEfKSjHgpYShGTXB0mBRLavFnLOf@mail.gmail.com>
From: Barry Leiba <barryleiba.mailing.lists@gmail.com>
To: Jeff Macdonald <macfisherman@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: barryleiba@computer.org
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Jun 2010 23:57:45 -0000

On Thu, Jun 24, 2010 at 7:47 PM, Jeff Macdonald <macfisherman@gmail.com> wrote:
> On Thu, Jun 24, 2010 at 5:36 PM, Murray S. Kucherawy <msk@cloudmark.com> wrote:
>
>> Does the WG consider this draft a good basis for discussion?
>
> --
> Jeff Macdonald
> Ayer, MA

And your answer, Jeff, is...... ?
--------------------------

Others:  Please do not discuss the options in this thread.  Please
just let us know "yes" or "no", about whether the WG should adopt the
subject document and work from there.

If you have discussion, please start another thread for it.

So far, I don't take any of the comments in this thread to say "no".
If you have posted to this thread and your vote on adoption is "no",
please re-post and make that clear.

Barry, as chair

From macfisherman@gmail.com  Thu Jun 24 17:54:06 2010
Return-Path: <macfisherman@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A52EF3A6995 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 17:54:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.553
X-Spam-Level: 
X-Spam-Status: No, score=-2.553 tagged_above=-999 required=5 tests=[AWL=0.046,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jPL6moGzpiBA for <marf@core3.amsl.com>; Thu, 24 Jun 2010 17:54:06 -0700 (PDT)
Received: from mail-qw0-f44.google.com (mail-qw0-f44.google.com [209.85.216.44]) by core3.amsl.com (Postfix) with ESMTP id CD1C33A69A2 for <marf@ietf.org>; Thu, 24 Jun 2010 17:54:05 -0700 (PDT)
Received: by qwe5 with SMTP id 5so128827qwe.31 for <marf@ietf.org>; Thu, 24 Jun 2010 17:54:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=CAu5tzasvJ9AVy3Yyx2GArvBlAmpIwSKnYWlUo/A/Ds=; b=FBdyXj2m7u0bimda8njcu7afWWzyDWC8maayJZ14Xf6al8WSDCE8T96lFmKNfMVYgc IIWELOXcJWxo+SECA215vfCJYOzzrgCs7OYRIEZH7yUF7ecIAJYhDH/Fj0NUb7Ju1cYT 1ktJ3Z2B0nVc/R678htVInihxoFeO17H5gZXo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=gnWGgVG3iHGM+RkrUBjCKGYNGALLIGNNijZ9u4j6YqfBnHdjg+CBbjhHUEAE8wPoCP hswdDReCGXtihj2FbE1CAZOQeVzwJ1bflkXUPimbSAYleaQvnMYSgxZuNX0+X1E7Z3XZ qkWOeTD79m2x44NvpkAeTu20Ww5pFN5N2c+g8=
MIME-Version: 1.0
Received: by 10.224.27.131 with SMTP id i3mr6940294qac.141.1277427246738; Thu,  24 Jun 2010 17:54:06 -0700 (PDT)
Received: by 10.229.251.81 with HTTP; Thu, 24 Jun 2010 17:54:06 -0700 (PDT)
In-Reply-To: <AANLkTikKdcET0JZtHEfKSjHgpYShGTXB0mBRLavFnLOf@mail.gmail.com>
References: <20100622040625.97472.qmail@joyce.lan> <22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org> <6.2.5.6.2.20100622114236.07390908@resistor.net> <BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <AANLkTin7XIhO5YylS0FUKr974XYpND2C-5AwJX9Fl5Ib@mail.gmail.com> <AANLkTikKdcET0JZtHEfKSjHgpYShGTXB0mBRLavFnLOf@mail.gmail.com>
Date: Thu, 24 Jun 2010 20:54:06 -0400
Message-ID: <AANLkTiku8zlxAoIGZDjXVCT_3_IMKGVGEJYkPvVPypWV@mail.gmail.com>
From: Jeff Macdonald <macfisherman@gmail.com>
To: barryleiba@computer.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 00:54:06 -0000

opps, don't know how that happened.

My answer is Yes.

On Thu, Jun 24, 2010 at 7:57 PM, Barry Leiba
<barryleiba.mailing.lists@gmail.com> wrote:
> On Thu, Jun 24, 2010 at 7:47 PM, Jeff Macdonald <macfisherman@gmail.com> =
wrote:
>> On Thu, Jun 24, 2010 at 5:36 PM, Murray S. Kucherawy <msk@cloudmark.com>=
 wrote:
>>
>>> Does the WG consider this draft a good basis for discussion?
>>
>> --
>> Jeff Macdonald
>> Ayer, MA
>
> And your answer, Jeff, is...... ?
> --------------------------
>
> Others: =A0Please do not discuss the options in this thread. =A0Please
> just let us know "yes" or "no", about whether the WG should adopt the
> subject document and work from there.
>
> If you have discussion, please start another thread for it.
>
> So far, I don't take any of the comments in this thread to say "no".
> If you have posted to this thread and your vote on adoption is "no",
> please re-post and make that clear.
>
> Barry, as chair
>



--=20
Jeff Macdonald
Ayer, MA

From dotis@mail-abuse.org  Thu Jun 24 19:29:45 2010
Return-Path: <dotis@mail-abuse.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 733423A696C for <marf@core3.amsl.com>; Thu, 24 Jun 2010 19:29:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.456
X-Spam-Level: 
X-Spam-Status: No, score=-5.456 tagged_above=-999 required=5 tests=[AWL=1.143,  BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y4-XWS9BL+bu for <marf@core3.amsl.com>; Thu, 24 Jun 2010 19:29:43 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id 455773A68F2 for <marf@ietf.org>; Thu, 24 Jun 2010 19:29:43 -0700 (PDT)
Received: from US-DOUGLASO-MB.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 5A85CA944F5 for <marf@ietf.org>; Fri, 25 Jun 2010 02:29:46 +0000 (UTC)
Message-ID: <4C24149A.2090106@mail-abuse.org>
Date: Thu, 24 Jun 2010 19:29:46 -0700
From: Douglas Otis <dotis@mail-abuse.org>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: marf@ietf.org
References: <20100622040625.97472.qmail@joyce.lan>	<22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>	<6.2.5.6.2.20100622114236.07390908@resistor.net>	<BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>	<BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>	<AANLkTin7XIhO5YylS0FUKr974XYpND2C-5AwJX9Fl5Ib@mail.gmail.com> <AANLkTikKdcET0JZtHEfKSjHgpYShGTXB0mBRLavFnLOf@mail.gmail.com>
In-Reply-To: <AANLkTikKdcET0JZtHEfKSjHgpYShGTXB0mBRLavFnLOf@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 02:29:46 -0000

On 6/24/10 4:57 PM, Barry Leiba wrote:
> On Thu, Jun 24, 2010 at 7:47 PM, Jeff Macdonald<macfisherman@gmail.com>  wrote:
>    
>> On Thu, Jun 24, 2010 at 5:36 PM, Murray S. Kucherawy<msk@cloudmark.com>  wrote:
>>
>>      
>>> Does the WG consider this draft a good basis for discussion?
>>>        

Although jdfak-marf reporting is okay, I must admit to preferring the 
approach found in:
http://tools.ietf.org/html/draft-daboo-srv-email-05

This srv mail approach seems like a natural place to make these 
extensions, which allows a way to prioritize a set of preferences.

I am also a bit concerned with the number of options, especially the 
option that allows use of http.  By itself, http is fine, but we have 
seen attempts to place captcha front-ends on these types of inputs, 
which severely limits their utility.  They seem share the attitude with 
those that put spam filters on their abuse feedback.  No kidding.

There will be a number of games played by administrators seeking ways 
divert this input, perhaps to keep it off management's radar.  All of 
the options in the jdfalk-marf report approach are likely to create 
hurdles and barriers that aren't needed.   Using a simpler strategy 
found with srv-email seems better along with a more constrained set of 
input parameters.

If there is any interest in consider this as an alternative, I'd be 
happy to create a draft along these lines as well.

-Doug




From johnl@iecc.com  Thu Jun 24 20:29:45 2010
Return-Path: <johnl@iecc.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7CF1328C0D6 for <marf@core3.amsl.com>; Thu, 24 Jun 2010 20:29:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.363
X-Spam-Level: 
X-Spam-Status: No, score=-10.363 tagged_above=-999 required=5 tests=[AWL=0.836, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qxhXEcovhyHq for <marf@core3.amsl.com>; Thu, 24 Jun 2010 20:29:44 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id 1ABD728C0D0 for <marf@ietf.org>; Thu, 24 Jun 2010 20:29:44 -0700 (PDT)
Received: (qmail 10940 invoked from network); 25 Jun 2010 03:25:01 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 25 Jun 2010 03:25:01 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; olt=johnl@user.iecc.com; bh=Dvkp0otypQ2J1ul6u4zBwiQjAgi6xVEGYG9PLSMoJBs=; b=Pr+tNy0eEh4GObKEU824+o4vYjQIDiha83EDBUWcR1FOKx5f8fuurwDBixe4Map/R51eUkg1RqYyG53QDn05jlw3+IflKmTzY59W6rUfuelloULCUtBVHQooEs6kvS5ZKf2a14afRcvoMDuOIOEMFfdjp5eWAoWcahw2SJz0sk4=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; bh=Dvkp0otypQ2J1ul6u4zBwiQjAgi6xVEGYG9PLSMoJBs=; b=kjWOakh4XDfMN+xBjPfrTLCWlSAVhDjA63uMa+epZnPeN1LQTd0u3iswFX7MsrBP8MRQXUeNztfPtzMhxx7xMnRg24NID4JxGhoy/8mmqyZHItyHJDARW3cHcWtBn/kt1AoeF8jY1tmH5VIe5oIvJqTR1EdZZ/qvRqazXOSnYrI=
Date: 25 Jun 2010 03:29:51 -0000
Message-ID: <20100625032951.56125.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <AANLkTikKdcET0JZtHEfKSjHgpYShGTXB0mBRLavFnLOf@mail.gmail.com>
Organization: 
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Cc: barryleiba@computer.org
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 03:29:45 -0000

>>> Does the WG consider this draft a good basis for discussion?

Sure, keeping in mind that "discussion" and "turning into an RFC" are
not synonyms.

R's,
John

From jacqui.caren@ntlworld.com  Fri Jun 25 01:21:23 2010
Return-Path: <jacqui.caren@ntlworld.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 092923A6846 for <marf@core3.amsl.com>; Fri, 25 Jun 2010 01:21:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.11
X-Spam-Level: 
X-Spam-Status: No, score=-1.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gYKtbdaStLy2 for <marf@core3.amsl.com>; Fri, 25 Jun 2010 01:21:21 -0700 (PDT)
Received: from mtaout03-winn.ispmail.ntl.com (mtaout03-winn.ispmail.ntl.com [81.103.221.49]) by core3.amsl.com (Postfix) with ESMTP id 384F93A63CB for <marf@ietf.org>; Fri, 25 Jun 2010 01:21:20 -0700 (PDT)
Received: from aamtaout03-winn.ispmail.ntl.com ([81.103.221.35]) by mtaout03-winn.ispmail.ntl.com (InterMail vM.7.08.04.00 201-2186-134-20080326) with ESMTP id <20100625082126.EAGZ3075.mtaout03-winn.ispmail.ntl.com@aamtaout03-winn.ispmail.ntl.com> for <marf@ietf.org>; Fri, 25 Jun 2010 09:21:26 +0100
Received: from [10.0.0.253] (really [86.0.245.29]) by aamtaout03-winn.ispmail.ntl.com (InterMail vG.2.02.00.01 201-2161-120-102-20060912) with ESMTP id <20100625082126.OUHL1598.aamtaout03-winn.ispmail.ntl.com@[10.0.0.253]> for <marf@ietf.org>; Fri, 25 Jun 2010 09:21:26 +0100
Message-ID: <4C2466FD.8010708@ntlworld.com>
Date: Fri, 25 Jun 2010 09:21:17 +0100
From: Jacqui Caren-home <jacqui.caren@ntlworld.com>
User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
MIME-Version: 1.0
To: marf@ietf.org
References: <20100622040625.97472.qmail@joyce.lan>	<22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>	<6.2.5.6.2.20100622114236.07390908@resistor.net>	<BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>	<BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com>	<AANLkTim8U3dfNMWV87Eq_zAYEEy2JXDmpOUkD8u2m2y4@mail.gmail.com> <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
In-Reply-To: <BB012BD379D7B046ABE1472D8093C61C01F4890D3A@EXCH-C2.corp.cloudmark.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Cloudmark-Analysis: v=1.1 cv=ZtHxNT4mZm3rCuM0SmWmgWxeBwJsziC8EqOrwwVkrhA= c=1 sm=0 a=dLo-aMAK3e8A:10 a=yQWWgrYGNuUA:10 a=8nJEP1OIZ-IA:10 a=QbxTNZaXAAAA:8 a=KB2pjeLNoI5GU72AdC0A:9 a=dQ_TXtcLoOZ5CSJu60YA:7 a=BQVje6hblmT-6rnEG7Jn9QgoPa8A:4 a=wPNLvfGTeEIA:10 a=vCzEYI1rHXYA:10 a=HpAAvcLHHh0Zw7uRqdWCyQ==:117
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 08:21:23 -0000

Murray S. Kucherawy wrote:
>> -----Original Message-----
>> From: Yakov Shafranovich [mailto:yakov@shaftek.org]
>> Sent: Thursday, June 24, 2010 2:44 PM
>> To: Murray S. Kucherawy
>> Cc: J.D. Falk; Message Abuse Report Format working group
>> Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-
>> discovery
>>
>> I think it is a good place as any to start discussion as one of the
>> proposals on advertising ARF receivers.
>>
>> HOWEVER, we might need to step back first and look at what possible
>> options there are before committing to a specific one. I think that
>> SMTP extensions, signed headers like List-Unsubscribe, DNS, etc. may
>> be some of them. Perhaps a draft covering possible advertising
>> mechanisms may be in order.
> 
> I'll count that as a "yes", given your first paragraph.  As I said, we're free to modify the draft according to what you said in the second based on consensus.

And thats also a yes from me - one of the quiet lurkers :-)

Jacqui

From vesely@tana.it  Fri Jun 25 02:41:51 2010
Return-Path: <vesely@tana.it>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E40513A66B4 for <marf@core3.amsl.com>; Fri, 25 Jun 2010 02:41:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.302
X-Spam-Level: 
X-Spam-Status: No, score=-3.302 tagged_above=-999 required=5 tests=[AWL=1.417,  BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wASAzO5FPECX for <marf@core3.amsl.com>; Fri, 25 Jun 2010 02:41:49 -0700 (PDT)
Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 226573A63C9 for <marf@ietf.org>; Fri, 25 Jun 2010 02:41:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tana.it; s=test; t=1277458913; bh=PsIVjsyOj4IRL1MpB3G3EFZpbeUwP+ffrxh6fuG20fI=; l=230; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=HjPoCQby0EEgA05EiDgLFgghE9/V8rN76TxIeucPNJqPV6cNcu8yirYrd5iX2MbqJ G2OTshRpXrHtuX7tx0GJ4TuouzWI4LINPubIfbaDF3eBD30eUHza5vEeh4JQk118IJ GZGwCZMs15wD9QS5qismkQN/c9Uj2VkckKkD/9Go=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Fri, 25 Jun 2010 11:41:53 +0200 id 00000000005DC02B.000000004C2479E1.00002F63
Message-ID: <4C2479E2.2060302@tana.it>
Date: Fri, 25 Jun 2010 11:41:54 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: marf@ietf.org
References: <20100622040625.97472.qmail@joyce.lan>	<22377F8C-4BFB-4F4D-AC57-B81A7531D86E@cybernothing.org>	<6.2.5.6.2.20100622114236.07390908@resistor.net>	<BB012BD379D7B046ABE1472D8093C61C01F48908DD@EXCH-C2.corp.cloudmark.com>	<BB012BD379D7B046ABE1472D8093C61C01F4890D30@EXCH-C2.corp.cloudmark.com> <FA00793D-2B41-4243-95A7-8A837266BEA6@cybernothing.org>
In-Reply-To: <FA00793D-2B41-4243-95A7-8A837266BEA6@cybernothing.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 09:41:51 -0000

On 25/Jun/10 00:27, J.D. Falk wrote:
> On Jun 24, 2010, at 3:36 PM, Murray S. Kucherawy wrote:
>
>>  Please state your position for the record.
>
> I support making draft-jdfalk-marf-reporting-discovery a WG document.

+1

From vesely@tana.it  Fri Jun 25 03:13:06 2010
Return-Path: <vesely@tana.it>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B01B53A695F for <marf@core3.amsl.com>; Fri, 25 Jun 2010 03:13:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.431
X-Spam-Level: 
X-Spam-Status: No, score=-3.431 tagged_above=-999 required=5 tests=[AWL=1.288,  BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ri5uBPDCl-1b for <marf@core3.amsl.com>; Fri, 25 Jun 2010 03:13:05 -0700 (PDT)
Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 9F8C13A6987 for <marf@ietf.org>; Fri, 25 Jun 2010 03:13:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tana.it; s=test; t=1277460789; bh=NyWRUwCiuIJtJBiVtUmktYWHQcwGwHuT9YZpKK7LltY=; l=1172; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=iS4ZuoqbsTVfYHRcaYsVjj3APJQwRG0LidWLP3mvsYjVrUEuwbqlFg7tOP1Ck7wbh FSxeyQhJXcnYwberN3QM65IGKhlfF+8bJIdM4NFF14a4nTWX4bhBMWyR4yFL4DM/1o arzcNwA7HV9lFI9ukRIMFIccaV9/YHCsqS3pP7lw=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Fri, 25 Jun 2010 12:13:09 +0200 id 00000000005DC037.000000004C248135.000040A4
Message-ID: <4C248135.5070002@tana.it>
Date: Fri, 25 Jun 2010 12:13:09 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
MIME-Version: 1.0
To: Message Abuse Report Format working group <marf@ietf.org>
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>	<B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>	<AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com> <82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org>
In-Reply-To: <82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [marf]  marf-reporting-discovery authentication
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 10:13:06 -0000

On 24/Jun/10 18:42, J.D. Falk wrote:
> On Jun 23, 2010, at 7:42 PM, Jeff Macdonald wrote:
>>  sure, and the bad guys can put whatever MAIL FROM they want:
>>
>>  "and/or in the DNS domain matching the one
>>    present in the [SMTP] MAIL commands it issues when sending mail"
>>
>>  did I misunderstand that?
>
> That was mostly an attempt to work with SPF.  It could be removed, and/or we could add even stronger language about authentication identifiers.  Any other thoughts on this from the group?

I vote for an even stronger specification of authentication.

It will complicate the document somewhat, as it will have to reference 
each method.  John says he uses abuse.net to lookup a domain's 
contacts, perhaps he'll also mention how he extracts the domain name...

How about a template around the lines of

   If original message was authenticated by method M,
   extract domain name D from field F,
   and send a report to address A or abuse@D
   (see also Security Considerations --Murphy is always right.)

Some email authentication methods are listed in 
http://www.iana.org/assignments/email-auth/email-auth.xhtml#email-auth-methods

From jdfalk-lists@cybernothing.org  Fri Jun 25 10:23:16 2010
Return-Path: <jdfalk-lists@cybernothing.org>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EC053A6359 for <marf@core3.amsl.com>; Fri, 25 Jun 2010 10:23:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.656
X-Spam-Level: 
X-Spam-Status: No, score=-5.656 tagged_above=-999 required=5 tests=[AWL=0.943,  BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ynoMcay+b0IZ for <marf@core3.amsl.com>; Fri, 25 Jun 2010 10:23:14 -0700 (PDT)
Received: from ocelope.disgruntled.net (ocelope.disgruntled.net [97.107.131.76]) by core3.amsl.com (Postfix) with ESMTP id 6B25A3A67E3 for <marf@ietf.org>; Fri, 25 Jun 2010 10:23:12 -0700 (PDT)
Received: from jds-macbook.rpcorp.local (np34.co.returnpath.net [38.109.196.34]) (authenticated bits=0) by ocelope.disgruntled.net (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o5PHNJtt003845 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <marf@ietf.org>; Fri, 25 Jun 2010 11:23:20 -0600
X-DKIM: Sendmail DKIM Filter v2.6.0 ocelope.disgruntled.net o5PHNJtt003845
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybernothing.org; s=triac; t=1277486600; bh=mA5rmLUzYqojivhOKNZEsTD1T9Pun9Too7UmTnDFm Bo=; h=References:In-Reply-To:Mime-Version:Content-Type:Message-Id: Content-Transfer-Encoding:From:Subject:Date:To; b=ZDpiskc1zL54TrNt sQx2zQ6uEmS9rh8PRjyZv31i7OiMe7rUD1f/Ml7gc2KXtlDu91xck+j3AcQly8+aIn/ rEFIVLNtVM3fQ5tqje2UdZaPfD+SGyUayZQn0FHONeHIhJqhzxZQqTubo0an/haVbMG DFLVM08gVthR7ov8pzBtc=
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>	<B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>	<AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com> <82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org> <4C248135.5070002@tana.it>
In-Reply-To: <4C248135.5070002@tana.it>
Mime-Version: 1.0 (Apple Message framework v1081)
Content-Type: text/plain; charset=us-ascii
Message-Id: <4EC01EAE-74BB-4FEB-828D-EC485CA27C93@cybernothing.org>
Content-Transfer-Encoding: quoted-printable
From: "J.D. Falk" <jdfalk-lists@cybernothing.org>
Date: Fri, 25 Jun 2010 11:23:13 -0600
To: Message Abuse Report Format working group <marf@ietf.org>
X-Mailer: Apple Mail (2.1081)
Subject: Re: [marf] marf-reporting-discovery authentication
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 17:23:16 -0000

On Jun 25, 2010, at 4:13 AM, Alessandro Vesely wrote:

> I vote for an even stronger specification of authentication.
>=20
> It will complicate the document somewhat, as it will have to reference =
each method.  John says he uses abuse.net to lookup a domain's contacts, =
perhaps he'll also mention how he extracts the domain name...
>=20
> How about a template around the lines of
>=20
>  If original message was authenticated by method M,
>  extract domain name D from field F,
>  and send a report to address A or abuse@D
>  (see also Security Considerations --Murphy is always right.)
>=20
> Some email authentication methods are listed in =
http://www.iana.org/assignments/email-auth/email-auth.xhtml#email-auth-met=
hods

Contributions to the draft are welcome.  *grin*

(If you'd like a copy of the current XML file, let me know.)

--
J.D. Falk <jdfalk@returnpath.net>
Return Path Inc





From johnl@iecc.com  Fri Jun 25 12:38:00 2010
Return-Path: <johnl@iecc.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B4D333A69D3 for <marf@core3.amsl.com>; Fri, 25 Jun 2010 12:37:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.786
X-Spam-Level: 
X-Spam-Status: No, score=-9.786 tagged_above=-999 required=5 tests=[AWL=-0.076, BAYES_05=-1.11, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ammvsb8V5YeX for <marf@core3.amsl.com>; Fri, 25 Jun 2010 12:37:56 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [64.57.183.53]) by core3.amsl.com (Postfix) with ESMTP id CD7763A687D for <marf@ietf.org>; Fri, 25 Jun 2010 12:37:53 -0700 (PDT)
Received: (qmail 93873 invoked from network); 25 Jun 2010 19:33:11 -0000
Received: from mail1.iecc.com (64.57.183.56) by mail1.iecc.com with QMQP; 25 Jun 2010 19:33:11 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; olt=johnl@user.iecc.com; bh=d+XuqBbdoQbfBN8zzzIHRIV8AHgw8x/awhKbgs3WE0I=; b=j6OnXPOVy09uqZ5h0sQ6qaMBrJFcOFYjWioYtIGhgzXlv9vb46YIF0lRh55/qENA4wY8Ohzp2XdDWZd+AEPstQZdzSy3rweLC+aWJAtAcewV3NVW16sVMs3CdGLHf5mDIkkvp3f1Rksvxla9tjn23jdihc1MWrvNanrKsO6eIKc=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:cc:mime-version:content-type:content-transfer-encoding; s=k1006; bh=d+XuqBbdoQbfBN8zzzIHRIV8AHgw8x/awhKbgs3WE0I=; b=Zqv1UvdbOR/8xZRvL6Senu1LYfRVY1IGdOmbogThLpuj1b/bKGtwzBV8+EBTvrpaqhpW+F7gGdKb1zrVeiYxKNI8s4h6PJ7mb0y2Xbn9F0bUPz3zGulkR4LFpBWJj5CtXHMpjF5T9b7u1eNl0UKntdHpdRy9Q6+8RfO35FNITz0=
Date: 25 Jun 2010 19:38:01 -0000
Message-ID: <20100625193801.90963.qmail@joyce.lan>
From: John Levine <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <4C248135.5070002@tana.it>
Organization: 
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Cc: vesely@tana.it
Subject: Re: [marf] marf-reporting-discovery authentication
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Jun 2010 19:38:00 -0000

>It will complicate the document somewhat, as it will have to reference 
>each method.  John says he uses abuse.net to lookup a domain's 
>contacts, perhaps he'll also mention how he extracts the domain name...

A combination of rDNS of the connecting IP and a manually maintained
table of IP ranges.  The rDNS is reasonably reliable so long as you do
the usual forward/reverse checks, but the IP range table really doesn't
scale.

R's,
John

From vesely@tana.it  Sat Jun 26 04:05:41 2010
Return-Path: <vesely@tana.it>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 408BC3A6452 for <marf@core3.amsl.com>; Sat, 26 Jun 2010 04:05:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.238
X-Spam-Level: 
X-Spam-Status: No, score=-2.238 tagged_above=-999 required=5 tests=[AWL=-0.119, BAYES_50=0.001, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245,  RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JfKOylgqY4v3 for <marf@core3.amsl.com>; Sat, 26 Jun 2010 04:05:39 -0700 (PDT)
Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 0FF753A690C for <marf@ietf.org>; Sat, 26 Jun 2010 04:05:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tana.it; s=test; t=1277550344; bh=1XlyKft9SRTB6WF3g+plX3zGaO95M9dwoFOQIAyAm+g=; l=11770; h=Message-ID:Date:From:Mime-Version:To:CC:References:In-Reply-To; b=Dd9FHKRs43JKdAPr5R2rPtq3HOzptgPrOV2+L/sDkH6rhJvWYOzboQM2kE9ak40RB A5AQKutt3iIx2WdHr81N5pJrld0Oc9fkALGEPN0IU6d2rlCqrM5guPhfvKm7zdfsJM IOSYOFe/tmyCZXzZmzU3b2pHPNRLJWzCUvJyxKtk=
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Sat, 26 Jun 2010 13:05:43 +0200 id 00000000005DC035.000000004C25DF07.00004779
Message-ID: <4C25DF07.1050603@tana.it>
Date: Sat, 26 Jun 2010 13:05:43 +0200
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.10) Gecko/20100512 Thunderbird/3.0.5
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="=_north-18297-1277550343-0001-2"
To: "J.D. Falk" <jdfalk-lists@cybernothing.org>
References: <BB012BD379D7B046ABE1472D8093C61C01F48906B4@EXCH-C2.corp.cloudmark.com>	<20100622040625.97472.qmail@joyce.lan>	<AANLkTin5LC61cfXEuroHh8l4Y2ygNRaa0dqaad5s-Fy9@mail.gmail.com>	<B5FD8A54-D5A2-496F-BFCE-D2E13D9AFED1@cybernothing.org>	<AANLkTikZVcWjl5mWBA3bej-rsimlm1JOCBzHhymbQnjj@mail.gmail.com>	<82D2B9A2-CE73-443F-8295-CEB2C065BBF9@cybernothing.org>	<4C248135.5070002@tana.it> <4EC01EAE-74BB-4FEB-828D-EC485CA27C93@cybernothing.org>
In-Reply-To: <4EC01EAE-74BB-4FEB-828D-EC485CA27C93@cybernothing.org>
Cc: Message Abuse Report Format working group <marf@ietf.org>
Subject: Re: [marf] marf-reporting-discovery authentication
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 26 Jun 2010 11:05:41 -0000

This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.

--=_north-18297-1277550343-0001-2
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

On 25/Jun/10 19:23, J.D. Falk wrote:
> On Jun 25, 2010, at 4:13 AM, Alessandro Vesely wrote:
>>  I vote for an even stronger specification of authentication.
>
> Contributions to the draft are welcome.  *grin*
>
> (If you'd like a copy of the current XML file, let me know.)

I attach a patch to an older version, it should work just the same, as 
the added text is rather self-contained.

I added two paragraphs before section 5.1, to bind with A-R, and then 
an authentication section (tentatively section 6) with just two 
methods --DKIM and SPF.  We can add more methods if that seems the 
right thing to do.  E.g., if the relay's IP is the MX of a sender 
address (or would MX/24 suffice? Hm... bad kind of heuristics.)

Finally, I tried a "Privacy considerations" subsection.  The 
attachment should be readable, so there is a chance to discuss it even 
before committing it.

--=_north-18297-1277550343-0001-2
Content-Type: text/plain; name="report-discovery-patch.txt"; charset=iso-8859-1
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="report-discovery-patch.txt"

LS0tIGRyYWZ0LWpkZmFsay1tYXJmLXJlcG9ydGluZy1kaXNjb3ZlcnktMDAueG1sCTIwMTAt
MDUtMTIgMTI6MjY6MDEuMDAwMDAwMDAwICswMjAwCisrKyBkcmFmdC1qZGZhbGstbWFyZi1y
ZXBvcnRpbmctZGlzY292ZXJ5LTAxLnhtbAkyMDEwLTA2LTI2IDEyOjM2OjUyLjAwMDAwMDAw
MCArMDIwMApAQCAtMTkxLDYgKzE5MSwxNSBAQAogCQkJPHhyZWYgdGFyZ2V0PSJQT1AiLz4g
c2VydmljZSB0byB0aGF0IHVzZXIuICBGb3IgZXhhbXBsZSwKIAkJCXdoZW4gdGhlIHVzZXIn
cyBJTUFQIHNlcnZlciBpcyBpbWFwLmV4YW1wbGUubmV0LCB0aGUgYXBwbGljYWJsZQogCQkJ
YWR2ZXJ0aXNlbWVudCB3aWxsIGJlIGZvdW5kIGF0IF9yZXBvcnQuaW1hcC5leGFtcGxlLm5l
dC4gPC90PgorCQkJPHQ+IEVuZCB1c2VycyBtYXkgYWxzbyByZWx5IG9uIHRydXN0ZWQgQXV0
aGVudGljYXRpb24tUmVzdWx0cworCQkJaGVhZGVyIGZpZWxkczogaW4gY2FzZSB0aGUgQXV0
aGVudGljYXRpb24gSWRlbnRpZmllciAoImF1dGhzZXJ2LWlkIgorCQkJaW4gPHhyZWYgdGFy
Z2V0PSJBVVRILU1FVEhPRFMiLz4pIHByb3ZpZGVzIGEgdmFsaWQgZW1haWwgZG9tYWluLAor
CQkJaXRzIGFidXNlQCBtYWlsYm94IG1heSBiZSBhc3N1bWVkIGEgdmFsaWQgdGFyZ2V0IGZv
ciByZXBvcnRpbmcKKwkJCWFidXNlLCBhY2NvcmRpbmcgdG8gPHhyZWYgdGFyZ2V0PSJNQUlM
Qk9YLU5BTUVTIi8+LjwvdD4KKwkJCTx0PiBJbiBhbnkgY2FzZSwgZmVlZGJhY2sgZ2VuZXJh
dG9ycyBzaG91bGQgbm90IHNlbmQgcmVwb3J0cyB0bworCQkJQURNRHMgdGhhdCBhcmUgbm90
IHJlc3BvbnNpYmxlIGZvciB0aGUgcmVwb3J0ZWQgbWVzc2FnZSwgZm9yIGJvdGgKKwkJCXNl
Y3VyaXR5IGFuZCBlZmZpY2llbmN5IHJlYXNvbnMuICBSZXNwb25zaWJpbGl0eSBjYW4gYmUg
YXNjZXJ0YWluZWQKKwkJCWFzIGRlc2NyaWJlZCBpbiA8eHJlZiB0YXJnZXQ9ImF1dGgtY2hl
Y2tzIi8+LjwvdD4KIAogCQkJPHNlY3Rpb24gYW5jaG9yPSJjb25zdW1lciIgdGl0bGU9IkZl
ZWRiYWNrIENvbnN1bWVycyI+CiAJCQkJPHQ+CkBAIC0zMjEsNiArMzMwLDI2IEBACiAJCQk8
L3NlY3Rpb24+CiAJCTwvc2VjdGlvbj4KIAorCQk8c2VjdGlvbiBhbmNob3I9ImF1dGgtY2hl
Y2tzIiB0aXRsZT0iQXV0aGVudGljYXRpb24gb2YgUmVwb3J0ZWQgTWVzc2FnZSI+CisJCQk8
dD4gPHhyZWYgdGFyZ2V0PSJBVVRILU1FVEhPRFMiLz4gYW5kIGl0cyBleHRlbnNpb25zIGRl
ZmluZSBhIG51bWJlcgorCQkJb2YgYXV0aGVudGljYXRpb24gbWV0aG9kcyB0aGF0IGFsbG93
IHRvIGF0dHJpYnV0ZSByZXNwb25zaWJpbGl0eSBvZgorCQkJdGhlIHJlcG9ydGVkIG1lc3Nh
Z2UgdG8gdGhlIEFETURzIGlkZW50aWZpZWQgYnkgdGhlIHJlbGV2YW50IGRvbWFpbgorCQkJ
bmFtZXMuICBBbiBpbml0aWFsIGxpc3Qgb2YgZG9tYWluIG5hbWVzIGlzIG9idGFpbmVkIGNo
ZWNraW5nIGVhY2gKKwkJCW1ldGhvZC4gIEVhY2ggZG9tYWluIG5hbWUgc2hhbGwgaW4gdHVy
biBiZSB2YWxpZGF0ZWQgYWdhaW5zdCB0aGUKKwkJCXJlbGV2YW50IHBvbGljeS48L3Q+CisJ
CQk8c2VjdGlvbiB0aXRsZT0iREtJTSBzaWduYXR1cmVzIj4KKwkJCQk8dD4gQW55IHZhbGlk
IERLSU0gc2lnbmF0dXJlIGluIHRoZSByZXBvcnRlZCBtZXNzYWdlIHByb3ZpZGVzIGEKKwkJ
CQlkb21haW4gbmFtZSwgZWl0aGVyIHRoZSBzaWduYXR1cmUgImQiIHRhZywgb3IgdGhlIGRv
bWFpbi1wYXJ0IG9mCisJCQkJdGhlIHNpZ25hdHVyZSAiaSIgdGFnLjwvdD4KKwkJCTwvc2Vj
dGlvbj4KKwkJCTxzZWN0aW9uIHRpdGxlPSJTUEYgYXV0aG9yaXplZCBzZW5kZXIiPgorCQkJ
CTx0PiBXaGVuIHRoZSBjaGVja19ob3N0KCkgZnVuY3Rpb24gZGVzY3JpYmVkIGluIDx4cmVm
IHRhcmdldD0iU1BGIi8+CisJCQkJcmVzdWx0cyBpbiBhICJwYXNzIiBmb3IgdGhlIGVudmVs
b3BlIHNlbmRlciwgdGhlIGRvbWFpbiBwYXJ0IG9mCisJCQkJdGhhdCBhZGRyZXNzLiAgT3Ro
ZXJ3aXNlLCBpZiBhICJwYXNzIiBpcyBvYnRhaW5lZCBmb3IgdGhlCisJCQkJSEVMTy9FSExP
IG5hbWUsIHRoYXQgZG9tYWluIG5hbWUuPC90PgorCQkJPC9zZWN0aW9uPgorCQk8L3NlY3Rp
b24+CisKIAkJPHNlY3Rpb24gYW5jaG9yPSJJQU5BIiB0aXRsZT0iSUFOQSBDb25zaWRlcmF0
aW9ucyI+CiAJCQk8dD4gVGhpcyBtZW1vIGluY2x1ZGVzIG5vIHJlcXVlc3QgdG8gSUFOQSwg
dGhvdWdoIHRoYXQgbWF5IGNoYW5nZQogCQkJaW4gbGF0ZXIgZHJhZnRzLjwvdD4KQEAgLTMz
Niw2ICszNjUsMjggQEAKIAkJCTxzZWN0aW9uIHRpdGxlPSJUQkQiPgogCQkJPHQ+IEFkZGl0
aW9uYWwgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgYXJlIGxpa2VseSwgYW5kIFRCRC4gPC90
PgogCQkJPC9zZWN0aW9uPgorCQkJPHNlY3Rpb24gdGl0bGU9IlByaXZhY3kgY29uc2lkZXJh
dGlvbnMiPgorCQkJCTx0PiBXaGVuIHJlY2lwaWVudHMgcmVwb3J0IHJlY2VpdmVkIG1lc3Nh
Z2VzIGFzIHNwYW0sIHRoZXkgZGVueQorCQkJCWFueSBpbnZvbHZlbWVudCB3aXRoIHdob2V2
ZXIgbWF5IHR1cm4gb3V0IHRvIGJlIHJlc3BvbnNpYmxlIG9mCisJCQkJYXV0aG9yaW5nIG9y
IGZvcndhcmRpbmcgdGhhdCBtYWlsLiAgVXNlcnMgc3VibWl0IHRoYXQgc3BhbSB0bworCQkJ
CXRoZSBjb21tdW5pdHkgYXQgbGFyZ2UgaW4gdGhlIGhvcGUgdGhhdCBhIGNvcnJlY3RpdmUg
YWN0aW9uIG1heQorCQkJCWJlIHRha2VuLiAgSW4gdGhhdCByZXNwZWN0LCB0aGUgb25seSBw
cml2YWN5IGlzc3VlIGlzIHRvIGF2b2lkIHRvCisJCQkJZnVydGhlciBkaXZ1bGdlIHRoZSBl
bWFpbCBhZGRyZXNzZXMgb2YgcmVwb3J0aW5nIHVzZXJzLCBvciBsZXQKKwkJCQl0aGVtIGJl
IHByb2ZpbGVkLiAgU3VpdGFibHkgcmVkYWN0ZWQgZW1haWwgYWRkcmVzc2VzIGFyZSBhbgor
CQkJCWFjY2VwdGFibGUgcmVtZWR5LiAgUmVzcG9uc2libGUgc2VuZGVycyBhcmUgYWR2aXNl
ZCB0byBpbmNsdWRlCisJCQkJb3BhcXVlIHRva2VucyBhcyBuZWNlc3NhcnksIGluIG9yZGVy
IHRvIHJlY29uc3RydWN0IG5lZWRlZCBkYXRhLjwvdD4KKwkJCQk8dD4gSG93ZXZlciwgdXNl
cnMgbWF5IGFsc28gZXJyLiAgVW53YW50ZWQgc21lYXIgbWF5IHJlc3VsdCBpbgorCQkJCWNh
c2UgYSBtZXNzYWdlIGNvbnRhaW5pbmcgY29uZmlkZW50aWFsIGRhdGEgaXMgZXJyb25lb3Vz
bHkKKwkJCQlyZXBvcnRlZCBhcyBzcGFtLiAgQXV0aGVudGljYXRpb24gYW5kIHBvbGljaWVz
IGFyZSBjb25jZXJuZWQgd2l0aAorCQkJCWF2b2lkaW5nIHN1Y2ggY2lyY3Vtc3RhbmNlcy4g
IFJlY2lwaWVudHMgb2Ygc3BlY2lhbCBhZGRyZXNzZXMKKwkJCQlhdCBhbiBBRE1EIHRoYXQg
aGFuZGxlZCBhIGdpdmVuIG1lc3NhZ2UgY291bGQgaGF2ZSBpbnRlcmNlcHRlZCB0aGUKKwkJ
CQltZXNzYWdlIHdoZW4gdGhleSBzaWduZWQgb3IgcmVsYXllZCBpdCwgaWYgdGhleSB3YW50
ZWQgdG8sCisJCQkJdGhlcmVmb3JlIGl0IGlzIGxlc3Mgb2YgYSBjb25jZXJuIHRvIGZvcndh
cmQgYWJ1c2UgcmVwb3J0cyB0aGVyZS48L3Q+CisJCQkJPHQ+IENvbnRhY3QgYWRkcmVzc2Vz
IGZvciBhIGdpdmVuIGRvbWFpbiBuYW1lIHNob3VsZCBiZWFyIHN1Y2gKKwkJCQluYW1lIGFz
IHRoZWlyIGRvbWFpbiBwYXJ0cy4gIEdlbmVyYXRvcnMgbWF5IHRyZWF0IG5vbi1jb25mb3Jt
aW5nCisJCQkJYWRkcmVzc2VzIHdpdGggZ3JlYXQgc3VzcGljaW9uLCBwb3NzaWJseSBhdm9p
ZGluZyB0byByZWxheSB0byB0aGVtLgorCQkJCTwvdD4KKwkJCTwvc2VjdGlvbj4KIAkJPC9z
ZWN0aW9uPgogCiAJCTxzZWN0aW9uIGFuY2hvcj0iQWNrbm93bGVkZ2VtZW50cyIgdGl0bGU9
IkFja25vd2xlZGdlbWVudHMiPgpAQCAtNTI0LDggKzU3NSw3NCBAQAogCQkJCTwvZnJvbnQ+
CiAJCQkJPHNlcmllc0luZm8gbmFtZT0iUkZDIiB2YWx1ZT0iMTAzNSIvPgogCQkJPC9yZWZl
cmVuY2U+Ci0JCTwvcmVmZXJlbmNlcz4KIAorCQkJPHJlZmVyZW5jZSBhbmNob3I9J0FVVEgt
TUVUSE9EUyc+CisKKwkJCTxmcm9udD4KKwkJCTx0aXRsZT5NZXNzYWdlIEhlYWRlciBGaWVs
ZCBmb3IgSW5kaWNhdGluZyBNZXNzYWdlIEF1dGhlbnRpY2F0aW9uIFN0YXR1czwvdGl0bGU+
CisJCQk8YXV0aG9yIGluaXRpYWxzPSdNLicgc3VybmFtZT0nS3VjaGVyYXd5JyBmdWxsbmFt
ZT0nTS4gS3VjaGVyYXd5Jz4KKwkJCTxvcmdhbml6YXRpb24gLz48L2F1dGhvcj4KKwkJCTxk
YXRlIHllYXI9JzIwMDknIG1vbnRoPSdBcHJpbCcgLz4KKwkJCTxhYnN0cmFjdD4KKwkJCTx0
PlRoaXMgbWVtbyBkZWZpbmVzIGEgbmV3IGhlYWRlciBmaWVsZCBmb3IgdXNlIHdpdGggZWxl
Y3Ryb25pYyBtYWlsIG1lc3NhZ2VzIHRvIGluZGljYXRlIHRoZSByZXN1bHRzIG9mIG1lc3Nh
Z2UgYXV0aGVudGljYXRpb24gZWZmb3J0cy4gIEFueSByZWNlaXZlci1zaWRlIHNvZnR3YXJl
LCBzdWNoIGFzIG1haWwgZmlsdGVycyBvciBNYWlsIFVzZXIgQWdlbnRzIChNVUFzKSwgbWF5
IHVzZSB0aGlzIG1lc3NhZ2UgaGVhZGVyIGZpZWxkIHRvIHJlbGF5IHRoYXQgaW5mb3JtYXRp
b24gaW4gYSBjb252ZW5pZW50IHdheSB0byB1c2VycyBvciB0byBtYWtlIHNvcnRpbmcgYW5k
IGZpbHRlcmluZyBkZWNpc2lvbnMuIFtTVEFOREFSRFMgVFJBQ0tdPC90PjwvYWJzdHJhY3Q+
PC9mcm9udD4KKworCQkJPHNlcmllc0luZm8gbmFtZT0nUkZDJyB2YWx1ZT0nNTQ1MScgLz4K
KwkJCTxmb3JtYXQgdHlwZT0nVFhUJyBvY3RldHM9Jzk3NDA0JyB0YXJnZXQ9J2h0dHA6Ly93
d3cucmZjLWVkaXRvci5vcmcvcmZjL3JmYzU0NTEudHh0JyAvPgorCQkJPC9yZWZlcmVuY2U+
CisKKworCQkJPHJlZmVyZW5jZSBhbmNob3I9J01BSUxCT1gtTkFNRVMnPgorCisJCQk8ZnJv
bnQ+CisJCQk8dGl0bGUgYWJicmV2PSdNYWlsYm94IE5hbWVzJz5NQUlMQk9YIE5BTUVTIEZP
UiBDT01NT04gU0VSVklDRVMsIFJPTEVTIEFORCBGVU5DVElPTlM8L3RpdGxlPgorCQkJPGF1
dGhvciBpbml0aWFscz0nRC4nIHN1cm5hbWU9J0Nyb2NrZXInIGZ1bGxuYW1lPSdEYXZlIENy
b2NrZXInPgorCQkJPG9yZ2FuaXphdGlvbj5JbnRlcm5ldCBNYWlsIENvbnNvcnRpdW08L29y
Z2FuaXphdGlvbj4KKwkJCTxhZGRyZXNzPgorCQkJPHBvc3RhbD4KKwkJCTxzdHJlZXQ+MTI3
IFNlZ3JlIEF2ZS48L3N0cmVldD4KKwkJCTxzdHJlZXQ+U2FudGEgQ3J1ejwvc3RyZWV0Pgor
CQkJPGNvdW50cnk+Q0E8L2NvdW50cnk+PC9wb3N0YWw+CisJCQk8cGhvbmU+KzEgNDA4IDI0
NiA4MjUzPC9waG9uZT4KKwkJCTxlbWFpbD5kY3JvY2tlckBpbWMub3JnPC9lbWFpbD48L2Fk
ZHJlc3M+PC9hdXRob3I+CisJCQk8ZGF0ZSB5ZWFyPScxOTk3JyBtb250aD0nTWF5JyAvPgor
CQkJPGFyZWE+QXBwbGljYXRpb25zPC9hcmVhPgorCQkJPGtleXdvcmQ+bWFpbDwva2V5d29y
ZD4KKwkJCTxhYnN0cmFjdD4KKwkJCTx0PgorCQkJICAgVGhpcyBzcGVjaWZpY2F0aW9uIGVu
dW1lcmF0ZXMgYW5kIGRlc2NyaWJlcyBJbnRlcm5ldCBtYWlsIGFkZHJlc3NlcworCQkJICAg
KG1haWxib3ggbmFtZSBAIGhvc3QgcmVmZXJlbmNlKSB0byBiZSB1c2VkIHdoZW4gY29udGFj
dGluZyBwZXJzb25uZWwKKwkJCSAgIGF0IGFuIG9yZ2FuaXphdGlvbi4gIE1haWxib3ggbmFt
ZXMgYXJlIHByb3ZpZGVkIGZvciBib3RoIG9wZXJhdGlvbnMKKwkJCSAgIGFuZCBidXNpbmVz
cyBmdW5jdGlvbnMuICBBZGRpdGlvbmFsIG1haWxib3ggbmFtZXMgYW5kIGFsaWFzZXMgYXJl
IG5vdAorCQkJICAgcHJvaGliaXRlZCwgYnV0IG9yZ2FuaXphdGlvbnMgd2hpY2ggc3VwcG9y
dCBlbWFpbCBleGNoYW5nZXMgd2l0aCB0aGUKKwkJCSAgIEludGVybmV0IGFyZSBlbmNvdXJh
Z2VkIHRvIHN1cHBvcnQgQVQgTEVBU1QgZWFjaCBtYWlsYm94IG5hbWUgZm9yCisJCQkgICB3
aGljaCB0aGUgYXNzb2NpYXRlZCBmdW5jdGlvbiBleGlzdHMgd2l0aGluIHRoZSBvcmdhbml6
YXRpb24uCisJCQk8L3Q+PC9hYnN0cmFjdD48L2Zyb250PgorCisJCQk8c2VyaWVzSW5mbyBu
YW1lPSdSRkMnIHZhbHVlPScyMTQyJyAvPgorCQkJPGZvcm1hdCB0eXBlPSdUWFQnIG9jdGV0
cz0nMTIxOTUnIHRhcmdldD0naHR0cDovL3d3dy5yZmMtZWRpdG9yLm9yZy9yZmMvcmZjMjE0
Mi50eHQnIC8+CisJCQk8Zm9ybWF0IHR5cGU9J0hUTUwnIG9jdGV0cz0nMjkwMTInIHRhcmdl
dD0naHR0cDovL3htbC5yZXNvdXJjZS5vcmcvcHVibGljL3JmYy9odG1sL3JmYzIxNDIuaHRt
bCcgLz4KKwkJCTxmb3JtYXQgdHlwZT0nWE1MJyBvY3RldHM9JzE2NzEyJyB0YXJnZXQ9J2h0
dHA6Ly94bWwucmVzb3VyY2Uub3JnL3B1YmxpYy9yZmMveG1sL3JmYzIxNDIueG1sJyAvPgor
CQkJPC9yZWZlcmVuY2U+CisKKworCisJCQk8cmVmZXJlbmNlIGFuY2hvcj0nU1BGJz4KKwor
CQkJPGZyb250PgorCQkJPHRpdGxlPlNlbmRlciBQb2xpY3kgRnJhbWV3b3JrIChTUEYpIGZv
ciBBdXRob3JpemluZyBVc2Ugb2YgRG9tYWlucyBpbiBFLU1haWwsIFZlcnNpb24gMTwvdGl0
bGU+CisJCQk8YXV0aG9yIGluaXRpYWxzPSdNLicgc3VybmFtZT0nV29uZycgZnVsbG5hbWU9
J00uIFdvbmcnPgorCQkJPG9yZ2FuaXphdGlvbiAvPjwvYXV0aG9yPgorCQkJPGF1dGhvciBp
bml0aWFscz0nVy4nIHN1cm5hbWU9J1NjaGxpdHQnIGZ1bGxuYW1lPSdXLiBTY2hsaXR0Jz4K
KwkJCTxvcmdhbml6YXRpb24gLz48L2F1dGhvcj4KKwkJCTxkYXRlIHllYXI9JzIwMDYnIG1v
bnRoPSdBcHJpbCcgLz4KKwkJCTxhYnN0cmFjdD4KKwkJCTx0PkUtbWFpbCBvbiB0aGUgSW50
ZXJuZXQgY2FuIGJlIGZvcmdlZCBpbiBhIG51bWJlciBvZiB3YXlzLiAgSW4gcGFydGljdWxh
ciwgZXhpc3RpbmcgcHJvdG9jb2xzIHBsYWNlIG5vIHJlc3RyaWN0aW9uIG9uIHdoYXQgYSBz
ZW5kaW5nIGhvc3QgY2FuIHVzZSBhcyB0aGUgcmV2ZXJzZS1wYXRoIG9mIGEgbWVzc2FnZSBv
ciB0aGUgZG9tYWluIGdpdmVuIG9uIHRoZSBTTVRQIEhFTE8vRUhMTyBjb21tYW5kcy4gIFRo
aXMgZG9jdW1lbnQgZGVzY3JpYmVzIHZlcnNpb24gMSBvZiB0aGUgZW5kZXIgUG9saWN5IEZy
YW1ld29yayAoU1BGKSBwcm90b2NvbCwgd2hlcmVieSBhIGRvbWFpbiBtYXkgZXhwbGljaXRs
eSBhdXRob3JpemUgdGhlIGhvc3RzIHRoYXQgYXJlIGFsbG93ZWQgdG8gdXNlIGl0cyBkb21h
aW4gbmFtZSwgYW5kIGEgcmVjZWl2aW5nIGhvc3QgbWF5IGNoZWNrIHN1Y2ggYXV0aG9yaXph
dGlvbi4gIFRoaXMgbWVtbyBkZWZpbmVzIGFuIEV4cGVyaW1lbnRhbCBQcm90b2NvbCBmb3Ig
dGhlIEludGVybmV0IGNvbW11bml0eS48L3Q+PC9hYnN0cmFjdD48L2Zyb250PgorCisJCQk8
c2VyaWVzSW5mbyBuYW1lPSdSRkMnIHZhbHVlPSc0NDA4JyAvPgorCQkJPGZvcm1hdCB0eXBl
PSdUWFQnIG9jdGV0cz0nMTA1MDA5JyB0YXJnZXQ9J2h0dHA6Ly93d3cucmZjLWVkaXRvci5v
cmcvcmZjL3JmYzQ0MDgudHh0JyAvPgorCQkJPC9yZWZlcmVuY2U+CisKKwkJPC9yZWZlcmVu
Y2VzPgogCQk8cmVmZXJlbmNlcyB0aXRsZT0iSW5mb3JtYXRpdmUgUmVmZXJlbmNlcyI+CiAK
IAkJCTxyZWZlcmVuY2UgYW5jaG9yPSJBU1JHLUFCVVNFIj4K
--=_north-18297-1277550343-0001-2--

From shmuel+gen@patriot.net  Sat Jun 26 18:19:47 2010
Return-Path: <shmuel+gen@patriot.net>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 128ED3A6942 for <marf@core3.amsl.com>; Sat, 26 Jun 2010 18:19:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.001
X-Spam-Level: 
X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9WM+2EhAgxcF for <marf@core3.amsl.com>; Sat, 26 Jun 2010 18:19:46 -0700 (PDT)
Received: from smtp.patriot.net (smtp.patriot.net [209.249.176.77]) by core3.amsl.com (Postfix) with ESMTP id 1B6CE3A68BC for <marf@ietf.org>; Sat, 26 Jun 2010 18:19:45 -0700 (PDT)
Received: from ECS35455305 (unknown [208.103.155.20]) (Authenticated sender: shmuel@patriot.net) by smtp.patriot.net (Postfix) with ESMTP id 07CFCF5808C for <marf@ietf.org>; Sat, 26 Jun 2010 21:16:12 -0400 (EDT)
From: Shmuel (Seymour J.) Metz <shmuel+mail-abuse-feedback-report@patriot.net>
Date: Sat, 26 Jun 2010 21:21:44 -0400
To: marf@ietf.org
In-Reply-To: <4C24149A.2090106@mail-abuse.org>
Mail-Copies-To: nobody
Mail-Followup-To: Message Abuse Report Format working group <MARF@IETF.ORG>
Organization: Atid/2
X-CompuServe-Customer: Yes
X-Coriate: NCAE@NewAmerica.org
X-Coriate: Mark Griffith <markgriffith@rocketmail.com>
X-Punge: Micro$oft
X-Terminate: SPA(GIS)
X-Treme: C&C,DWS
X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v3.00.11.18 BETA/60 
Message-Id: <20100627011613.07CFCF5808C@smtp.patriot.net>
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Message Abuse Report Format working group <MARF@IETF.ORG>
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Jun 2010 01:19:47 -0000

In <4C24149A.2090106@mail-abuse.org>, on 06/24/2010
   at 07:29 PM, Douglas Otis <dotis@mail-abuse.org> said:

>This srv mail approach seems like a natural place to make these 
>extensions, which allows a way to prioritize a set of preferences.

AOL.

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)


From daniel.subs@internode.on.net  Sun Jun 27 00:45:01 2010
Return-Path: <daniel.subs@internode.on.net>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D3DA3A684F for <marf@core3.amsl.com>; Sun, 27 Jun 2010 00:45:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.092
X-Spam-Level: 
X-Spam-Status: No, score=-2.092 tagged_above=-999 required=5 tests=[AWL=-1.907, BAYES_40=-0.185]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mh-KVDWCyIkb for <marf@core3.amsl.com>; Sun, 27 Jun 2010 00:45:00 -0700 (PDT)
Received: from mail.internode.on.net (bld-mail14.adl6.internode.on.net [150.101.137.99]) by core3.amsl.com (Postfix) with ESMTP id CCA9E3A684A for <marf@ietf.org>; Sun, 27 Jun 2010 00:44:59 -0700 (PDT)
Received: from passivegrunt.localnet (unverified [121.45.222.22])  by mail.internode.on.net (SurgeMail 3.8f2) with ESMTP id 29678660-1927428 for multiple; Sun, 27 Jun 2010 17:15:04 +0930 (CST)
From: Daniel Black <daniel.subs@internode.on.net>
To: marf@ietf.org, "Murray S. Kucherawy" <msk@cloudmark.com>
Date: Sun, 27 Jun 2010 17:44:10 +1000
User-Agent: KMail/1.13.3 (Linux/2.6.32-gentoo-r6; KDE/4.4.4; x86_64; ; )
References: <20100421183005.A06203A6CF7@core3.amsl.com>
In-Reply-To: <20100421183005.A06203A6CF7@core3.amsl.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Message-Id: <201006271744.11066.daniel.subs@internode.on.net>
Subject: Re: [marf] I-D Action:draft-ietf-marf-dkim-reporting-00.txt review
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 27 Jun 2010 07:45:01 -0000

late review:

First complements on a good draft that builds on the foundations of ARF to 
keep domain owners aware of failures related to DKIM/ADSP failures with 
respect to their administrative domain.

I see a small scope for enhancement of this draft to provide third party 
signatures with feedback if the message gets rejected at the end. After all, 
what's the point of sending something through knowing its going to be 
rejected?

More specifically, I see an application with mailing list managers (MLMs). MLM 
would attach a DKIM signature in such a way that hopefully recipients would be 
able to decisions to accept the third party signature added. In the same way 
that MLM use bounce messages to realise that some list subscribers have moved 
on or otherwise have disfunctional mailboxes, this dkim reporting mechanism 
could enable MLM to receive feedback that the efforts to deliver to a 
subscriber message aren't successful. This feedback loop should be used when 
the MLM signature is intact however the recipient decides to reject/discard 
the message due to ADSP or another DKIM signature failure.

Specific changes to facilitate this are:

Introduction

"domain owner" -> "domain owner or intermediary"

typo introduction - publicatons -> publications

3.
1st paragraph

"domain owner" -> "domain owner or intermediary"

in the r= paragraph:

"or (b)......" -> "(b)......, or (c) the message was rejected because of a 
DKIM signature or ADSP failure not associated with this signature."

key-ro-type  paragraph: append - / "i"

4 Optional Key Reporting Address for DKIM-ADSP
I'm assuming ri is an interval measured in number of messages rather than a 
time based (number of hours, days, weeks) interval?

5.1.  Requested Reports for DKIM Failures

append:

"i  Reports are requested if this message was rejected for a DKIM or ADSP 
failure reasons not related to this signature"

7.3 DKIM Failure Types

I'm assuming revoked is implicitly DNS key not found in DNS?

Should there be others like 'integrity:  The key referenced by the signature 
on the message could failed integrity checks during retrieval (e.g. DNSSEC 
failure).

What about other more traditional server failure DNS errors?

Is this workable/useful?

Daniel

From barryleiba.mailing.lists@gmail.com  Mon Jun 28 15:07:27 2010
Return-Path: <barryleiba.mailing.lists@gmail.com>
X-Original-To: marf@core3.amsl.com
Delivered-To: marf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 43CD33A6A8D for <marf@core3.amsl.com>; Mon, 28 Jun 2010 15:07:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.203
X-Spam-Level: 
X-Spam-Status: No, score=-2.203 tagged_above=-999 required=5 tests=[AWL=0.396,  BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z3hOrcSrc4eK for <marf@core3.amsl.com>; Mon, 28 Jun 2010 15:07:26 -0700 (PDT)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 3CBE73A67CC for <MARF@ietf.org>; Mon, 28 Jun 2010 15:07:23 -0700 (PDT)
Received: by fxm1 with SMTP id 1so980802fxm.31 for <MARF@ietf.org>; Mon, 28 Jun 2010 15:07:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:reply-to :in-reply-to:references:date:message-id:subject:from:to:content-type :content-transfer-encoding; bh=xVmBfKCum1kawIvcBDsrAI0yr+Pwi6vYgtsHzoMAvfA=; b=lR7+dgJGJG/X0rXHrkSjpCrorFVJA1yUH40zTb9TK6X3RX4w6jsz91VPqhFxbDTiJf 5knbOflxCBokbW8gRpDI0rdI+Sjfk6A1n5fm1iQdoS7BS0z9bq40fERh40kXkP/yiPmS xjVXDR+tlWMkL/74KTrR2qmxJx6GM0RZgEvyk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:in-reply-to:references:date:message-id :subject:from:to:content-type:content-transfer-encoding; b=uhK1k44807yyaAFK43agxYBxafLUQ/4sY+Zfev6O2CMCeOKu1ihwSq5/IXWqMgto2y 7kGoiJ9HIPOkaG25GA6ThfYdXNIp8eGVrBZiEufzEhcNAUdNppdbWmPdXUC0rTJ6AqE/ xGX/rpz01c1Z5+fN8c+xo1gVfNDyTtFDFXX88=
MIME-Version: 1.0
Received: by 10.102.207.1 with SMTP id e1mr1487980mug.122.1277762850095; Mon,  28 Jun 2010 15:07:30 -0700 (PDT)
Received: by 10.103.24.7 with HTTP; Mon, 28 Jun 2010 15:07:30 -0700 (PDT)
In-Reply-To: <20100627011613.07CFCF5808C@smtp.patriot.net>
References: <4C24149A.2090106@mail-abuse.org> <20100627011613.07CFCF5808C@smtp.patriot.net>
Date: Mon, 28 Jun 2010 18:07:30 -0400
Message-ID: <AANLkTik9mAuYg7JcMy7CH4A6fpYaqk1p4ropKRVh3ymY@mail.gmail.com>
From: Barry Leiba <barryleiba.mailing.lists@gmail.com>
To: shmuel+mail-abuse-feedback-report@patriot.net,  Message Abuse Report Format working group <MARF@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [marf] Poll: Importing draft-jdfalk-marf-reporting-discovery
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: barryleiba@computer.org
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Jun 2010 22:07:27 -0000

> AOL.
>
> --
> =A0 =A0 Shmuel (Seymour J.) Metz, SysProg and JOAT

Shmuel, is that a vote for, or against adoption of the subject document?

Barry, as MARF chair