Subject: [Tools-team] Question about ticket system and spam / cc: created tickets

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 20 Sep 2004 14:49:35 +0200

Hi Barbara,

	During the latest tools-team conference we discussed some
possible suggestions for ways to reduce the number of bad tickets 
created in the ticket system by spam and people cc:ing the ticket
system address by mistake.

One of the possible alternatives was something which I understand
has been mentioned before - to use a challenge-response mechanism
to validate the submitter email address, as a one-time action for
each submitter.

However, how meaningful this would be is strongly dependent on the
ratio between bad tickets created by incoming spam, and bad tickets
created by people inadvertently cc:ing the ticket address when
discussing the subject of a ticket.  Do you have data on this 
ratio?  If so, would it be possible to share those with us?

	Best regards,

		Henrik

_______________________________________________
Tools-team mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-team

---

From: "Barbara B. Fuller" <[email-masked]>
Date: Mon, 20 Sep 2004 11:15:20 -0400

Hi Henrik:

Although we do not maintain statistics, it is safe to say that the majority 
of messages sent to the RT queues are spam in the true sense of the 
word.  In the past three to four weeks, we have had about three instances 
of multiple spurious tickets generated by people copying a queue address in 
a discussion.  In each case the number of tickets was probably less than 
10.  However, we received hundreds of spam messages during the same period.

I hope that this helps...

Regards,

Barbara

P.S. I am copying our technical support staff on this message.  If the 
TOOLS Team wants to propose methods for mitigating spam on Secretariat 
queues, then it would be best to include them in the discussion right from 
the beginning.

P.P.S. I personally do not recall any discussion of using a 
challenge-response mechanism to reduce spam on the ticket system 
queues.  Perhaps someone suggested it on the spam discussion list...a 
technical discussion list to which I don't subscribe.
-------------------------------------------------------------------------
At 02:49 PM 9/20/2004 +0200, Henrik Levkowetz wrote:
>possible suggestions for ways to reduce the number of bad tickets created 
>in the ticket system by spam and people cc:ing the ticket
>discussing the subject of a ticket.  Do you have data on this ratio?  If 
>so, would it be possible to share those with us?
>
>
>         Best regards,
>
>                 Henrik
>

------------------------------------------------
Barbara B. Fuller
Acting Executive Director
Internet Engineering Task Force

Natick, Massachusetts Office:

Phone: +1-508-650-4020
Fax:     +1-508-650-4639

Reston, Virginia Office:

Phone: +1-703-620-9053
Fax:     +1-703-620-9071

---

From: Alex Rousskov <[email-masked]>
Date: Mon, 20 Sep 2004 09:49:53 -0600 (MDT)

On Mon, 20 Sep 2004, Barbara B. Fuller wrote:

> P.S. I am copying our technical support staff on this message.  If 
> the TOOLS Team wants to propose methods for mitigating spam on 
> Secretariat queues, then it would be best to include them in the 
> discussion right from the beginning.

It may also be a good idea to ask IESG (or, at least, Harald and 
Allison) to give us a more coherent signal on whether we should be 
even discussing this. During telechat, Allison wanted us to look into 
this. When I posted initial ideas to the mailing list, Harald said 
that we should not touch this Secretariat project/interface.

Are we proceeding and ignoring Harald? Are we proceeding with a 
solution that Harald did not explicitly oppose?

Henrik, I know that you are going by existing action items. I am just 
confused whether (after Harald's e-mail) we are allowed to recommend 
something here, what is our scope, how much freedom we have in our 
recommendations, and what solutions (if any) we already agreed on.

Thanks,

Alex.

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 20 Sep 2004 17:59:07 +0200

Hi Barbara,

Barbara B. Fuller wrote:
> Hi Henrik:
> 
> Although we do not maintain statistics, it is safe to say that the 
> majority of messages sent to the RT queues are spam in the true sense of 
> the word.  In the past three to four weeks, we have had about three 
> instances of multiple spurious tickets generated by people copying a 
> queue address in a discussion.  In each case the number of tickets was 
> probably less than 10.  However, we received hundreds of spam messages 
> during the same period.
> 

Yes, that is very clear, thanks :-)

To me it indicates that putting a challenge response system such as e.g.
TMDA (http://tmda.net/) in front of the ticket system would give good
benefits.  Any ticket submitter not already known by the system would get
an email asking for confirmation of the submission, on the first submission
only, and after responding to that - on subsequent submissions - the emails
would go straight through.

The alternative above would not work particularly well if a major number
of undesired tickets were from cc: mails from people also known by the 
challenge response system.  In that case, a proposal from Alex of 
requiring a special tag line as the first line of the email would 
be more effective.  That solution would however be dependent on people
remembering to put in the tag line, and getting it correct.
( Alex' mail on the subject: 
http://www1.ietf.org/mail-archive/web/tools-team/current/msg00171.html )

	Regards,

		Henrik

> queues, then it would be best to include them in the discussion right 
> from the beginning.
> 
>> discussing the subject of a ticket.  Do you have data on this ratio?  
>> If so, would it be possible to share those with us?
>>
>>
>>         Best regards,
>>
>>                 Henrik
>>

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 20 Sep 2004 21:37:39 +0200

Hi Alex,

Alex Rousskov wrote:
> Allison) to give us a more coherent signal on whether we should be even 
> discussing this. During telechat, Allison wanted us to look into this. 
> When I posted initial ideas to the mailing list, Harald said that we 
> should not touch this Secretariat project/interface.
> 
> Are we proceeding and ignoring Harald? Are we proceeding with a solution 
> that Harald did not explicitly oppose?
> 

I understood Harald's message as an indication that the info summary
from Barbara regarding changes to email addresses etc. was for information,
not for action, and we should keep such distinctions clear.

Last conference call we agreed (with Harald on the call) to solicit
information regarding the relative proportions of spam-generated bad
tickets and cc: generated ones; that's Ok I believe.

I may have gone beyond what's been mandated in giving my immediate
response on that information - Barbara, Harald, if you feel I've 
overstepped the boundaries and meddled where I shouldn't, I apologise.

	Henrik

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 20 Sep 2004 22:10:38 +0200

Henrik,

> overstepped the boundaries and meddled where I shouldn't, I apologise.

I think information gathering is a Good Thing - within reason; Barbara 
needs to be able to tell you when you asking questions interferes with the 
work of the secretariat! - but I don't think that's been a problem so far.

The point wrt the list of aliases was that you shouldn't expect that 
Barbara was waiting for any response from you before acting on it.

Go ahead and gather information!

                     Harald

---

From: <[email-masked]>
Date: Mon, 20 Sep 2004 16:14:56 -0400 (EDT)

Hi Henrik and All,

I like the TMDA suggestion, it could be coupled with a seeded
whitelist of all "known" ietf or iesg members.  The tag line approach
is interesting but puts the burden on the user from the beginning and
is less "standard" and maybe a little more work.

We'd have to think a little about the implementation.  It would be
nice to do TMDA/Tag-Line right at the border and right off the top of
my head I am not sure how to implement that.

sb. Scott Blomquist for [email-masked]

   Date: Mon, 20 Sep 2004 17:59:07 +0200
   From: Henrik Levkowetz <[email-masked]>
   Cc: [email-masked], [email-masked],         IETF TOOLS <[email-masked]>

   Hi Barbara,

	   Regards,

		   Henrik

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 21 Sep 2004 12:15:41 +0200

Scott,

in the "example config" that Rob Austein sent to Brett many moons ago, 
there was included an example TMDA setup.
The suggestion at the time was to put this in front of the whole IETF mail 
system, and pre-seed it with all the addresses from all the mailing lists - 
this would give a "single sign-on" to all the IETF mailing lists, ticket 
systems and so on.

But Brett (and others!) was quite nervous about doing such a radical change 
to how IETF mail is accepted, so he decided to do all the other things on 
his list first, and then return to the TMDA issue.

A TMDA in front of the ticket system should have far less potential for 
controversy, I think; not allowing "everyone" to post tickets can't really 
be painted as a free speech issue.

                 Harald

---

From: Alex Rousskov <[email-masked]>
Date: Tue, 21 Sep 2004 10:37:24 -0600 (MDT)

On Mon, 20 Sep 2004 [email-masked] wrote:

> The tag line approach is interesting but puts the burden on the user 
> from the beginning and is less "standard" and maybe a little more 
> work.

IMO, if TMDA is used for the first request only (i.e., all confirmed 
requests result in sender being whitelisted), then tagging approach is 
inferior to TMDA. I assume that is how you are going to use TMDA.

However, if your TMDA implementation requires confirmation of _every_ 
request (for example, to solve the "non-request via CC" problem), then 
tagging puts no more burden on the user and has certain advantages. 
TMDA can be enabled for untagged requests in this case.

Thanks,

Alex.