[Asrg] "Mythical" Global Reputation System

John Leslie <john@jlc.net> Fri, 11 December 2009 14:42 UTC

Return-Path: <john@jlc.net>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 145B83A6AC5 for <asrg@core3.amsl.com>; Fri, 11 Dec 2009 06:42:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.205
X-Spam-Level:
X-Spam-Status: No, score=-6.205 tagged_above=-999 required=5 tests=[AWL=0.394, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9pndC9fEI+pZ for <asrg@core3.amsl.com>; Fri, 11 Dec 2009 06:42:09 -0800 (PST)
Received: from mailhost.jlc.net (mailhost.jlc.net [199.201.159.9]) by core3.amsl.com (Postfix) with ESMTP id 1924F3A69D1 for <asrg@irtf.org>; Fri, 11 Dec 2009 06:42:09 -0800 (PST)
Received: by mailhost.jlc.net (Postfix, from userid 104) id 5110733CD5; Fri, 11 Dec 2009 09:41:49 -0500 (EST)
Date: Fri, 11 Dec 2009 09:41:49 -0500
From: John Leslie <john@jlc.net>
To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
Message-ID: <20091211144149.GF24477@verdi>
References: <20091211011855.13454.qmail@simone.iecc.com> <4B21DE58.6090901@mail-abuse.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <4B21DE58.6090901@mail-abuse.org>
User-Agent: Mutt/1.4.1i
Subject: [Asrg] "Mythical" Global Reputation System
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Dec 2009 14:42:10 -0000

Douglas Otis <dotis@mail-abuse.org> wrote:
> On 12/10/09 5:18 PM, John Levine wrote:
>> 
>> ... if you'd like to set up a reputation system subgroup, that
>> would be fine.
> 
> Rather than a reputation system subgroup, something more along the line 
> of a legitimate senders clearing-house system which establishes 
> postmaster contacts, and tracks repeated feedback from vetted sources. 

   Neither John nor Doug should be surprised I'm still interested in
reputation systems.

   I remain convinced that senders need an established relationship
with vouching services and receivers need an established relationship
with reputation services, and that the interaction between these two
types of services is an area for interesting work.

   Both services individually, IMHO, could be mostly automatic, with
the reputation services receiving spam reports (presumably ARF format)
and notifying the appropriate vouching service when these pass a
threshhold set by the reputation service. (Passing the actual ARF
reports to the vouching services would not necessarily be allowed.)

   We would need to formalize how reputation services discover the
vouching service(s) related to specific senders, and it would help
to formalize how to report a complaint threshhold being passed. In
some cases, there should be sufficient trust between a reputation
service and a vouching service to pass each individual ARF report,
but IMHO this would not be the default case, and would need to be
supported by reporting an action taken.

   I'm not sure about the need to formalize how vouching services
discover the reputation services for particular receivers: I can
imagine cases where receivers would not want that information public,
and it's not obvious how this information would help.

   I do not believe it would be helpful to formalize how vouching
services report abuse allegations to their customers -- postmaster
and abuse emails are already quite useless for the majority of
domains, and IMHO anything we might standardize _will_ become
useless.

   Though I really don't want to formalize a reporting process, I
believe we should think in terms of a SPAM button automatically
sending an ARF report to the configured reputation service for that
receiver, which would discover the appropriate vouching service
and determine a reporting threshhold. When the threshhold is reached,
the reputation service would obfuscate anything it promised its
customers it won't reveal (and perhaps more if it has reason to
mistrust the vouching service), and pass the revised ARF report to
the vouching service. The vouching service would report to its
customer whatever it received (possibly reformatted for "easier"
interpretation by clue-challenged MTA operators) and possibly change
its vouching report to show "incident in progress." We presume that
if the sender proved completely unresponsive, the vouching service
would report "no longer our customer."

   YMMV, of course. Some large senders might want to operate the
vouching service internally, and some large receivers might want to
operate the reputation service internally; but this would tend to
complicate the N by M problem of determining the "reputation" of
vouching services -- that tussle, IMHO, will tend to work itself
out as vouching services fail to attain enough good-reputation
ratings.

--
John Leslie <john@jlc.net>