Re: [marf] WGLC starting for draft-ietf-marf-base-01

["Murray S. Kucherawy" <[e-mail]>]

[as participant]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Alessandro Vesely
> Sent: Friday, April 09, 2010 11:02 AM
> To: [e-mail]
> Subject: Re: [marf] WGLC starting for draft-ietf-marf-base-01
> 
> "Reported-Domain" is unspecified by design. Fine :-( However, it is
> not clear whether it may appear multiple times even if the report
> covers a single incident.

I disagree.  It's clearly in the "Optional Fields Appearing Multiple Times" section.

> As for using "Reported-URI" for the spamvertized mailbox, I just note
> that IODEF's draft-cain-post-inch-phishingextns (now in LC) calls that
> "Collection Site". The phrase "a URI to which the report recipient can
> go for further details", instead, suggests something like
> 
>   http://example.com/arf-generators/XYZ-v1.04b/meaning-of-fields.html

I think I agree that this is somewhat ambiguous.  To those who are using ARF now: How do you use this field?  Is it a URI found in the offending message, or is it a reference URI for further action by the ARF recipient?  If the latter, it is probably mis-named.  If it could be either, I suspect the text should indicate that the provided URI might and might not be taken from the message.

> I propose to replace that phrase with just "See next Section 3.4".
> (Will there be an applicability statement to clarify how meanings may
> be negotiated, eventually?)

Do you have text to propose? :-)

> Section 7.3 still says "MAIL FROM:<>". See the end of
> http://www.ietf.org/mail-archive/web/marf/current/msg00641.html

Ah right.  I'll remove 7.3.

> Should the security section mention that automatically forwarding an
> abuse report to the wrong party may leak sensible information,
> especially if the report had been inadvertently generated by a user?
> (The intro says something about supporting mail clients.)

Isn't that true of any email?

> Should "http://www.mipassoc.org/arf/" in the examples be replaced with
> something with like the first http link above? (Should the spec
> RECOMMEND that the meaning of fields is stated that way?)

As it's just an example, I don't think this is a critical change.  What might be useful would be something in an earlier section RECOMMENDing the leading text/plain section include a reference to a document decoding ARF messages, at least during a rollout period.

> In appendix B2, the Authentication-Results looks bogus. In addition,
> the caption says "Example 3" rather than 2.

Fixed.