Re: [marf] Misuse of ARF by spam-friendly ISPs

["Murray S. Kucherawy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Alessandro Vesely
> Sent: Wednesday, August 03, 2011 3:02 AM
> To: [e-mail]
> Subject: Re: [marf] Misuse of ARF by spam-friendly ISPs
> 
> On 03/Aug/11 02:42, J.D. Falk wrote:
> > On Jul 30, 2011, at 9:30 PM, Murray S. Kucherawy wrote:
> >
> >> I wonder if this could be mentioned in the BCP effort we're doing (JD?).
> >
> > I suppose it could be added to the growing list of use cases that
> > draft-jdfalk-marf-as specifically does not address, along with
> > individual user submissions, virus/malware reports, churning monkey
> > butter, et cetera.
> 
> What is the meaning of a list of non-addressed use cases?  Possibly
> suggest that they are not worth being addressed in general?

It's referring to a list of use cases that the ARF was not designed to handle.  There's no intent that I can see to state that those use cases aren't interesting to handle.

The issue is whether it's reasonable for an "abuse@" address to accept only reports that are ARFs.  I would suggest that such is a violation of RFC2142, but it doesn't explicitly state that all formats have to be accepted so I'd probably ultimately lose that argument.

> Hmm...
> that's quite strange, especially considering that everyone likes the
> monkey butter.

That's a new one on me.  What does it mean?

> > Sounds to me like what's actually needed is a BCP on accepting
> > abuse reports from the general public -- maybe a task for the
> > ASRG?
> 
> I agree such a BCP is needed, and I take this chance to propose it
> again.  The ASRG has already done research on this topic, and John
> summarized it in
> 
>   http://wiki.asrg.sp.am/wiki/Adding_a_junk_button_to_MUAs
> 
> That still looks current.  It allows MUAs to report in a variety of
> ways.  For SMTP, it is obviously better to wrap the offending mail in
> an ARF message, but not mandatory.

Just to be precise, I think JD is suggesting a BCP about how one handles received abuse reports, not how they are generated.  The point at issue is that one large service provider has decided only to accept abuse mail if it's an ARF; free-form complaints are no longer accepted.  It's caused quite a bit of trouble, not the least of which being the three co-authors of ARF getting a lot of "I hope you're happy" hate-mail.

> For homogeneity, I'd put this extra BCP in MARF rather than ASRG.
> There are related issues, like manual vs. auto submission, and privacy
> considerations.

I'd be fine with that, but I'd invite the ASRG to comment.

-MSK (as participant)