Re: [marf] Section 1.1 (was: Require body?

["Murray S. Kucherawy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Alessandro Vesely
> Sent: Friday, April 16, 2010 3:53 AM
> To: [e-mail]
> Subject: [marf] Section 1.1 (was: Require body?
> 
> Since the previous section is fairly generic, IMHO this should be more
> specific, e.g. "mail operators", or "mailbox providers and email
> service providers".

+1

> IMHO this may be less specific, so as to broaden the class of
> exemplified uses; e.g. "such as email service providers sending mail
> that causes problems with abuse detection systems."

How about:

                                <t> potential issues with the perceived
                                    quality of outbound mail, such as email
                                    service providers sending mail that
                                    attracts the attention of automated abus
                                    detection systems. </t>

> Do you mean to drop the last paragraph ("Please note [...] and SHOULD
> NOT be used for other reports.")?

Nope, that hasn't been removed.  I just didn't cite it.

> It is still unclear whether this section is meant to also cover future
> extensions. I don't think we want to limit possible uses of ARF.
> However, we may inform about alternative formats for reporting email
> messages: rfc3462 for end users, and the upcoming
> draft-cain-post-inch-phishingextns for network providers. Adding such
> information may identify by exclusion our niche of treatable abuses
> that are neither delivery errors nor manifest attacks.

The abstract says that the format is extensible, and I think that's obvious once one looks down at the IANA stuff.  And ARF is based on RFC3462 (it's a normative reference), so I'm a little confused as to your intent here.  Can you propose some text?

I think the focus is clearly on reporting about objectionable mail and not generic questionable network activity.  That said, we might want to make a reference to the INCH work early on and explain why all the sites that have gone with ARF did so instead of using INCH.  Some text about that (from such an operator on this list) would be really helpful, even if it's a statement that INCH was found to be too hard, or ARF was ready before INCH was, or such.