Re: [Rucus] comments on draft-niccolini-sipping-spam-feedback-00

Hannes Tschofenig <Hannes.Tschofenig@gmx.net> Tue, 26 February 2008 08:16 UTC

Return-Path: <rucus-bounces@ietf.org>
X-Original-To: ietfarch-rucus-archive@core3.amsl.com
Delivered-To: ietfarch-rucus-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD38D3A6CA8; Tue, 26 Feb 2008 00:16:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.557
X-Spam-Level:
X-Spam-Status: No, score=-0.557 tagged_above=-999 required=5 tests=[AWL=-0.120, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ypYX1RBmoZ69; Tue, 26 Feb 2008 00:16:30 -0800 (PST)
Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE7F63A6C39; Tue, 26 Feb 2008 00:16:30 -0800 (PST)
X-Original-To: rucus@core3.amsl.com
Delivered-To: rucus@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4ADFC3A683D for <rucus@core3.amsl.com>; Tue, 26 Feb 2008 00:16:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0IFVlun8Gdeo for <rucus@core3.amsl.com>; Tue, 26 Feb 2008 00:16:15 -0800 (PST)
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by core3.amsl.com (Postfix) with SMTP id 15C423A6BF2 for <rucus@ietf.org>; Tue, 26 Feb 2008 00:16:14 -0800 (PST)
Received: (qmail invoked by alias); 26 Feb 2008 08:16:08 -0000
Received: from proxy1-nsn.nsn-inter.net (EHLO [217.115.75.229]) [217.115.75.229] by mail.gmx.net (mp028) with SMTP; 26 Feb 2008 09:16:08 +0100
X-Authenticated: #29516787
X-Provags-ID: V01U2FsdGVkX18F2WZNR2cFMTCwjKVyIQmoVZ2KFafNAuZgOb6gem MjKzLbbxoaRvmN
Message-ID: <47C3CAC4.6030604@gmx.net>
Date: Tue, 26 Feb 2008 10:16:04 +0200
From: Hannes Tschofenig <Hannes.Tschofenig@gmx.net>
User-Agent: Thunderbird 2.0.0.12 (Windows/20080213)
MIME-Version: 1.0
To: Jonathan Rosenberg <jdrosen@cisco.com>
References: <47C382AF.7060109@cisco.com>
In-Reply-To: <47C382AF.7060109@cisco.com>
X-Y-GMX-Trusted: 0
Cc: rucus@ietf.org
Subject: Re: [Rucus] comments on draft-niccolini-sipping-spam-feedback-00
X-BeenThere: rucus@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Hannes.Tschofenig@gmx.net
List-Id: <rucus.ietf.org>
List-Unsubscribe: <http://www.ietf.org/mailman/listinfo/rucus>, <mailto:rucus-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/rucus>
List-Post: <mailto:rucus@ietf.org>
List-Help: <mailto:rucus-request@ietf.org?subject=help>
List-Subscribe: <http://www.ietf.org/mailman/listinfo/rucus>, <mailto:rucus-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: rucus-bounces@ietf.org
Errors-To: rucus-bounces@ietf.org

Hi Jonathan,

thanks for your feedback.

You are right that this mechanism does not make a lot of sense if you 
consider an architecture that uses authorization policies and whitelists 
in particular.
It makes some sense when you consider these statistical learning 
techniques that require "good" and "bad" examples to learn.

This is obviously a -00 draft and I believe we should end up with this 
work is more something along the lines of Peter's work

http://www.xmpp.org/extensions/inbox/error-abuse.html
where there is communication between proxies rather than between the end host and the proxy. 

Ciao
Hannes



Jonathan Rosenberg wrote:
> Thanks for writing this, its a good topic to discuss.
>
> One thing that wasn't clear; what is the benefit of signaling something 
> as spam to my proxy, as opposed to just putting the sender on a black 
> list. We have mechanisms defined already for that, for example. I 
> suspect its around sharing of the spam classification with other users 
> in the domain. Its worth discussing this.
>
> Seems easier if you just send the entire sip message as content rather 
> than picking apart pieces of it.
>
> The mechanism is clearly intended to be between a UA and a proxy in its 
> own domain; however I didn't find that stated till much deeper in the 
> document. This should be clear up front.
>
> In terms of specific protocols, I think SUB/NOT is a very poor choice. 
> The proxy will require a subscription to EVERY UA, and the events will 
> be infrequent. This means a lot of overhead for little data. I think you 
> are much better off with an asynchronous push, either PUBLISH or even 
> non-sip. Maybe a REST interface or something.
>
> Thanks,
> Jonathan R.
>
>
>   

_______________________________________________
Rucus mailing list
Rucus@ietf.org
http://www.ietf.org/mailman/listinfo/rucus