Re: [Sipping] comments on draft-wing-sipping-spam-score-00

[Henning Schulzrinne <[e-mail]>]

The mechanism proposed has reasonable precedent in email, with various  
X-Spam-Score style headers inserted by the local mailserver. The  
problem in email is that every spam filter seems to have picked some  
other X- convention or re-use the same header with different formats.  
I don't think that's an experience that we want to repeat.

For example, your message arrived in my inbox with
X-Spam-Score: 	-3 () CU_OK_LISTUNSUB RBL_DNSWL_127.0.9.3


On Dec 4, 2007, at 9:42 AM, Jonathan Rosenberg wrote:

> I think a key part of this is that you need to have a trust  
> relationship with the sender of the score, otherwise its useless. As  
> with any trust relationship, it requires authentication to make sure  
> the guy you are talking to is the one you trust. This typically  
> implies mutual TLS authentication between domains. It also means  
> that you can't have more than one spam score at a time - just the  
> one from the previous hop domain. So how would you authenticate and  
> authorize the sources farther away, as this draft proposes?

Clearly, authentication would work (e.g., in the SIP Connect style),  
but the simpler approach taken today by email also works: The inbound  
proxy deletes all such headers and the UA has a trust relationship  
with its proxy. This does not work if the originating domain computes  
the scores; there, you'd need a trust relationship.

This seems pretty similar to PAI.

The limitations of this approach need to be clearly documented in the  
draft.


>
>
> It seems that, unless there is a standardized range and meaning of  
> values it will be hard to take any action based on this value.

This isn't true today for email spam scores, but it is still useful,  
given that the tests performed by one's inbound proxy tend not to  
change a whole lot over time. Spam Assassin inserts similar tokens  
into inbound email and it is then up to the scripts in the email "UA"  
to decide whether, for example, Chinese characters are a sign of spam  
or not.

Henning



_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [e-mail] for questions on current sip
Use [e-mail] for new developments of core SIP