Subject: Re: Proposed WG charter for "arf" (Abuse Report Format)

From: Eliot Lear <[email-masked]>
Date: Thu, 09 Jul 2009 16:02:44 +0200

Murray,

I think standardizing ARF is a GREAT idea, but I wonder if we need a 
working group to do it.  There's a lot of ARF out there today.  Is there 
something controversial here that requires us to bang our heads together?

Eliot

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 10 Jul 2009 15:44:55 +0200

Murray S. Kucherawy wrote:
> Furthermore, some extensions to the current proposal are 
> of interest to the community, such as the means for an operator to advertise 
> an email address to which abuse reports using ARF should be sent.

Apparently, that snippet considers "generic" reports. It is not 
explicit from the proposal if that email address is going to be 
specified in the same RFC that also standardizes the ARF. Since a 
(possibly different) email address is mentioned in your dkim-reporting 
draft, I understand a generic ARF email address is not what you aim 
for. In facts, there are two obvious arguments against it:

1) When feedback reports are processed by software, it may be 
convenient to have different addresses for different types of report.

2) The primary target for "generic" abuse reports (fraud, spam, virus, 
etcetera) would be the abuse desk of the organization accountable for 
originating the message. A document specifying where the target 
address can be found should also say how to identify such accountable 
originator, which is not a marginal task for a document --or a WG-- 
dedicated to a format specification.

OTOH, there are various possible synergies. For example, some of the 
r/rs/ri/ro/rs tags that describe feedback characteristics could be 
factored out in the ARF document, so as to avoid having to repeat them 
every time. SPF's softfail result might be a good candidate for 
collecting reports about SPF checks. DKIM's key reporting policy might 
require SPF "pass" to avoid collecting reports about extraneous 
transmitters trying to forge signatures. My vhlo draft defines the 
accountable originator mentioned in (2) above. Giving room to these 
synergies may expand the WG goals beyond reporting issues, and add one 
or two "issue/achieve/submit" triplets to its milestones. Would that 
be good or bad?

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 10 Jul 2009 06:58:05 -0700

> Messaging anti-abuse operations between independent services often requires
> 	sending reports on observed fraud, spam virus or other abuse activity.

oops.  subject/verb mismatch.  not sure whether plural or singular is better.

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 9 Jul 2009 09:04:43 -0700

Hi Eliot,

The MAAWG conference in Amsterdam showed that there are a few deployed enhancements not already covered by the current draft, and a few others people are interested in discussing.  I'm also interested in exposing ARF to a wider body of operational scrutiny than what MAAWG tends to have before moving it toward formal publication.  Covering all of this in the context of a working group seems like a good use of resources to me.

The DKIM reporting stuff could really use a home too and it's become tied to ARF in some ways, so this is also a good fit.

So no, not much in the way of controversy, but there's still work to be done and this seems to be a good way to keep the momentum up.

-MSK

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 10 Jul 2009 08:57:17 -0700

Murray S. Kucherawy wrote:
> Hi Eliot,
> 
> The MAAWG conference in Amsterdam showed that there are a few deployed
> enhancements not already covered by the current draft, and a few others
> people are interested in discussing. 

The current draft lists exactly one item from this set.  It would probably help 
to list others.

The goal is to increase the risk of failure...

d/
-- 

   Dave Crocker

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 13 Jul 2009 13:25:12 -0700

Here's a revised charter that lists some specific enhancements that have been proposed by operators already using ARF within MAAWG.  The working group would consider these as enhancements to the current specification.