Subject: [domainrep] A document about reputation data meta-issues

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sun, 23 Oct 2011 13:39:51 -0700

We included in our charter the need to produce an "informational document, discussing issues of data transparency, redress, meta-reputation and other important operational considerations."  This comes from some fairly passionate discussion at the BoF in Quebec City.

Does anyone have some thoughts about this that might be a good starting point for constructing that draft?

-MSK

---

From: SM <[email-masked]>
Date: Sun, 23 Oct 2011 13:55:02 -0700

Hi Murray,
At 13:39 23-10-2011, Murray S. Kucherawy wrote:
>We included in our charter the need to produce an "informational 
>document, discussing issues of data transparency, redress, 
>meta-reputation and other important operational 
>considerations."  This comes from some fairly passionate discussion 
>at the BoF in Quebec City.

The data transparency and redress discussion is going to be highly 
controversial.  Does this have to be done before the technical work?

Regards,
-sm

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 25 Oct 2011 12:16:23 +0200

On 23 October 2011 22:39, Murray S. Kucherawy wrote:

> Does anyone have some thoughts about this that
> might be a good starting point for constructing
> that draft?

I'd be interested to learn why SIQ / DNSBL / VBR
are not good enough for whatever will be created
here.  As neutral as possible, I'm not ready to
get into any flame wars before I know some facts.

-Frank

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 25 Oct 2011 04:26:03 -0700

> -----Original Message-----
> From: Frank Ellermann [mailto:[email-masked]]
> Sent: Tuesday, October 25, 2011 3:16 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [domainrep] A document about reputation data meta-issues

Hi Frank,

> get into any flame wars before I know some facts.

Have you read the drafts that are out already?  I think they answer that question quite readily, but I'm happy to improve them if there's information missing.

And the question posed had nothing to do with specific protocols, but rather they referred to issues that were brought up during the BoF about management of reputation services, use of them, and the potential impacts thereof.  The issues are protocol agnostic.

---

From: Douglas Otis <[email-masked]>
Date: Tue, 25 Oct 2011 14:37:33 -0700

On 10/23/11 1:55 PM, SM wrote:
>> meta-reputation and other important operational considerations."  
>> This comes from some fairly passionate discussion at the BoF in 
>> Quebec City.
>
The greatest concern is ramification of using "purported" identities as 
a basis to establish reputation.   After all, IP address authorization 
or signatures in a message will not "authenticate" the actual domain 
accountable for abuse.

IP address authorization will become disruptive in the face of Large 
Scale NATs and MTAs not offering IPv6 connectivity.  A signature not 
covering intended recipients and the entity actually sending the message 
removes nonrepudiation of purported abuse.  As such, enforcement on that 
basis is unable to withstand scrutiny.

The only entities likely held harmless are those considered "too big to 
block".  These large domains carry a growing percentage of overall 
abuse, and have little incentive to remediate compromised accounts.

Most users have been trained that complaining is useless, and are now 
seeking other often proprietary alternatives.  Disruptions caused by 
purported reputations seems certain to reduce reliance on SMTP.

-Doug

---

From: SM <[email-masked]>
Date: Tue, 25 Oct 2011 15:01:42 -0700

Hi Doug,
At 14:37 25-10-2011, Douglas Otis wrote:
>The greatest concern is ramification of using "purported" identities 
>as a basis to establish reputation.   After all, IP address 
>authorization or signatures in a message will not "authenticate" the 
>actual domain accountable for abuse.

With all due respect, I do not see anything which is directly related 
to "data transparency and redress" in the reply.

If anyone wants to argue about this, I suggest submitting the 
arguments as an I-D.

Regards,
-sm

---

From: Douglas Otis <[email-masked]>
Date: Tue, 25 Oct 2011 15:48:36 -0700

> If anyone wants to argue about this, I suggest submitting the 
SM,

Whenever reputation is misplaced using methods not controlled by the 
"purported" abusing sender,  there is neither transparency nor redress.

There is no transparency with respect to which "message element" formed 
an authorization and whether an apparent outbound MTA acted to constrain 
this element.  In other words, outbound MTAs MUST be considered opaque 
when making assumptions about which "message element" offers authorization.

When an effort to authorize an outbound MTA for the purpose of ensuring 
NDNs is misused to assign accountability, data collected on that basis 
must be considered opaque.  Since a mistaken basis for accrual of 
negative reputation would be well beyond the control of the sender, 
there is also no redress either.

An I-D could be written to clarify the likely outcome of using 
"purported" rather than "authenticated" identifiers.  Is this what you 
meant?

-Doug

---

From: SM <[email-masked]>
Date: Tue, 25 Oct 2011 16:31:15 -0700

Hi Doug,
At 15:48 25-10-2011, Douglas Otis wrote:
>"purported" rather than "authenticated" identifiers.  Is this what you meant?

The topic was about data transparency and redress.  The I-D could be 
about that.

Regards,
-sm

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 26 Oct 2011 00:36:59 -0700

> From: SM [mailto:[email-masked]]
> Sent: Sunday, October 23, 2011 1:55 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]

I think they can be done in parallel.  I don't think those issues affect the technical solution.  And if the working group contains people that care about one but not the other, we might be able to bang out some of that work in parallel.

But I'm not partial to either approach.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 26 Oct 2011 00:40:49 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Douglas Otis
> Sent: Tuesday, October 25, 2011 2:38 PM
> To: [email-masked]

This was brought up at the BoF, and is reasonable potential subject matter for this draft.  But my view is that a reputation provider needs to make it clear to its consumers what data it collects, how it does so, how it processes it to come up with its reputations, and what redress methods it has.  Then the consumers can gauge how safe it is to make use of that data in its decision engines.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 26 Oct 2011 00:41:33 -0700

> From: [email-masked] [mailto:[email-masked]] On Behalf Of SM
> Sent: Tuesday, October 25, 2011 4:31 PM
> To: Douglas Otis
> Cc: [email-masked]

...and other things.  See the BoF minutes.