Subject: Ticket status, USEPRO

From: Harald Alvestrand <[email-masked]>
Date: Tue, 16 Jan 2007 21:03:08 +0100

I have now filed tickets for all the issues raised with ISSUE: in their 
subject lines, except for "ISSUE: Injecting agents and From", which I do 
not see any reason to pursue. I'll file it if anyone but Charles wants 
to argue that a change is needed based on what Charles wrote.

The following tickets are open:

#1083: USEPRO 5.3: Rules for generating message-ID
#1093: USEPRO 2.3: Supported email addresses
   This has a recorded consensus not to say MUST or SHOULD in USEPRO 
about the addresses news@, usenet@ and abuse@.
   -07 seems to mention none of them.
   Unless new technical information comes to light, I'll close it.
#1412: USEPRO 5.3: Cancel newsgroups: Matching
#1413: USEPRO 5.5: ihave/sendme syntax
#1414: USEPRO 3.2.1: delimiter for multiple Path identities
#1415: USEPRO 3.2.1: Number of path entries per site
#1416: USEPRO 3.9: Reinjection and Injection-Date
#1417: USEPRO 3.4: Injecting-agent modification of message-ID
   The 2 people discussing seem to agree that document should say "MUST 
NOT modify a message-ID already present", or
   words to that effect.

When following up, please place the ticket number in the subject line, 
and follow up ONE ticket per message, unless the message proposes that 
two tickets should be merged.

                      Harald

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 17 Jan 2007 11:43:06 +0100

>    Unless new technical information comes to light, I'll close it.

The abuse@ part of this issue is covered by Injection-Info parameter
"mail-complaints-to".  

But the mess of not less than three admin addresses specified in 2142
and s-o-1036, with an "obscure" (= I didn't find it) justification in
2142 based on an obsoleted RFC, has to be cleaned up.

If those Martian implementors install a server to test their software
they're not going to read both 2142 and s-o-1036.  And if they read it
they could decide that two or three role addresses for one admin does
not pass Martian giggle tests.

Please update ticket #1093 to say "specify one and only one default
admin address (updating RFC 2142)".  Obviously this can't be a MUST 
for any <path-identity>, it won't work without MX (or A/AAAA).

Frank

---

From: Harald Alvestrand <[email-masked]>
Date: Wed, 17 Jan 2007 11:55:08 +0100

Just to be sure what you are arguing:

Are you arguing that there should be a single admin address, AND that it 
should be documented in USEPRO?

I can see some people agreeing with the first part, but not agreeing 
with the second, and vice versa.

---

From: Richard Clayton <[email-masked]>
Date: Wed, 17 Jan 2007 11:17:12 +0000

In message <[email-masked]>, Harald Alvestrand
<[email-masked]> writes
>with the second, and vice versa.

Apart from tidiness what is gained by saying that usenet/newsmaster/news
whatever is not to be used ?   Everyone just aliases them all together
anyway -- and you can hardly dish out "usenet@" for some other purpose
because its historical baggage means that it may still get some useful
email from the unreconstructed, and a lot of spam from being on lists.

I'm all for tidiness, but this horse is long out of the stable.

- -- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

---

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 17 Jan 2007 11:42:46 GMT

>to argue that a change is needed based on what Charles wrote.

My request for an issue number or that still stands.

>   Unless new technical information comes to light, I'll close it.

Agreed. The matter of a NOTE referring to the matter and directing you to
USEAGE still remains, however.

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 18 Jan 2007 15:13:12 GMT

>> not pass Martian giggle tests.

Hey! Part of the rules for the Martians was that they had copies of all
the standards track RFCs, and that inlcudes 2142 :-) .
>> for any <path-identity>, it won't work without MX (or A/AAAA).

Then you have to say which one it should be. So you might say generate
news@, but SHOULD still accept usefor@, or maybe vice versa. But you can't
go beyond that because currently there is no preference between them, and
people use whichever they feel like. If one has to choose one, I suppose
it would be whichever one is used in the Injection-Info.

But the real point is that you would also have to specify how to find the
domain to use with it, and RFC 2142 tried to deduce it from the Path in
methods that were muddled and unnecessarily complicated. In earlier drafts
we had wording that some/all of the Path domains had to be "mailable", and
the consensus to which Harald refers was to take that out.

But I remain neutral on whether to reopen this issue (though I still hold
an opinion against having <path-identity>s which do not resolve, at least
to an MX, in the DNS, and that is an issue I will raise at some point, or
we can take it as part of this #1093 if #1093 is to remain open).

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 19 Jan 2007 00:46:57 +0100

Harald Alvestrand wrote:

> Are you arguing that there should be a single admin address, AND that
> it should be documented in USEPRO?

YES and yes.  For the latter I've no clue if a USEAGE BCP can update a
rather old PS 2142.  There's of course also the issue that I'm not sure
when (or if) USEAGE will be published, and if admins would read it.

Frank

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 19 Jan 2007 01:21:42 +0100

> the standards track RFCs, and that inlcudes 2142 :-) .

<evil> So if we find that two addresses in a PS are messy, then I could
try to convince you that it should be fixed on standards track, and not
in a BCP... </evil>

> news@, but SHOULD still accept usefor@, or maybe vice versa.

IMO just news@ is good enough for everybody.  The usenet@ and newsmaster@
could be mentioned (JFTR) in an appendix about differences from s-o-1036.

If an appendix about such differences makes sense - if the implementors
here say that such differences won't affect existing implementations we
don't need an explicit list in USEPRO.

> you can't go beyond that because currently there is no preference between
> them, and people use whichever they feel like.

That's precisely the reason why we should go beyond that.  No MUST, it
is only a useful convention.

> the real point is that you would also have to specify how to find the
> methods that were muddled and unnecessarily complicated.

That's another reason why 2142 has to be updated.  Maybe something in the
direction of "a mailbox news@<path-identity> SHOULD exist for the most
commonly used <path-identity> of a news server".

> In earlier drafts we had wording that some/all of the Path domains had
> to be "mailable"

Yes, but I think that was all far too convoluted.  News admins can figure
out how to arrange news@<path-identity>.  USEPRO doesn't need to specify
details about MX, CNAME, A, AAAA, etc., folks can read RFC 2821 for that.

> I still hold an opinion against having <path-identity>s which do not
> resolve, at least to an MX, in the DNS

A <path-nodot> legacy name has no MX.  And if admins change their setup
using multiple path identities they could use old "dead" FQDNs in a path.

Or they use additional "gbl" FQDNs relevant only in their own LAN (until
ICANN convinces them that they are idiots, but that's not our problem ;-)

> that is an issue I will raise at some point, or we can take it as part
> of this #1093 if #1093 is to remain open).

It's related, but maybe not exactly the same issue (?)

Frank

---

From: Russ Allbery <[email-masked]>
Date: Thu, 18 Jan 2007 16:41:51 -0800

Frank Ellermann <[email-masked]> writes:

> That's another reason why 2142 has to be updated.  Maybe something in
> the direction of "a mailbox news@<path-identity> SHOULD exist for the
> most commonly used <path-identity> of a news server".

I don't think "if you run a Netnews server, you have to be spammable" is
really going to fly in the real world.  It works so wonderfully well for
e-mail, after all.

If individual Netnews networks want to require this, that's another
matter, but there's no requirement that an arbitrary Netnews installation
support e-mail at all.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: "Charles Lindsey" <[email-masked]>
Date: Fri, 19 Jan 2007 19:59:57 GMT

>really going to fly in the real world.  It works so wonderfully well for

Except that "[email-masked]" is not likely to be visibly
plastered all over Usenet and the Web, ready to be scraped by spammers (as
"[email-masked]" might well be).

So if a spammer sends to [email-masked] he must have read RFC
2142, and then looked at all the domains he found in Path headers and in
Injection-Info and so tried putting "news@" in front of them. And that
situation already exists today (RFC 2142 is already out there), but I have
not heard that excessive amounts of spam are currently hitting news@
addresses (indeed, I would expect them to be rather quiet spamwise
compared to more visible addresses, and I don't see how putting "news@"
into USEPRO would change that).

Which is just to point out a flaw in your counter-argument, and not to say
that I necessarily support Frank's attempts to reopen this issue.

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 20 Jan 2007 21:56:57 +0100

Russ Allbery wrote:

>> "a mailbox news@<path-identity> SHOULD exist for the most commonly
>>  used <path-identity> of a news server".
 
> I don't think "if you run a Netnews server, you have to be spammable"
> is really going to fly in the real world.

That's the status quo wrt news@ and usenet@ in RFC 2142, or a variation
of this scheme in s-o-1036.  With "my" catchall vanity domain I get tons
of spam (several thousands daily), and role accounts like postmaster@
don't get much of this flood.

Most spam local parts are based on something that I've actually used,
e.g. bugzilla@ or the RHS of Message-IDs, or wild guesses like "joe",
or pieces of Message-IDs.  Apparently spammers stay to some degree 
away from abuse@, but otherwise they don't care.  I could modify my
script to create a statistics for some days if you're interested in
the bloody details wrt news@ + usenet@ + newsmaster@

How admins with role accounts or similar constructs (info@, nobody@)
solve their spam problem is irrelevant for this WG, it affects all
mail users and all domains with an MX alike.

What's relevant is to pick a single default instead of the two or
three today.  No default at all makes no sense - if somebody is
determined to get no mails they publish no MX, or reject mails to 
undesired local parts, or forward it to /dev/nul.

News admins can't read the admin groups of hundreds of TLHs.  They
need a way to contact them in the case of problems requiring manual
intervention.  Some socipathic admins could decide that existing
abuse@ or Tech-C whois-addresses are good enough for this purpose,
but I don't want a standards track document for sociopaths.

If USEPRO-07 stays worse than s-o-1036 it shouldn't be published.

Frank

---

From: Russ Allbery <[email-masked]>
Date: Sat, 20 Jan 2007 14:20:56 -0800

Charles Lindsey <[email-masked]> writes:

> plastered all over Usenet and the Web, ready to be scraped by spammers
> (as "[email-masked]" might well be).

Right, that's why postmaster so rarely gets spam.

(In case it's not obvious, I'm being extremely sarcastic.)

> Injection-Info and so tried putting "news@" in front of them.

No, they just send mail to news@ every single host that they run across in
any context.  Why bother going to the work of limiting it down?

---

From: Russ Allbery <[email-masked]>
Date: Sat, 20 Jan 2007 14:27:14 -0800

Frank Ellermann <[email-masked]> writes:

> That's the status quo wrt news@ and usenet@ in RFC 2142,

A standard that I feel no particular urge to link to our work.  It can
hang out there and succeed or fail on its own merits.  There's no
compelling need for us to get involved.  If you want to propose a
follow-on to RFC 2412 that addresses flaws in that standard, there's a
whole IETF process to do so and this isn't the working group that would
handle such work.

> or a variation of this scheme in s-o-1036.

Not a standard at all.

Please don't mix the protocol standard for Netnews with a standard for
e-mail addresses.  Those are two separate protocols and there's no need to
link them.

Anyway, this is a pointless conversation; everyone already knows what I
think.  If other folks than Frank and Charles want to chime in, you
probably should; otherwise, I intend to ignore this issue until the WG
chairs discuss resolution.

---

From: Dan Schlitt <[email-masked]>
Date: Sat, 20 Jan 2007 20:03:17 -0500

Judging from the "Unknown Users" list I see in my log files I conclude
that the spammers have a list of likely users that they use. They don't
have any relation to addresses that they find out in the Internet. Some
even look like variations that might be used by some places to avoid
spam to more obvious users.

One mailbox or three, it doesn't seem like something that merits
spending time on. Is it a protocol issue? Does it need to be
standardized? No and no.

/dan

-- 

Dan Schlitt
[email-masked]

---

From: Frank Ellermann <[email-masked]>
Date: Sun, 21 Jan 2007 08:00:24 +0100

> (In case it's not obvious, I'm being extremely sarcastic.)

postmaster@, webmaster@, and abuse@ are among the local parts I consider
as "potentially valid", therefore it won't directly go to a junk folder.

The spam to these addresses is very rare, I don't recall a single case
of postmaster@ in the last 500,000 mails.  For webmaster@ it's not so
good, but a smart harvester could find this address if it follows the
<meta rev="made" href="http://putl.net/xyzzy/mailto/webmaster" /> links
on my pages, and if it also knows the %40 trick.

Frank

---

From: Russ Allbery <[email-masked]>
Date: Sun, 21 Jan 2007 09:27:10 -0800

> on my pages, and if it also knows the %40 trick.

Lucky you.

I'm [email-masked] as well as postmaster at quite a few other
systems here, and I can assure you that from where I'm sitting, you look
like an exception.

---

From: Frank Ellermann <[email-masked]>
Date: Sun, 21 Jan 2007 22:04:24 +0100

> Not a standard at all.

| A draft update to RFC 1036 ( "Son of RFC 1036" ) was released by Henry
| Spencer in June 1994 but this was not further pursued and is now itself
| out of date. Currently a combination of this and RFC 1036 are regarded
| as the de-facto standard.
         ^^^^^^^^^^^^^^^^^
S-o-1036 has the "how stuff works" clear, even if some of its ideas like
See-Also didn't make it.

> e-mail addresses.

count ,mail, all => 138 occurences in 133 lines (of s-o-1036)

Frank

---

From: "Forrest J. Cavalier III" <[email-masked]>
Date: Mon, 22 Jan 2007 08:30:44 -0500

> on my pages, and if it also knows the %40 trick.

Aren't you arguing a logical fallacy: "Good enough for me, so must be good
enough for everyone."?

Today's batch of email:
Checked: 1139 BCC: 250 NewUCE: 520 SpamCatch: 886 RepeatUCE: 395 Disposed: 915

At least 38 of those were to webmaster@.  Which to my knowledge appears
nowhere.  So as far as I know, it wasn't harvested.

Let 2142 pretend what it wants.  We don't need to go along.

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 22 Jan 2007 20:59:34 +0100

Forrest J. Cavalier III wrote:

> Aren't you arguing a logical fallacy: "Good enough for me, so must be
> good enough for everyone."?

No, it's just an observation.  I got the numbers wrong, 3*365*5000 is
more like "not one mail to postmaster@ in 5,000,000", not only 500,000.

> Let 2142 pretend what it wants.  We don't need to go along.

Most likely we're going nowhere, and keep s-o-1036 with its newsmaster@
and usenet@.  S-o-1036 got all "principles of operation" right, so it's
not too bad.

Frank