Re: [Asrg] ARF traffic, was Spam button scenarios

Alessandro Vesely wrote:
> On 09/Feb/10 17:45, Steve Atkins wrote:
> > On Feb 9, 2010, at 8:32 AM, Alessandro Vesely wrote:
> > >  There's a whole theory of other ARF messages that may arrive at a domain's 
> > > abuse@ mailbox. A domain's user, or someone writing to a forwarded address of 
> > > that domain, writes a message that is reported as spam, either correctly or by 
> > > mistake. As part of an FBL or other trust-chain, the message comes back wrapped 
> > > in an ARF report at the apparently originating domain.
> > >
> > >  The mailbox is abuse(_at_)domain in both cases. Although it may seem desirable 
> > > to have different addresses for incoming and outgoing reports, I doubt such 
> > > distinction will ever be effective. Indeed, the forwarded case is ambiguous.
> > If you think that any part of this chain is involving mail sent to abuse@ 
> > anywhere your model of it is a long way from how I understand the situation.
> The abuse-mailbox is an attribute in some whois db (e.g. RIPE). The 
> form abuse(_at_)domain is standardized by rfc 2142. Some people (e.g. 
> Abusix) may plan to send machine generated complaints at such addresses.
And they'll learn very very soon that that doesn't work.

Been there/done that in a limited fashion, and even in that limited 
fashion, it don't work.
Do NOT assume that TiS buttons have anything to do whatsoever with 
RFC2142, standardized role accounts, or whois "abuse-mailbox" entries.
Filter tuning doesn't, nor do FBLs (ARF'd or otherwise).  While abuse@ 
_may_ get derivations of TiS reports via ARF in some specific cases that 
are pre-arranged in advance, in no sense should we encourage such role 
accounts to be target for a raw MUA (or even MTA) stream of complaints.
> I agree that's a possibility. I've proposed abuse(_at_)authserv-id, which 
> may or may not be simpler. I don't think it makes a big difference.
@authserv-id may well be a good idea, but _not_ to "abuse" or any other
pre-existing role account intended, as in the old way, for human 
consumption.
> Yes, but I've used abuse(_at_)tana(_dot_)it for the FBL(s) I've subscribed to. 
> Perhaps if I had a ponderous ARF traffic I'd be better off using a 
> different address. However, that would be more of a nuisance if then 
> I'd have to redirect there other ARF messages that somehow reach the 
> abuse mailbox instead of my dedicated address.
It'd be more than a nuisance if the standard forces a one-size-fits-all 
targetting of all MUA-generated ARFs at abuse(_at_)everywhere(_dot_)
Best to simply not go there.
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg