Subject: [Asrg] An "ideal" false positive (TMGRS take 2)

From: Alessandro Vesely <[email-masked]>
Date: Thu, 28 Jan 2010 19:04:42 +0100

Alice reports as spam a message from Bob, either by mistake or out of 
curiosity. Statistically irrelevant as this fact is, ignoring it will 
convey the impression that TIS buttons represent a somewhat garbled 
functionality. What should happen in an ideal case?

IMHO: The abuse report (AR) is received by Alice's server --the one 
responsible for receiving. This server determines that the message had 
been sent by Bob's server --the one responsible for sending. Assume 
that Alice's server trusts Bob's one, then the former may forward the 
AR to the latter. Bob had authenticated himself for sending that 
message, hence his server can send him a warning that he shouldn't 
have sent spam, with the AR attached. The readable text in the ARF may 
mention the trust chain. In this case, it is Bob who determines that 
this AR is an FP. He may ask for human inspection of the message, 
unless Alice retracts her report. IOW, human inspection of spam is 
only required in case of dispute.

Does this shed some light on the role of an external service? 
Normally, if Alice and Bob have different domains, there is no trust 
relationship between their servers. Therefore, Alice's server should 
route the AR through the trusted external service that vouched for 
Bob's server. No vouch, no FBL.

I think the "external service" /is/ the MGRS. All what it has to know 
is that Bob's server is not a bot nor a spammer, although some users 
there may occasionally fall into temptation. By monitoring all ARs 
concerning a given MTA, it can ascertain whether its postmaster do 
stop local spammers: it can both track individual ESMTPSA senders, and 
determine the spam rate against the number of /good/ VBR DNS lookups. 
The rest is policy (how does an MTA assess new users, how it stops bad 
senders, how it solves disputes) and protocol (how to avoid multiple 
FBLs in case of multiple vouchers, how to track mailing list 
subscriptions, et cetera.)

---

From: Rich Kulawiec <[email-masked]>
Date: Fri, 29 Jan 2010 08:56:07 -0500

On Thu, Jan 28, 2010 at 07:04:42PM +0100, Alessandro Vesely wrote:
> Alice reports as spam a message from Bob, either by mistake or out
> of curiosity. 

But there is no way to know that Alice actually filed the report
or that Bob actually sent the message.

If either Alice's or Bob's system is a zombie, which -- if they're
running Windows -- already has a two-digit percentage probability which
has been monotonically increasing for most of a decade -- then there is
no way for any external observer to distinguish between:

	- Alice pushed the report-as-spam button
	- Malware resident on Alice's system pushed the report-as-spam button

Nor is there any way for any external observer to distinguish between:

	- Bob sent the message
	- Malware resident on Bob's system sent the message

We already know that the latter case happens billions of times a day
(at least) on hundreds of millions of systems.  There is no reason
to think that the former won't happen too, if report-as-spam buttons
become ubiquitous/standardized, and every reason to think it *will* happen.

There are even some reasons to think it has already happened.

Let me also note in passing that there is no way for any external
observer to distinguish between:

	- Alice did not push the report-as-spam button
	- Alice pushed the report-as-spam button, but malware
		resident on Alice's system intercepted the push,
		prevented the information from being transmitted,
		yet told Alice that it had been sent

My point being that even if we accept that users are reliable classifiers
of spam/not-spam (and I've already expressed in another thread that I
think they're utterly incompetent, but let's ignore that for now) there
is no way to know that apparently-user-originated input via such a mechanism
is in fact user-originated.  There are at minimum 100M zombies out there
(lesser estimates should be laughed out of the room) and more every minute.
I see no reason -- at the moment -- why that number won't steadily continue
to increase over the next several years, which is as far as my crystal ball
will let me see. ;-)  Given that, setting up a mechanism that spammers and
other abusers can co-opt for their own purposes *at will* appears to me
to be a pointless exercise.

---Rsk

---

From: Ian Eiloart <[email-masked]>
Date: Fri, 29 Jan 2010 14:33:56 +0000

> no way for any external observer to distinguish between:

So, does that mean that all computer mediated communication is pointless?

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 29 Jan 2010 18:59:09 +0100

> or that Bob actually sent the message.

Botted users and nonsensical users would result in disputes that will 
eventually reveal their true nature. (For the time being, let's 
discard the case that _both_ Alice and Bob are botted, with their bots 
playing funny games with one another.)

I have already observed (take 1) that TMGRS cannot work for sites that 
allow repeated uncontrolled anonymous subscriptions by the same 
user/bot. If each user can be reached, directly or indirectly, the 
number of botted users /per site/ will still be manageable.

> to be a pointless exercise.

OTOH such state of affairs is driven by spam. Thus there may be a 
point in trying this exercise. I would dare say that the Internet has 
the potential to elicit acceptable privacy rules for advertisement 
--unlike tele(phone/vision).

The other chicken and egg problem is how to start an MGRS to support 
AR forwarding, given that TMGRS requires ARs to work reliably.