[anti-abuse-wg] Abuse-C attributes - required e-mail address contact method.

On Tue, Mar 17, 2015 at 07:39:22AM +0100, peter h wrote:
> On Tuesday 17 March 2015 01.42, Ronald F. Guilmette wrote:
> > 
> > My two cents...
> > [...]

> Wonderful !  A masterpiece ! Well formulated, well written and ON THE SPOT !

I agree fully.

My two cents:

There are feedback loops from large places and SpamCop, that should account 
for the overwhelming majority of reports, and there are isolated reports
from net citizens.  The flows from the feedback loop places have a
lower quality of individual reports (high fraction of "mail that i do 
not want" that is not really spam) but their strength is the volume,
they have a fixed format and so processing of those reports should be
easy to automate - they do not need to enter the queue of mails inspected
manually.  I believe that there are products for abuse desks on the market 
that do these splittings already.

It is a known fact that very few people nowadays take the time to
send reports manually.  It is also a known fact that spammers have
learnt about the effects of feedback loops and plan their activity
accordingly.  So, for instance, they have a vision of the world which
is something like
World = { Gmail, Hotmail/Office365/WindowsLive, Yahoo, General Internet }
and they develop an independent delivery strategy for each category.

So, those flows of reports are likely to be different.  An IP hitting
Yahoo at some point in time is not necessarily hitting also the
"General Internet" at the same time, etc.

Most people here work in the "General Internet" realm. The big places
tend to have their own teams and resources, and their defense strategies 
are not well known and often kept opaque for obvious reasons.
In contrast, the "General Internet" is more open, and for the spammers
it is a dangerous territory.  Some spammers avoid it completely,
concentrating only on the big platforms.  Other spammers spend a lot
of efforts to identify the traps used by major blocking list services
and avoid them, forcing those services to take measures to prevent
easy trap detection.  Some of these spammers (mostly of the 'snowshoe'
category) seem to have some success in these endeavours - thanks to
the negative feedback of hundreds or thousands of terminations! -
and manage to survive at ISPs for longer times through avoidance of
known traps.

The "General Internet" does not have many feedback loops, and therefore
reports from users there - particularly experienced users that invest
time in composing their reports - should be taken as PURE GOLD,
because they provide independent informations on the "tiny" subset 
of the Internet mail recipients which is not hosted on the big platforms
and that is defended mostly through an open community effort, but also
because they often offer a viewpoint of the Internet that nobody else has.
These efforts very often results in spam operations brought down,
with benefits for the large platforms too  (this is why spammers
consider dangerous the "General Internet"!).

So, every effort should be made to make life _easier_ for this 
almost estinct species - the abuse reporters - because their
diversity is one of our biggest assets.

furio