Please see attached review.
I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>. Please resolve these comments along with any other Last Call comments you may receive. Document: draft-ietf-marf-not-spam-feedback-01.txt Reviewer: Brian Carpenter Review Date: 2011-09-09 IETF LC End Date: 2011-09-22 IESG Telechat date: Summary: Almost ready -------- Issue: ------ I'm not sure whether to classify this as major or minor. In most cases, "not-spam" reports will probably not be taken on their own, but will be considered along with other information, analysis of the message, etc. Did you consider using a normative SHOULD NOT ... SHOULD instead of "will probably not ... will"? Similarly, in the Security Considerations, "Operators need to be careful" seems very mild to me. Generating hundreds of "not-spam" reports seems like a very plausible gambit for a spamming botnet. (A bot receives spam from one of its own swarm, and generates a completely valid "not-spam" report to be sent to the victim's own provider. Repeat until done.) This would essentially nullify the value of any "not-spam" report, unless operators deploy heuristics to detect it.
_______________________________________________ Gen-art mailing list [email protected] https://www.ietf.org/mailman/listinfo/gen-art
