Subject: Corporate email attachment filters and IETF emails

From: Robert Moskowitz <[email-masked]>
Date: Tue, 08 Dec 2009 08:22:56 -0500

ALL my IETF mailing lists come to email accounts that I control on my 
own mail server. but....

I recently submitted my first Internet Draft since my company was bought 
by a BIG TELCO, and it has BIG email filtering rules.  In large part 
these rules were developed by my colleagues in the other part of my 
company that was bought by the BIG TELCO.

But the short of it is that only a small selection of email attachments 
are let through and otherwise the email is dropped silently.  Thus the 
email for validating an ID submission never got to my corporate email 
account.

Have others seen this sort of challenge?  What do others do?  Our 
corporate IT does not listen to researchers like me to produce 
individual rules, it seems.  As it is they killed an email address based 
on my intials that I have been using for 10 years (with some changes to 
the domain portion); got to be the full name...

Should the ID submission tool have the option of NOT including an 
attachment, perhaps just a URL to a temp file with a 24-48 hr life?

Or is there a way already to customize this that I missed?

---

From: IETF Member Dave Aronson <[email-masked]>
Date: Tue, 8 Dec 2009 08:40:22 -0500

Robert Moskowitz <[email-masked]> wrote:

> ALL my IETF mailing lists come to email accounts that I control on my own
> mail server. but....
>
> I recently submitted my first Internet Draft since my company was bought by
> a BIG TELCO, and it has BIG email filtering rules.  In large part these
> rules were developed by my colleagues in the other part of my company that
> was bought by the BIG TELCO.
>
> But the short of it is that only a small selection of email attachments are
> let through and otherwise the email is dropped silently.  Thus the email for
> validating an ID submission never got to my corporate email account.

Maybe you could point out to The Powers That Be, that if they want any
glory for their company for your work in helping shape the future of
Teh Intarwebs, their silly mail rules are interfering.  Don't expect
them to change their rules, just point out that you have a perfectly
valid reason not to use a company email addy, for this sort of work.

Meanwhile, use one of your personal addresses.  That's probably more
permanent anyway; even if you don't leave the company, as you've seen,
companies get bought.  The new owner doesn't always maintain the email
processing for the old name(s).  Getting your own domain (or multiple)
is generally your best bet.

-Dave (owner of davearonson.com for mainly that reason, and a few others)

-- 
Dave Aronson - Have Pun, Will Babble | Work: davearonson.com | /\ ASCII
-------------------------------------+ Play: davearonson.net | \/ Ribbon
"Specialization is for insects."     | Life: dare2xl.com     | /\ Campaign
-Robert A. Heinlein                  | Wife: nasjleti.net    | Email<>Web

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 08 Dec 2009 09:05:24 -0500

> -Dave (owner of davearonson.com for mainly that reason, and a few others)

I have had htt-consult.com since '95.  I have wanted htt.com, but it was 
already taken by some guy in Spain.

Old email addresses has always been a problem here.  My email in RFC 
1918 has not worked for almost 12 years.

I also have an IANA enterprise number:  6715 that I actually used a 
couple times for some X.509 attribute work...

---

From: Joe Abley <[email-masked]>
Date: Tue, 8 Dec 2009 14:58:35 +0000

> Or is there a way already to customize this that I missed?

You can submit a draft using the I-D submission tool using an address that is not listed in the document as an author's address.

You can validate a draft for submission using the I-D submission tool without using e-mail at all, I think.

Joe

---

From: Russ Housley <[email-masked]>
Date: Tue, 08 Dec 2009 11:51:39 -0500

Bob:

There are no attachments in I-D Submission verification email 
messages from the online I-D Submission tool.  The most recent one I 
got went like this:

<begin verification message>
From: IETF I-D Submission Tool
To: [email-masked]
Subject: I-D Submitter Authentication for <draft-name>
Date: ,date.

Please follow the link below to complete your I-D submission.

https://datatracker.ietf.org/idst/auto_post.cgi?auth_key=<ugly-string>&submission_id=<number>

Please note that if you do not follow the link above by <date>, then 
this submission will be canceled and your Internet-Draft will be 
permanently removed from the staging area.

THIS PROCESS MUST BE COMPLETED BEFORE ANY CUTOFF DATES.  IF A CUTOFF 
PERIOD BEGINS BEFORE YOU COMPLETE THE SUBMISSION PROCESS, YOUR 
SUBMISSION CANNOT BE ACCEPTED.

The IETF Secretariat.
<end verification message>

Russ

At 08:22 AM 12/8/2009, Robert Moskowitz wrote:
>ALL my IETF mailing lists come to email accounts that I control on 
>my own mail server. but....
>
>I recently submitted my first Internet Draft since my company was 
>bought by a BIG TELCO, and it has BIG email filtering rules.  In 
>large part these rules were developed by my colleagues in the other 
>part of my company that was bought by the BIG TELCO.
>
>But the short of it is that only a small selection of email 
>attachments are let through and otherwise the email is dropped 
>silently.  Thus the email for validating an ID submission never got 
>to my corporate email account.
>
>individual rules, it seems.  As it is they killed an email address 
>based on my intials that I have been using for 10 years (with some 
>changes to the domain portion); got to be the full name...
>

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 08 Dec 2009 12:04:31 -0500

Russ Housley wrote:
> Bob:
>
> There are no attachments in I-D Submission verification email messages 
> from the online I-D Submission tool. The most recent one I got went 
> like this:

Thanks Russ. I just got a call from our IT guy that will look at the log 
and see what happened to the verificaiton email messages....

>> bought by a BIG TELCO, and it has BIG email filtering rules. In large 
>> part these rules were developed by my colleagues in the other part of 
>> my company that was bought by the BIG TELCO.
>>
>> silently. Thus the email for validating an ID submission never got to 
>> my corporate email account.
>>
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 08 Dec 2009 09:04:12 -0800

> email for validating an ID submission never got to my corporate email 

I doubt that I-D transaction messages conform to any common abuse template.  As 
Russ notes, there's no attachment, but I do not, offhand, know any any 
interesting vocabulary or text pattern in these messages that ought to be 
problematic.  Even the included URL ought not to be all that interesting to 
filtering code.

Consequently, it could be interesting to track down why your corporate filters 
are flagging these.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Jari Arkko <[email-masked]>
Date: Tue, 08 Dec 2009 19:16:04 +0200

Dave, Bob,

> I do not, offhand, know any any interesting vocabulary or text pattern 
> in these messages that ought to be problematic.

All upper case text. Just a wild guess.

But its good that Bob's IT person has promised to figure this out. The 
filters seem simply too sensitive. I have not heard of other people 
having a similar issue, at least not beyond an extent experienced for 
all autogenerated e-mail (travel reservations etc).

Jari

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 09 Dec 2009 08:01:55 -0800

Wes Hardaker wrote:
> But consider the fact that: half the purpose of posting an ID is to get
> comments about it sent to you.  Consider then that if you have any sort
> of aggressive filtering in place that's blocking your receipt of the
> verification messages then the chances are very very high that you'll
> also block comments from some random person out there that happens to
> look questionable to your companies blocking algorithms.

Given that 90-98% of email over the open Internet is spam, aggressive filtering 
at the receive side is the only thing that keeps email viable.  The /quality/ of 
that filtering is the question, not whether to have it.

d/
-- 

   Dave Crocker

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 09 Dec 2009 07:57:31 -0800

>>>>> On Tue, 08 Dec 2009 19:16:04 +0200, Jari Arkko <[email-masked]> said:

JA> But its good that Bob's IT person has promised to figure this out. The
JA> filters seem simply too sensitive. I have not heard of other people
JA> having a similar issue, at least not beyond an extent experienced for
JA> all autogenerated e-mail (travel reservations etc).

That's all well and good if all you're concerned about is the posting
verification message from the automated servers.

I've found large numbers of companies, for example, that assume that all
their traffic is internal to their particular company and start running
spam assassin with very high scores against mail arriving from outside
their local bubble.  This doesn't work well with comments about an IETF
document.

-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: Julian Reschke <[email-masked]>
Date: Wed, 09 Dec 2009 17:38:51 +0100

Wes Hardaker wrote:
> ...
> ...

I would hope that the ID actually points out a specific IETF mailing 
list for comments, and the author is reading it.

BR, Julian

---

From: Dave CROCKER <[email-masked]>
Date: Wed, 09 Dec 2009 08:59:23 -0800

> list for comments, and the author is reading it.

Sometime back, I tried to convince folks that such a pointer should be required 
for all I-Ds.  It did not get any traction.

So the presence of a pointer to a discussion forum is a matter of happenstance. 
  If an author thinks of it and decides to include it, it's there.  But the I-D 
tools do not look for or require it.

d/

-- 

   Dave Crocker

---

From: Julian Reschke <[email-masked]>
Date: Wed, 09 Dec 2009 18:09:09 +0100

Dave CROCKER wrote:
> Sometime back, I tried to convince folks that such a pointer should be 
> required for all I-Ds.  It did not get any traction.

I happen to agree that it should be mandatory.

BR, Julian

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 10 Dec 2009 12:09:02 -0800

>>>>> On Wed, 09 Dec 2009 17:38:51 +0100, Julian Reschke <[email-masked]> said:

JR> I would hope that the ID actually points out a specific IETF mailing
JR> list for comments, and the author is reading it.

I'd say most do not.  Most just list author addresses and do not list
the WG mailing list.
-- 
Wes Hardaker
Cobham Analytic Solutions

---

From: "Doug Ewell" <[email-masked]>
Date: Sat, 12 Dec 2009 13:10:35 -0700

"Dave CROCKER" <dhc2 at dcrocker dot net> wrote:

> Consequently, it could be interesting to track down why your corporate 
> filters are flagging these.

A former employer of mine once blocked a message which contained the 
phrase "magna cxm laude," where the X was a U.  Apparently that one 
word, taken out of context, was sufficient.

--
Doug Ewell  |  Thornton, Colorado, USA  |  http://www.ewellic.org
RFC 5645, 4645, UTN #14  |  ietf-languages @ http://is.gd/2kf0s

---

From: IETF Member Dave Aronson <[email-masked]>
Date: Mon, 14 Dec 2009 10:12:17 -0500

On Sat, Dec 12, 2009 at 15:10, Doug Ewell <[email-masked]> wrote:

> A former employer of mine once blocked a message which contained the phrase
> "magna cxm laude," where the X was a U.  Apparently that one word, taken out
> of context, was sufficient.

That's clbuttic.  A group I belong to, once had a convention where an
optional side-trip was a "train ride cxm party" (same subsbreastution
performed).  Oh, the ignorant flames in the "Letters to the Editor"!

-Dave

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 14 Dec 2009 12:46:02 -0500

Clearly, the best solution to this problem is to enforce Latin as the  
official language of the Internet.  Lots of people already use the  
Latin character set!

--Richard

---

From: Julian Reschke <[email-masked]>
Date: Mon, 14 Dec 2009 18:55:03 +0100

Richard L. Barnes wrote:
 > official language of the Internet.  Lots of people already use the Latin
 > character set!
 >
 > --Richard

...we could also define a character encoding "XTF-8" which is identical 
to UTF-8, except that it exchanges "x" and "u".

BR, Julian

---

From: "Randy Presuhn" <[email-masked]>
Date: Mon, 14 Dec 2009 16:10:35 -0800

Hi -

> From: "Richard L. Barnes" <[email-masked]>
> To: "IETF Member Dave Aronson" <[email-masked]>
> Cc: "IETF Discussion" <[email-masked]>
> Sent: Monday, December 14, 2009 9:46 AM
> Subject: Re: Corporate email attachment filters and IETF emails
>

It's about time we got rid of that pesky J and W, and we don't
*really *need both V and U, do uue?

:-)

Randy

---

From: IETF Member Dave Aronson <[email-masked]>
Date: Mon, 14 Dec 2009 19:44:41 -0500

> *really *need both V and U, do uue?

Cue Mark Twain and his orxografikl riform...

-Dave

---

From: "Loa Andersson" <[email-masked]>
Date: Tue, 15 Dec 2009 02:10:00 +0100 (CET)

All,

> *really *need both V and U, do uue?
great idea - and we should als adopt Latin numbers!

/Loa
> Randy

Loa Andersson

Sr Strategy and Standards Manager
Ericsson ///
   phone:  +46 10 717 52 13
           +46 767 72 92 13

   email:  [email-masked]
           [email-masked]

---

From: Steven Bellovin <[email-masked]>
Date: Mon, 14 Dec 2009 21:05:48 -0500

> great idea - and we should als adopt Latin numbers!

Are you expecting people to reply with +I?  (Hint: if you don't get it, check your fonts...)

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: IETF Member Dave Aronson <[email-masked]>
Date: Mon, 14 Dec 2009 21:08:08 -0500

...
> Sr Strategy and Standards Manager

Shouldn't you therefore have written:

  phone:  +XLVI X DCCXVII LII XIII
          +XLVI DCCLXVII LXXII XCII XIII

? ;-)

-Dave

---

From: Dave Cridland <[email-masked]>
Date: Tue, 15 Dec 2009 08:54:13 +0000

>           +XLVI DCCLXVII LXXII XCII XIII

I was going to send a flippant and trivial message to the list on  
this, but I was concerned I may be raising the tone.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Stewart Bryant <[email-masked]>
Date: Tue, 15 Dec 2009 10:28:35 +0000

> this, but I was concerned I may be raising the tone.
-/..../.-././. .../-.--/--/-.../---/.-../... -../---/- -../.-/.../.... 
.-/-./-.. .../.--./.-/-.-./. .-/.-./. ./-./---/..-/--./.... ..-./---/.-. 
--/. -../. .../-/./.--/.-/.-./-

---

From: Dave Cridland <[email-masked]>
Date: Tue, 15 Dec 2009 11:09:57 +0000

On Tue Dec 15 10:28:35 2009, Stewart Bryant wrote:
> -/..../.-././. .../-.--/--/-.../---/.-../... -../---/-  
> -../.-/.../.... .-/-./-.. .../.--./.-/-.-./. .-/.-./.  
> ./-./---/..-/--./.... ..-./---/.-. --/. -../. .../-/./.--/.-/.-./-

I hate to be pedantic - especially on this list - but isn't that four?

Dave.

---

From: Jari Arkko <[email-masked]>
Date: Tue, 15 Dec 2009 13:11:56 +0200

Steven,

> Are you expecting people to reply with +I?

Some of us have already transitioned to the new numbering system. This 
document is currently in last call:

   http://tools.ietf.org/html/draft-xli-behave-ivi-05

and I quote:

   This document presents the CERNET IVI translation design and
   deployment for the IPv4/IPv6 coexistence and transition.  In roman
   numerals, the IV stands for 4 and VI stands for 6, so IVI stands for
   the IPv4/IPv6 translation.

Jari

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 30 Dec 2009 08:13:10 -0500

Well we finally tracked down the problem!!!!

Part of the delay was, I was not going to submit a fake ID to run this 
down, but was just working toward the -01 version which I submitted 
yesterday.....

Dave CROCKER wrote:
> I doubt that I-D transaction messages conform to any common abuse 
> template. As Russ notes, there's no attachment, but I do not, offhand, 
> know any any interesting vocabulary or text pattern in these messages 
> that ought to be problematic. Even the included URL ought not to be 
> all that interesting to filtering code.
>

Ho boy, this was interesting:

==============================================================

Bob,

I think I found the problem.  For this particular message, something in
the message is triggering the adult spam rule and the message is being
discarded. See "action-discard" in the filter log query below.

I will safe list this address
and I have added a rule to classify anything with the string "I-D
Submitter Authentication for draft" to NOT be classified as spam.
Unfortunately, I don't have a copy of the entire message, only the
header information.  Please submit your request (again, and I'm sorry)
and I'll follow it though again.

filter.log.20091229133738:[2009-12-29 13:49:41.105443 +0000] trce
s=jy7be8shq mod=mltr cmd=rcptto
addr=<[email-masked]>
filter.log.20091229133738:[2009-12-29 13:49:41.108045 +0000] trce
s=jy7be8shq m=1 x=nBTDne4N011260 mod=session cmd=rcptto
data=<[email-masked]>
filter.log.20091229133738:[2009-12-29 13:49:41.110406 +0000] rprt
s=jy7be8shq m=1 x=nBTDne4N011260 mod=mail cmd=env_rcpt r=1
value=[email-masked] verified= routes=
filter.log.20091229133738:[2009-12-29 13:49:41.110651 +0000] debg
s=jy7be8shq m=1 x=nBTDne4N011260 mod=session cmd=rcptto
data=<[email-masked]>  duration=0.003
filter.log.20091229133738:[2009-12-29 13:49:41.690626 +0000] rprt
s=jy7be8shq m=1 x=nBTDne4N011260 mod=mail cmd=msg module=spam
rule=notspam_adultspam action=discard attachments=0 rcpts=1 routes=
size=1897 guid=fcf05cb1989e39177f93e4b510f07261
hdr_mid=<[email-masked]> qid=nBTDne4N011260
subject="I-D Submitter Authentication for
draft-moskowitz-hip-rfc4423-bis" duration=0.504 elapsed=0.590

=======================================================================================

Once we cleared this up, the system sent me another auth email this morning that got properly caught in the spamblocker that I was able to release and safelist.

My hunch it is all that NASTY stuff in the auth key that set the filters off!  :)