[anti-abuse-wg] Spam FAQs need revision, was 2011-06 New Policy

Dear all,

We are working on improving the procedures and documentation in the area 
of reporting abuse. As part of this work, we have already rewritten the 
FAQs currently being discussed on this list.

We will inform you as soon as the revised FAQs are published.

Best regards,

Laura Cobley
RIPE NCC Customer Services Manager


On 12/12/11 11:44 AM, Alessandro Vesely wrote:
> All,
> some of the replies to spam FAQs are bad.
>
> FAQ#1 (What is spam?) looks good enough to me.  So I'd start with
> FAQ#2 that Leo brought up recently
>
> On 01/Dec/11 16:27, Leo Vegoda wrote:
>> Hi Tobias, You wrote:
>>
>>> The naive user should use the abuse finder tool which is already
>>> in place and would run much easier than today
>>
>> I disagree and I support the RIPE NCC's answer in its abuse FAQ:
>>
>> http://www.ripe.net/data-tools/db/faq/faq-hacking-spamming/should-i-just-ignore-spam
>
> I too disagree with Tobias' statement, at least for some values of
> "naive user".  Nevertheless, that FAQ's answer is bad.  It reads:
>
>     Should I just ignore spam?
>
>     Yes. We recommend that you simply ignore and delete any spam
>     emails you get. Spam is a universal problem and there is not much
>     that can be done to stop it. However, if you do want to try to
>     find out where the spam is originating from you can follow the
>     steps in FAQ 5.
>
> I propose the following replacement text:
>
>     Should I just ignore spam?
>
>     Your mailbox provider may equip you with some means to report
>     spam.  If you can conveniently deploy such means using your
>     preferred email client, please do so.  Otherwise, we recommend
>     that you simply ignore and delete any spam emails you get.  Your
>     email client may provide you with filters to do so automatically.
>
>     Spam is a social problem, not a technical one.  Therefore,
>     technical remedies tend to get rather complicated.  If you are a
>     mailbox provider or want to learn more about how to find out where
>     the spam is originating from, you can follow the steps in the FAQ
>     entry "How can I counter spam?"
>
> Please note that FAQ#5 currently asks "What can I do to stop spam
> emails?"  Since FAQ entries are not numbered, referring to "FAQ 5" is
> ambiguous, so I quoted its text, and changed the question while at it.
>   FAQ#5 needs an even deeper revision, but please let's tackle them one
> at a time.
>
> Does everyone agree with the replacement text for FAQ#2?
>
>> The overwhelming majority of abuse is perpetrated by skilled
>> professionals who work hard to hide their tracks. Telling ordinary
>> Internet users that they have a useful role in identifying abuse
>> sources and reporting them to the hosting networks is a cruel lie.
>
> Agreed.
>
>> The scale of the problem requires large scale sampling and
>> statistical analysis rather than individual reports.
>
> In part agreed.  Individual reports are useful because humans can
> complement automated filters in detecting spam, albeit both make
> errors.  At any rate, I agree individual reports are to be collected.
>   That's why I'm proposing to amend that entry.
>
>