JEP-0161: SPIM Reporting

Peter Saint-Andre

Email: stpeter@jabber.org
JID: stpeter@jabber.org

1. Introduction

2. Protocol

2.1. Reporting a SPIM Stanza

2.2. Reporting a Spimmer

3. Reporting SPIM

4. Processing SPIM Reports

4.1. Initial Processing

4.2. Determining Spimmer Status

5. Discovering Support

6. Security Considerations

7. IANA Considerations

8. Jabber Registrar Considerations

9. XML Schema

Notes

Revision History

2.1 Reporting a SPIM Stanza

The protocol for SPIM reporting is quite simple: wrap the complete SPIM stanza in a <spim/> element qualified by the 'http://jabber.org/protocol/spimreport' namespace and send an IQ stanza of type "set" to the entity that shall receive the report. This protocol SHOULD be used by recipients of SPIM stanzas and by other entities (e.g., servers or services) that wish to pass around SPIM reports. The following is an example:

Example 1. Unsuspecting User Receives SPIM from Evil Bot

<presence from='makemoney@spimmersheaven.info/bot' 
          to='unsuspectinguser@example.net'
          type='subscribe'>
  <status>
    You too can be rich! Find out how at 
    http://spimmersheaven.info/makemoney
    Let&apos;s chat to make your dreams
    come true!
  </status>
</presence>
    

Example 2. Unsuspecting User Reports SPIM

<iq from='unsuspectinguser@example.net'
    to='example.net'
    type='set'
    id='report1'>
  <spim xmlns='http://jabber.org/protocol/spimreport'>
    <presence from='makemoney@spimmersheaven.info/bot' 
              to='unsuspectinguser@example.net'
              type='subscribe'
              xmlns='jabber:client'>
      <status>
        You too can be rich! Find out how at 
        http://spimmersheaven.info/makemoney
        Let&apos;s chat to make your dreams
        come true!
      </status>
    </presence>
  </spim>
</iq>
    

If the entity that receives the report does not support the SPIM reporting protocol, it MUST return a <service-unavailable/> error to the reporting entity:

Example 3. Service Unavailable

<iq from='example.net'
    to='unsuspectinguser@example.net'
    type='error'
    id='report1'>
  <spim xmlns='http://jabber.org/protocol/spimreport'>
    <presence from='makemoney@spimmersheaven.info/bot' 
              to='unsuspectinguser@example.net'
              type='subscribe'
              xmlns='jabber:client'>
      <status>
        You too can be rich! Find out how at 
        http://spimmersheaven.info/makemoney
        Let&apos;s chat to make your dreams
        come true!
      </status>
    </presence>
  </spim>
  <error code='503' type='cancel'>
    <service-unavailable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
  </error>
</iq>
    

If the entity that receives the report is able to process the report, it MUST return an IQ-result to the reporting entity:

Example 4. Report Processed

<iq from='example.net'
    to='unsuspectinguser@example.net'
    type='result'
    id='report1'/>
    

2.2 Reporting a Spimmer

If an entity that processes SPIM reports determines that the suspected spimmer is indeed an actual spimmer, it SHOULD report its conclusions to appropriate other entities (e.g., the spimmer's server or dedicated SPIM reporting services). Here again, the protocol is quite simple: wrap the spimmer's JID in a <spimmer/> element qualified by the 'http://jabber.org/protocol/spimreport' namespace and send an IQ stanza of type "set" to the entity that shall receive the report. This protocol SHOULD NOT be used by recipients of SPIM stanzas. The following is an example:

Example 5. Server Reports Spimmer

<iq from='example.net'
    to='spim.xmpp.net'
    type='set'
    id='spimmer1'>
  <spimmer xmlns='http://jabber.org/protocol/spimreport'>makemoney@spimmersheaven.info</spimmer>
</iq>
    

4.1 Initial Processing

The following rules and guidelines apply to initial processing of a SPIM report.

1. Before processing the report, the processor MAY respond to the report by sending a challenge to the sender (e.g., using Robot Challenges [1]) in order to make sure that the sender is not sending spurious reports or otherwise abusing the SPIM reporting system.
2. The processor MUST add the report to a list or database of pending SPIM reports.
3. If the suspected spimmer is not already on the processor's list of known spimmers, the processor SHOULD use the report in determining whether the suspected spimmer is an actual spimmer (see next section).
4. The processor MAY report the SPIM stanza to the suspected spimmer's server.
5. The processor MAY report the SPIM stanza to dedicated SPIM reporting services.
6. The processor MAY report the SPIM stanza to other servers it trusts.
7. The processor SHOULD NOT report the SPIM stanza to the suspected spimmer.

4.2 Determining Spimmer Status

Not all SPIM reports are valid, and not all JIDs that send stanzas reported as SPIM are spimmers. Care must be taken in correctly determining if a suspected spimmer is an actual spimmer. The following rules apply:

1. The processor SHOULD NOT add a suspected spimmer to its list of known spimmers until it has received at least three (3) valid SPIM reports with regard to that suspected spimmer.

2. If the processor determines that the suspected spimmer is an actual spimmer, the processor:

   1. MUST add that JID to its list of known spimmers.
   2. SHOULD send a spimmer report to the spimmer's server.
   3. MAY send a spimmer report to SPIM reporting services or reputation services.
   4. MAY send a spimmer report to other servers it trusts.
   5. SHOULD NOT send a spimmer report to the spimmer.

<iq from='unsuspectinguser@example.net'
    to='example.net'
    type='get'
    id='disco1'>
  <query xmlns='http://jabber.org/protocol/disco#info'/>
</iq>
  

<iq from='example.net'
    to='unsuspectinguser@example.net'
    type='result'
    id='disco1'>
  <query xmlns='http://jabber.org/protocol/disco#info'>
    ...
    <feature var='http://jabber.org/protocol/spimreport'/>
    ...
  </query>
</iq>
  

1. JEP-0158: Robot Challenges <http://www.jabber.org/jeps/jep-0158.html>.

2. JEP-0030: Service Discovery <http://www.jabber.org/jeps/jep-0030.html>.

3. The Internet Assigned Numbers Authority (IANA) is the central coordinator for the assignment of unique parameter values for Internet protocols, such as port numbers and URI schemes. For further information, see <http://www.iana.org/>.

4. The Jabber Registrar maintains a list of reserved Jabber protocol namespaces as well as registries of parameters used in the context of protocols approved by the Jabber Software Foundation. For further information, see <http://www.jabber.org/registrar/>.

Version 0.1 (2005-10-19)

Version 0.0.1 (2005-09-28)