Subject: Re: [domainrep] First pass at reputons and the like

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 25 Oct 2010 14:46:40 -0700

Does anyone disagree with me that we appear to have a workable starting point and enough interest to begin the work of writing a WG charter?

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 26 Oct 2010 16:55:22 -0700

> Does anyone disagree with me that we appear to have a workable starting point and enough interest to begin the work of writing a WG charter?

Does this deafening silence indicate a consensus to continue, or general disinterest?

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 26 Oct 2010 18:02:36 -0600

> Does this deafening silence indicate a consensus to continue, or general disinterest?

On my part, it indicates that I have too many mailing lists to monitor.
I'm interested, and hope to catch up before IETF 79.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 26 Oct 2010 17:09:13 -0700

> Does this deafening silence indicate a consensus to continue, or general disinterest?

"Deafening silence" from me is due to the focus of this discussion
almost exclusively with regards to "domain reputation" with regards to
e-mail -related issues -- which I am not interested in.

When the discussion shifts to include "domain reputation" with regards
to a domain's historical record with regard to criminal or malicious
activity, then I will crawl back out from under my rock. :-)

- ferg

-- 
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 26 Oct 2010 20:57:26 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Paul Ferguson
> Sent: Tuesday, October 26, 2010 5:09 PM
> To: J.D. Falk
> Cc: [email-masked]
> Subject: Re: [domainrep] First pass at reputons and the like
> 

It's clear from the most recent proposals that the focus so far has not been on email, but on the idea of being able to express reputation, in a standard way, about just about anything.  The examples presented include mail domains, URLs, even baseball players.

I thought this was cleared up when we talked in Washington.

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 26 Oct 2010 21:12:44 -0700

> I thought this was cleared up when we talked in Washington.

Hi Murray,

Well, I think there is a disconnect from what you are saying here, and
the majority of the discussion on the list -- it has clearly been
focused on the DKIM-leveraged issues, which is what I identify with as
e-mail -related issues.

Sure, there is some "background" insistence that this is not "just
e-mail domain reputation" and can include other aspects of "domain
reputation", but I see a major disconnect here.

I do not believe that you can lump these issues altogether, and
satisfy all stakeholders. The criteria, and the "reputation" will be
completely diverse, and although I have seen some hand-waving of the
ability of this effort to address non-e-mail related domain reputation
issues, I just have *not* seen any pertinent dialogue which can
address the issues that I have in mind (e.g. malicious/criminal
domains).

if the framework of this effort truly wants to embrace issue which are
not e-mail related, then I have seen very little dialog about it on
the list.

I personally feel that dismissing those issues as "...something we
intend to include..." is overlooking some of the more important issues
of what is already in place in the market, and what may evolve from
it.

As I have said before, many people are already doing "domain
reputation" and it has nothing to do with messaging abuse.

Thanks,

- ferg

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 26 Oct 2010 21:16:16 -0700

> From: Paul Ferguson [mailto:[email-masked]]
> Sent: Tuesday, October 26, 2010 9:13 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> [...]

Well, I certainly concede that the premise for a lot of this work is email centric, but I don't believe at all that there's any intent, express or implied, to confine the work in that way.

I guess time will prove one of us right.

-MSK

---

From: Paul Ferguson <[email-masked]>
Date: Tue, 26 Oct 2010 21:24:51 -0700

Hi Murray,

Please don't take offense -- I'm just trying to make an observation.

We're just coming at this thing from two different perspectives.

Thanks,

- ferg

---

From: "J.D. Falk" <[email-masked]>
Date: Wed, 27 Oct 2010 12:11:33 -0700

> focused on the DKIM-leveraged issues, which is what I identify with as

Most of that discussion was before Nathaniel's "First pass at reputons and the like."  I agree, it's been hard to think outside of email, but I think his ideas get us there (or pretty close, anyway.)

What else would you want to see before you would consider this effort to be sufficiently generic?

---

From: Franck Martin <[email-masked]>
Date: Thu, 28 Oct 2010 07:49:18 +1200 (FJT)

To me it seems we are lacking tools outside email related domains.

MC-Afee/Symantec and other publish TLD based report on malware. They have also plugins to add to your browser to alert you.

The only data I know which is easily accessible is the Google domain blocking list. The thing that Firefox and a few others use to prevent you going on bad websites.

I have the feeling from an end-user perspective the vectors of malware are email or web browsing, therefore the domain data collected is from email reports or web page analysis.

Am I missing some?

Franck Martin 
http://www.avonsys.com/ 
http://www.facebook.com/Avonsys 
twitter: FranckMartin Avonsys 

Check your domain reputation: http://gurl.im/b69d4o 

----- Original Message -----
From: "J.D. Falk" <[email-masked]>
To: [email-masked]
Sent: Thursday, 28 October, 2010 8:11:33 AM
Subject: Re: [domainrep] First pass at reputons and the like

_______________________________________________
domainrep mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/domainrep

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 27 Oct 2010 16:17:41 -0400

> To me it seems we are lacking tools outside email related domains.

I'm not sure that's right:

http://www.isc.org/community/blog/201007/taking-back-dns-0

Note that (1) I am appalled at this and (2) I suggested something
along these lines at an OARC meeting a few years ago.  Yes, (2) seems
inconsistent with (1).  Just because I live in the world doesn't mean
I have to be happy with it.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Franck Martin <[email-masked]>
Date: Thu, 28 Oct 2010 09:36:39 +1200 (FJT)

Yes, I have seen that, and I have seen a few presentations that were looking like a sales pitch to me.

It is a great capability in bind, however, I have yet to come across a single list that fits the format/or use case. 

May be I'm wrong, someone has pointers?

Franck Martin 
http://www.avonsys.com/ 

----- Original Message -----
From: "Andrew Sullivan" <[email-masked]>
To: [email-masked]
Sent: Thursday, 28 October, 2010 9:17:41 AM
Subject: Re: [domainrep] First pass at reputons and the like

A

---

From: Paul Ferguson <[email-masked]>
Date: Wed, 27 Oct 2010 16:15:44 -0700

SURBL is already offering DNS RPZ zone service(s), but since it is a
relatively new framework, it still will have a few changes in the spec
befor eit is fully baked, I think.

But back on point, this is exactly the sort of dialogue which I like
to see regarding this topic. ;-)

- ferg