Subject: [OPSEC] LC comments on draft-oreirdan-mody-bot-remediation-08.txt

From: Danny McPherson <[email-masked]>
Date: Sun, 2 May 2010 19:26:56 -0600

Jason et al., 
Apologies for the late response, some comments below on
the -08 spin of this draft.

-danny

---

General issues:

-
I'd recommend moving the Introduction and Problem Statement
up at least above Terminology, if not to Section 1.

-
I think one of the points that should be made explicit in the 
introduction is something along these lines:

"Broadband consumer attached end systems that are participating in 
bot-driven malicious activity is normally the result of compromise, 
and the subscribers themselves, consumers of services provided by 
their access service provider, are victims of this compromise.  Service 
providers typically don't own, administer, or otherwise have remote 
access to subscriber end systems.  As such, end-system level remediations 
that are ultimately necessary, and might normally be applicable as with 
enterprise or similar environments, are not usually viable options to bot 
remediation in consumer and residential access networks - at least until 
the consumer has been notified.

These unique circumstances create a difficult predicament for service 
providers."

-
I suspect the discussion on benign or malicious bots (S 2.1) might 
well be informed by a slight variant on the concept, specifically, 
as we've seen evolve the past few years and as outlined by Gunter
in "The Opt-In Botnet Generation".  Of course, any more text here
is probably just a distraction and will increase the noise level, 
but it could give consideration to this if others think it's 
useful.  

Additionally, it might be useful to provide a reference to a
wide-spread application that might be non-maliciouls (e.g.,
SETI@home - http://setiathome.ssl.berkeley.edu/).

---

From: Danny McPherson <[email-masked]>
Date: Sun, 2 May 2010 21:56:41 -0600

> the -08 spin of this draft.

Oops, Jason et al, I flushed my drafts queue prematurely when
switching mail relays - this message wasn't fully baked.  Most
of the points stand, but I've got a more detailed analysis 
that I'll send when I get the time to complete that factors the
whole draft after a re-read and another set of review comments.

I.e., you're welcome to consider or disregard these comments, 
I intend to send more.

Apologies for the confusion.

-danny

> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec