Re: The Internet's Immune System

["Christopher X. Candreva" <chris () westnet com>]

On Wed, 12 Nov 2003, David A. Ulevitch wrote:

> Automated techniques are the only thing that will stop it but is your
> idea "fast enough?"  I don't think so.  Relying on user reports is good
> for compromises and spambots but it won't do anything to stop CodeRed or
> Nimda.

True -- but I did say that this was a:
> > mechanism for various firewalls, intrusion detection systems, etc to talk
> > to each other to solve problems as quickly as possible.

> I don't think anything comes close to that today.

No, nothing does. This is a start. The example I gave of a command line tool
was just that. The idea is a framework that people and tools can use to
exchange information. I think the protocol itself -- the underlying system
-- is what will be important.  The command line program would be the second
part of "Rough consensus and working code". As with DNS and web servers, I
expect there would be many implementations, from inclusion in firewall
programs to CPAN modules.



==========================================================
Chris Candreva  -- chris () westnet com -- (914) 967-7816
WestNet Internet Services of Westchester
http://www.westnet.com/