Re: On-going Internet Emergency and Domain Names

[Paul Vixie <paul () vix com>]

> From: Dave Crocker <dcrocker () bbiw net>
> To: Paul Vixie <paul () vix com>, nanog () merit edu, Gadi Evron <ge () linuxbox org>
> Subject: Re: On-going Internet Emergency and Domain Names
>
> offlist.

actually, not, according to the headers shown above.

> Paul Vixie wrote:
> > a push-pull.  first, advance the current effort to get registrars and
> > dynamic-dns providers to share information about bad CC#'s, bad customers,
> > bad domains, whatever.  arrange things so that a self-vetting society of
> > both in-industry and ombudsmen have the communications fabric they need to
> > behave responsibly.  push hard on this, make sure everybody hears about it
> > and that the newspapers are full of success stories about it.
>
> IP Address blacklists are a sufficiently solid staple of email anti-abuse
> effort, that I suspect similar approaches, for other information tidbits,
> would be quite useful.

as the inventor of the internet's first ip address blackhole list (not
"blacklist"), i agree that it's a solid staple, but i'm not sure it was
the most effective 10-year plan we could have made at the time, had we
been making 10-year plans.

> This is less about "shaming" and more about filtering.  In this case,
> filtering at DNS registration time, ISP account setup, or the like.

agreed.  i'd be happy to see the DNS registration "front end" (one of its
"edges") gain some kind of reputation filtering.  i just don't want to see
"core"-level filtering like we did in e-mail, unless it's at the customer-
facing ("edge") level, like Trend ICSS offers.

> The difficulties, here, are to a) establish a credible organization for
> creating and maintaining the list(s), b) getting folks to submit data to
> it, and c) getting folks to use it.

those are Gadi's three areas of strength and i'd help him if he did this.

> Since there is quite a lot of track-record on doing this -- both well and
> poorly -- the challenge here is all about implementation, rather than
> design, of the service.

having designed a reputation system inadequately once upon a time, i think
it's important to get both the design and implementation right.