Re: [dispatch] Proposal for scantxt; scanning opt-in/out, identification, verification, notification, and reporting

[John R Levine <[e-mail]>]

> Perhaps generic probing is mostly malicious but if you include services that people and businesses often use or sign up for, it likely isn't all that malicious. Consider the following as scanners (not recommendations, just examples): MXToolBox, Detectify, Hardenize, Snyk

I take your point about scanning by request, but that makes the problem a 
whole lot simpler.

It's not hard to see how you could come up with standard ways for scanners 
to say here's the kinds of scanning they do and here's the IPs they scan 
from, and for the victims to say here's the IP ranges you can scan and the 
ports you can probe, and replies from the scanners saying here's what we 
found.  Since the parties already know wach other you can wrap it in OAUTH 
or the like to authenticate it.

Beyond that, I still don't see the point.  It's hard to think of anything 
other than http that lets you bundle an authentication token with a probe 
and even there, one of the major points of scanning is to find ports and 
servers that are open by mistake so they wouldn't be looking for the 
token.  To identify the scanners, do the scans from dedicated IPs.

It's hard to imagine a use for a public "go ahead and scan this range" (as 
distinct from sending a message to a known party) other than as a honeypot 
or security challenge.  The bad guys will scan anyway, and challenges have 
a poor reputation in the security world.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly