Re: [Rucus] ARF BoF: no SIP?

[John R Levine <[e-mail]>]

>> There's interest in a more general abuse report, but I have not yet
>> succeeded in getting people to explain why, other than a dislike of
>> XML, we wouldn't just be doing a rerun of INCH.
>
> Dunno.  I'm not familiar with INCH and currently not connected to
> the Internet to figure out what it is.

It's an old IETF WG, which produced an incident reporting format called 
IODEF which is simultaneously reviled for being too complex, because it's 
in XML, and at the same time for not having enough specific features for 
everyone's favorite online evils.  Personally, I think it's ugly but I 
doubt anything useful could be much less ugly, and that efforts to turn 
ARF into a general reporting format will end up with a mess that is too 
underspecified to interoperate.

> My only thought is that if ARF is going to be extended to cover
> things like SSH and FTP attacks, it should also cover SIP (and,
> to Peter's point) and XMPP.

Oh, sure.  Indeed, they fit into ARF a lot better than SSH does since they 
have something that obviously makes sense as the included 2822 message, 
but I hope I can keep ARF for mail and do something else for all the other 
kinds of evil.

R's,
John