Re: [Rucus] [spitstop] Botnets, take 2... Re: Draft RUCUS charter

["Saverio Niccolini" <[e-mail]>]

> > You do not contact Henning directly to tell him that something is 
> > wrong. You have to rely on your infrastructure to take the 
> necessary 
> > countermeasures otherwise it is the anarchy...
> >   
> Why wouldn't I contact him directly?

-1- you are saying that if people in the world receive 1.000.000 spam
calls then they should generate an equal number of calls to let the
other people know? I am sure there are more intelligent things to do
than that...
-2- have you ever heard of reflection attacks when reading about DoS,
what if the purpose of the compromised account is not only to deliver
you a telemarketing call but also to move people to bring down
Henning's phone by calling him back?

I hope these two are enough to understand that what you 
suggest is in principle NOT the solution...

> > That is why exchanging reputation of identities (as perceived by 
> > end-users or domains) is an important building block.
> > Such reputation system (one of the points of RFC 5039) can be built 
> > using mechanisms like feedbacks:
> > http://tools.ietf.org/html/draft-niccolini-sipping-spam-feedback-00
> > and spam scores:
> > http://tools.ietf.org/html/draft-wing-sipping-spam-score-01
> > of course there are privacy issues that apply (but this is 
> a problem 
> > of reputation systems as well) :-)
> >   
> There is a long way to go between a global reputation system 
> and the drafts you mention above.

I thought we are talking about the general architecture and its
building blocks... Those are building blocks that belong to the
general architecture. The way is long and if we wait until it is
too late there will be no end to the road, better start now then...

> > It seems this list is converging to the point we tried to 
> raise since 
> > 2006, I should be happy :-)
> >    
> Nobody is saying that these mechanisms do not exist on paper. 
> They just have a quite challenging deployment story and the 
> protocol issue is the least problematic thing to worry about: 
> it is the trust relationships you have to establish between 
> the VoIP provider. If you think about a model similar to 
> email then you will have a hard time to establish such an 
> infrastructure.

Are you saying that a model with white lists for calls would be
more acceptable then? That my mother (even if she learnt how to use
the PC since I am living abroad just to stay in contact with me)
would configure her white list and switch its authorization policies
every time she wants to be contacted by unknown people?
Are you aware of how many people nowadays do not use properly
presence indicators? (even skilled people)

I would say my mother would rely on the provider to filter the
vary bad calls on her behalf (using some sort of spam score and
reputation system) and if she receives a spam call every now and then
she would be able to press a button on her phone for "spam feedback"

And of course, she has some authorization policies (but not the one:
receive call only from white list...)

That is why the "white list" concept is not enough without the
"black list" concept. and I think it would be nonsense for RUCUS
to focus only on "white list" and related architecture
(remember that reputation is both "white" and "black"...)

Saverio

> 
> Ciao
> Hannes
> 
> > Saverio
> >
> > ============================================================
> > Dr. Saverio Niccolini
> > Senior Researcher
> > NEC Laboratories Europe, Network Research Division	
> > Kurfuerstenanlage 36, D-69115 Heidelberg
> > Tel.     [phone]
> > Fax:     [phone]
> > e-mail:  [e-mail] <-- !!! NEW ADDRESS !!!
> > ============================================================
> > NEC Europe Limited Registered Office: NEC House, 1 Victoria
> > Road, London W3 6BL Registered in England 2832014
> >  
> > _______________________________________________
> > spitstop mailing list
> > [e-mail]
> > https://listserv.netlab.nec.de/mailman/listinfo/spitstop
> >   
> 
> 


============================================================
Dr. Saverio Niccolini
Senior Researcher
NEC Laboratories Europe, Network Research Division	
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     [phone]
Fax:     [phone]
e-mail:  [e-mail] <-- !!! NEW ADDRESS !!!
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014
_______________________________________________
Rucus mailing list
[e-mail]
http://www.ietf.org/mailman/listinfo/rucus