Re: [Rucus] [spitstop] Botnets, take 2... Re: Draft RUCUS charter

Hi Saverio,

Saverio Niccolini wrote:
> Hannes, all,
>
>   
>> Let's take an example:
>> When Henning's host is compromised and a bot is using 
>> Henning's account to send me spam then I would contact 
>> Henning (by using various ways) to tell him that something is 
>> wrong with his PC/phone/etc. I would not tell my VoIP 
>> provider that there is something wrong with Henning's account. 
>> Typically, this will lead to more problems rather than less 
>> -- such as no communication to Columbia University anymore 
>> because my VoIP provider just blocks all calls from that domain.
>>
>> (Just to reflect my experience with email problems in the company....)
>>     
>
> You do not contact Henning directly to tell him that something
> is wrong. You have to rely on your infrastructure to take the
> necessary countermeasures otherwise it is the anarchy...
>   
Why wouldn't I contact him directly?

> That is why exchanging reputation of identities (as perceived by
> end-users or domains) is an important building block.
> Such reputation system (one of the points of RFC 5039) can be built
> using mechanisms like feedbacks:
> http://tools.ietf.org/html/draft-niccolini-sipping-spam-feedback-00
> and spam scores:
> http://tools.ietf.org/html/draft-wing-sipping-spam-score-01
> of course there are privacy issues that apply (but this is 
> a problem of reputation systems as well) :-)
>   
There is a long way to go between a global reputation system and the 
drafts you mention above.

> It seems this list is converging to the point we tried to raise 
> since 2006, I should be happy :-)
>   

Nobody is saying that these mechanisms do not exist on paper. They just 
have a quite challenging deployment story and the protocol issue is the 
least problematic thing to worry about: it is the trust relationships 
you have to establish between the VoIP provider. If you think about a 
model similar to email then you will have a hard time to establish such 
an infrastructure.

Ciao
Hannes

> Saverio
>
> ============================================================
> Dr. Saverio Niccolini
> Senior Researcher
> NEC Laboratories Europe, Network Research Division	
> Kurfuerstenanlage 36, D-69115 Heidelberg
> Tel.     +49 (0)6221 4342-118
> Fax:     +49 (0)6221 4342-155
> e-mail:  saverio.niccolini@nw.neclab.eu <-- !!! NEW ADDRESS !!!
> ============================================================
> NEC Europe Limited Registered Office: NEC House, 1 Victoria
> Road, London W3 6BL Registered in England 2832014
>  
> _______________________________________________
> spitstop mailing list
> spitstop@listserv.netlab.nec.de
> https://listserv.netlab.nec.de/mailman/listinfo/spitstop
>   

_______________________________________________
Rucus mailing list
Rucus@ietf.org
http://www.ietf.org/mailman/listinfo/rucus