Re: [Rucus] [spitstop] Botnets, take 2... Re: Draft RUCUS charter

["Saverio Niccolini" <[e-mail]>]

Hannes, all,

> Let's take an example:
> When Henning's host is compromised and a bot is using 
> Henning's account to send me spam then I would contact 
> Henning (by using various ways) to tell him that something is 
> wrong with his PC/phone/etc. I would not tell my VoIP 
> provider that there is something wrong with Henning's account. 
> Typically, this will lead to more problems rather than less 
> -- such as no communication to Columbia University anymore 
> because my VoIP provider just blocks all calls from that domain.
> 
> (Just to reflect my experience with email problems in the company....)

You do not contact Henning directly to tell him that something
is wrong. You have to rely on your infrastructure to take the
necessary countermeasures otherwise it is the anarchy...

That is why exchanging reputation of identities (as perceived by
end-users or domains) is an important building block.
Such reputation system (one of the points of RFC 5039) can be built
using mechanisms like feedbacks:
http://tools.ietf.org/html/draft-niccolini-sipping-spam-feedback-00
and spam scores:
http://tools.ietf.org/html/draft-wing-sipping-spam-score-01
of course there are privacy issues that apply (but this is 
a problem of reputation systems as well) :-)

It seems this list is converging to the point we tried to raise 
since 2006, I should be happy :-)

Saverio

============================================================
Dr. Saverio Niccolini
Senior Researcher
NEC Laboratories Europe, Network Research Division	
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     [phone]
Fax:     [phone]
e-mail:  [e-mail] <-- !!! NEW ADDRESS !!!
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014
 
_______________________________________________
Rucus mailing list
[e-mail]
http://www.ietf.org/mailman/listinfo/rucus