Re: [Secdispatch] [Smart] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Eliot Lear <[e-mail]>]

Hi Bret,

> 
> 1) Is the content or content provider that the user is going to compromised and trying to attack the endpoint?
> 2) Is the content provider that the user is going to a stage 2 delivery site?
> 3) Is the content provider that the user is going to the location for outbound malicious content (data exfiltration, CnC traffic)
> 4) Is the content provider that the user is going to adversely tracking and monitoring everything the end client does, aka active surveillance versus passive surveillance?
> 5) Is the remote site that the user did not go to attack the end point.

While we tend to think of endpoints as being equivalent in class, in which case your use of the term "content provider” would be somewhat redundant, from a scaling perspective I am far more concerned about unwatched unmanaged endpoints than I am about content services.  And again, to me it is a matter of what problems I think might be tractable.

Eliot