Subject: RE: [Asrg] 2. Improving Blacklists and Reputation Services

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 11 Feb 2004 13:53:08 -0800

> Some years ago I saw a long essay posted on the web with a 
> title something
> like "DNS makes a bad distributed database for things other 
> than domain
> names". It was written in the style of an RFC, but it doesn't 
> look like it
> was ever made part of the series. 

I seem to recall John Klensen getting irate about all sorts of 
junk just getting thrown in without any sort of architecture.
There was a presentation at an IETF.

I think that a lot of his points were on the issue of fuzzy match
though. DNS is fast because it is an exact match scheme. Try to
fuzz it or include search (aka X.500, LDAP or other failures)
and it goes bazzzongo.

I agree in principle, but disagree that there is no architecture.
We could have one, just insist that the SPF TXT record uses
the _SPF prefix.

It is an entirely logical extension to the DNS. Instead of 
extending through the RR system we extend through the name 
system.

> I would add that the use of DNS for distributing RBL information has a
> remarkable breadth of support covering all major open source and
> proprietary MTAs, and could better be held up as a model for 
> imitation,
> rather than carping about minor shortcomings. 

The other information point here is that there has been
a lot of work on Web Services and WSDL and WS-Policy and
that can all be run back to the DNS through appropriate
syntax modifications.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 11 Feb 2004 17:32:41 -0500

> that can all be run back to the DNS through appropriate

Would there be a benefit to the community:
1. Codifying the existing BCPs, protocols and formats in use.
2. Researching future possible formats and protocols.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"But in this world nothing can be said to be certain, except death and 
taxes" (Benjamin Franklin)
-------

---

From: david <[email-masked]>
Date: Wed, 11 Feb 2004 17:05:17 -0600

I have been of the opinion since late 2002 that DNS would make perfect sense
as the way to distribute *PERSONAL* (not per-domain) RMX information.

Furthermore I think Verisign (who has at least two people who read this 
list)
would be the perfect entity to unilaterally initiate such a project, 
since they
(some of them, at least) would like to see everyone have a personal domain.

Personal RMX information in your personal domain.   Or at least
a protocol for listing personal RMX information with the domain of which
you are a member:  when your e-mail addy is [email-masked] your RMX
host listings would appear under d.c.b.a.you.rmx.your.domain where a.b.c.d
are the dotted-quad IPv4 addresses of the hosts you use.

Yakov Shafranovich wrote:

>>> proprietary MTAs, and could better be held up as a model for imitation,