Subject: RE: [Asrg] 2. Improving Blacklists and Reputation Services

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Feb 2004 13:39:28 -0800

> There is a big difference between accreditation and 
> reputation. Lumping 
> them together like your draft does not seem to be a good idea.

Perhaps, but how do I know Yakov's reputation? I have to ask someone. And
they cannot tell me Yakov's reputation, they can only tell me their opinion
of his reputation.

> Additionally, why resort to DNS if other possible ways are 
> possible for 
> retrieving such data. Some ISPs might even want to use bulk 
> methods. 

This is possible and even likely. But I see that as an optimization rather
than a base protocol. 

In the original spec I proposed supporting different access protocols and
folk said, no just try with one to start. Everyone seemed to think that
there would have to be a DNS scheme as a minimum.

> The 
> DNS packet size might also be an issue if the reputation and 
> accreditation data is rather large. There is also no indication of what 
> the values measure. Multiple values are possible. If an ISP subscribes 
> or gets data from a specific reputation service like MAPS, then it is 
> very likely that other methods aside from DNS can be used.

That is the role of the meta-data record. Here it would be easiest if it was
possible to go to XML for the description.

> Additionally, if you have both, than new MTAs on the Internet do not 
> need to pay money to someone in order to get accreditated, 
> rather they 
> can use build their reputation over time. Or they can start with 
> accrediation and then switch to reputation services once their 
> reputation has been established.

The draft allows for multiple accreditations of different types. You can
have as many accreditations as you can get into your DNS records.

what type of accreditation you need is likely to depend on what you want to
do. A business sending out a lot of contracts is likely to be a lot more
concerned about their mail getting through than joe average.

		Phill 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 09 Feb 2004 16:45:08 -0500

> they cannot tell me Yakov's reputation, they can only tell me their opinion

Correct which is what the current blacklists do. It is upto you to 
figure out whose opinions you trust. An accrediation service is vouching 
  for someone, a reputation service is stating an opinion of someone's 
reputation. The two things are different.

> possible to go to XML for the description.

Perhaps we should just discuss what goes into it first, before 
discussing how its stored and queried.

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I want to know G-d's thoughts... the rest are details" (Albert Einstein)
-------

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 9 Feb 2004 18:47:39 -0500 (EST)

Yakov Shafranovich <[email-masked]> wrote:

> An accrediation service is vouching for someone, a reputation
> service is stating an opinion of someone's reputation. The two
> things are different.

How are they different (in any way that matters to me)?  In both
cases, a third party X is saying something to the effect of "I think
you should trust Y."  (Or is it that accreditation can only be
positive, while reputation can be positive or negative?  In that case,
I see no reason for accreditation services since they're strictly a
subset of reputation services.)

Seth

---

From: "Walter Dnes" <[email-masked]>
Date: Wed, 11 Feb 2004 00:13:32 -0500

On Mon, Feb 09, 2004 at 06:47:39PM -0500, Seth Breidbart wrote
> subset of reputation services.)

  I interpret accreditation to mean testifying to known facts.  E.g. the
company using a certificate is XYZ.  Reputation is more word-of-mouth,
or what the community *THINKS* of someone's character.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: George Schlossnagle <[email-masked]>
Date: Wed, 11 Feb 2004 09:07:41 -0500

> or what the community *THINKS* of someone's character.

Accreditation to me involves an official, recognizable entity 
certifying that the party in question meets some sort of standard.  
This accrediting entity should be widely recognized as being able to 
provide this sort of assessment without need for corroborating support.

Reputation is a less-formal aggregate measure formed from the 
collective opinion of a community.

The difference to me is that with accreditation you can point back to a 
single entity as the source, while with reputation you cannot.

George

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 11 Feb 2004 13:00:31 -0500 (EST)

> provide this sort of assessment without need for corroborating

"official" according to whom?  "widely recognized" among whom?

> collective opinion of a community.

Defined how?

Where would you place something like SPEWS?  It seems to me that just
about all of the interesting cases don't meet either of those
definitions.

Seth

---

From: George Schlossnagle <[email-masked]>
Date: Wed, 11 Feb 2004 13:17:51 -0500

> "official" according to whom?  "widely recognized" among whom?

Well that's the rub, eh?  The validity of an accrediting entity is 
always questionable.  If you look at most accreditations in meatspace, 
you end up with the same issue.  In general, unless the accrediting 
entity is granted there powers legally, the legitimacy of such an 
entity rests with the community.

> about all of the interesting cases don't meet either of those

Well, why do all cases have to fall into those two categories?  I would 
say that SPEWS is neither.  It certainly is not an accreditor, as

a) it does not certify anyone
b) it bills itself only as a reporting service, not a policy service

I don't think it's a reputation system either, though you could make 
the claims that they provide a gateway into a reputation service (since 
the accumulate reports and make listing judgements based on the 
aggregated info) or that the public dnsrbls collectively form a 
reputation service.

I see SPEWS as a watchdog group, which is a third type of system.  
BondedSender is probably the closest thing to an 'accreditor' for 
email.

George