Subject: [domainrep] Multi-Party [Web of Trust] XML Queries

From: Paul Ferguson <[email-masked]>
Date: Thu, 12 Aug 2010 00:14:11 -0700

So, I was contacted by several parties who expressed interest in my earlier
mention of IODEF -- or something like it -- as a possible information
exchange mechanism.

I say "something like it" since it is simply nothing more than an
extensible XML query/response mechanism to exchange information.

It seems to me that, in contrast to trying to cram more stuff into DNS,
there is an alternative -- a "web" or multi-party XML query/response
entities.

This makes a lot of sense to me -- there is no need to define limitations
in this scheme, since each entity determines on their own with whom they
will query or respond.

In this scheme, the only work to be done is to determine how that data
would be encoded, any particular scalar ratings, etc.

$.02,

- - ferg

-- 
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 12 Aug 2010 10:22:40 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Paul Ferguson
> Sent: Thursday, August 12, 2010 12:14 AM
> To: [email-masked]
> Subject: [domainrep] Multi-Party [Web of Trust] XML Queries
> 

For the record, the arguments that have come up before against doing it this way have included:

- TCP is required for such a mechanism, and it's more heavyweight than UDP
- you get DNS caching, redundancy, etc. for free if you do it that way
- XML parsing is expensive compared to the amount of data you're encoding
- you need to use the DNS anyway to find the place where this service is listening
- nobody wants these complicated replies; the preference is just one or a few scalars

I don't know that I agree with any of these, but we should expect that any text we produce will need to discuss these points.

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 13 Aug 2010 13:02:46 +0200

> mention of IODEF -- or something like it -- as a possible information

Rather than the format, IODEF is relevant because incident handling is a good 
input for reckoning reputation.  Besides IODEF, which is oriented toward 
connection providers, MARF provides for a similar context in email.

As for the "Multi-Party", every admin that had an occasion to interact with a 
given domain's abuse team, is a "party" who provides part of the score.  When 
I, as an enquirer, retrieve the score of that domain, I'd obviously be more 
interested in the evaluations given by admins of domains I trust.  I propose 
no formula yet, but tend to consider the trust as a multiplicative factor, so 
that contributions to reputation scores are weighted according to the web of 
trust.