Subject: [domainrep] What's in scope and what's not

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Tue, 31 Aug 2010 00:02:26 +0200

Hi, all

as promised, in addition to the list of (tentative) requirements, sent 
to this list by Alessandro, I have tried to gather information from the 
discussions about 'scope'. We have seen a number of discussions, which 
sometimes were more or less in scope, some of them in part or in whole 
out of scope. But we can only say 'in scope' or 'out scope' if we first 
define what that scope exactly is. What are we trying to describe? 
Again, I have here and there copy-and-past'ed words or sentences from 
contributions to the list.

What should be in scope (according to some):

    * just protocol, i.e. specification of how to ask a question and get
      an answer, versus which questions should be asked
    * just syntax
    * Asking about a domain name's reputation
    * not only e-mail

What should be out of scope (according to some):

    * semantics
    * how to pick which domain name to ask about
    * what data is used to construct the answer
    * secret sauce of Domain Reputation Provider
    * whether the Domain Reputation Requester must first authenticate
      the domain before querying the Domain Reputation Provider

Question:

    * is the way Domain Reputation Providers exchange their reputation
      information (between Domain Reputation Providers) in scope? Some
      say 'yes', but isn't that adding a complexity factor?
    * is the following question in scope, or out scope:
      if the unit of reputation c.q. the granularity of reputation is a
      single domainname, how can reputations be differentiated between
      different web pages within the same domain (e.g. big ISP or ESP or
      content provider); a similar question can be asked about
      differentiating between reputations of mail addresses within a
      domain. Is this discussion in scope?

/rolf

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 31 Aug 2010 08:18:20 +0100

On 30/08/10 23:02, Rolf E. Sonneveld wrote:
> discussions about 'scope'. 

This may have come up in the requirements thread (if so, sorry, I'm
catching up from vacation;-), but I think considerations related to
the requestor's privacy should be in scope. I guess the main
concern would be that the service provider (or someone else) should
not be easily able to track the list of domains of interest to a
requestor.

For a DNS based solution, that can be achieved to an acceptable
level for free or nearly free, but for the large query/response
model, it can be a good bit of work. (And may be an example of
where the "large" protocol differs substantively from the "small"
one.)

S.

---

From: "Rolf E. Sonneveld" <[email-masked]>
Date: Wed, 01 Sep 2010 00:05:13 +0200

> not be easily able to track the list of domains of interest to a

That's a good one! I believe this has not been discussed before on this 
list and you're the first here to mention it. IMO this requirement is 
definitely in scope and is important enough to be included in a document 
about domain reputation.

> level for free or nearly free,

Can you elaborate?

> but for the large query/response

Why would the large query/response be very different from the small one? 
After all, the 'unit of query' is a domain name (or uri), and not the 
small amount of data (small query) or large amount of data (large query) 
that will be returned for the domain/uri.

/rolf

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 31 Aug 2010 15:31:22 -0700

(as participant)

On Aug 30, 2010, at 3:02 PM, Rolf E. Sonneveld wrote:

> 	• is the way Domain Reputation Providers exchange their reputation information (between Domain Reputation Providers) in scope? Some say 'yes', but isn't that adding a complexity factor?

Why would it be different from the way a Domain Reputation Provider gives information to any other querant?

> 	• is the following question in scope, or out scope:
> if the unit of reputation c.q. the granularity of reputation is a single domainname, how can reputations be differentiated between different web pages within the same domain (e.g. big ISP or ESP or content provider); a similar question can be asked about differentiating between reputations of mail addresses within a domain. Is this discussion in scope?

If the identifier is a domain name construct, then those would be out of scope.  If we're talking about any random text string that might possibly be construed to be an identifier, then they'd be in scope.  I'd prefer the former, because it seems far more achievable and has immediate value.

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 31 Aug 2010 15:32:46 -0700

> not be easily able to track the list of domains of interest to a

Interesting!  I hadn't considered this possibility, probably because it doesn't exist in any current reputation framework.  Which concern(s) does it solve?

---

From: Douglas Otis <[email-masked]>
Date: Tue, 31 Aug 2010 16:33:01 -0700

On 8/31/10 3:05 PM, Rolf E. Sonneveld wrote:
> That's a good one! I believe this has not been discussed before on 
> this list and you're the first here to mention it. IMO this 
> requirement is definitely in scope and is important enough to be 
> included in a document about domain reputation.
Well, it has been, but perhaps only in passing.

http://www.ietf.org/mail-archive/web/domainrep/current/msg00179.html

>> level for free or nearly free,
For an example see:
ftp://ftp.isc.org/isc/dnsrpz/isc-tn-2010-1.txt

Sharing this type of information would be a way to quickly remove 
threats published in DNS.  This seems inexpensive in terms of resources 
and performance, and a need to modify existing applications and services.
> Why would the large query/response be very different from the small 
> one? After all, the 'unit of query' is a domain name (or uri), and not 
> the small amount of data (small query) or large amount of data (large 
> query) that will be returned for the domain/uri.
There is a substantial difference between responding to query for any 
domain, or responding to a specific category of domains.  And an even 
bigger difference when responding to specific categories of URIs, where 
a fair percentage will not fit within a DNS query.

Often the round trip needed to establish TCP connections is considered 
an undesirable overhead which seems to suggest that only information 
within a very limited category of domains can be collected.  Such as 
domains not yet taken down by authorities currently engaged in criminal 
activity such as the distribution of malware, or phishing of unwary victims.

-Doug