<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div>Hans-Martin Mosner wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div class="moz-cite-prefix">One problem with the approach is that there isn't a single measure of badness, as the topic list already shows. It's a multi-dimensional vector, and its dimensions are not easily defined in a non-controversial way. The criteria
for including a network in a top N list will therefore be unavoidably subjective.</div>
<p>In the process of thinking about ways to tackle e-mail abuse (which doesn't even show in your list, probably because it's not really a problem for network operators but only for mail operators) I came up with some ideas about a distributed reputation network
that might have some desirable properties:</p>
<ul>
<li>Separation of network and resource owner observations and policy decisions:<br>
It would be very helpful to have multiple independent and reliable sources listing type and severity of network abuse in real time, but I'd like to define my own policy rules and use those abuse metrics as input for policy decisions. As a mail operator, I might
be personally very concerned about malware hosting, but the things that would affect my blocking policy are spam volume and mail account bruteforce attacks (and to some extent, DDOS traffic). Network operators may have different policies to protect the integrity
of their networks and implement legally required rules.</li></ul>
</blockquote>
<div><br>
</div>
<div>I agree. There are two points. First to agree on a list of observations/metrics, so that everyone categorises things the same way. This should be relatively simple.</div>
<div>And then, hopefully, some kind on agreement on a recommended threshold. Or a set of thresholds depending on the tolerance (which also allows initiatives like AAN to start gradually).</div>
<div><br>
</div>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<ul>
<li>Distributed P2P database:<br>
I'm thinking about something like a cryptocurrency blockchain or the PGP web of trust, which avoids having a single point of failure and also avoids a single hierarchy of trust. Cryptography provides some excellent tools, but apart from the ubiquitous TLS (and
the mentioned blockchain systems) it's used much too sparingly in securing information integrity.</li></ul>
</blockquote>
<div><br>
</div>
<div>Cryptocurrency blockchains are not a good tool, but I completely agree.</div>
<div>Validation should be included from the beginning. It can be as simple as including signatures. Similar to Certificate Transparency servers.</div>
<div><br>
</div>
<div>Note you also need to define who is allowed to send there if you expect "everybody" to consume it. This is similar to your following point:</div>
<div><br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<ul>
<li>Reputation metrics:<br>
It should be possible to assert not only observations of network behavior, but also reputation statements about the publishers of such observations. This makes evaluating the trustworthyness of a reporter possible, and with enough participants could provide
a relatively unbiased view.</li></ul>
</blockquote>
<div><br>
</div>
<div>although I was thinking in a bad actor flooding the database with useless observations in order to make it inoperative.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Best regards</div>
<div><br>
</div>
<div><br>
</div>
<div><span>
<pre><pre>-- <br></pre>INCIBE-CERT - Spanish National CSIRT
https://www.incibe-cert.es/
PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys
====================================================================
INCIBE-CERT is the Spanish National CSIRT designated for citizens,
private law entities, other entities not included in the subjective
scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen
Jurídico del Sector Público", as well as digital service providers,
operators of essential services and critical operators under the terms
of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de
las redes y sistemas de información" that transposes the Directive (EU)
2016/1148 of the European Parliament and of the Council of 6 July 2016
concerning measures for a high common level of security of network and
information systems across the Union.
====================================================================
In compliance with the General Data Protection Regulation of the EU
(Regulation EU 2016/679, of 27 April 2016) we inform you that your
personal and corporate data (as well as those included in attached
documents); and e-mail address, may be included in our records
for the purpose derived from legal, contractual or pre-contractual
obligations or in order to respond to your queries. You may exercise
your rights of access, correction, cancellation, portability,
limitationof processing and opposition under the terms established by
current legislation and free of charge by sending an e-mail to
dpd@incibe.es. The Data Controller is S.M.E. Instituto Nacional de
Ciberseguridad de España, M.P., S.A. More information is available
on our website: https://www.incibe.es/proteccion-datos-personales
and https://www.incibe.es/registro-actividad.
====================================================================
</pre>
</span></div>
<style>@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}div.WordSection1
{page:WordSection1;}ol
{margin-bottom:0cm;}ul
{margin-bottom:0cm;}</style>
</body>
</html>