Subject: [domainrep] New to the reputation list

From: "David F. Skoll" <[email-masked]>
Date: Mon, 13 Jun 2011 10:07:15 -0400

Hello,

A colleague pointed me to this list, which has some interesting info on it.

We have had a reputation-collection system up and running for over
a year now and wrote an Internet draft detailing the reputation-collection
protocol.  Please see http://www.mimedefang.org/reputation for more info.

Our system operates well; we collect thousands of reputation events per
second on a single commodity Linux box with very low load.  Our system
is much more low-level and limited than the drafts mentioned on the list,
but it does have the virtue of being working code. :)

Naturally, if there's a process of standardizing reputation collection
and dissemination, I'd like to be involved.  We would prefer to use a
standard system than continue our own development independently from
the rest of the Internet community.

Just some observations on the drafts I've read so far:

I think HTTP/XML for reputation reporting is a non-starter.  It's far
too verbose, cpu-intensive and bandwidth-intensive.  You need to think
about a system that can collect tens to hundreds of thousands of
reputation events per second.  (HTTP/XML for reputation dissemination
might work, though.)

Echoing a comment from John Levine, you need to collect both "good" and
"bad" events for a reputation system to be useful.

I think there should be some discussion of how to *use* reputation data.
Given that a system's reputation can be multidimensional (there are several
orthogonal reputation measurements), it's not always clear what to do
with the reputation data.  It's probably not possible to dictate how to
use the reputation data, but there should be some recommendations.

Regards,

David.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 13 Jun 2011 09:27:58 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of David F. Skoll
> Sent: Monday, June 13, 2011 7:07 AM
> To: [email-masked]
> Subject: [domainrep] New to the reputation list
> 
> Hello,
> 

Welcome!

> a year now and wrote an Internet draft detailing the reputation- collection

I think that's the goal.  The protocols that have been proposed so far mostly deal with a client asking a server "What is the reputation of X?", not so much the exchange of the events that comprise the ultimate answer to that question.  It could be though that that's something this group could (and should) tackle.  What you have at the above URL could be a starting point.  (It's expired; you might want to post an update.)

> "bad" events for a reputation system to be useful.

I don't remember anything in the current drafts that constrains the system to making only "good" assertions.  Certainly some of the examples like SENDS-SPAM aren't "good".  Or did you have something else in mind?

There was also some hallway track chatter at MAAWG that suggested being able to express a reputation between -1 and 1, rather than 0 and 1.

> use the reputation data, but there should be some recommendations.

A BCP, once we have enough field experience, seems entirely appropriate to me.  We could add that to the charter.

-MSK

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 13 Jun 2011 10:30:50 -0600

On 6/13/11 10:27 AM, Murray S. Kucherawy wrote:

> There was also some hallway track chatter at MAAWG that suggested
> being able to express a reputation between -1 and 1, rather than 0
> and 1.

FWIW, that's how I've always thought of it -- an entity that is new to
the network starts out at zero, and depending on its behavior it will be
modded up or down.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 13 Jun 2011 09:32:37 -0700

> From: Peter Saint-Andre [mailto:[email-masked]]
> Sent: Monday, June 13, 2011 9:31 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> Subject: Re: [domainrep] New to the reputation list
> 

Could be, but it depends on the assertion.  For example, I can't think of what a negative number for SENDS-SPAM would be.  (Eats spam, perhaps?)

Maybe that just means we standardize on -1 to 1, and specify that assertions have to be crafted accordingly.

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 13 Jun 2011 10:36:15 -0600

On 6/13/11 10:32 AM, Murray S. Kucherawy wrote:
>> -----Original Message----- From: Peter Saint-Andre
>> [mailto:[email-masked]] Sent: Monday, June 13, 2011 9:31 AM To:
>> Murray S. Kucherawy Cc: [email-masked] Subject: Re: [domainrep]
>> New to the reputation list
>> 
>> FWIW, that's how I've always thought of it -- an entity that is new
>> to the network starts out at zero, and depending on its behavior it
>> will be modded up or down.
> 
> Could be, but it depends on the assertion.  For example, I can't
> think of what a negative number for SENDS-SPAM would be.  (Eats spam,
> perhaps?)
> 
> Maybe that just means we standardize on -1 to 1, and specify that
> assertions have to be crafted accordingly.

I tend to think of things in terms like "reputation as a sender of
email". If I send messages that are useful, I get modded up (like
Slashdot "+1 insightful" or whatever), whereas if I send messages that
are annoying I get modded down. However, "good" or "bad" don't need to
be subjective judgements, they could be things like "uses DKIM" or
"signs messages with a cert or key" etc.

Just my gram of silver, mind you...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 13 Jun 2011 09:37:59 -0700

> Sent: Monday, June 13, 2011 9:36 AM
> To: Murray S. Kucherawy
> Cc: [email-masked]

I suppose the registry for vocabularies could include a field that indicates whether or not negative values are legal for that vocabulary.

---

From: "David F. Skoll" <[email-masked]>
Date: Mon, 13 Jun 2011 12:51:07 -0400

On Mon, 13 Jun 2011 09:32:37 -0700
"Murray S. Kucherawy" <[email-masked]> wrote:

> think of what a negative number for SENDS-SPAM would be.

It'd be SENDS-HAM.  It's important to capture that.  It's why
our reputation system lists Yahoo! mail servers (for example... I don't
mean to pick on Yahoo!) as "mixed" rather than good or bad.

Regards,

David.

---

From: <[email-masked]>
Date: Mon, 13 Jun 2011 12:09:24 -0500

It all depends on what 0 means in this case.  If you have a reputation system that has extensive coverage and a long memory then a new sender may be a cause for suspicion merely because it is new, before other behavior attributes are factored in (which could increase the trustworthiness of a new sender appropriately). 

--adam

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Peter Saint-Andre
> Sent: Monday, June 13, 2011 12:31 PM
> To: Murray S. Kucherawy
> Cc: [email-masked]
> and
> > 1.
> the network starts out at zero, and depending on its behavior it will
> be modded up or down.
> 
> Peter
> 
> --
> Peter Saint-Andre
> https://stpeter.im/
> 
>