Subject: [Rucus] ARF BoF: no SIP?

From: "Dan Wing" <[email-masked]>
Date: Thu, 17 Sep 2009 17:11:01 -0700

http://www.ietf.org/mail-archive/web/apps-discuss/current/msg00833.html
http://trac.tools.ietf.org/bof/trac/wiki

Interesting that while they list SSH, FTP, and "web server" attacks as
possible extensions, but SIP isn't listed.

Anyone want to tackle that one?

-d

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 17 Sep 2009 18:20:48 -0600

> possible extensions, but SIP isn't listed.

Yes, including VoIP and IM attacks would be worthwhile...

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: John Levine <[email-masked]>
Date: 19 Sep 2009 02:00:41 -0000

>possible extensions, but SIP isn't listed.

I'll throw it into the pot.

Although there are people who wish it were otherwise, the current ARF
format is tightly tied to reporting metadata about an individual
e-mail message, and that's not likely to change.

There's interest in a more general abuse report, but I have not yet
succeeded in getting people to explain why, other than a dislike of
XML, we wouldn't just be doing a rerun of INCH.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor
"More Wiener schnitzel, please", said Tom, revealingly.

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 20 Sep 2009 08:52:38 -0700

> >Interesting that while they list SSH, FTP, and "web server" 
> >attacks as possible extensions, but SIP isn't listed.
> 

Dunno.  I'm not familiar with INCH and currently not connected to
the Internet to figure out what it is.

My only thought is that if ARF is going to be extended to cover
things like SSH and FTP attacks, it should also cover SIP (and, 
to Peter's point) and XMPP.

SIP and XMPP are much more similar to email than ssh, as well
(From/To headers and suchlike), which may ease extending ARF
to cover SIP/XMPP than the complications of extending ARF to
report abuse of a service such as ssh.

-d

---

From: John R Levine <[email-masked]>
Date: Sun, 20 Sep 2009 12:02:45 -0400 (EDT)

> the Internet to figure out what it is.

It's an old IETF WG, which produced an incident reporting format called 
IODEF which is simultaneously reviled for being too complex, because it's 
in XML, and at the same time for not having enough specific features for 
everyone's favorite online evils.  Personally, I think it's ugly but I 
doubt anything useful could be much less ugly, and that efforts to turn 
ARF into a general reporting format will end up with a mess that is too 
underspecified to interoperate.

> to Peter's point) and XMPP.

Oh, sure.  Indeed, they fit into ARF a lot better than SSH does since they 
have something that obviously makes sense as the included 2822 message, 
but I hope I can keep ARF for mail and do something else for all the other 
kinds of evil.

R's,
John

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 20 Sep 2009 09:21:52 -0700

> but I hope I can keep ARF for mail and do something else for 
> all the other kinds of evil.

Sounds reasonable for ARF.

RUCUS, if it ever gets off the ground, could look at ARF as a 
baseline to extend into SIP-ARF or something.

-d