Re: [Asrg] 7. Best Practices - DNSBLs

[Brad Knowles <brad.knowles@skynet.be>]

At 3:59 PM -0400 2003/08/13, Chris Lewis wrote:

>  =head2 Listings should be temporary
>
>  Listings should all be temporary (suggested default listing period:
>  24 hours L</Footnote1>) so that if your blacklist doesn't get around
>  to removing the entry then it times out at some point in the future.
	Fine, but if the entry is removed and then you discover reason to 
put it back again (maybe because of a re-scan, or whatever), then the 
next timeout should be longer.

	I'd recommend something like a bounded exponential backoff.

>  =head2 Reasonable re-scan periods
>
>  If the blacklist uses re-scans to determine whether the listing
>  should timeout or not, the re-scan period should be reasonable.
	Again, I'd recommend bounded exponential backoff.

	Moreover, I think I'd probably move someone from the "confirmed" 
list to the "probationary" list immediately, then investigate their 
claims of being cleaned up.  They might have to stay on the 
probationary list for a while before I'd be willing to let them off 
completely.  If they ever came back, they'd stay on the main list a 
lot longer, have to stay on the probationary list a lot longer the 
next time they claim to be cleaned-up, etc....


	Other than that, it seems to be reasonable.  I look forward to 
seeing an expanded version that details tools and methods that can be 
used to run a real-world black list.

--
Brad Knowles, <brad.knowles@skynet.be>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
    -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg