RE: [Asrg] 2. Improving Blacklists and Reputation Services

["Hallam-Baker, Phillip" <pbaker at verisign.com>]

> There is a big difference between accreditation and 
> reputation. Lumping 
> them together like your draft does not seem to be a good idea.

Perhaps, but how do I know Yakov's reputation? I have to ask someone. And
they cannot tell me Yakov's reputation, they can only tell me their opinion
of his reputation.


> Additionally, why resort to DNS if other possible ways are 
> possible for 
> retrieving such data. Some ISPs might even want to use bulk 
> methods. 

This is possible and even likely. But I see that as an optimization rather
than a base protocol. 

In the original spec I proposed supporting different access protocols and
folk said, no just try with one to start. Everyone seemed to think that
there would have to be a DNS scheme as a minimum.

> The 
> DNS packet size might also be an issue if the reputation and 
> accreditation data is rather large. There is also no indication of what 
> the values measure. Multiple values are possible. If an ISP subscribes 
> or gets data from a specific reputation service like MAPS, then it is 
> very likely that other methods aside from DNS can be used.

That is the role of the meta-data record. Here it would be easiest if it was
possible to go to XML for the description.

> Additionally, if you have both, than new MTAs on the Internet do not 
> need to pay money to someone in order to get accreditated, 
> rather they 
> can use build their reputation over time. Or they can start with 
> accrediation and then switch to reputation services once their 
> reputation has been established.

The draft allows for multiple accreditations of different types. You can
have as many accreditations as you can get into your DNS records.

what type of accreditation you need is likely to depend on what you want to
do. A business sending out a lot of contracts is likely to be a lot more
concerned about their mail getting through than joe average.

		Phill 

_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg