Subject: Re: [mile] XMPP incident reporting extension

From: <[email-masked]>
Date: Tue, 15 May 2012 13:26:09 -0400

I should have noted that their intent was to cover incidents relevant to XMPP only, so it may be the operators/administrators of XMPP that would be the users (if they are actively using it).  Similar to the MARF effort that is specific to mail abuse between mail operators. A formal binding that lets us map between these efforts could be helpful.  For MARF, there was a proposed MARF extension to IODEF to fill that gap, but was just proposed.

Peter's IETF role: Peter Saint-Andre is currently co-director of the IETF Applications Area and also has served as Executive Director of the XMPP Standards Foundation since 2002.

Best regards,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Tuesday, May 15, 2012 1:12 PM
To: [email-masked]; [email-masked]
Subject: Re: XMPP incident reporting extension 

This was recently implemented as you noted.  Peter St. Andre was the catalyst to make this happen, he is an AD in the IETF.  He reached out after they announced it for me to take a look from a MILE perspective (IODEF/RID, etc.).  Pretty cool!

Best regards,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Tuesday, May 15, 2012 12:25 PM
To: [email-masked]
Subject: XMPP incident reporting extension 

Just got updated to use IODEF last month! Contains its own tiny version of RID, too, kinda.

http://xmpp.org/extensions/xep-0268.html

How widespread is XMPP server-to-server incident reporting/notification? People actually do this?

 - Tom Millar, US-CERT

[email-masked]
BB: [email-masked] / 202-631-1915
24x7: [email-masked] / 888-282-0870

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 16 May 2012 10:40:59 -0600

On 5/15/12 11:26 AM, [email-masked] wrote:
> I should have noted that their intent was to cover incidents relevant
> to XMPP only, so it may be the operators/administrators of XMPP that
> would be the users (if they are actively using it). 

It's not actively in use yet. I need to clean up the spec some more and
then write some code or convince others to do so. However, there is
definitely interest in implementing and deploying it among developers of
XMPP server software and operators of XMPP services.

> Similar to the
> MARF effort that is specific to mail abuse between mail operators. A
> formal binding that lets us map between these efforts could be
> helpful.  For MARF, there was a proposed MARF extension to IODEF to
> fill that gap, but was just proposed.

>From what I understand of the MARF extension, that sounds correct. In
particular, we're not defining an XMPP transport binding for IODEF or
RID, just a use of IODEF (with, as Tom noted, some RID-like semantics)
for the XMPP network.

> Peter's IETF role: Peter Saint-Andre is currently co-director of the
> IETF Applications Area and also has served as Executive Director of
> the XMPP Standards Foundation since 2002.

Actually my IESG term ended at IETF 83, so now I'm just a regular IETF
contributor again. :)

Thanks for your interest!

Peter

> -----Original Message----- From: [email-masked]
> [mailto:[email-masked]] On Behalf Of
> [email-masked] Sent: Tuesday, May 15, 2012 1:12 PM To:
> [email-masked]; [email-masked] Subject: Re: XMPP incident
> reporting extension
> 
> This was recently implemented as you noted.  Peter St. Andre was the
> catalyst to make this happen, he is an AD in the IETF.  He reached
> out after they announced it for me to take a look from a MILE
> perspective (IODEF/RID, etc.).  Pretty cool!
> 
> Best regards, Kathleen
> 
> -----Original Message----- From: [email-masked]
> [mailto:[email-masked]] On Behalf Of
> [email-masked] Sent: Tuesday, May 15, 2012 12:25 PM To:
> [email-masked] Subject: XMPP incident reporting extension
> 
> How widespread is XMPP server-to-server incident
> reporting/notification? People actually do this?
> 
> - Tom Millar, US-CERT
> 
> [email-masked] BB: [email-masked] / 202-631-1915

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 16 May 2012 11:00:00 -0600

A follow-up about RID...

> RID, just a use of IODEF (with, as Tom noted, some RID-like semantics)

If there's wider interest in an XMPP transport binding for IODEF/RID,
then I could put some work into defining it. Currently we have a need on
the XMPP network for communication among XMPP servers about incidents on
the XMPP network, which is where XEP-0268 came from. I only recently
changed the payload format to use IODEF. When doing that, I realized
that some RID-like semantics would also be useful, but some of those
mapped quite closely to the existing semantics of the XMPP "IQ" stanza
type from RFC 6120, so it seemed sensible to just use XMPP primitives
for our limited use case. Naturally, if an XMPP server is being used as
a front end for reporting of more generalized incidents then we'll want
to revisit some of the decisions I made when working on version 0.4 of
XEP-0268.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Diego R. Lopez" <[email-masked]>
Date: Sat, 19 May 2012 23:07:38 +0000

Hi,

> to revisit some of the decisions I made when working on version 0.4 of

We have a project proposal in which such a transport binding would
be extremely interesting.

Hope this widens interest.

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
http://people.tid.es/diego.lopez/

e-mail: [email-masked]
Tel:    +34 913 129 041
Mobile: +34 682 051 091
-----------------------------------------

________________________________

Este mensaje se dirige exclusivamente a su destinatario. Puede consultar nuestra política de envío y recepción de correo electrónico en el enlace situado más abajo.
This message is intended exclusively for its addressee. We only send and receive email on the basis of the terms set out at.
http://www.tid.es/ES/PAGINAS/disclaimer.aspx

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 21 May 2012 09:06:24 -0600

> Hope this widens interest.

Thanks for the expression of interest. I'll give some further thought to
working on that binding. It should be pretty straightforward...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/