RE: a business opportunity?

["Tomas L. Byrnes" <tomb () byrneit net>]

The real solution to the scorched earth problem is for aging from
blacklists to be dynamic.

If a given IP hasn't spammed or otherwise been naughty in some period of
time, and the RP contact information for that netblock exists and
responds, then the benefit of the doubt should go to the neblock
owner/operator, and the IP(s) delisted.

There's been some work done @ SRI on using a weighting algorithm that
includes things like prevalence, persistence, and "badness", with a
Gaussian decay function as to time, to establish cut levels for what
should be blocked. 

Look at Phil Porras work, and Usenix presentations.

> -----Original Message-----
> From: Paul Vixie [mailto:vixie () isc org] 
> Sent: Saturday, July 05, 2008 2:57 PM
> To: nanog () merit edu
> Subject: Re: a business opportunity?
>
> randy () psg com (Randy Bush) writes:
>
> > if the ipv4 free pool run-out produces a lot of address 
> shifting and 
> > recycling of old address space, will there be a market in clean-up 
> > services such as the above.  give them your newly-acquired address 
> > space for two months before you need to use it, and they 
> will test and 
> > scrub and write and beg and whine on nanog?  it could be 
> that one or 
> > two reputable clean-up folk could develop history with the various 
> > blockers and be able to get the job done better than we 
> could do it ourselves.
>
> reputation-washing is an inherently nonscalable business.  
> dirty blocks that go back to the washer will be harder and 
> harder to re-clean once the victims harken to the 
> repeat-business aspects of the activity.  dirty users will go 
> on incorporating a new LLC every week so as to appear to be a 
> new and different entity as often as they need to, to avoid 
> regulations linked to one's past reputation.
>
> now, a business whereby small discontugous blocks could be 
> traded in (with some cash perhaps) for a contiguous block of 
> the same total size, that'd be interesting.
> --
> Paul Vixie
>
> --
> This message has been scanned for viruses and dangerous 
> content by MailScanner, and is believed to be clean.