On 1/25/07, Tony Finch <dot(_at_)dotat(_dot_)at> wrote:
"Martin Hannigan" <hannigan(_at_)gmail(_dot_)com> wrote:
>
>If I had to pick a technology priority to pique my interest for '07,
>that I would
>consider proposing as a spending item to "make mail better", it would
>be centered around IP reputation.
DNS blacklists have been around for a decade.
<delurk>
"IP reputation" is a different concept than black list. By tracking
the historical behavoir
of /32's or larger allocations, we could develop a profile of the
behaviors that will eventually
establish a baseline for those allocations as "good" "nuetral" or
"bad", to keep it kind of simple. A lot of this data is already out
there.
Take the case of 60 /8 (IIRC). It was allocated to APNIC by IANA and
almost immediately
spammers began unauthorized advertisements of prefixes high in this
block, "politely" staying ahead of the RIR allocations, but using them
as "fresh" address space. In a reputation system, those blocks would
likely be marked bad since they are unallocated
at the RIR level. Since they are allocated out of IANA, they would be
legitimate to most
RBL's until they were caught in the act, but by the time they are
observed, the allocations
are swapped.
The biggest problem I am having this year, so far, is justifying
spending money on
anything related to mail that will not be a) very long life and b)
really make it better. The more knobs I have, the better, and I think
IP reputation is the place to be this year.
Account verification before data is "better" in my situation, and
technologies to block or drop connections en masse will have more of a
likelihood of getting funded internally.
The spam conference is coming up in Cambridge. I'm looking forward to it.
YMMV.
</lurk>
-M<
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg