Re: [gnso-ff-pdp-may08] 5.4

[Jose Nazario <jose@xxxxxxxxx>]

On Fri, 14 Nov 2008, Mike Rodenbaugh wrote:

> I appreciate all the work that went into this Section by many folks, but 
> I think the opening sentence is not true, and think it is likely to be 
> harmful to efforts against fast flux attacks if it left as-is.  Is there 
> Support (or even Agreement?) for any all of these three sentences 
> instead ??
>
>
> 1.      There is at least anectodal evidence that at least a few registrars
> and/or their resellers intentionally facilitate fast flux domain name
> exploits, particularly ?double-flux? attacks.
> 2.      There is evidence that some registrars and/or their resellers have
> willfully ignored evidence that they are facilitating fast flux domain name
> exploits that were causing harm to the broader internet community.
> 3.      Many and perhaps most registrars take affirmative steps to ensure
> that they do not facilitate fast flux exploits, and also rapidly respond to
> information that they may be doing so without their knowledge.
i am obviously not on the call but i can concur with you here on this 
rewording, mike.
-------------------------------------------------------------
jose nazario, ph.d.             <jose@xxxxxxxxx>
manager of security research    arbor networks
v: (734) 821 1427               http://asert.arbornetworks.com/