Re: [gnso-ff-pdp-may08] Abuse in general

["George Kirikos" <fastflux@xxxxxxxx>]

Hello,

On Fri, Aug 8, 2008 at 9:36 AM, Dave Piscitello
<dave.piscitello@xxxxxxxxx> wrote:
> The criminals may have adopted short TTLs but that's not the only marker.
> Anyone who looks at a DNS configuration, sees a short TTL, and concludes
> "this is a fast flux attack" is going to be wrong. And we have already
> agreed to this point.

I'm fully aware of the differences, involving round robin DNS, and
other factors. It's a question of semantics. i.e. if you *define*
"Fast Flux" as involving compromised hosts, as per the Wiki:

https://st.icann.org/pdp-wg-ff/index.cgi?initial_draft_definitions

and "malicious content costs"  then you're talking about one thing.
The underlying technology, though, is content neutral. Suppose I call
the underlying technology as "Bunny Rabbit Networks" (which do a lot
of "hopping"), for lack of a better term, i.e. all the identical
technological aspects, but excluding anything that's illegal or
involving compromised. e.g. used for torrents, free speech or other
legitimate applications that might not even exist yet.

We want to make sure that "Bunny Rabbit Networks" can continue (which
some folks might call "Fast Flux *TECHNOLOGY*"), but bar the malicious
aspects (which you define implicitly as "fast flux" to include the
criminal and malcious aspects).

It's like some people perhaps defining a "Death Ray" as a laser that
is used by malicious countries to shoot down innocent citizens. If
"Death Ray Technology" can be used for something else (e.g. improving
crop yields through focused energy), we don't want to ban the lasers
themselves.

Sincerely,

George Kirikos
www.LEAP.com