[gnso-ff-pdp-may08] Placeholder comments on Section 8

[Dave Piscitello <dave.piscitello@xxxxxxxxx>]

I¹m juggling my attention between conference participation, FFWG (you saw my
post), competing against a 7-10 hour time difference from the US where most
of the members reside, and an agenda that will carry late into the night
here. Tomorrow is no better, and I am in transit to Tallin Wednesday.

I am unlikely to have time to compose a thoughtful alternative text today.

I think much has been accomplished in revising the report. More could be
done if we extend the review/comment period another week and I hope this
will be discussed Wednesday. Meanwhile, here are some hasty notes that I
hope will serve as placeholders for text I'll submit when I return to my
office.

Lines 597+

8.1 Conclusions

This section needs to be revised to reflect changes in preceding text,
particularly the definition of FF. I also think that there are other
conclusions worthy of inclusion:

- conclusions relating how fast flux is only one form of flux attack
- conclusions relating the challenges posed when attempting to associate an
intent to networks that employ fast flux techniques (I think that the text
that characterize fast flux in attacks versus fast flux in
production/operational networks pushes us in a promising direction, mine is
an attempt to reconcile the definitions work of Randy, George, Greg and my
own.

Line 611+

8.2 Possible next steps (and subsections)

- delete all references to consensus, rough consensus, minority, etc.  We do
not need consensus to include possible next steps - IMO the fact that we
offer several is sufficient to meet our remit.

Lines 622-624 - delete this note. I believe it's accurate that the group
agreed to publish a report. I don't think we can accurately gauge support
for P1 or P2 until we all have an opportunity to review - and I would
encourage a roll call of opinion if not a formal vote to show support for
each (P1, P2, and any others that may be added).

- who is the WG recommending consider these options? A continuance of this
WG, a new WG? The GNSO council?

Lines 632-649

- S1 does not discuss "roles and players" - for example, there are several
discussions in various threads relating to collecting data, making it
available, but no clear understanding who is collecting and who gets to
access the data. There are also "historical data and analysis" discussions.
These are not adequatel distinguished in S1.
- S1 discusses developing algorithms but does not talk about testing, nor
does it define a target metric value for "false positives"
- Similarly, S1 does not identify the target entities for financial and
operational justifications - registrants, ISPs, users, registrars,
registries, ICANN, all?

Lines 628-630

- once we sort out S1, S2 through S4 must be presented in the same level of
detail or we prejudice the choice by providing too little information for
comparing the options.

Line 673+

- Why is SSAC excluded from the list of stakeholders?

Line 666+

- I think there is a third option that is "broader than fast flux and
smaller than (all) fraud and abuse". We have talked about slow flux, double
flux, and characteristics that have less to do with TTL values and more to
do with other network attributes that make the network "volatile" We should
include this option and it should fall within GNSO's remit.

Lines 695+

- I don't think we have discussed approaches enough to make the claims
included in this section. I think "weak rough consensus" is an impossible
term to parse and object to notes making such claims without some roll call
or recorded vote.

Lines 710

- Please provide the roll call or vote that corroborates the claim that the
group is evenly divided or remove this.

Line 719

- this can be rephrased as a question to the GNSO and ICANN board.


That's all I have time for now. I'll try to continue later.