RE: [gnso-ff-pdp-may08] Rasmussen/Piscitello action 4.h

["Greg Aaron" <gaaron@xxxxxxxxxxxx>]

I recommend that the first two sentences be amended to read: "The FF WG
concurs with this comment. The FF WG encourages registrars and
registries to adopt recognized best practices to curtail Fast Flux."  

(Recommendations about "all forms of abuse" take us in another direction,
including a discussion of what "all" abuses might consist of.  It's just
beyond the ambit of the FFWG group and I don't want to draw things out
further.)

I also recommend we cut this text from the last bullet:
"compensating a registrant whose" 
This is an issue that registrars already deal with all the time.  (They
suspend domains regularly for all kinds of problems.)  And this is a
business and market issue, not a technical or procedural one.  Depending on
the situation, compensation might not even be in order.  

All best,
--Greg


-----Original Message-----
From: Dave Piscitello [mailto:dave.piscitello@xxxxxxxxx] 
Sent: Wednesday, May 06, 2009 8:36 AM
To: Fast Flux Workgroup
Subject: [gnso-ff-pdp-may08] Rasmussen/Piscitello action 4.h


(4.h) Encourage registrars to adopt recognized best practices
designed to curtail the harms caused by illegitimate uses of
fast flux hosting 


Proposed response:

The FF WG concurs with this comment. The FF WG encourages registrars and
registries to adopt recognized best practices to curtail all forms of abuse,
not just Fast Flux.  Best practices are by definition things that everyone
in an industry should look to adopt. As described in the responses to (4.a,
4.f), the devil is in the details. While there are practices designed to
detect what is suspected to be fast flux today, and some of these are very
accurate, additional study is required to

- demonstrate that the algorithm(s) registrars use has a very
  low rate of false positives
- identify an acceptable rate of false positives,
- identify what actions registrars are to take (in considerable detail)
  when evidence of fast flux hosting is presented
- identify a process through which parties who submit evidence of FF hosting
  are deemed to be trustworthy
- identify a process of restoring service and compensating a
  registrant whose domain was suspended based on a false positive
  report of fast flux hosting