<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">In last Wednesday's NCAP call, I expressed my confusion related to the differences in understanding of the proposals that have been discussed. We were asked to go back and review the definitions of some of these proposals.<div class=""><br class=""></div><div class="">Let me share some history here. In each mailman message, please read the whole thread.<div class=""><div class=""><br class=""></div><div class="">In February 2022, Jeff Schmidt posted a cost-benefit of proposed interruption and data collection techniques:</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-February/000744.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-February/000744.html</a></div><div class=""><br class=""></div><div class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">The slides from the presentation above clearly refer to active collision assessment as a mechanism in which HTTP(S) requests are intercepted.</div></div><div class=""><br class=""></div><div class="">However, noting that there still seemed to be some specification confusion, Jeff later posted the following:</div><div class=""><br class=""></div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-February/000794.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-February/000794.html</a></div><div class="">(Discussion continues in Nov 2022:)</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-November/000998.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-November/000998.html</a></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">(Discussion continues in Aug 2023:)</span></div><div class=""><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2023-August/001206.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2023-August/001206.html</a></span></font></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""><br class=""></span></div><div class="">These threads also show application-layer interception as part of active collision assessment.</div><div class=""><br class=""></div><div class="">In October 2022, I shared with the group the writeup I prepared "A Comparison of Proposed Techniques", which is similar in many ways to both sets of slides Jeff posted in February 2022.</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-October/000968.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-October/000968.html</a></div><div class="">(Discussion continues here:)</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-November/000980.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-November/000980.html</a></div><div class="">(Actual document):</div><div class=""><a href="https://docs.google.com/document/d/14g4hp_BlosWQJ6-otygww9OHmu1C0GCHIMyfsinbqOE/edit?usp=sharing" class="">https://docs.google.com/document/d/14g4hp_BlosWQJ6-otygww9OHmu1C0GCHIMyfsinbqOE/edit?usp=sharing</a></div><div class=""><br class=""></div><div class="">In the November 9, 2022, NCAP call, I shared this comparison with the group:</div><div class=""><a href="https://community.icann.org/pages/viewpage.action?pageId=221348112" class="">https://community.icann.org/pages/viewpage.action?pageId=221348112</a><br class=""></div><div class=""><br class=""></div><div class="">This document -- with some modifications -- is now part of the NCAP Study 2 document as Sections 1 - 3 (specifically section 3.5 and 3.6):</div><div class=""><a href="https://docs.google.com/document/d/13SQnZt1HHeD9i1cSds-kj16mxRQgxp6hpb2K1kLqB1U/edit?usp=sharing" class="">https://docs.google.com/document/d/13SQnZt1HHeD9i1cSds-kj16mxRQgxp6hpb2K1kLqB1U/edit?usp=sharing</a></div><div class=""><br class=""></div><div class="">The original document -- and these sections in the Study 2 doc -- very clearly show active collision assessment as a mechanism that (in part) intercepts application-layer information.</div><div class=""><br class=""></div><div class="">In February 2023 I shared my thoughts on the proposed techniques, AND I introduced a new technique ("reject-all") which is a variation on active collision assessment (as previously defined):</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2023-February/001105.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2023-February/001105.html</a></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">(Discussion continues in Mar 2023:)</span></div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2023-March/001131.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2023-March/001131.html</a></div><div class=""><br class=""></div><div class="">Note that the "reject-all" proposal is *not* currently integrated into the NCAP Study 2 doc. I *propose* that it be considered as one of the options, for the reasons described in my email above.</div><div class=""><br class=""></div><div class="">As I reviewed past discussions, I did find that this (Feb 2023) was not the first time this has been referenced. Matt Thomas alluded to this on the list in Feb 2022:</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-February/000775.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-February/000775.html</a></div><div class="">But the very next response seemed to disagree:</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-February/000776.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-February/000776.html</a></div><div class="">The confusion was caught immediately:</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-February/000784.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-February/000784.html</a></div><div class=""><br class=""></div><div class="">Fast forward to last week, when we observe this from the chat transcript on the August 2, 2023, meeting:</div><div class=""><a href="https://icann.zoom.us/rec/play/6X_woMuHOsxAK60F_KVko-P5DDLoRt_1h9K6KcvyFr_10dXv1Hd5Jpc_vzBtLu4IjZ-xFgPE-RFufuk.UL2RISdM4RL0xjPM" class="">https://icann.zoom.us/rec/play/6X_woMuHOsxAK60F_KVko-P5DDLoRt_1h9K6KcvyFr_10dXv1Hd5Jpc_vzBtLu4IjZ-xFgPE-RFufuk.UL2RISdM4RL0xjPM</a></div><div class=""><br class=""></div><blockquote type="cite" class="">James Galvin (he/him)<br class=""><div class="">33:01</div><div class="">ACA - current working model is delegation with a return of an IP address (IPv4 and IPv6) for an authoritative server that captures additional meta data about usage of the name. there are two methods under ACA today: controlled interruption as defined in 2012 and the minimal honeypot we have been discussing ad infinitum.</div><div class=""><br class=""></div><div class="">Casey Deccio<br class="">52:39<br class="">Another model that has been proposed is the active-reject model, where clients reach out, but all TCP connections are reset.</div><div class=""><br class=""></div><div class="">James Galvin (he/him)<br class="">54:02<br class="">Exactly Casey. That’s what I meant by minimal honeypot.</div><span id="x-apple-selection:end"></span></blockquote><div class=""><br class=""></div>My first confusion was referring to <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">controlled interruption as a "method" of active collision assessment, when we</span>'ve always compared active collision assessment against controlled interruption. Second, I'm not sure I've heard this term "minimal honeypot" with any sort of regularity before, and I don't recall discussing it by that name or by its description (is this the reject-all proposal?) "ad infinitum".</div><div class=""><div class=""><br class=""></div><div class="">So far I've only discussed active collision assessment. I haven't even touched passive collision assessment. For example, Jeff Schmidt made this comment about lack of technical detail:</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-November/000989.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-November/000989.html</a></div><div class="">It is echoed later on, including here, by Matt Larson:</div><div class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-November/000993.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-November/000993.html</a></div><div class=""><br class=""></div><div class="">Okay, so now what? Passive collision assessment and active collision assessment are definitely ambiguous - shown most recently in last week's (Aug 2, 2023) meeting. We need precise terms. For example (I'm not expecting these to stick, per se):</div><div class=""><br class=""></div><div class="">1. Delegation of minimal TLD zone or Delegation of apex-only TLD zone.</div><div class="">2. Resolution to loopback using special IP address in 127/8.</div><div class="">3. Transport-layer rejection at publicly available IP address.</div><div class="">4. Application-layer interception at publicly available IP address.</div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">5. Eliciting DNS lookups using ads embedded in Web browsers</span></div><div class=""><br class=""></div><div class="">Now, I'm not suggesting that the technical details of these are all spelled out with these more succinct names. In fact, some will argue that there's more confusion. I'm not suggesting that these are popular, but it's clear that terms that we've coined and used in the past have been misunderstood and/or changed over time. At this point, understanding what we're dealing with is more important than making them easy to say or even market.</div><div class=""><br class=""></div><div class="">The way I have understood things is: #1 is passive collision assessment, #2 is controlled interruption, and #3 is reject-all (and maybe what was referred to as "minimal honeypot" las week?). Active collision assessment is a combination of #4 (for ports 80, 443, and others where interception was proposed) and #3 (for all other ports). And, of course, #5 is the ad-based measurements using, which I believe is proposed to happen in the environment specified by #1.</div><div class=""><br class=""></div><div class="">It makes more sense to discuss (or not discuss) the issue of (for example) application-layer redirection when we know whether we're talking about #3 vs. #4, for example.</div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2022-February/000796.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2022-February/000796.html</a></span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""></div><div class=""><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2023-August/001206.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2023-August/001206.html</a></span></font></div><div class=""><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><a href="https://mm.icann.org/pipermail/ncap-discuss/2023-August/001208.html" class="">https://mm.icann.org/pipermail/ncap-discuss/2023-August/001208.html</a></span></font></div><div class=""><br class=""></div><div class=""><font color="#000000" class="">Casey</font></div></div></div></body></html>