[atlas] HTTP measurements at willing targets / protocol suggestion

​+1 ​
Sounds like a perfect solution
​ 👍​

Med venlig hilsen / Best regards
Emil Stahl

On Mon, Nov 16, 2015 at 9:35 AM, Gil Bahat <gil at magisto.com> wrote:

> Hi,
>
> We are interested (like many others, I guess) in the ability to perform
> HTTP measurements at our own non-anchored network. Understanding the
> potential for abuse, I would like to suggest the following authentication
> protocol, which is based on best practices exhibited by other services with
> such potential (abuse or privacy implications).
>
> 1. Confirm control of the domain registration:
> * This is usually done by mailing the technical contact for the relevant
> WHOIS entry with a confirmation email containing a unique hash, thus
> validating ownership.
>
> 2. Confirm control of the DNS servers:
> * This is usually done by editing the root TXT record with a unique hash
> or publishing a CNAME with unique hash.
>
> 3. Confirm control of the Web servers:
> * This is usually done by placing a uniquely-hashed file in the webserver
> root directory, a unique hash in the meta-tags for the index html file or a
> unique value in a file such as robots.txt.
>
> I believe this protocol is sufficient to ensure that a web site owner
> agrees to the implications of allowing free HTTP measurements against their
> servers and that no unwilling server will ever be probed. At most during
> the protocol, the only resource that can be hit is a static file or
> robots.txt specifically, which has very little capability to overwhelm a
> web server, especially if negative responses are cached for a considerable
> amount of time / validation is done via a few nodes and propagated across
> the network.
>
> thoughts/ideas welcome.
>
> Regards,
>
> Gil Bahat,
> DevOps Engineer,
> Magisto Ltd.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ripe.net/ripe/mail/archives/ripe-atlas/attachments/20151116/4ad9443a/attachment.html>