diff options
Diffstat (limited to 'AGENTS.md')
| -rw-r--r-- | AGENTS.md | 37 |
1 files changed, 37 insertions, 0 deletions
@@ -332,6 +332,27 @@ failures: AFRINIC and `nic.cz` publish a handle but no `abuse` role, and `example.museum` has no RDAP server for the TLD. The IANA bootstrap held 5 IPv4 services, 5 IPv6 and 590 DNS. +`report` was swept the same way on 2026-09-10, after `parse.py` changed. +Sweep A: 92 messages, 1685 indicators, 92 bodies generated, 0 crashes, 0 empty +parses, 475 query targets. No address from a raw source reached the IOC output, +and no recipient address reached a generated body. + +That sweep measured the limit the spec accepts rather than finding a defect. +The `Subject` header is published verbatim, and 14 of the 92 messages carried +the recipient's LOCAL PART inside it, because the kit personalises the lure. +None carried it in the `From` display name. The envelope recipient was cut +from the boundary `Received` line in every message. `tests/fixtures/` +`personalised-subject.eml` pins all three behaviours, including the accepted +one, so that number cannot change silently. Re-measure it when the whitelist +changes. + +Sweep B on the same date: 12 of 12 targets completed, 0 failures, all five +RIRs returning a parseable jCard, IPv6 live, the label walk reducing +`www.ripe.net` and `a.b.c.example.org`, and `nic.uk` resolving the multi-part +suffix. Three non-resolutions were correct: AFRINIC and `nic.cz` publish no +abuse role, and `.museum` has no RDAP server. Bootstrap held 5 IPv4 services, +5 IPv6 and 590 DNS. + **Sweep B must never draw its targets from the user's own spam corpus.** A query tells a registrar which of their customers someone is investigating, and for a phishing domain that registrar may be the attacker's own. Pick targets that are @@ -359,6 +380,12 @@ settles only what they share. touching RDAP, the bootstrap cache, or anything that issues a query. The fourth property it introduced is stated above in its own right; the spec carries the reasoning behind the rest of the module. +- `docs/specs/2026-09-09-report.md`, the `report` spec. Read it before + changing the publishable-header whitelist, the freeze rule, or what a + report body contains. It records what is deliberately NOT filtered and + why, which is the first thing to read if a sweep result looks like a leak. +- `docs/plans/2026-09-09-report.md`, the plan `report` was built from. + Historical in the same way, and it records the defect found in each task. - `docs/plans/2026-09-08-parse.md`, the plan `init` and `parse` were built from. Historical once built, but it records why each test exists. - `docs/plans/2026-09-09-contacts.md`, the plan `contacts` and `rdap` were @@ -367,3 +394,13 @@ settles only what they share. - `docs/BACKLOG.md`, open items, with the cause verified in the code rather than assumed. Read it before starting work; add to it rather than fixing something unasked. + +The author also keeps an idea note OUTSIDE this repository, in his Obsidian +vault at `~/Documents/Obsidian/note/notes on abusectl.md`. It is an inbox, +written as things occur to him while developing or using the tool, split into +done and not-done and in no particular order. **The note is the inbox, the +backlog is the tracked list.** Reconcile them in both directions when starting +substantial work: an idea in the note that is real work earns a backlog entry +with its cause verified in the code, and a backlog item he has marked done in +the note can be closed. Do not edit the note unasked; it is his, not the +repository's. |