kpcyrd/sn0int

Auto noscope

Closed this issue · 0 comments

In addition to recursive noscoping in #87 there should be a way to "permanently recursively noscope".

This is inspired by #107 and after thinking about this for a while I think this could work:

  1. we keep a list of autoscope and autonoscope
  2. we compare new objects to this list
  3. the most precise rule wins

The following objects qualify for autonoscoping:

  • domains/subdomains (they would share the same rules, actually)
  • ipaddrs
  • urls
  • emails(?)
  • accounts(?)

Precision is measured depending on the object type.

  • ipaddrs: precision is simply the netmask. 0.0.0.0/0 has a precision of 0, 10.3.4.0/8 has a precision of 8 and ::/64 has a precision of 64.
  • domains/subdomains: split by ., filter empty strings and count them. example.com has a precision of 2, . has a precision of 0, com has a precision of 1.
  • urls: on addition to the rules applied to the domain we would split by / in this case to exclude or restrict to certain folders. An important bit is that a rule of /abc would match /abc/def but not /abcxyz. I'n not sure if and how we would support query strings.
  • emails: only support the domain part behind the @, but use a separate list so our domain rules don't apply to emails and vice versa.
  • accounts: this is a simple one, autonoscope in this case would filter accounts by type. a rule of instagram.com: would match on instagram accounts, a rule of : would match all accounts

Instead of traversing things recursively every time we would apply these filters to new objects as we add them.