3 ms·

1) Tackling abuse requires a consistent definition of abuse that transcends cultures and can be implemented without major privacy and/or censorship implications

1) Tackling abuse requires a consistent definition of abuse that transcends cultures and can be implemented without major privacy and/or censorship implications. 2) The fact I can avoid the large networks and mitigates the abuse problems simultaneously implies the issue is largely a values issue rather than a technical one about how one defines abuse. 3) 99.9999999% of the spam I have to mitigate comes from "big networks". I've literally had 1 piece of spam in 2016 come from Tor. I've only ever had DoS/DDoS from compromised servers on "big networks" who fail to notice for day(s) and require manual notification. So when you say "abuse problems", it clearly means something different to you than it does to me. 4) The "big networks" are not interested in cooperating with relatively cheap solutions like the one CF is now implementing until they are publicly called out. I asked for that 4+ years ago and was ready to move an account at $DayJob to CF until I realized how unresponsive they were.

mike_hearn 11y ago
Sometimes yes, sometimes no. In practice, for example, webmail spam filters tend to be (virtually) culturally neutral because they're driven by voting over large populations. In cases where someone writes a specific policy, yes, it will be culturally biased. That may be inevitable. If you're talking about email spam, then Tor blocks SMTP outbound, and big webmail services all treat send attempts from Tor with suspicion, so yeah you'd not see much direct SMTP spam from them. And yes, Tor tends to already be blocked by any reasonable abuse filter, whereas the big networks are too-big-to-block, so that's where spammers focus their efforts. But that's why the big networks have full time outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean. You can argue that they're not doing enough, but when it comes to stuff like that, there is always more that can be done.
- fweespeech 11y ago
  Just to be clear, I'm not talking about just email spam [email spam is actually something we outsource the handling of]. I'm talking about side projects that are little more than forums to 9 figure/year eCommerce companies I find big providers to be more of a problem with comment, review, etc. spam. Whether they spend a large amount of money mitigating it or not, the fact that the quality of Tor [proportional to traffic] is not substantially worse compared to a VPN provider on those networks in my experience doesn't fill me with confidence that your solution would actually work. > But that's why the big networks have outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean. Any suggestions on how to get them to actually respond within a reasonable amount of time and with a substantial response (rather than a brush off) to things like people testing out credit cards to place fraudulent orders via their IP Space / VPNs?
  - mike_hearn 11y ago
    Ah, you're talking about VPN providers. Sorry. I thought you were talking about networks like Google, Microsoft, Amazon, Facebook etc. Some VPNs do fight abuse. Others are basically like Tor: they ignore it. The best thing you can do in those cases is indeed just block their IP space. Cross-checking the global routing tables can be a good way to enumerate their IP space. Sorry.
    - fweespeech 11y ago
      Google and Amazon are two of the providers that: A) Provide VPNs themselves to the general public. [e.g. Their web proxies] B) Provide infrastructure used by VPN providers. So yes, I was including those two. Microsoft provides infrastructure to VPN providers as well via Azure, so they also qualify. Facebook would not. Other providers that qualify: Every hosting company that provides dedicated or VPS. [e.g. Linode, OVH, Hetzner] I just don't bother publicly calling people out on what appears to be a systemic problem. A problem that, frankly, Tor is no worse than any of the other actors. To me, the odd behavior is the fact CF seems to treat them as bad actors despite the fact they are an insubstantial portion of the problem.
      - mike_hearn 11y ago
        Google and Amazon do have extensive anti-abuse teams. So do hosting providers, to varying degrees. It may not seem like it when you're receiving abuse from those networks anyway, but it'd be much, much worse if they weren't doing the work at all.
        fweespeech 11y ago
        Yeah, but in my experience, their extensive anti-abuse teams still end up with as much abuse [proportional to overall traffic] as Tor, if not more. So to me, I don't understand why people complain about Tor when the real problem is the fact the larger networks simply take too damned long and throw far, far greater problems at people. To me, the idea of blocking/throttling Tor more heavily than any other provider seems patently absurd for that reason. I understand other people may have different experiences but that doesn't create a great deal of sympathy from me when a simple white list option takes 4-5 years.

mike_hearn 11y ago

Sometimes yes, sometimes no. In practice, for example, webmail spam filters tend to be (virtually) culturally neutral because they're driven by voting over large populations. In cases where someone writes a specific policy, yes, it will be culturally biased. That may be inevitable. If you're talking about email spam, then Tor blocks SMTP outbound, and big webmail services all treat send attempts from Tor with suspicion, so yeah you'd not see much direct SMTP spam from them. And yes, Tor tends to already be blocked by any reasonable abuse filter, whereas the big networks are too-big-to-block, so that's where spammers focus their efforts. But that's why the big networks have full time outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean. You can argue that they're not doing enough, but when it comes to stuff like that, there is always more that can be done.

fweespeech 11y ago
Just to be clear, I'm not talking about just email spam [email spam is actually something we outsource the handling of]. I'm talking about side projects that are little more than forums to 9 figure/year eCommerce companies I find big providers to be more of a problem with comment, review, etc. spam. Whether they spend a large amount of money mitigating it or not, the fact that the quality of Tor [proportional to traffic] is not substantially worse compared to a VPN provider on those networks in my experience doesn't fill me with confidence that your solution would actually work. > But that's why the big networks have outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean. Any suggestions on how to get them to actually respond within a reasonable amount of time and with a substantial response (rather than a brush off) to things like people testing out credit cards to place fraudulent orders via their IP Space / VPNs?
- mike_hearn 11y ago
  Ah, you're talking about VPN providers. Sorry. I thought you were talking about networks like Google, Microsoft, Amazon, Facebook etc. Some VPNs do fight abuse. Others are basically like Tor: they ignore it. The best thing you can do in those cases is indeed just block their IP space. Cross-checking the global routing tables can be a good way to enumerate their IP space. Sorry.
  - fweespeech 11y ago
    Google and Amazon are two of the providers that: A) Provide VPNs themselves to the general public. [e.g. Their web proxies] B) Provide infrastructure used by VPN providers. So yes, I was including those two. Microsoft provides infrastructure to VPN providers as well via Azure, so they also qualify. Facebook would not. Other providers that qualify: Every hosting company that provides dedicated or VPS. [e.g. Linode, OVH, Hetzner] I just don't bother publicly calling people out on what appears to be a systemic problem. A problem that, frankly, Tor is no worse than any of the other actors. To me, the odd behavior is the fact CF seems to treat them as bad actors despite the fact they are an insubstantial portion of the problem.
    - mike_hearn 11y ago
      Google and Amazon do have extensive anti-abuse teams. So do hosting providers, to varying degrees. It may not seem like it when you're receiving abuse from those networks anyway, but it'd be much, much worse if they weren't doing the work at all.
      - fweespeech 11y ago
        Yeah, but in my experience, their extensive anti-abuse teams still end up with as much abuse [proportional to overall traffic] as Tor, if not more. So to me, I don't understand why people complain about Tor when the real problem is the fact the larger networks simply take too damned long and throw far, far greater problems at people. To me, the idea of blocking/throttling Tor more heavily than any other provider seems patently absurd for that reason. I understand other people may have different experiences but that doesn't create a great deal of sympathy from me when a simple white list option takes 4-5 years.