4 ms·
Just to be clear, I'm not talking about just email spam [email spam is actually something we outsource the handling of]. I'm talking about side projects that a
by fweespeech 11y ago
Just to be clear, I'm not talking about just email spam [email spam is actually something we outsource the handling of].
I'm talking about side projects that are little more than forums to 9 figure/year eCommerce companies I find big providers to be more of a problem with comment, review, etc. spam.
Whether they spend a large amount of money mitigating it or not, the fact that the quality of Tor [proportional to traffic] is not substantially worse compared to a VPN provider on those networks in my experience doesn't fill me with confidence that your solution would actually work.
> But that's why the big networks have outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean.
Any suggestions on how to get them to actually respond within a reasonable amount of time and with a substantial response (rather than a brush off) to things like people testing out credit cards to place fraudulent orders via their IP Space / VPNs?
- mike_hearn 11y agoAh, you're talking about VPN providers. Sorry. I thought you were talking about networks like Google, Microsoft, Amazon, Facebook etc. Some VPNs do fight abuse. Others are basically like Tor: they ignore it. The best thing you can do in those cases is indeed just block their IP space. Cross-checking the global routing tables can be a good way to enumerate their IP space. Sorry.
- fweespeech 11y agoGoogle and Amazon are two of the providers that: A) Provide VPNs themselves to the general public. [e.g. Their web proxies] B) Provide infrastructure used by VPN providers. So yes, I was including those two. Microsoft provides infrastructure to VPN providers as well via Azure, so they also qualify. Facebook would not. Other providers that qualify: Every hosting company that provides dedicated or VPS. [e.g. Linode, OVH, Hetzner] I just don't bother publicly calling people out on what appears to be a systemic problem. A problem that, frankly, Tor is no worse than any of the other actors. To me, the odd behavior is the fact CF seems to treat them as bad actors despite the fact they are an insubstantial portion of the problem.
- mike_hearn 11y agoGoogle and Amazon do have extensive anti-abuse teams. So do hosting providers, to varying degrees. It may not seem like it when you're receiving abuse from those networks anyway, but it'd be much, much worse if they weren't doing the work at all.
- fweespeech 11y agoYeah, but in my experience, their extensive anti-abuse teams still end up with as much abuse [proportional to overall traffic] as Tor, if not more. So to me, I don't understand why people complain about Tor when the real problem is the fact the larger networks simply take too damned long and throw far, far greater problems at people. To me, the idea of blocking/throttling Tor more heavily than any other provider seems patently absurd for that reason. I understand other people may have different experiences but that doesn't create a great deal of sympathy from me when a simple white list option takes 4-5 years.
- middleclick 11y agoI am not sure how a VPN provider fights abuse if they say they don't log anything. And if they do log, then what is the purpose of using them? Can you point out how VPNs fight abuse?
- mike_hearn 11y agoSome VPNs don't and they get treated the same as Tor i.e. CAPTCHAd a lot, throttled, outright blocked (I've seen it happen). Others do keep logs and use them. Guess what? They're not pointless. Lots of people don't require absolute anonymity against everyone - they just want to get over a particular firewall or shield their IP address from one particular network. But they don't include the VPN provider (or host country) in their threat model.