6 ms·

It's needed because CDNs are presently 'protection rackets' for the Internet. Instead of having a mechanism by which a website under attack (or simply un-monit

• Alupis 10y ago
  > Instead of having a mechanism by which a website under attack ... from a host or number of hosts can direct the ISPs of those hosts to not send it traffic How is this any different? You're putting the responsibility of being internet police on the ISP's, which have shown their either do not want that responsibility, or will abuse that responsibility. Not to mention, this would go squarely against the notion of ISP's as "dumb pipes".
  • JoshTriplett 10y ago
    I'd like to see ISPs doing better policing of their customers: disconnecting (and prosecuting) spammers, blocking users infected with malware until they get clean, and so on. I'd like a world in which I can reasonably expect to react to spam by tracking down where it came from and getting the spammer removed from the Internet. abuse@ ought to function and produce a rapid response. (That doesn't mean we shouldn't have anonymous, untrackable services as well, but using such services means you have to put up with spam too. When you have a service like email, with all the tracking information readily available in the headers, it shouldn't be as near-impossible as it currently is to get something done with that information.)
    • AnthonyMouse 10y ago
      The problem is there are two sources of spam. The first is large networks that tolerate spam, and those are irrelevant because their IP blocks are already on every blacklist in the world. The second is compromised machines, which are the real problem because they're ephemeral. Spammers can compromise a hundred new machines a week. You can't fix them or block them faster than they compromise new ones. The only solution to that is to improve computer security so they don't get compromised to begin with, which has nothing to do with ISPs. Removing people from the internet is never the answer, both because it's too broad (should the spammers not be able to go to the government's website to pay their taxes?), and because the nominal current source of the spam isn't actually where the spammer connects to the internet anyway. The better solution if you can actually find a real life spammer is to impose a fine on them that exceeds the profits of spamming.
      • jfoutz 10y ago
        There is also the great firewall attack that hit GitHub a while ago.
      • kazagistar 10y ago
        Wait, why can't you block spammers as fast as they are created? If your computer is compromised, it seems fine to disconnect it, or at least severely rate limit uploading until you fix the problem. Its the responsibility of the internet user to keep their computer in working order. Really, if your computer is spamming someone, even if you aren't aware of it, you are harming them, and ignorance shouldn't be protection. Maybe fines and jail are a bit too severe, but rate limiting and possible disconnection are more then fair.
        • plttn 10y ago
          So if Joe Shmo's router is compromised, then the ISP turns it off. How then is Joe supposed to learn that he's compromised by looking up symptoms, or download an antivirus to clean it up? It's a pretty solution to the problem in theory, but when you actually apply it, it doesn't quite work out as well.
          • kazagistar 10y ago
            He calls the ISP and they tell him he is compromised. Or they robocall him.
          • jon-wood 10y ago
            My ISP actually did once cut me off when one of the machines on the network was compromised by malware. I called up their support line and they told me what had happened, I fixed it, and all was well.
          • internetionals 10y ago
            Shameless plug: http://www.quarantainenet.com/ http://www.quarantainenet.com/
          • mdpopescu 10y ago
    • btreesOfSpring 10y ago
      one of the major issues of malware/spam/botnets is a direct result of the hardware ISPs provide to their customers. They should at minimum be taking on that responsibility of security upgrading their rootable hardware. If abuse@ could just be triggered by honeypots that could quickly identify hacked routers & ISPs would replace/upgrade them accordingly, at least one ugly sliver of the IoT would be addressed.
    • amorphid 10y ago
      How would an ISP identify spammers without directly inspecting unencrypted packets?
      • jlgaddis 10y ago
        (Sr. Net Eng at $ISP) Netflow data is extremely helpful, although not on its own (it will also identify legitimate customers running their own mail servers). It's a good start, though.
    • dredmorbius 10y ago
      There's some really interesting work (some of it recently from Cloudflare) on tying reputation to reliably anonymous trafic. Fair Anonymity and FAUST are the two approaches I'm familiar with, though AFAIU each are very preliminary academic proofs of concept, not anything production-ready. There might be other ways of managing traffic, though it would require more pipe smarts. Generally, I'm in favour of ASNs -- autonomous systems -- taking responsibility as you describe. After all, they do present a single administrative bound of control, and ought take responsibility for their traffic as you describe. The Routeviews Project (asn.routeviews.org) offers both DNS lookups and downloadable zonefiles for mapping individual IPs to ASNs. Of late, the problem I'm finding is that far too many services are hosted on Amazon, though firewalling off a wide swath of a few AWS AZs might be an interesting approach.
  • mjevans 10y ago
    Analogies fail in this area because the INTER-network part of the Internet is not similar to real world examples. In the real world making large volumes of things appear at one specific location takes effort. The real world is also fairly good about having ways to track down and prosecute those who are unusually heinous about some activity. There are costs, resources, and attachments of presence involved. In this context the closest example would be the PTSN (Public Telephone Switched Network). That analogy still fails because while the cost is low there is still SOME cost and a lot of documentation about who might be 'making someone's phone blow up'. However from the perspective of the solution it still holds true. On many hard-phone-lines it is possible to dial a number sequence to block calls from the number which previously called the phone. In this case the provider hired by the victim will deny the connection request before it ever reaches the victim. Something similar can currently happen as 'blackholing' the victim, but this is victim blaming and allows the attacker to win. What is necessary is to instead push the blocking far enough back the chain that the victim sees no bill and is completely impugned from the actions of bad actors. Logically, this means blocking it at the backbone level or lower, and still charging the sending party for the data.
    • dredmorbius 10y ago
      Postal-service analogues suggest themselves. Issues with mailstorms (chain letters and the like) were a sufficient issue that there are specific statutes against them.
  • rasz_pl 10y ago
    Water utility company is a epitome of dumb pipes, but they will cut off bad supply instead of pumping poison while cutting out customers.
• toast0 10y ago
  When you do have cooperative ISPs filtering DDoS traffic, it's usually a null route, so the IP under attack goes offline, but without taking the rest of the customers on your ISP offline.
  • rasz_pl 10y ago
    He described system that would work the other way around, null-route the ATTACKERS, not the victim.
    • makerbraker 10y ago
      That's not quite how routing works -- null routing the attackers affects RETURN traffic to the attackers. By then, the damage is done, the target host is already overwhelmed with attack traffic.
    • krackers 10y ago
      Isn't that hard to do based on the distributed nature of DDOS attacks though?