3 ms·
what about looking for active abuse? Assuming I tell you on account signup, is running your traffic through an IDS to alert me when your system is compromised
by lsc 16y ago
what about looking for active abuse? Assuming I tell you on account signup, is running your traffic through an IDS to alert me when your system is compromised unacceptable? what if I only look at your traffic after I get an abuse report? what if I get an abuse report... can I use tcpdump?
I mean, these are all possibilities. my concern is that if, for example, you make running an inward facing IDS illegal, selling (nearly) anonymous accounts on the cheap will be ah, more difficult. In theory, a good enough inward-facing IDS, if implemented by more ISPs, could largely mitigate the botnet problem we have now, where almost any site can be wiped off the internet by IRC kids. (now, my IDS system never got past 'experimental' and has been down for several years now. But when it was active, I think it was pretty neat; customers could see incoming attacks, and I could see outgoing attacks. Of course, like any ids, it had a huge false positive rate, so honestly, it wasn't all that useful, which is part of why it's currently down. I'm just interested in why people think that sort of technology is inherently a bad idea- a bad enough idea that there should be a law, even.)
Now, I think it's important that providers are very clear about what they do with a customer's packets... but I worry that codifying what a provider can do to a packet /with the consent of the customer/ into law will eliminate services I like.
- jacquesm 16y agoThat's a good point and a fine line to walk. I'm going to have to think about that for a bit, it's a tricky enough situation you sketch that there shouldn't be some kind of exception for it. First thing to come to mind is maybe an electronic way of securing permission from the 'endpoint' of the traffic, since they benefit from not having their hardware and their connection abused as well. The key is 'with the consent of the customer', and I think that such instances should be the exception rather than the rule. So if there is no specific reason why a certain customers packets are inspected and it is done without their knowledge and consent it should be illegal. Also, it may very well be possible to correlate enough transport layer data to figure out which packets are part of an attack and which are legit, but that might be computationally very expensive to do.
- lsc 16y agowell, I'm actually /really interested/ in what people think about this. I mean, laws aside, privacy policies[1] are pretty important to some people. But the thing is, by looking at (and sometimes mucking with) your traffic, I can provide you a better service. So it's important for me to know where the line is for different people. [1] note: this isn't final, but it's my latest working draft: http://wiki.xen.prgmr.com/xenophilia/2010/06/please-comment-on-the-first-dr.html http://wiki.xen.prgmr.com/xenophilia/2010/06/please-comment-...
- jacquesm 16y agoI think you've already nailed it, the 'better service' is the key element in that sentence. If the endpoint finds their services degraded to give other people better service then I think most people would balk. If it is to give them better service they'll be fine with it. Whether or not they read the privacy policy is another matter, I think I must be the only person that actually reads those things.
- lsc 16y agoas for privacy policies, what I'd really like is to use a privacy policy published by a trusted body such as the EFF. In my perfect world, the EFF would publish several, modeled after the 'creative commons' licenses; each policy would grant different levels or different kinds of privacy, and the meaning of the policy would be fairly well understood by all parties just by stating the name of the policy. edit: I don't mean /legally mandating/ these privacy policies... I'm suggesting something like the system in place for managing copyright (or,uh, left) - the idea would be that if there are standard policies, you won't have to read each policy all the way through for every service.
- jacquesm 16y agoHow about a privacy policy review entity? Something totally independent of both business and government run as a non-profit that reviews the various privacy policies, notices changes (by spidering them periodically) and alerts users to those changes and their consequences? You could also issue a 'badge' or a widget that you could include on your privacy policy page that gets served up from the reviewing institution.