6 ms·

Notorious ‘Hijack Factory’ Shunned from Web

111 points by dsr12 8y ago

okket 8y ago
See also previous discussion about this topic from yesterday https://news.ycombinator.com/item?id=17501201 https://news.ycombinator.com/item?id=17501201 (56 comments)
wjnc 8y ago
An underlying question I have: Is it useful to trust IP-addresses on their range / owner / (distant) past behavior?
- peteretep 8y ago
  If you don't, you have to track ownership information, which sounds like an administrative nightmare.
- Arnt 8y ago
  It depends on the use. You probably wanted a simple answer, but it isn't a simple question.
  - wjnc 8y ago
    jacquesm is known to give pretty exhaustive answers ;) I knew it wasn't an easy question, but the article seemed to indicate that at least some parties do indiscriminate blocking which struck me as rather dumb. Hence the question.
    - Arnt 8y ago
      Some parties (including myself at one point in the past) block with low cost. Suppose you're a microservice that does caching, fast-track authentication or similar. If you block a user, that user will have to spend several or even many seconds on reauthentication and/or cache refreshing, but that's the whole cost. Is your proper threshold for blocking high or low?
- jacquesm 8y ago
  IPV6 offers to all practical intents and purposes a near infinite range so there that tactic won't work (you will simply exhaust your storage at some point). IPV4 addresses in 'known bad' ranges can be totally benign, I know this because I've been the owner/steward of a whole pile of such addresses over the years. Typically the hosting providers where our stuff was colocated would be the likes of Leaseweb and Dynamic Pipe which had a lot of porn customers and spammers as customers. It would not be rare at all to be blocked either on entire class C's or ports from those blocks of addresses in spite of never having had interaction with certain parties before. Kudos to the people at Spamhaus who never blocked us and went out of their way to ensure they only hit the boxes of the spammers with surgical precision. Finally, 'distant past behavior' is what caused me to have to jump through all kinds of hoops to reclaim the IP address of my present day mail server. There is no set protocol to register a change of tenancy for an IP address and I'm pretty sure if such a protocol did exist that spammers would abuse it but it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...).
  - dvfjsdhgfv 8y ago
    > it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...). This is really upsetting. The imbalance of power is especially pronounced here as they don't really care whether you deliver you mail or not - you do. You're totally at their mercy. That's why lots of people nowadays say "it's too much hurdle to maintain my own e-mail server, I'll just use some service" - and in this way they give even more power to Google and the rest. We'll wake up one day and realize e-mail is no longer as free as it used to be, but it will be too late.
    - gingerlime 8y ago
      Totally agree. I'm not entirely sure the various spam RBLs have a much better process though, and some blacklisting seems arbitrary. Wouldn't each RBL have their own obscure process as well? I'm dreading the day that I have to switch my personal mail server's IP address. (important disclaimer: it's been a while since I had to deal with un-blacklisting, so maybe things have changed since?)
- DanBC 8y ago
  SPEWS doesn't seem to have achieved much other than make a bunch of people really fucking angry. https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_System https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_...
JulianMorrison 8y ago
I really don't know why this isn't more common. Bad actors can often be identified. Their upstream should just disconnect them. Or their upstream should. Draw a boundary around them and their intransigent collaborators, and cut them out of the network like a cancer.
- Cthulhu_ 8y ago
  Every party involved there has to be careful and do their due diligence though; you can't just cut it off because there might be an actual legitimate business or a critical service in there.
  - MaxBarraclough 8y ago
    Ah, you beat me to it.
  - djsumdog 8y ago
    You could also get corporate censorship of the Internet, simply because a hosting provider may allow a lot of content that is offensive, but not illegal. I wrote about this last year using The Daily Stormer as an example: https://fightthefuture.org/article/the-new-era-of-corporate-censorship/ https://fightthefuture.org/article/the-new-era-of-corporate-...
- MaxBarraclough 8y ago
  The article seems to make no mention at all of the possibility of collateral damage. Were any honest actors harmed by this 'shunning'? Seems unlikely that this 'Bitcanal' web-hosting company was used exclusively by malicious parties. Also, if this 'shunning' idea were to really catch on, couldn't it end up colliding with net-neutrality laws?
- jpalomaki 8y ago
  Maybe they are afraid that once you start doing this, it may never end. Once you cut somebody out from your network, then you can no longer argue that you are just the dump pipe and don't judge your customers. This can lead to demands for cutting access to sites hosting controversial content etc. All this may generate tons of extra work and no matter what you do, you certainly are not going to please everybody.
oliwarner 8y ago
The conversations that strike up off the back of things like this (why does it take 4 years to disconnect them‽) really make me wonder what the internet will look like in a couple of decades. There clearly is appetite at most levels of government for a restricted internet. Obvious crime, paedophilia, terrorism, etc but increasingly, you're seeing direct-to-consumer sites like Alibaba and Wish flogging knock-off crap over borders without paying taxes, without consumer safety checks and often without having license to make and sell that stuff in the first place. It's not going to be long before somebody legislates that you're only allowed to peer a network if you agree to cut anybody off who enables that, including other peers who ignore abuse across their network. It'll effectively limit what "the internet" is allowed to contain. Essentially embargoing bad actors and those that enable them, and all in a very pro-active way. It will —and should— put the fear of iJesus into consumer ISPs. They could easily cut off customers with computers operating within botnets, alerting them to infections, etc. At the peril of having your peerings cut off, you'd expect them to be a lot more pro-active too. I honestly don't how I'd feel about this. It seems safer but if life has taught me anything, that usually just means it's not, and somebody's just quietly getting rich in the corner.
- dcbadacd 8y ago
  The first question is who decides what's illegal? Being gay is illegal in certain countries... Making ISPs more proactive is only doable with either heavy restrictions what communication is allowed or heuristics (that fail). That sounds like anyone out of the ordinary (so a majority of this site's users) will get flagged as suspicious. The fun thing is that I've seen both methods already applied and either me or someone I know has been encumbered by them. There's not a single piece of me that feels that this would somehow end up positive in total.
  - oliwarner 8y ago
    I think it would have to be a single multi-signatory convention. And part of that stipulates that you can only peer against networks in signatory nations. The process of deciding that sort of law would be awful but if everybody focussed on serious and network focussed crime and not protecting Mickey Mouse et al, something good could come from it. But you are probably right. The US —esp with current leadership— could very easily force protectionist terms on others. Nobody would want to be separated from the US. Switzerland would have no leverage. African countries would have no leverage. The EU and China might have a chance, but the latter especially stands to lose a lot more than it could gain. China still needs access to a global market. It's definitely has potential to be deeply insidious. But with the value of the network, I'm just surprised people aren't suggesting more things like this. To be clear, I'm not advocating this. I just see it as an inevitability.
api 8y ago
Pet peeve: shunned from Internet, not web.

111 points by dsr12 8y ago

See also previous discussion about this topic from yesterday https://news.ycombinator.com/item?id=17501201 https://news.ycombinator.com/item?id=17501201 (56 comments)

wjnc 8y ago

An underlying question I have: Is it useful to trust IP-addresses on their range / owner / (distant) past behavior?

peteretep 8y ago
If you don't, you have to track ownership information, which sounds like an administrative nightmare.
Arnt 8y ago
It depends on the use. You probably wanted a simple answer, but it isn't a simple question.
- wjnc 8y ago
  jacquesm is known to give pretty exhaustive answers ;) I knew it wasn't an easy question, but the article seemed to indicate that at least some parties do indiscriminate blocking which struck me as rather dumb. Hence the question.
  - Arnt 8y ago
    Some parties (including myself at one point in the past) block with low cost. Suppose you're a microservice that does caching, fast-track authentication or similar. If you block a user, that user will have to spend several or even many seconds on reauthentication and/or cache refreshing, but that's the whole cost. Is your proper threshold for blocking high or low?
jacquesm 8y ago
IPV6 offers to all practical intents and purposes a near infinite range so there that tactic won't work (you will simply exhaust your storage at some point). IPV4 addresses in 'known bad' ranges can be totally benign, I know this because I've been the owner/steward of a whole pile of such addresses over the years. Typically the hosting providers where our stuff was colocated would be the likes of Leaseweb and Dynamic Pipe which had a lot of porn customers and spammers as customers. It would not be rare at all to be blocked either on entire class C's or ports from those blocks of addresses in spite of never having had interaction with certain parties before. Kudos to the people at Spamhaus who never blocked us and went out of their way to ensure they only hit the boxes of the spammers with surgical precision. Finally, 'distant past behavior' is what caused me to have to jump through all kinds of hoops to reclaim the IP address of my present day mail server. There is no set protocol to register a change of tenancy for an IP address and I'm pretty sure if such a protocol did exist that spammers would abuse it but it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...).
- dvfjsdhgfv 8y ago
  > it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...). This is really upsetting. The imbalance of power is especially pronounced here as they don't really care whether you deliver you mail or not - you do. You're totally at their mercy. That's why lots of people nowadays say "it's too much hurdle to maintain my own e-mail server, I'll just use some service" - and in this way they give even more power to Google and the rest. We'll wake up one day and realize e-mail is no longer as free as it used to be, but it will be too late.
  - gingerlime 8y ago
    Totally agree. I'm not entirely sure the various spam RBLs have a much better process though, and some blacklisting seems arbitrary. Wouldn't each RBL have their own obscure process as well? I'm dreading the day that I have to switch my personal mail server's IP address. (important disclaimer: it's been a while since I had to deal with un-blacklisting, so maybe things have changed since?)
DanBC 8y ago
SPEWS doesn't seem to have achieved much other than make a bunch of people really fucking angry. https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_System https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_...

JulianMorrison 8y ago

I really don't know why this isn't more common. Bad actors can often be identified. Their upstream should just disconnect them. Or their upstream should. Draw a boundary around them and their intransigent collaborators, and cut them out of the network like a cancer.

Cthulhu_ 8y ago
Every party involved there has to be careful and do their due diligence though; you can't just cut it off because there might be an actual legitimate business or a critical service in there.
- MaxBarraclough 8y ago
  Ah, you beat me to it.
- djsumdog 8y ago
  You could also get corporate censorship of the Internet, simply because a hosting provider may allow a lot of content that is offensive, but not illegal. I wrote about this last year using The Daily Stormer as an example: https://fightthefuture.org/article/the-new-era-of-corporate-censorship/ https://fightthefuture.org/article/the-new-era-of-corporate-...
MaxBarraclough 8y ago
The article seems to make no mention at all of the possibility of collateral damage. Were any honest actors harmed by this 'shunning'? Seems unlikely that this 'Bitcanal' web-hosting company was used exclusively by malicious parties. Also, if this 'shunning' idea were to really catch on, couldn't it end up colliding with net-neutrality laws?
jpalomaki 8y ago
Maybe they are afraid that once you start doing this, it may never end. Once you cut somebody out from your network, then you can no longer argue that you are just the dump pipe and don't judge your customers. This can lead to demands for cutting access to sites hosting controversial content etc. All this may generate tons of extra work and no matter what you do, you certainly are not going to please everybody.

oliwarner 8y ago

The conversations that strike up off the back of things like this (why does it take 4 years to disconnect them‽) really make me wonder what the internet will look like in a couple of decades. There clearly is appetite at most levels of government for a restricted internet. Obvious crime, paedophilia, terrorism, etc but increasingly, you're seeing direct-to-consumer sites like Alibaba and Wish flogging knock-off crap over borders without paying taxes, without consumer safety checks and often without having license to make and sell that stuff in the first place. It's not going to be long before somebody legislates that you're only allowed to peer a network if you agree to cut anybody off who enables that, including other peers who ignore abuse across their network. It'll effectively limit what "the internet" is allowed to contain. Essentially embargoing bad actors and those that enable them, and all in a very pro-active way. It will —and should— put the fear of iJesus into consumer ISPs. They could easily cut off customers with computers operating within botnets, alerting them to infections, etc. At the peril of having your peerings cut off, you'd expect them to be a lot more pro-active too. I honestly don't how I'd feel about this. It seems safer but if life has taught me anything, that usually just means it's not, and somebody's just quietly getting rich in the corner.

dcbadacd 8y ago
The first question is who decides what's illegal? Being gay is illegal in certain countries... Making ISPs more proactive is only doable with either heavy restrictions what communication is allowed or heuristics (that fail). That sounds like anyone out of the ordinary (so a majority of this site's users) will get flagged as suspicious. The fun thing is that I've seen both methods already applied and either me or someone I know has been encumbered by them. There's not a single piece of me that feels that this would somehow end up positive in total.
- oliwarner 8y ago
  I think it would have to be a single multi-signatory convention. And part of that stipulates that you can only peer against networks in signatory nations. The process of deciding that sort of law would be awful but if everybody focussed on serious and network focussed crime and not protecting Mickey Mouse et al, something good could come from it. But you are probably right. The US —esp with current leadership— could very easily force protectionist terms on others. Nobody would want to be separated from the US. Switzerland would have no leverage. African countries would have no leverage. The EU and China might have a chance, but the latter especially stands to lose a lot more than it could gain. China still needs access to a global market. It's definitely has potential to be deeply insidious. But with the value of the network, I'm just surprised people aren't suggesting more things like this. To be clear, I'm not advocating this. I just see it as an inevitability.

api 8y ago

Pet peeve: shunned from Internet, not web.