12 ms·

An underlying question I have: Is it useful to trust IP-addresses on their range / owner / (distant) past behavior?

by wjnc 8y ago

peteretep 8y ago
If you don't, you have to track ownership information, which sounds like an administrative nightmare.
Arnt 8y ago
It depends on the use. You probably wanted a simple answer, but it isn't a simple question.
- wjnc 8y ago
  jacquesm is known to give pretty exhaustive answers ;) I knew it wasn't an easy question, but the article seemed to indicate that at least some parties do indiscriminate blocking which struck me as rather dumb. Hence the question.
  - Arnt 8y ago
    Some parties (including myself at one point in the past) block with low cost. Suppose you're a microservice that does caching, fast-track authentication or similar. If you block a user, that user will have to spend several or even many seconds on reauthentication and/or cache refreshing, but that's the whole cost. Is your proper threshold for blocking high or low?
jacquesm 8y ago
IPV6 offers to all practical intents and purposes a near infinite range so there that tactic won't work (you will simply exhaust your storage at some point). IPV4 addresses in 'known bad' ranges can be totally benign, I know this because I've been the owner/steward of a whole pile of such addresses over the years. Typically the hosting providers where our stuff was colocated would be the likes of Leaseweb and Dynamic Pipe which had a lot of porn customers and spammers as customers. It would not be rare at all to be blocked either on entire class C's or ports from those blocks of addresses in spite of never having had interaction with certain parties before. Kudos to the people at Spamhaus who never blocked us and went out of their way to ensure they only hit the boxes of the spammers with surgical precision. Finally, 'distant past behavior' is what caused me to have to jump through all kinds of hoops to reclaim the IP address of my present day mail server. There is no set protocol to register a change of tenancy for an IP address and I'm pretty sure if such a protocol did exist that spammers would abuse it but it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...).
- dvfjsdhgfv 8y ago
  > it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...). This is really upsetting. The imbalance of power is especially pronounced here as they don't really care whether you deliver you mail or not - you do. You're totally at their mercy. That's why lots of people nowadays say "it's too much hurdle to maintain my own e-mail server, I'll just use some service" - and in this way they give even more power to Google and the rest. We'll wake up one day and realize e-mail is no longer as free as it used to be, but it will be too late.
  - gingerlime 8y ago
    Totally agree. I'm not entirely sure the various spam RBLs have a much better process though, and some blacklisting seems arbitrary. Wouldn't each RBL have their own obscure process as well? I'm dreading the day that I have to switch my personal mail server's IP address. (important disclaimer: it's been a while since I had to deal with un-blacklisting, so maybe things have changed since?)
    - pbhjpbhj 8y ago
      It's not enough not to be on blacklists, Google Mail and MS Outlook online use complex, cryptic, algos to determine whether to receive mails and whitelisting someone is very far down the filter for MS (don't know about Gmail) so receiving mail you've told Outlook you want, from non-RBLed servers on long-term domains is blocked ... but you can pay to ensure the mail gets through. We're talking single emails, in reply, from whitelisted addresses, being blocked because they come from (paraphrasing) "a server associated with a server whose IP address was previously a spam source". That's a shared hosting experience. Mind you we were trying to send a flood of perhaps 10 emails a month to ourselves, so you can understand why they'd ignore our whitelisting./s
    - eilyra 8y ago
      Not sure they've changed that much since. I have a mail server, and while it's not blacklisted by any of the bigger ones (MS, Google and so on), my whole /24 block(!) is on the blacklist of whoever is providing spam filtering to Slackware (signed up for their mailing lists while I was still using Google as a mail provider). Because the provider says: "If you are on a network that is known for allowing email marketing to occur, you may be out of luck as well. If you aren't doing email marketing consider a different network."[0] I haven't yet gone through and actually contacted them especially since my IP is included in their "worst" category[1]. It's also the only place I've had a problem with so far, so not worth the hassle yet. [0] http://www.mipspace.com/contact.php http://www.mipspace.com/contact.php [1] http://www.mipspace.com/ratings.php http://www.mipspace.com/ratings.php
DanBC 8y ago
SPEWS doesn't seem to have achieved much other than make a bunch of people really fucking angry. https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_System https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_...

An underlying question I have: Is it useful to trust IP-addresses on their range / owner / (distant) past behavior?

by wjnc 8y ago

An underlying question I have: Is it useful to trust IP-addresses on their range / owner / (distant) past behavior?

peteretep 8y ago

If you don't, you have to track ownership information, which sounds like an administrative nightmare.

Arnt 8y ago

It depends on the use. You probably wanted a simple answer, but it isn't a simple question.

wjnc 8y ago
jacquesm is known to give pretty exhaustive answers ;) I knew it wasn't an easy question, but the article seemed to indicate that at least some parties do indiscriminate blocking which struck me as rather dumb. Hence the question.
- Arnt 8y ago
  Some parties (including myself at one point in the past) block with low cost. Suppose you're a microservice that does caching, fast-track authentication or similar. If you block a user, that user will have to spend several or even many seconds on reauthentication and/or cache refreshing, but that's the whole cost. Is your proper threshold for blocking high or low?

jacquesm 8y ago

IPV6 offers to all practical intents and purposes a near infinite range so there that tactic won't work (you will simply exhaust your storage at some point). IPV4 addresses in 'known bad' ranges can be totally benign, I know this because I've been the owner/steward of a whole pile of such addresses over the years. Typically the hosting providers where our stuff was colocated would be the likes of Leaseweb and Dynamic Pipe which had a lot of porn customers and spammers as customers. It would not be rare at all to be blocked either on entire class C's or ports from those blocks of addresses in spite of never having had interaction with certain parties before. Kudos to the people at Spamhaus who never blocked us and went out of their way to ensure they only hit the boxes of the spammers with surgical precision. Finally, 'distant past behavior' is what caused me to have to jump through all kinds of hoops to reclaim the IP address of my present day mail server. There is no set protocol to register a change of tenancy for an IP address and I'm pretty sure if such a protocol did exist that spammers would abuse it but it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...).

dvfjsdhgfv 8y ago
> it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...). This is really upsetting. The imbalance of power is especially pronounced here as they don't really care whether you deliver you mail or not - you do. You're totally at their mercy. That's why lots of people nowadays say "it's too much hurdle to maintain my own e-mail server, I'll just use some service" - and in this way they give even more power to Google and the rest. We'll wake up one day and realize e-mail is no longer as free as it used to be, but it will be too late.
- gingerlime 8y ago
  Totally agree. I'm not entirely sure the various spam RBLs have a much better process though, and some blacklisting seems arbitrary. Wouldn't each RBL have their own obscure process as well? I'm dreading the day that I have to switch my personal mail server's IP address. (important disclaimer: it's been a while since I had to deal with un-blacklisting, so maybe things have changed since?)
  - pbhjpbhj 8y ago
    It's not enough not to be on blacklists, Google Mail and MS Outlook online use complex, cryptic, algos to determine whether to receive mails and whitelisting someone is very far down the filter for MS (don't know about Gmail) so receiving mail you've told Outlook you want, from non-RBLed servers on long-term domains is blocked ... but you can pay to ensure the mail gets through. We're talking single emails, in reply, from whitelisted addresses, being blocked because they come from (paraphrasing) "a server associated with a server whose IP address was previously a spam source". That's a shared hosting experience. Mind you we were trying to send a flood of perhaps 10 emails a month to ourselves, so you can understand why they'd ignore our whitelisting./s
  - eilyra 8y ago
    Not sure they've changed that much since. I have a mail server, and while it's not blacklisted by any of the bigger ones (MS, Google and so on), my whole /24 block(!) is on the blacklist of whoever is providing spam filtering to Slackware (signed up for their mailing lists while I was still using Google as a mail provider). Because the provider says: "If you are on a network that is known for allowing email marketing to occur, you may be out of luck as well. If you aren't doing email marketing consider a different network."[0] I haven't yet gone through and actually contacted them especially since my IP is included in their "worst" category[1]. It's also the only place I've had a problem with so far, so not worth the hassle yet. [0] http://www.mipspace.com/contact.php http://www.mipspace.com/contact.php [1] http://www.mipspace.com/ratings.php http://www.mipspace.com/ratings.php

DanBC 8y ago

SPEWS doesn't seem to have achieved much other than make a bunch of people really fucking angry. https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_System https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_...