4 ms·

Dynamic IP is a bummer, but outright closing ports is a direct violation of net neutrality. It's baffling that it's tolerated at all. An ISP's job is to forwa

Dynamic IP is a bummer, but outright closing ports is a direct violation of net neutrality. It's baffling that it's tolerated at all. An ISP's job is to forward IP packets. Not read them. TCP/UDP ports number are the content of those IP packets—not the meta data. Filtering based on such content is already a form of discrimination. What's next, deep packet inspection? Some ISP filter by default, but they do this at the router level, and you can either configure or change the router. That's okay, possibly even beneficial. Blocking at the backbone level however is just evil.

walrus01 8y ago
Counterpoint: Unless you've been in network engineering for an ISP with tens of thousands or more residential customers, you have no idea how much spam/abuse/trojaned PC traffic comes from residential users. There's a very good reason why ISPs block some of this, for the protection of their own users. It's even necessary to block port 139 windows file sharing or people will connect PCs with totally open file shares straight into their cable or DSL modems. It's a real headache. The average HN user is in like the 99.9th percentile of residential internet users. HN users, give them a proper DIA feed, sure. Everyone else, I'm wary.
- znpy 8y ago
  > The average HN user is in like the 99.9th percentile of residential internet users. And we have the right of doing this. Anyhow: the dynamic ip problem might be solved with ipv6. The spam problem... Imho graylisting + spf + dkim + reverse-ptr should be enough to kill spamlists once and for all.
  - walrus01 8y ago
    Good luck getting the average residential ISP to edit rDNS records for you. It's a special thing they will only do in certain circumstances and as a special one-off thing. Automated provisioning tools and customer service are not set up for it. I'm not saying that is a good thing, or satisfactory, but that's the current status quo. I'm all in favor of ipv6 everywhere but the current reality is that a huge number of organizations presently have v4 only smtpd in their MX records, if you try to do a pure v6 approach you will break delivery to/from something like 65% of the internet.
  - bradknowles 8y ago
    Even when gr[ae]ylisting was introduced (see <http://projects.puremagic.com/greylisting/whitepaper.html> http://projects.puremagic.com/greylisting/whitepaper.html>), it was quickly recognized that there are some important sites out there that don't follow the RFCs, and therefore they break gr[ae]yisting. The page at <https://www.greylisting.org/whitelisting.php> https://www.greylisting.org/whitelisting.php> links to a source at <http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk/schema/whitelist_ip.txt> http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk... that doesn't even exist anymore. For postfix, we now have the project at <https://github.com/stevejenkins/postwhite> https://github.com/stevejenkins/postwhite> to help automate the maintenance of whitelists of sites that break gr[ae]ylising. IMO, we passed the point years ago when gr[ae]ylisting was still a useful technique. For anything within the last decade or so, I would say it probably does more harm than good.
  - bradknowles 8y ago
    See also the "Disadvantages" section at <https://en.wikipedia.org/wiki/Greylisting> https://en.wikipedia.org/wiki/Greylisting>, and read section 4 of RFC6647 at <https://tools.ietf.org/html/rfc6647#section-4> https://tools.ietf.org/html/rfc6647#section-4>. Note that his RFC was written in 2012.
- canhascodez 8y ago
  OT: most developers have probably not been in network engineering for an ISP. If you've written anything about your experiences, or if you could be persuaded to, I believe that a lot of people on HN would be keenly interested (myself included).
  - walrus01 8y ago
    I'd be totally willing to answer any specific questions. Not sure if I have the free time or motivation to write a full guide to network engineering, the best I can really do is point people at the right reference sources. I'm honestly not nearly as qualified to do so anyways, compared to far more senior people who work for huge transit ASNs.
    - canhascodez 8y ago
      I probably mean more in the "human interest" relation of experiences sense than anything like a comprehensive guide to the profession. I'm not wholly ignorant of what happens to bits after they leave my router, but I know nothing about the people involved in making that happen, and I don't get the impression that it's widely written of. Anecdotes about daily challenges tend to be interesting; I would probably have gone quite a long time without ever knowing about port 139 otherwise I'm sure. But, I certainly wouldn't want to try to compel anyone to write anything they're weren't going to write anyway, so please don't take this as anything other than an expression of interest.
- technion 8y ago
  I've done it at the scale of a few hundred and I still feel I've seen more than enough to 100% agree with you. I've seen customers max out gigabit links with outbound spam from a compromised desktop. Contacting the customer leads to ignored emails and unanswered voicemails at best, angry Facebook rants about "getting in my face" at worst.
- loup-vaillant 8y ago
  Counterpoint of what exactly? Blocking ports by default is okay, and will address the clueless user problem (clueless users won't change the defaults to begin with). It's blocking them no matter what that's evil. Now I live in a country where most ISPs lend you a "box", a router, which is capable of doing all the blocking they want, and is configurable by the user. One of them uses that box to block the SMTP port by default, and let the users who want to change that setting. Problem solved.

walrus01 8y ago

Counterpoint: Unless you've been in network engineering for an ISP with tens of thousands or more residential customers, you have no idea how much spam/abuse/trojaned PC traffic comes from residential users. There's a very good reason why ISPs block some of this, for the protection of their own users. It's even necessary to block port 139 windows file sharing or people will connect PCs with totally open file shares straight into their cable or DSL modems. It's a real headache. The average HN user is in like the 99.9th percentile of residential internet users. HN users, give them a proper DIA feed, sure. Everyone else, I'm wary.

znpy 8y ago
> The average HN user is in like the 99.9th percentile of residential internet users. And we have the right of doing this. Anyhow: the dynamic ip problem might be solved with ipv6. The spam problem... Imho graylisting + spf + dkim + reverse-ptr should be enough to kill spamlists once and for all.
- walrus01 8y ago
  Good luck getting the average residential ISP to edit rDNS records for you. It's a special thing they will only do in certain circumstances and as a special one-off thing. Automated provisioning tools and customer service are not set up for it. I'm not saying that is a good thing, or satisfactory, but that's the current status quo. I'm all in favor of ipv6 everywhere but the current reality is that a huge number of organizations presently have v4 only smtpd in their MX records, if you try to do a pure v6 approach you will break delivery to/from something like 65% of the internet.
- bradknowles 8y ago
  Even when gr[ae]ylisting was introduced (see <http://projects.puremagic.com/greylisting/whitepaper.html> http://projects.puremagic.com/greylisting/whitepaper.html>), it was quickly recognized that there are some important sites out there that don't follow the RFCs, and therefore they break gr[ae]yisting. The page at <https://www.greylisting.org/whitelisting.php> https://www.greylisting.org/whitelisting.php> links to a source at <http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk/schema/whitelist_ip.txt> http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk... that doesn't even exist anymore. For postfix, we now have the project at <https://github.com/stevejenkins/postwhite> https://github.com/stevejenkins/postwhite> to help automate the maintenance of whitelists of sites that break gr[ae]ylising. IMO, we passed the point years ago when gr[ae]ylisting was still a useful technique. For anything within the last decade or so, I would say it probably does more harm than good.
- bradknowles 8y ago
  See also the "Disadvantages" section at <https://en.wikipedia.org/wiki/Greylisting> https://en.wikipedia.org/wiki/Greylisting>, and read section 4 of RFC6647 at <https://tools.ietf.org/html/rfc6647#section-4> https://tools.ietf.org/html/rfc6647#section-4>. Note that his RFC was written in 2012.
canhascodez 8y ago
OT: most developers have probably not been in network engineering for an ISP. If you've written anything about your experiences, or if you could be persuaded to, I believe that a lot of people on HN would be keenly interested (myself included).
- walrus01 8y ago
  I'd be totally willing to answer any specific questions. Not sure if I have the free time or motivation to write a full guide to network engineering, the best I can really do is point people at the right reference sources. I'm honestly not nearly as qualified to do so anyways, compared to far more senior people who work for huge transit ASNs.
  - canhascodez 8y ago
    I probably mean more in the "human interest" relation of experiences sense than anything like a comprehensive guide to the profession. I'm not wholly ignorant of what happens to bits after they leave my router, but I know nothing about the people involved in making that happen, and I don't get the impression that it's widely written of. Anecdotes about daily challenges tend to be interesting; I would probably have gone quite a long time without ever knowing about port 139 otherwise I'm sure. But, I certainly wouldn't want to try to compel anyone to write anything they're weren't going to write anyway, so please don't take this as anything other than an expression of interest.
technion 8y ago
I've done it at the scale of a few hundred and I still feel I've seen more than enough to 100% agree with you. I've seen customers max out gigabit links with outbound spam from a compromised desktop. Contacting the customer leads to ignored emails and unanswered voicemails at best, angry Facebook rants about "getting in my face" at worst.
loup-vaillant 8y ago
Counterpoint of what exactly? Blocking ports by default is okay, and will address the clueless user problem (clueless users won't change the defaults to begin with). It's blocking them no matter what that's evil. Now I live in a country where most ISPs lend you a "box", a router, which is capable of doing all the blocking they want, and is configurable by the user. One of them uses that box to block the SMTP port by default, and let the users who want to change that setting. Problem solved.