5 ms·

>Most spam comes from domains registered with these fake TLDs Domains don't send spam, servers do.

AnIdiotOnTheNet 8y ago
Technically accurate, but not useful. At work we block nearly all TLDs that aren't extremely common because a whole lot of phishing pages use them, more than enough to completely outweigh their legitimate uses except in a few cases like '.ms'. Oh, btw, if anyone reading this is one of the people making the decision to use a bunch of random domains in a TLD like that to host necessary chunks of your site or services required by your application, go to hell.
- yjftsjthsd-h 8y ago
  > Oh, btw, if anyone reading this is one of the people making the decision to use a bunch of random domains in a TLD like that to host necessary chunks of your site or services required by your application, go to hell. Tone aside, why do you object so sharply to anyone using a perfectly valid domain?
  - AnIdiotOnTheNet 8y ago
    Because it makes using DNS filtering a pain. I may have whitelisted all of 'microsoft.com', for instance, and a bunch of '.ms' domains I've seen in the logs and know are microsoft's, but invariably they'll start using others and I won't know about it until a user complains and I have to go dig around in the logs and possibly the site code to figure out which bullshit domain needs to be whitelisted. It's even worse with everybody using '.io'. And why? to save a scant few bytes when referencing a 1MB block of JS?
    - int_19h 8y ago
      You chose to use domain filtering. That's fine, but why should other people be obligated to arrange their parts of the internet in such a way that makes it easier for you to do that?
      - AnIdiotOnTheNet 8y ago
        I'm not saying they should, other than that I can't think of a good reason they have to do it the way they do it and the way they do it inconveniences anyone trying to be proactive about controlling where users can visit. They don't have to change, but I don't have to like what they're doing either.
    - hueving 8y ago
      >Because it makes using DNS filtering a pain. You're doing the internet wrong and I feel sorry for your users. A tld makes no difference when a request to a resource could be to gstatic.com or to gstatic.io unless you're doing something as stupid as assuming the .com tld is magically safe from hosting malware and phishing sites. >to save a scant few bytes when referencing a 1MB block of JS? Presumably you are referring to the cookie with those "scant few bytes". I highly recommend you read up on the cdn caching implications of having all of your users request resources with cookies.
      - AnIdiotOnTheNet 8y ago
        > You're doing the internet wrong and I feel sorry for your users. A tld makes no difference when a request to a resource could be to gstatic.com or to gstatic.io unless you're doing something as stupid as assuming the .com tld is magically safe from hosting malware and phishing sites. I certainly don't think they're safe, but a much, much higher ratio of .com domains are A) actually used by our business, and B) legitimate. > Presumably you are referring to the cookie with those "scant few bytes". I highly recommend you read up on the cdn caching implications of having all of your users request resources with cookies. No, I'm referring to the domain using one of these TLDs. Why 'gstatic.com' instead of 'static.google.com' or some other subdomain of the primary?
        hueving 8y ago
        >I certainly don't think they're safe, but a much, much higher ratio of .com domains are A) actually used by our business, and B) legitimate. So what? It seems like you are confusing false positives with false negatives and using that to justify bad policy. There are probably 0.001% of .com domains your users need access to and 0.0001% of alt tlds. That's not a justification for whitelisting .com and blacklisting the others.
        AnIdiotOnTheNet 8y ago
        The policy hasn't inconvenienced users much at all, I'd know because I see any unblock requests, so why not? As I keep saying, it is just one of many safeguards in place against malware and phishing, we are not under the delusion that it is anything other than that. If it were causing any significant friction in the business I'd be among the first to recommend stopping the practice.
- yebyen 8y ago
  What if I'm a guy who can't access the QA/staging version of his favorite pet open-source web project because they decided to host it at "[sitename].review"? It doesn't technically prevent anyone from visiting the site, but my whole campus blocks every .review domain, so I have to tunnel out to another campus network (where they don't blindly follow all of ISAC's sometimes braindead suggestions) each and every time I want to verify that a change actually fixes the bug. Isn't this a perfectly legitimate use of `.review`? Do you block this one too?
  - AnIdiotOnTheNet 8y ago
    By default? Yes. Sorry, it turns out you can't trust the internet. You're free to make a request for it to be unblocked.
    - yebyen 8y ago
      I've been asking for months. They also have blocked an entire /24 with some perfectly safe documentation on it, our InfoSec department says it came from our threat vendor, and our threat vendor says it came from one of our custom lists. I got one thing unblocked successfully once, it took an entire week. Who are you protecting from what? It seems to me like "turns out you can't trust the internet" is the right idea, but what exactly do you hope to accomplish with this block? You're not trying to make it so that... your users will think they can trust the internet?
      - AnIdiotOnTheNet 8y ago
        Sounds like you're blaming me because your InfoSec department sucks and can't get such a request turned around quickly. > what exactly do you hope to accomplish with this block? It's just one of many layers of defense against phishing and malware links.
        yebyen 8y ago
        No I'm not blaming you, I'm recognizing that InfoSec has more important fish to fry, than unblocking my pet projects that were a casualty of this garbage policy. Maybe it's appropriate for your company, but it is not appropriate for a college campus or other larger organization with many salaried employees. I understand not giving users rope to hang themselves with, but now I can only do this work at home. I don't like policies that cause tech workers to need to bring some of their work home with them. It's a personal project (with some work-related applications, but putting that aside) — that shouldn't mean I can only work on it at home. But because of the overhead of making these requests, the only effective way for me to work on this stuff is now at home. I don't like policies that result in people needing to bring more work home. I'd rather stay an hour late to get the thing some attention that it needs, and leave my computer in the desk drawer overnight. Policies like this sometimes make this impossible.
- hueving 8y ago
  If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of detecting phishing/malware sites. Seriously, blacklisting tlds is not how to secure a network. If you can't trust your users and browsers enough to prevent phishing on a .io domain, they're gonna get phished on a .com and a .net. The existence of free dynamic dns services on both of those should be enough evidence for you to rethink that. If your network is that sensitive you need to be whitelisting specific trusted IPs and blocking everything else. Your current approach to security is the kind of attitude that breaks the internet for nebulous gains. Do you block ipv6 too?
  - AnIdiotOnTheNet 8y ago
    > If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of detecting phishing/malware sites. You say that like it is the only measure we employ to guard against malware and phishing. We have many other measures in place. If this mechanism were causing more trouble than it was worth I'd be among the first to say we should ditch it. > Do you block ipv6 too? Sadly our ISP doesn't even support IPv6.
- CydeWeys 8y ago
  You'll find that lots of ccTLDs have worse rates of abuse than many of the new gTLDs. It mostly comes down to domain price. TLDs that are cheap for the first year tend to have the highest rates of abuse. Not that I agree with the idea of blocking entire TLDs to prevent abuse, but if you are, at least do it correctly.
  - AnIdiotOnTheNet 8y ago
    Actually we do block most ccTLDs since we only do business in the continental US.
    - CydeWeys 8y ago
      I'm so damn glad I'm not subjected to your network management practices.
      - AnIdiotOnTheNet 8y ago
        All I can say is that it doesn't cause much friction with our users, or else I would be pushing to change the policy. Can't imagine what you'd be doing for our company that would require all this access. Maybe you're just entitled?
        yebyen 8y ago
        No, I'm with CydeWeys, it's not entitled we're just glad we don't work for you! :) Just because your customers don't come from these countries, doesn't mean your vendors (and source code for important infrastructure) won't. Doesn't this seem a little bit even possibly xenophobic? I understand you'll make exceptions in cases where the use is legitimate, and I don't know how large your organization is, but I would be worried that there are going to be missed opportunities because they're not going to come to me, if I was in your shoes. They're just going to say "oh well," then move on and use something inferior that comes from inside of the bubble.
        8y ago

Technically accurate, but not useful. At work we block nearly all TLDs that aren't extremely common because a whole lot of phishing pages use them, more than enough to completely outweigh their legitimate uses except in a few cases like '.ms'. Oh, btw, if anyone reading this is one of the people making the decision to use a bunch of random domains in a TLD like that to host necessary chunks of your site or services required by your application, go to hell.

yjftsjthsd-h 8y ago
> Oh, btw, if anyone reading this is one of the people making the decision to use a bunch of random domains in a TLD like that to host necessary chunks of your site or services required by your application, go to hell. Tone aside, why do you object so sharply to anyone using a perfectly valid domain?
- AnIdiotOnTheNet 8y ago
  Because it makes using DNS filtering a pain. I may have whitelisted all of 'microsoft.com', for instance, and a bunch of '.ms' domains I've seen in the logs and know are microsoft's, but invariably they'll start using others and I won't know about it until a user complains and I have to go dig around in the logs and possibly the site code to figure out which bullshit domain needs to be whitelisted. It's even worse with everybody using '.io'. And why? to save a scant few bytes when referencing a 1MB block of JS?
  - int_19h 8y ago
    You chose to use domain filtering. That's fine, but why should other people be obligated to arrange their parts of the internet in such a way that makes it easier for you to do that?
    - AnIdiotOnTheNet 8y ago
      I'm not saying they should, other than that I can't think of a good reason they have to do it the way they do it and the way they do it inconveniences anyone trying to be proactive about controlling where users can visit. They don't have to change, but I don't have to like what they're doing either.
  - hueving 8y ago
    >Because it makes using DNS filtering a pain. You're doing the internet wrong and I feel sorry for your users. A tld makes no difference when a request to a resource could be to gstatic.com or to gstatic.io unless you're doing something as stupid as assuming the .com tld is magically safe from hosting malware and phishing sites. >to save a scant few bytes when referencing a 1MB block of JS? Presumably you are referring to the cookie with those "scant few bytes". I highly recommend you read up on the cdn caching implications of having all of your users request resources with cookies.
    - AnIdiotOnTheNet 8y ago
      > You're doing the internet wrong and I feel sorry for your users. A tld makes no difference when a request to a resource could be to gstatic.com or to gstatic.io unless you're doing something as stupid as assuming the .com tld is magically safe from hosting malware and phishing sites. I certainly don't think they're safe, but a much, much higher ratio of .com domains are A) actually used by our business, and B) legitimate. > Presumably you are referring to the cookie with those "scant few bytes". I highly recommend you read up on the cdn caching implications of having all of your users request resources with cookies. No, I'm referring to the domain using one of these TLDs. Why 'gstatic.com' instead of 'static.google.com' or some other subdomain of the primary?
      - hueving 8y ago
        >I certainly don't think they're safe, but a much, much higher ratio of .com domains are A) actually used by our business, and B) legitimate. So what? It seems like you are confusing false positives with false negatives and using that to justify bad policy. There are probably 0.001% of .com domains your users need access to and 0.0001% of alt tlds. That's not a justification for whitelisting .com and blacklisting the others.
        AnIdiotOnTheNet 8y ago
        The policy hasn't inconvenienced users much at all, I'd know because I see any unblock requests, so why not? As I keep saying, it is just one of many safeguards in place against malware and phishing, we are not under the delusion that it is anything other than that. If it were causing any significant friction in the business I'd be among the first to recommend stopping the practice.
yebyen 8y ago
What if I'm a guy who can't access the QA/staging version of his favorite pet open-source web project because they decided to host it at "[sitename].review"? It doesn't technically prevent anyone from visiting the site, but my whole campus blocks every .review domain, so I have to tunnel out to another campus network (where they don't blindly follow all of ISAC's sometimes braindead suggestions) each and every time I want to verify that a change actually fixes the bug. Isn't this a perfectly legitimate use of `.review`? Do you block this one too?
- AnIdiotOnTheNet 8y ago
  By default? Yes. Sorry, it turns out you can't trust the internet. You're free to make a request for it to be unblocked.
  - yebyen 8y ago
    I've been asking for months. They also have blocked an entire /24 with some perfectly safe documentation on it, our InfoSec department says it came from our threat vendor, and our threat vendor says it came from one of our custom lists. I got one thing unblocked successfully once, it took an entire week. Who are you protecting from what? It seems to me like "turns out you can't trust the internet" is the right idea, but what exactly do you hope to accomplish with this block? You're not trying to make it so that... your users will think they can trust the internet?
    - AnIdiotOnTheNet 8y ago
      Sounds like you're blaming me because your InfoSec department sucks and can't get such a request turned around quickly. > what exactly do you hope to accomplish with this block? It's just one of many layers of defense against phishing and malware links.
      - yebyen 8y ago
        No I'm not blaming you, I'm recognizing that InfoSec has more important fish to fry, than unblocking my pet projects that were a casualty of this garbage policy. Maybe it's appropriate for your company, but it is not appropriate for a college campus or other larger organization with many salaried employees. I understand not giving users rope to hang themselves with, but now I can only do this work at home. I don't like policies that cause tech workers to need to bring some of their work home with them. It's a personal project (with some work-related applications, but putting that aside) — that shouldn't mean I can only work on it at home. But because of the overhead of making these requests, the only effective way for me to work on this stuff is now at home. I don't like policies that result in people needing to bring more work home. I'd rather stay an hour late to get the thing some attention that it needs, and leave my computer in the desk drawer overnight. Policies like this sometimes make this impossible.
hueving 8y ago
If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of detecting phishing/malware sites. Seriously, blacklisting tlds is not how to secure a network. If you can't trust your users and browsers enough to prevent phishing on a .io domain, they're gonna get phished on a .com and a .net. The existence of free dynamic dns services on both of those should be enough evidence for you to rethink that. If your network is that sensitive you need to be whitelisting specific trusted IPs and blocking everything else. Your current approach to security is the kind of attitude that breaks the internet for nebulous gains. Do you block ipv6 too?
- AnIdiotOnTheNet 8y ago
  > If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of detecting phishing/malware sites. You say that like it is the only measure we employ to guard against malware and phishing. We have many other measures in place. If this mechanism were causing more trouble than it was worth I'd be among the first to say we should ditch it. > Do you block ipv6 too? Sadly our ISP doesn't even support IPv6.
CydeWeys 8y ago
You'll find that lots of ccTLDs have worse rates of abuse than many of the new gTLDs. It mostly comes down to domain price. TLDs that are cheap for the first year tend to have the highest rates of abuse. Not that I agree with the idea of blocking entire TLDs to prevent abuse, but if you are, at least do it correctly.
- AnIdiotOnTheNet 8y ago
  Actually we do block most ccTLDs since we only do business in the continental US.
  - CydeWeys 8y ago
    I'm so damn glad I'm not subjected to your network management practices.
    - AnIdiotOnTheNet 8y ago
      All I can say is that it doesn't cause much friction with our users, or else I would be pushing to change the policy. Can't imagine what you'd be doing for our company that would require all this access. Maybe you're just entitled?
      - yebyen 8y ago
        No, I'm with CydeWeys, it's not entitled we're just glad we don't work for you! :) Just because your customers don't come from these countries, doesn't mean your vendors (and source code for important infrastructure) won't. Doesn't this seem a little bit even possibly xenophobic? I understand you'll make exceptions in cases where the use is legitimate, and I don't know how large your organization is, but I would be worried that there are going to be missed opportunities because they're not going to come to me, if I was in your shoes. They're just going to say "oh well," then move on and use something inferior that comes from inside of the bubble.
        8y ago