4 ms·

It’s still profoundly disturbing to my eyes. Technically their underlying problem is relying on IP ranges, wich is flawed and raises false positives all the ti

by hrktb 8y ago

It’s still profoundly disturbing to my eyes. Technically their underlying problem is relying on IP ranges, wich is flawed and raises false positives all the time. They seem to recognize they shouldn’t be doing irreversible and critical action with only that info, yet will still use it to drop traffic. To me their message is “sorry we screwed with your accounts, going forward we’ll only screw with your messages”. Am I supposed to be that reassured ?

whoisjuan 8y ago
My guess is that this was a poorly thought and prioritized issue. Probably they asked some junior engineer to write a database query looking for a list of accounts with IP logs that matched a range of IPs coming from the banned countries, and then they passed that list to another junior employee who deactivated the accounts. Of course, there are many reasons for those IPs that are not your default/work/home, to be logged against your Slack account. They probably didn't think this throughly.
Gibbon1 8y ago
I find it profoundly disturbing the US foreign policy has been hijacked by Israel and Saudi Arabia.
mirimir 8y ago
I totally agree. But the problem then is what they ought to rely on. If in fact they are legally required to deny service to those in sanctioned countries. The whole thing is silly. I mean, anyone in a sanctioned country who was truly up to no good would be spoofing their IP address in some way. So most of the users that they ban or block will be innocent.
- daveFNbuck 8y ago
  Sanctions aren't about stopping people who are up to no good. They're supposed to hurt the country as a whole, which mostly means hurting the innocent. The idea is that this will incentivize the country to stop doing the thing it's being sanctioned for.
  - mirimir 8y ago
    OK, so I know nothing about the legal context for sanction enforcement. But in the US, the standard of proof in criminal cases is something like "beyond a reasonable doubt". And even in civil cases, it's something like "preponderance of the evidence". In my experience with pollution torts, that typically meant >50% probability of causation. But it usually devolved into battles of experts, and Daubert challenges. I don't get how IP-based geolocation could satisfy either standard.
    - tgsovlerkhgsel 8y ago
      Sanctions work like this: One country decides "fuck that other country in particular", either alone by their power of sovereignty or together with some international body. The sanctioning country (say, the US) now declares economic sanctions against another country (say, Iran). Since the US can only directly make rules for citizens/entities within the US, they say "it is illegal for anyone to export goods or services to anyone in Iran - if your company does it, the company gets fined and the CEO goes to prison". They might also say "and if anyone else that I can't punish directly sells to Iran, I will prohibit my people from selling things to you!" to force others to also participate in their sanctions. Now, the US gets a suspicion that Slack provided services to Iran. They arrange for the FBI (or whoever is responsible) to raid their offices, build a case beyond reasonable doubt that shows Slack provided services to a company in Iran, e.g. because said companies egress NAT IP was connecting and the user names match people working for that company in Iran. On top of that, they also show that Slack didn't do enough to prevent that from happening. Now, Slack gets fined and their CEO goes to jail (not sure if that's the penalty for sanction violations but I'd assume so). Since the CEO doesn't want to go to jail, and the company doesn't want to be fined, they'll do whatever they can to avoid selling services to Iran. They can generally choose who they do business with, and its in their best interest to err on the side of caution. You have little recourse if Slack doesn't do business with you because they don't like your IP, and they're almost certainly well covered by their ToS.
lucb1e 8y ago
I've never seen the whois info for an IP address resolve to the wrong country though. The owner is registered with the regional IP something (RIR if I'm not mistaken - like ARIN, RIPE, etc.) so that should be quite reliable. Posting this I'm sure someone will take the challenge and can find an example where it wasn't assigned to the right country, but is it more than one in a billion IP addresses? GeoIP databases on the other hand, the city and often even the province/department/state are very unreliable.
- jldugger 8y ago
  > I've never seen the whois info for an IP address resolve to the wrong country though. Try anything in 17.x
- mirimir 8y ago
  Consider HideMyAss server fun-tv.prcdn.net (5.62.58.220). They claim that it's in Tuvalu. However, https://www.iplocation.net/ https://www.iplocation.net/ reports some results indicating that it's in the UK, and some indicating that it's in Tuvalu. According to Hurricane Electric's BGP Toolkit, the origin AS for 5.62.58.0/23 is AS198605, with "Country of Origin: Czech Republic".[0] But results from many ping probes (ping.pe, asm.ca.com and maplatency.com) indicate that the server is in Miami, FL, US.[1] That's a lot different from Tuvalu, the UK or the Czech Republic. 0) https://bgp.he.net/AS198605 https://bgp.he.net/AS198605 1) https://www.ivpn.net/blog/wp-content/img/HMA-fun-tv.prcdn_.net-5.62.58.220-All-Probes-Tweak-Server.png https://www.ivpn.net/blog/wp-content/img/HMA-fun-tv.prcdn_.n...

by hrktb 8y ago

whoisjuan 8y ago

My guess is that this was a poorly thought and prioritized issue. Probably they asked some junior engineer to write a database query looking for a list of accounts with IP logs that matched a range of IPs coming from the banned countries, and then they passed that list to another junior employee who deactivated the accounts. Of course, there are many reasons for those IPs that are not your default/work/home, to be logged against your Slack account. They probably didn't think this throughly.

Gibbon1 8y ago

I find it profoundly disturbing the US foreign policy has been hijacked by Israel and Saudi Arabia.

mirimir 8y ago

I totally agree. But the problem then is what they ought to rely on. If in fact they are legally required to deny service to those in sanctioned countries. The whole thing is silly. I mean, anyone in a sanctioned country who was truly up to no good would be spoofing their IP address in some way. So most of the users that they ban or block will be innocent.

daveFNbuck 8y ago
Sanctions aren't about stopping people who are up to no good. They're supposed to hurt the country as a whole, which mostly means hurting the innocent. The idea is that this will incentivize the country to stop doing the thing it's being sanctioned for.
- mirimir 8y ago
  OK, so I know nothing about the legal context for sanction enforcement. But in the US, the standard of proof in criminal cases is something like "beyond a reasonable doubt". And even in civil cases, it's something like "preponderance of the evidence". In my experience with pollution torts, that typically meant >50% probability of causation. But it usually devolved into battles of experts, and Daubert challenges. I don't get how IP-based geolocation could satisfy either standard.
  - tgsovlerkhgsel 8y ago
    Sanctions work like this: One country decides "fuck that other country in particular", either alone by their power of sovereignty or together with some international body. The sanctioning country (say, the US) now declares economic sanctions against another country (say, Iran). Since the US can only directly make rules for citizens/entities within the US, they say "it is illegal for anyone to export goods or services to anyone in Iran - if your company does it, the company gets fined and the CEO goes to prison". They might also say "and if anyone else that I can't punish directly sells to Iran, I will prohibit my people from selling things to you!" to force others to also participate in their sanctions. Now, the US gets a suspicion that Slack provided services to Iran. They arrange for the FBI (or whoever is responsible) to raid their offices, build a case beyond reasonable doubt that shows Slack provided services to a company in Iran, e.g. because said companies egress NAT IP was connecting and the user names match people working for that company in Iran. On top of that, they also show that Slack didn't do enough to prevent that from happening. Now, Slack gets fined and their CEO goes to jail (not sure if that's the penalty for sanction violations but I'd assume so). Since the CEO doesn't want to go to jail, and the company doesn't want to be fined, they'll do whatever they can to avoid selling services to Iran. They can generally choose who they do business with, and its in their best interest to err on the side of caution. You have little recourse if Slack doesn't do business with you because they don't like your IP, and they're almost certainly well covered by their ToS.

lucb1e 8y ago

I've never seen the whois info for an IP address resolve to the wrong country though. The owner is registered with the regional IP something (RIR if I'm not mistaken - like ARIN, RIPE, etc.) so that should be quite reliable. Posting this I'm sure someone will take the challenge and can find an example where it wasn't assigned to the right country, but is it more than one in a billion IP addresses? GeoIP databases on the other hand, the city and often even the province/department/state are very unreliable.

jldugger 8y ago
> I've never seen the whois info for an IP address resolve to the wrong country though. Try anything in 17.x
mirimir 8y ago
Consider HideMyAss server fun-tv.prcdn.net (5.62.58.220). They claim that it's in Tuvalu. However, https://www.iplocation.net/ https://www.iplocation.net/ reports some results indicating that it's in the UK, and some indicating that it's in Tuvalu. According to Hurricane Electric's BGP Toolkit, the origin AS for 5.62.58.0/23 is AS198605, with "Country of Origin: Czech Republic".[0] But results from many ping probes (ping.pe, asm.ca.com and maplatency.com) indicate that the server is in Miami, FL, US.[1] That's a lot different from Tuvalu, the UK or the Czech Republic. 0) https://bgp.he.net/AS198605 https://bgp.he.net/AS198605 1) https://www.ivpn.net/blog/wp-content/img/HMA-fun-tv.prcdn_.net-5.62.58.220-All-Probes-Tweak-Server.png https://www.ivpn.net/blog/wp-content/img/HMA-fun-tv.prcdn_.n...