4 ms·

I remember, years ago, sending abuse reports to Shodan's ISPs asking them to enforce their ToS against Shodan, and receiving several emails from Shodan telling

I remember, years ago, sending abuse reports to Shodan's ISPs asking them to enforce their ToS against Shodan, and receiving several emails from Shodan telling me what their mission is and how it's not abuse. I continued reporting them and eventually their unsolicited scans ceased. Seemed like such a bizarre response to a perfectly cromulent request.

vore 5y ago
I feel like the incentive here is to make sure your devices are secured rather than asking them to stop scanning :-) Better someone who is openly providing you this information such that you can use it than a malicious attacker!
- proactivesvcs 5y ago
  Perhaps, but I knew how my systems were set-up, and their connections were odd enough that I noticed them. I would suggest this shows that my security precautions were working well.
robbedpeter 5y ago
This seems like a perfectly Karen request. Information you expose to the public internet, behind an isp or not, is not private or secure. This is like complaining that people keep taking walks by your house whenever your wife sunbathes nude on your front porch. The people doing the looking aren't the problem. Where your wife is exposing anything sensitive is the problem. The solution is to move your wife to the privacy of the back yard, buy her a sunbooth,or accept that she's on display to the public. Much the same, make sure your firewall facing your public network connection only exposes what you want it to. Part of the implicit structure of the internet is that by connecting, you're agreeing to be connected to, to be visible to everyone else that's connected. Leave Shodan be, their presence is important and relevant to the ongoing discussions of educating the public and maintaining accountability for security decisions by giant corporations.
- deleted 5y ago
  [deleted]
- ozim 5y ago
  Example you picked has a flaw that nude wife will be fined even if she exposes herself on your property - but in a way that others can see her. Police officer will be quite quick to explain her why she should not do this :) Other point on "Karen request" is spot on because Shodan is making requests for research purposes and selling the results. They don't access anything that is behind password and they don't scan with intention to find something that they can break through. While I mostly don't agree with people "scanning is not a crime", because I don't believe randoms on the internet that they are "scanning just for fun" and I expect they scan to find something they can get into which is first step of crime "preparation". Then people don't understand intent of scanning is what makes it illegal/legal not the scan on itself. Just like knife is not good/bad but if you hold it to harm someone it makes it bad and illegal.
  - hnlmorg 5y ago
    > example you picked has a flaw that nude wife will be fined even if she exposes herself on your property That's not even true for every jurisdiction in America, let alone the world. > Police officer will be quite quick to explain her why she should not do this That's not a flaw in the analogy. The point of the GPs comparison is to pick a similar real life scenario in which the fault is very obvious. The fact that you're able to identify the obviousness of the fault (and suggest the police would too) demonstrates the success of the analogy.
- rocqua 5y ago
  To push the analogy a little, what is she is nude in the living room, and people are stopping on the sidewalk to look in through your windows. I think that would be a rude invasion of privacy. (Alternatively, replace the living room window with an open front-door, or to push it even more with a closed but not locked front-door) The question of this analogy hinges, in my mind, on whether "this site talks https on port 443" is the equivalent of looking in someones front yard, or the equivalent of looking through the window into someones living room. I think one weird difference is that we can passively observe things in the real world. But you can't passively observe an IP-address. You need to send data at it to see how it responds. On that note, perhaps the analogy should be that people are shining a flashlight into your front-garden at night. Because they need to illuminate your private property in order to see anything.
petre 5y ago
Do you also report Chinese botnets? Because the most traffic I get is from those.
pmontra 5y ago
So Shodan doesn't look at your network now but every crook out there can scan it, find vulnerabilities and possibly exploit them. How are you protecting your network against that?
- proactivesvcs 5y ago
  I didn't ask them to look at my network. I then explicitly withdrew consent when they contacted me. They profit from the data they collected from me. This pushes them into crook territory in my opinion. I'm well aware that crooks can connect to my systems: that's why Shodan came to my attention. I find vulnerabilities by scanning my own network, I don't need someone else to profit by doing that against my permission.

vore 5y ago

I feel like the incentive here is to make sure your devices are secured rather than asking them to stop scanning :-) Better someone who is openly providing you this information such that you can use it than a malicious attacker!

proactivesvcs 5y ago
Perhaps, but I knew how my systems were set-up, and their connections were odd enough that I noticed them. I would suggest this shows that my security precautions were working well.

robbedpeter 5y ago

This seems like a perfectly Karen request. Information you expose to the public internet, behind an isp or not, is not private or secure. This is like complaining that people keep taking walks by your house whenever your wife sunbathes nude on your front porch. The people doing the looking aren't the problem. Where your wife is exposing anything sensitive is the problem. The solution is to move your wife to the privacy of the back yard, buy her a sunbooth,or accept that she's on display to the public. Much the same, make sure your firewall facing your public network connection only exposes what you want it to. Part of the implicit structure of the internet is that by connecting, you're agreeing to be connected to, to be visible to everyone else that's connected. Leave Shodan be, their presence is important and relevant to the ongoing discussions of educating the public and maintaining accountability for security decisions by giant corporations.

deleted 5y ago
[deleted]
ozim 5y ago
Example you picked has a flaw that nude wife will be fined even if she exposes herself on your property - but in a way that others can see her. Police officer will be quite quick to explain her why she should not do this :) Other point on "Karen request" is spot on because Shodan is making requests for research purposes and selling the results. They don't access anything that is behind password and they don't scan with intention to find something that they can break through. While I mostly don't agree with people "scanning is not a crime", because I don't believe randoms on the internet that they are "scanning just for fun" and I expect they scan to find something they can get into which is first step of crime "preparation". Then people don't understand intent of scanning is what makes it illegal/legal not the scan on itself. Just like knife is not good/bad but if you hold it to harm someone it makes it bad and illegal.
- hnlmorg 5y ago
  > example you picked has a flaw that nude wife will be fined even if she exposes herself on your property That's not even true for every jurisdiction in America, let alone the world. > Police officer will be quite quick to explain her why she should not do this That's not a flaw in the analogy. The point of the GPs comparison is to pick a similar real life scenario in which the fault is very obvious. The fact that you're able to identify the obviousness of the fault (and suggest the police would too) demonstrates the success of the analogy.
rocqua 5y ago
To push the analogy a little, what is she is nude in the living room, and people are stopping on the sidewalk to look in through your windows. I think that would be a rude invasion of privacy. (Alternatively, replace the living room window with an open front-door, or to push it even more with a closed but not locked front-door) The question of this analogy hinges, in my mind, on whether "this site talks https on port 443" is the equivalent of looking in someones front yard, or the equivalent of looking through the window into someones living room. I think one weird difference is that we can passively observe things in the real world. But you can't passively observe an IP-address. You need to send data at it to see how it responds. On that note, perhaps the analogy should be that people are shining a flashlight into your front-garden at night. Because they need to illuminate your private property in order to see anything.

petre 5y ago

Do you also report Chinese botnets? Because the most traffic I get is from those.

pmontra 5y ago

So Shodan doesn't look at your network now but every crook out there can scan it, find vulnerabilities and possibly exploit them. How are you protecting your network against that?

proactivesvcs 5y ago
I didn't ask them to look at my network. I then explicitly withdrew consent when they contacted me. They profit from the data they collected from me. This pushes them into crook territory in my opinion. I'm well aware that crooks can connect to my systems: that's why Shodan came to my attention. I find vulnerabilities by scanning my own network, I don't need someone else to profit by doing that against my permission.