3 ms·

> The idea that you can appeal to the community to do a better job of policing badly behaved clients on their networks Have you ever worked in network engineer

> The idea that you can appeal to the community to do a better job of policing badly behaved clients on their networks Have you ever worked in network engineering for an ISP that holds a decent sized chunk of ARIN or RIPE ipv4 IP space, and actually cares about its long term IP space reputation? There's a big difference between a $5/mo colo/VPS operator that doesn't give a damn, and an ISP that does pay attention when legit "you have customers with abusive traffic" reports reach their network engineering team. Your comment about not caring about policing badly behaved clients on a network seems like the sort of organization that would land itself on every SMTP RBL in existence. A hosting company (and Azure and AWS are just the giant corporate evolution of a hosting/colo company) needs to be prepared and have a process to fire a customer for violation of TOS/AUP. It's done all the time. The immense size and callous nature of Microsoft/Azure makes this less likely in the modern era.

jameshart 4y ago
SMTP abuse has its mechanisms, with widespread IP blocking mechanisms that ISPs care about. What’s the equivalent mechanism whereby abusive HTTP traffic gets identified and causes an ISP to pay attention? Is there some sort of greybeard grapevine that old school webmasters can use to get the attention of class A IP network operators?
- walrus01 4y ago
  > Is there some sort of greybeard grapevine that old school webmasters can use to get the attention of class A IP network operators? webmasters as in single operators of httpd somewhere, no, not likely other network operators who are recognized ASNs and go to NANOG or RIPE or APNIC conferences and meet people face to face, yes. if you wilfully disregard valid human-written abuse complaints coming from other equally-clueful network engineering persons at other ISPs, you and your ISP will acquire a tainted reputation. there's various industry back-channels that exist between ISPs to communicate with each other about this sort of thing, I won't go into many details, primarily because there's a high degree of interest of the parties on all sides in keeping the email inboxes and phone numbers uncluttered with clueless single-residential-last-mile-user complaints about their wifi not working right.
  - jameshart 4y ago
    Right, and do those people give a crap about the fact that someone's IP space is originating some low grade HTTP noise? "Hey Bob. Bunch of clients on your network keep initiating https connections with servers on my network" "Gee Bob, sorry about that I'll go see what's causing that right away..."
    - catminou 4y ago
      Some actually do. If folks are escalating to the neteng crews it usually means something is broken via normal channels and it could use attention. That's social network is exercised for a variety of things: Abuse, ddos, IP spoofing, botnet C2s being hosted somewhere, malware hosting, complex customer investigations, route leaks, route hijacks, routing loops, congestion, executives home internet issues and more.

jameshart 4y ago

SMTP abuse has its mechanisms, with widespread IP blocking mechanisms that ISPs care about. What’s the equivalent mechanism whereby abusive HTTP traffic gets identified and causes an ISP to pay attention? Is there some sort of greybeard grapevine that old school webmasters can use to get the attention of class A IP network operators?

walrus01 4y ago
> Is there some sort of greybeard grapevine that old school webmasters can use to get the attention of class A IP network operators? webmasters as in single operators of httpd somewhere, no, not likely other network operators who are recognized ASNs and go to NANOG or RIPE or APNIC conferences and meet people face to face, yes. if you wilfully disregard valid human-written abuse complaints coming from other equally-clueful network engineering persons at other ISPs, you and your ISP will acquire a tainted reputation. there's various industry back-channels that exist between ISPs to communicate with each other about this sort of thing, I won't go into many details, primarily because there's a high degree of interest of the parties on all sides in keeping the email inboxes and phone numbers uncluttered with clueless single-residential-last-mile-user complaints about their wifi not working right.
- jameshart 4y ago
  Right, and do those people give a crap about the fact that someone's IP space is originating some low grade HTTP noise? "Hey Bob. Bunch of clients on your network keep initiating https connections with servers on my network" "Gee Bob, sorry about that I'll go see what's causing that right away..."
  - catminou 4y ago
    Some actually do. If folks are escalating to the neteng crews it usually means something is broken via normal channels and it could use attention. That's social network is exercised for a variety of things: Abuse, ddos, IP spoofing, botnet C2s being hosted somewhere, malware hosting, complex customer investigations, route leaks, route hijacks, routing loops, congestion, executives home internet issues and more.