3 ms·

Very good overview of Spamhous' practices in Ars today (http://arstechnica.com/security/2013/03/when-spammers-go-to-war-behind-the-spamhaus-ddos/ http://arstech

by nsns 14y ago

Very good overview of Spamhous' practices in Ars today (http://arstechnica.com/security/2013/03/when-spammers-go-to-war-behind-the-spamhaus-ddos/ http://arstechnica.com/security/2013/03/when-spammers-go-to-...).

kevingadd 14y ago
Some of the behaviors described by Ars definitely sound shady to me; big ISP doesn't agree with you on the definition of illegal behavior, or in fact insists that local laws obligate them to protect their customers, so you blacklist the entire ISP? Complete nonsense. Feels to me like Spamhaus' operators understand that they now have a big hammer to swing (due to their popularity) so they use it freely to punish anyone they consider to be an 'evildoer', regardless of the collateral damage. If I were a customer of that ISP, I wouldn't be blaming the ISP, I'd be blaming Spamhaus. It also makes me wonder: How legit are the people running Spamhaus? If someone decides he wants to make a quick buck, is it possible for him to just arbitrarily add a site's IP ranges to the routing blacklist, and then send the site's operators a cash demand, like DDOS operators sometimes do?
- wpietri 14y ago
  Disagree all you want, but that's definitely not nonsense. The way the Internet has worked since day 1 is as a bunch of relatively independent groups deciding who they'll talk to and in what fashion. If a bunch of people don't want to talk to your ISP because of who the ISP hosts, that seems pretty sensible to me. And if they have decided to trust Spamhaus to make those calls, that also seems reasonable. Supposing you get your wish and Spamhaus disappears tomorrow. What's your proposed solution? With the kind of money that on-line crime like spamming and phishing makes, it's easy enough to find somewhere to buy protection from law enforcement. Or just buy laws. Either we decide not to talk to the bad neighborhoods, or the globally connected nature of the Internet means that we all live in the worst neighborhood.
  - kevingadd 14y ago
    When did I say Spamhaus should go away? Anyway, you're missing my point: Why on earth do you have to blacklist the entire ISP to deal with one customer? Presumably if you are certain that one specific customer is to blame, and you're demanding that customer be disconnected, you know which IPs the customer is using and you can block them. Or you are otherwise able to identify the customer, say through headers - in which case, you should filter those headers. Blacklisting the ISP should only be necessary if the ISP is intentionally helping its customer obscure their identity and disguising spammy/malicious traffic as normal traffic. There is no excuse for punishing innocent web users and businesses for the actions of third parties, or for holding those innocents hostage in order to force their ISP to do something you want. The fact that the ISP later complained to the authorities suggests to me that this is exactly what happened. Is it really impossible from a technical perspective to do anything other than blackhole the entire ISP? I'll admit I'm not an expert on IPv4, but that seems implausible to me. The problem with these policies and principles you're defending is that they can be equally applied to innocents in order to do harm. I'm not claiming I have some perfect alternative; I am merely pointing out that Spamhaus' means don't seem legitimate, even if their ends are legitimate. And in this case, the legitimacy of the ends can come into question as well. There's a gray area between obvious spam (penis pills, etc) and obvious solicited mail (personal mails between individuals) - Twitter sends me emails regularly containing tweets by people I follow, because I have an account, but I never solicited that email. Is it spam? What if there are other people who do want those emails, even if I don't? Is it really appropriate to blacklist Twitter? The Twitter example isn't a fantasy, either; Gmail automatically started sending those things to my Spam folder without my intervention, and I've seen it do that to other content in the past. Would you be happy if Spamhaus added the IP ranges of businesses and ISPs you interact with to its blacklists? What if they blacklisted your home ISP?
    - wpietri 14y ago
      Sure, there's an excuse. Or more correctly, a reason: network integrity. The question isn't what's technically possible. It's what's practically necessary to keep parasitism to a minimum. If Spamhaus blacklisted my ISP and had reasonable evidence that they were harboring spammers, I wouldn't yell at Spamhaus. I'd tell my ISP to kick out the spammers or I'd leave. This isn't a hypothetical for me: I moved a cabinet of gear out of an ISP precisely because they were dealing with the devil. I can't remember now if Spamhaus was involved, but I was definitely grateful to find out that the ISP was harboring spammers. It was a clear sign that they were in financial difficulty and were being run by idiots. They were out of business less than a year later because of those financial difficulties, and because their good staff didn't want to work for assholes. If you want to run a blacklist in a way that you think is better than Spamhaus, nobody's stopping you. If you are right, then presumably people will pick yours up and drop theirs. But my guess is that they'll retain their popularity, because people who actually have experience dealing with network abuse are pretty happy with their approach.

by nsns 14y ago

kevingadd 14y ago

Some of the behaviors described by Ars definitely sound shady to me; big ISP doesn't agree with you on the definition of illegal behavior, or in fact insists that local laws obligate them to protect their customers, so you blacklist the entire ISP? Complete nonsense. Feels to me like Spamhaus' operators understand that they now have a big hammer to swing (due to their popularity) so they use it freely to punish anyone they consider to be an 'evildoer', regardless of the collateral damage. If I were a customer of that ISP, I wouldn't be blaming the ISP, I'd be blaming Spamhaus. It also makes me wonder: How legit are the people running Spamhaus? If someone decides he wants to make a quick buck, is it possible for him to just arbitrarily add a site's IP ranges to the routing blacklist, and then send the site's operators a cash demand, like DDOS operators sometimes do?

wpietri 14y ago
Disagree all you want, but that's definitely not nonsense. The way the Internet has worked since day 1 is as a bunch of relatively independent groups deciding who they'll talk to and in what fashion. If a bunch of people don't want to talk to your ISP because of who the ISP hosts, that seems pretty sensible to me. And if they have decided to trust Spamhaus to make those calls, that also seems reasonable. Supposing you get your wish and Spamhaus disappears tomorrow. What's your proposed solution? With the kind of money that on-line crime like spamming and phishing makes, it's easy enough to find somewhere to buy protection from law enforcement. Or just buy laws. Either we decide not to talk to the bad neighborhoods, or the globally connected nature of the Internet means that we all live in the worst neighborhood.
- kevingadd 14y ago
  When did I say Spamhaus should go away? Anyway, you're missing my point: Why on earth do you have to blacklist the entire ISP to deal with one customer? Presumably if you are certain that one specific customer is to blame, and you're demanding that customer be disconnected, you know which IPs the customer is using and you can block them. Or you are otherwise able to identify the customer, say through headers - in which case, you should filter those headers. Blacklisting the ISP should only be necessary if the ISP is intentionally helping its customer obscure their identity and disguising spammy/malicious traffic as normal traffic. There is no excuse for punishing innocent web users and businesses for the actions of third parties, or for holding those innocents hostage in order to force their ISP to do something you want. The fact that the ISP later complained to the authorities suggests to me that this is exactly what happened. Is it really impossible from a technical perspective to do anything other than blackhole the entire ISP? I'll admit I'm not an expert on IPv4, but that seems implausible to me. The problem with these policies and principles you're defending is that they can be equally applied to innocents in order to do harm. I'm not claiming I have some perfect alternative; I am merely pointing out that Spamhaus' means don't seem legitimate, even if their ends are legitimate. And in this case, the legitimacy of the ends can come into question as well. There's a gray area between obvious spam (penis pills, etc) and obvious solicited mail (personal mails between individuals) - Twitter sends me emails regularly containing tweets by people I follow, because I have an account, but I never solicited that email. Is it spam? What if there are other people who do want those emails, even if I don't? Is it really appropriate to blacklist Twitter? The Twitter example isn't a fantasy, either; Gmail automatically started sending those things to my Spam folder without my intervention, and I've seen it do that to other content in the past. Would you be happy if Spamhaus added the IP ranges of businesses and ISPs you interact with to its blacklists? What if they blacklisted your home ISP?
  - wpietri 14y ago
    Sure, there's an excuse. Or more correctly, a reason: network integrity. The question isn't what's technically possible. It's what's practically necessary to keep parasitism to a minimum. If Spamhaus blacklisted my ISP and had reasonable evidence that they were harboring spammers, I wouldn't yell at Spamhaus. I'd tell my ISP to kick out the spammers or I'd leave. This isn't a hypothetical for me: I moved a cabinet of gear out of an ISP precisely because they were dealing with the devil. I can't remember now if Spamhaus was involved, but I was definitely grateful to find out that the ISP was harboring spammers. It was a clear sign that they were in financial difficulty and were being run by idiots. They were out of business less than a year later because of those financial difficulties, and because their good staff didn't want to work for assholes. If you want to run a blacklist in a way that you think is better than Spamhaus, nobody's stopping you. If you are right, then presumably people will pick yours up and drop theirs. But my guess is that they'll retain their popularity, because people who actually have experience dealing with network abuse are pretty happy with their approach.