4 ms·

> chose to forward this complaint > ... > the email also contained sensitive information about who this operator was > ... > This is a fundamental breach of

> chose to forward this complaint > ... > the email also contained sensitive information about who this operator was > ... > This is a fundamental breach of that mutual trust > ... >Hetzner.de has broken one of the most fundamental aspects of any report of criminal activity or suspicion thereof; source protection. Excuse me? How is this in any way Hetzner's problem? The only "fundamental breach" of trust I can see here is the one that occurred when efnet gave "sensitive information" on its own operators to a third party at all. It sounds to me like efnet is the one in need of a lesson on "source protection." This reads more like a "we screwed up bad and are about to divert blame as hard as we can" letter than anything else. But I'm more than ready to listen to any further context that can be given to this.

dsl 14y ago
For abuse reports to be taken seriously you need to provide timestamped logs and legitimate real world contact details, in exchange there is the expectation that reports are not forwarded in an unsanitizied fashion to end users. (I worked an abuse desk for a few years)
- cientifico 14y ago
  The problem is that if you have a problem and want to solve that problem, the first thing you do is talking with the person. Instead of trying to fix this like normal persons, you want others to work for you by free. Who gives you the role of a judge in this case, to even consider that the actions from that ip where illegal. If they were illegal why don't sue? If you ask a lawer the first thing he will tell you will be to talk with the other parties before starting legal actions.
  - dsl 14y ago
    I really hate to use this analogy, but consider abuse desks the police of the Internet for a second. Your local ops team notices a lot of SSH break-in attempts coming from Sprint's network (for example). They forward the logs on to the abuse team, who reach out to the abuse team at Sprint. In the same way that a cross jurisdiction investigation would be handled by two police departments working together, the two abuse teams will work together to investigate and remediate the problem. Now imagine if the Seattle Police Department contacted the Chicago PD about an ongoing investigation of a jewelry heist, and the Chicago PD says "we are too busy to deal with this" and forwarded it on to the thieves so they could respond directly and help the Seattle PD with their investigation... Now the investigating officer is compromised and at risk. Sure, he was a known as a cop to the bad guys before, but now his enforcement actions have made him a direct target. This is a system that has worked for 20+ years. We have our own mailing lists, meetings and conferences, heck even a private direct dial phone system.
    - ciupicri 14y ago
      Except that the communication between police departments is clearly marked or known (because of various regulations/laws) to be confidential. Here it's not clear (as I've also mentioned in a previous comment [1]). [1] https://news.ycombinator.com/item?id=5518161 https://news.ycombinator.com/item?id=5518161
- devicenull 14y ago
  There is this expectation? I've never heard about such expectations before today.

dsl 14y ago

For abuse reports to be taken seriously you need to provide timestamped logs and legitimate real world contact details, in exchange there is the expectation that reports are not forwarded in an unsanitizied fashion to end users. (I worked an abuse desk for a few years)

cientifico 14y ago
The problem is that if you have a problem and want to solve that problem, the first thing you do is talking with the person. Instead of trying to fix this like normal persons, you want others to work for you by free. Who gives you the role of a judge in this case, to even consider that the actions from that ip where illegal. If they were illegal why don't sue? If you ask a lawer the first thing he will tell you will be to talk with the other parties before starting legal actions.
- dsl 14y ago
  I really hate to use this analogy, but consider abuse desks the police of the Internet for a second. Your local ops team notices a lot of SSH break-in attempts coming from Sprint's network (for example). They forward the logs on to the abuse team, who reach out to the abuse team at Sprint. In the same way that a cross jurisdiction investigation would be handled by two police departments working together, the two abuse teams will work together to investigate and remediate the problem. Now imagine if the Seattle Police Department contacted the Chicago PD about an ongoing investigation of a jewelry heist, and the Chicago PD says "we are too busy to deal with this" and forwarded it on to the thieves so they could respond directly and help the Seattle PD with their investigation... Now the investigating officer is compromised and at risk. Sure, he was a known as a cop to the bad guys before, but now his enforcement actions have made him a direct target. This is a system that has worked for 20+ years. We have our own mailing lists, meetings and conferences, heck even a private direct dial phone system.
  - ciupicri 14y ago
    Except that the communication between police departments is clearly marked or known (because of various regulations/laws) to be confidential. Here it's not clear (as I've also mentioned in a previous comment [1]). [1] https://news.ycombinator.com/item?id=5518161 https://news.ycombinator.com/item?id=5518161
devicenull 14y ago
There is this expectation? I've never heard about such expectations before today.