4 ms·

I'm still not sure why ISPs cannot detect when customer machines have been turned into botnet nodes and, effectively, disable them until cleaned. Seems that the

I'm still not sure why ISPs cannot detect when customer machines have been turned into botnet nodes and, effectively, disable them until cleaned. Seems that the machine's Net activity would leave tell-tale signatures that wouldn't be too hard to detect. Yet, about the most I have seen an ISP do is block port 25. In general, it seems that ISPs have a lot of unweilded power in this fight.

ZoFreX 12y ago
What motivation do they have to do that? For a clueless user all they will understand is that their ISP has cut them off, and if they give money to a different company instead then their internet will work (from their perspective their computer works fine in most cases - well, perhaps a little slowly).
- unclebucknasty 12y ago
  >What motivation do they have to do that? Security. Notifying a user that he's been pwned can protect that user's confidential info/identity. It's really a service to the user as much as anything. The ISP would just need to message it as such. They wouldn't just cut off "clueless users" without explanation. Instead, they'd explain that the user's machine has been compromised and disconnecting them until they can get it cleaned up is for their own good.
blhack 12y ago
God this sounds like a nightmare. What looks like botnet traffic to an ISP (irc, ssh, just about anything other than 80, 443, and 53) is stuff that I use all day, every day, as part of my work. Even filtering out SMTP traffic has been really frustrating for me at points in the past. I really hope ISPs don't start doing this. I want them to be as dumb of a pipe as possible.
- unclebucknasty 12y ago
  I hear you. I was frustrated by the SMTP thing once myself. Thereafter, I knew what was going on. Anyway, as devs who need access to this stuff we are in the minority, and I am sure they can find a way to make exceptions for people like us who are "power users". But, to leave the other 98% of grandmothers, etc. completely vulnerable to botnets by default seems an unreasonable approach. What seems clear is that they will eventually have to do something.

ZoFreX 12y ago

What motivation do they have to do that? For a clueless user all they will understand is that their ISP has cut them off, and if they give money to a different company instead then their internet will work (from their perspective their computer works fine in most cases - well, perhaps a little slowly).

unclebucknasty 12y ago
>What motivation do they have to do that? Security. Notifying a user that he's been pwned can protect that user's confidential info/identity. It's really a service to the user as much as anything. The ISP would just need to message it as such. They wouldn't just cut off "clueless users" without explanation. Instead, they'd explain that the user's machine has been compromised and disconnecting them until they can get it cleaned up is for their own good.

blhack 12y ago

God this sounds like a nightmare. What looks like botnet traffic to an ISP (irc, ssh, just about anything other than 80, 443, and 53) is stuff that I use all day, every day, as part of my work. Even filtering out SMTP traffic has been really frustrating for me at points in the past. I really hope ISPs don't start doing this. I want them to be as dumb of a pipe as possible.

unclebucknasty 12y ago
I hear you. I was frustrated by the SMTP thing once myself. Thereafter, I knew what was going on. Anyway, as devs who need access to this stuff we are in the minority, and I am sure they can find a way to make exceptions for people like us who are "power users". But, to leave the other 98% of grandmothers, etc. completely vulnerable to botnets by default seems an unreasonable approach. What seems clear is that they will eventually have to do something.