Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

71–80 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#71

Post by ninju »

wolrah wrote: post #41
Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

> As a personal note, I know I’m a bit of an exception for operating multiple IP addresses, but I need the flexibility to send packets with any of my source addresses through any of my ISPs. That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. If you actually have your own IP addresses this is normal and expected, but if you're able to use ISP A's IP addre…

https://xkcd.com/1172/

for those that need more context regarding the "reenable spacebar heating" comment

Re: How to get the whole planet to send abuse complaints to your best friends

#72

Post by remram »

Ekaros wrote: post #20
preciousoo wrote: post #9

Earlier quoted context omitted.

Or someone would figure out how to find who’s behind the spoofed requests, as those orgs have the resources to do so

Why not make ISPs responsible for blocking any such traffic. In the end it must originate from someone's network. And really they also should know who their peering partners are and what traffic should be allowed from there.

You're describing BCP38, which is discussed in the article.

Re: How to get the whole planet to send abuse complaints to your best friends

#73

Post by remram »

wizzwizz4 wrote: post #16

There's no in-band solution to this problem, but out-of-band solutions might exist! For example: (1) Notify the destination ISP that you're receiving backscatter. (2) That ISP checks where the packets are coming from, and notifies that ISP. (3) Repeat step 2 until source is found. (4) Quarantine that part of the network until it behaves better. At the end of the day, the internet is people.

Your steps 2&3 require a lot of people to put in work for free to solve someone else's problem.

Re: How to get the whole planet to send abuse complaints to your best friends

#74

Post by salawat »

dataflow wrote: post #68
salawat wrote: post #42

Earlier quoted context omitted.

Which do you prefer? Internet where you send a packet over the wire and the network takes it and delivers it per RFC. Basically OG Internet. Network of networks of more or less trusted peers. Or Internet where you need to requisition every connection/circuit be provisined before it is routed, which includes explaining why you need the service, and where any provider in the chain will deny you transit by default? You…

I don't think I understand your comment. I don't see why verifying that an IP from your own subnet isn't claiming to be from outside it requires everything in your second paragraph.

> don't see why verifying that an IP from your own subnet isn't claiming to be from outside it requires everything in your second paragraph.

You're looking at this as a collective update of firewall rules, and content to stop there. I'm more concerned about what that gesture turns into once it's significance percolates out to the public at large. Societies rearrange themselves around technical capabilities. Continue reasoning about how that constraint evolves into new obligations and legal precedents on the network operator, and you should eventually arrive at why I'm content to leave that particular bear unpoked.

It never stops at the technical. Ever.

Re: How to get the whole planet to send abuse complaints to your best friends

#75

Post by alwayslikethis »

mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

Spoofed MAC addresses is pretty essential for wifi privacy though.

Re: How to get the whole planet to send abuse complaints to your best friends

#76

Post by MichaelZuo »

alwayslikethis wrote: post #75
mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

Spoofed MAC addresses is pretty essential for wifi privacy though.

Yeah this seems more like a feature?

Re: How to get the whole planet to send abuse complaints to your best friends

#77

Post by alwayslikethis »

buildbuildbuild wrote: post #45

The “someone hates Tor relays” theory doesn’t sound worth the effort. This could be an entity running malicious relays, while also trying to unethically take down legitimate relays to increase the percentage of the network that they control.

Yeah. If you hate the tor network an easier thing to do is just to overwhelm it with traffic and degrade the service. Running some bittorrent downloads might be enough.

Re: How to get the whole planet to send abuse complaints to your best friends

#79

Post by EasyMark »

boring_twenties wrote: post #32
Avamander wrote: post #12

Earlier quoted context omitted.

Sometimes that's all the abuse you'll see though, with for example port scans.

Well the obvious answer there is that port scans shouldn't be considered abuse absent other factors like rising to the level of a DoS.

If you scan a bunch of my ports and you aren’t on my LAN then your IP gets banned (ignored) for a week.

Re: How to get the whole planet to send abuse complaints to your best friends

#80

Post by Dylan16807 »

alwayslikethis wrote: post #75
mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

Spoofed MAC addresses is pretty essential for wifi privacy though.

That depends on how you define "spoof".

You're not copying the MAC of someone else on the network.

Post reply on HN