Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

91–100 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#91

Post by kombookcha »

colechristensen wrote: post #27
mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

The thing is, obviously, that the Internet isn't broken, it has incredible utility and reliability. If it was designed and operated to be perfect , then it would likely be massively broken quite often. It is the tolerance for mild brokenness that has contributed significantly to its robustness and utility. That isn't an argument for not improving things though, just a warning against perfection, if you chase it then…

Retaining functionality even in the face of mild-to-moderate borkedness is sorta the inciting goal for even making it in the first place, way back in the cold war days. Building on top of "How do we make a communications network that can handle a bunch of nukes" sets you up for a very resilient baseline :)

Re: How to get the whole planet to send abuse complaints to your best friends

#92

Post by timokoesters »

mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

I often hear complaints about DNS. How secure is it in practice and why are there little efforts to fix it?

Re: How to get the whole planet to send abuse complaints to your best friends

#94

Post by franga2000 »

jmuguy wrote: post #2

It seems like systems shouldn't report abuse (at least automatically) for single packet, no round trip, requests unless its reaching denial of service levels of traffic (and maybe these are). Like in particular for SSH there's no way thats even a valid connection attempt until some sort of handshake has occurred.

But since anyone can submit an abuse complaint, maybe server providers should actually check the abuse reports before triggering the "respond in 2 days or we suspend your server" or similar measure of their ToS.

I've had my main server thrown offline by a bogus abuse report claiming that they received an over 1Gbps DoS attack from my IP even though my server only has a 400 Mbps cap. Had a human actually read the report, they would've seen it was impossible and wouldn't have had to spend 2 days arguing with phone support on my holiday.

Re: How to get the whole planet to send abuse complaints to your best friends

#95

Post by fragmede »

timokoesters wrote: post #92
mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

I often hear complaints about DNS. How secure is it in practice and why are there little efforts to fix it?

Not especially, but most websites are protected by TLS, so the problem that DNS is insecure is less of a problem. It's mainly a coordination problem, you have up get a lot of people on board to design a new DNS-SECure, and then everyone would also have to adopt it. Which they did (create DNSSEC, that is), but it has not seen the desired adoption. The other one is DoH, DNS over https. It's not without issue either though. So there are efforts, it's just a hairy coordination problem.

Re: How to get the whole planet to send abuse complaints to your best friends

#96

Post by timokoesters »

fragmede wrote: post #95
timokoesters wrote: post #92

Earlier quoted context omitted.

I often hear complaints about DNS. How secure is it in practice and why are there little efforts to fix it?

Not especially, but most websites are protected by TLS, so the problem that DNS is insecure is less of a problem. It's mainly a coordination problem, you have up get a lot of people on board to design a new DNS-SECure, and then everyone would also have to adopt it. Which they did (create DNSSEC, that is), but it has not seen the desired adoption. The other one is DoH, DNS over https. It's not without issue either tho…

For TLS certificates, the certificate authority has to look up IPs to verify the domain. So the security is still based on DNS, right?

Re: How to get the whole planet to send abuse complaints to your best friends

#97

Post by fragmede »

timokoesters wrote: post #96
fragmede wrote: post #95

Earlier quoted context omitted.

Not especially, but most websites are protected by TLS, so the problem that DNS is insecure is less of a problem. It's mainly a coordination problem, you have up get a lot of people on board to design a new DNS-SECure, and then everyone would also have to adopt it. Which they did (create DNSSEC, that is), but it has not seen the desired adoption. The other one is DoH, DNS over https. It's not without issue either tho…

For TLS certificates, the certificate authority has to look up IPs to verify the domain. So the security is still based on DNS, right?

you can get certificates for an IP, but they're rare. How it generally works is the DNS server says Google.com is at w.x.y.z IP address, your browser talks to that, it gives you a certificate, (skipping a few cryptography steps for simplicity,) you computer checks the certificate coming from Google.com as being valid, without checking w.x.y.z, and then encrypts your connection and shows the green lock icon.

If the DNS server is bad, it'll return e.v.i.l as the IP, your browser will talk to that, but it can't give a certificate that your computer thinks is valid. so your protected from accidentally logging in to a fake bank website, but also you can't access the correct bank website, so there's still a denial of service problem.

The certificate authority (CA) that gives out the certificates has to verify you own the domain that you're asking for the certificate for. One method is to look up the IP, but as that's problematic if they get the wrong IP, they usually check that from multiple places all over the world.

Re: How to get the whole planet to send abuse complaints to your best friends

#98

Post by 71bw »

gherard5555 wrote: post #93
71bw wrote: post #90

The way scrolling is implemented on that page is absolutely abhorrent.

you mean the 2 different panels ?

I mean the big margins on each side where I can't scroll the page with my mouse without having to have the cursor in front of some of the text.

Re: How to get the whole planet to send abuse complaints to your best friends

#99

Post by bornfreddy »

cuu508 wrote: post #86
shadowgovt wrote: post #66

Earlier quoted context omitted.

It's true due to the nature of what the network is . In the abstract: if I own the infrastructure and someone uses that infrastructure to hurt someone, that someone who was hurt (or the parties who protect them) are going to come to me asking questions. If I just say "I don't know" and the law doesn't protect my willful ignorance, I'm at best enabling harm; I'm at worst socially or legally liable for negligence. In t…

OK, but in this specific example, what would you do in the shoes of Hetzner? My understanding of the situation is, somebody in Network A is sending spoofed traffic to Network B. Hetzner receives abuse reports from Network B. Should Hetzner either establish trust or cut off: Network A, Network B, or their customer? Hetzner has or should have means to verify that their customer is not the one making port 22 requests. T…

If they feel like it, they can reply to the abused party that they have misidentified the attacker (and why). It is up to the victim to then research further if they feel so inclined.
Post reply on HN