[67825] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: BL of Compromised Hosts?

daemon@ATHENA.MIT.EDU (Tom (UnitedLayer))
Mon Feb 23 15:42:40 2004

Date: Mon, 23 Feb 2004 12:38:23 -0800 (PST)
From: "Tom (UnitedLayer)" <tom@unitedlayer.com>
To: "william(at)elan.net" <william@elan.net>
Cc: nanog@merit.edu
In-Reply-To: <Pine.LNX.4.44.0402222106040.17106-100000@sokol.elan.net>
Errors-To: owner-nanog-outgoing@merit.edu


On Mon, 23 Feb 2004, william(at)elan.net wrote:
> I find that most admins that decides on RBL lists are well educated about
> what lists they choose to use are (the end-users are however not always
> well informed about it and that is where most of the complaints are
> coming from).

The fact that people use some of the ridiculous RBLs out there indicates
that there are still quite a few boneheads out there, and I'd be willing
to bet that they outnumber the clued ones.

You'd be suprised at how many times I've come into a consulting situation
and had to explain to executives that their problems came from some admin
using blacklists with high casualty rates and irresponsible practices
(SPEWS/etc). But hey, it gives me lots of consulting opportunity, so I
guess I shouldn't complain too much.

Every time someone gets fired/reprimanded for using SPEWS or some other
kind of list, I'm sure one more person springs up to fill their place.

> I suspect that BGP admins are by their nature even better educated and
> will likely do even more research prior to using anything.

Don't be so sure of that either;  I regularly find poorly configured
routers redistributing default, loads of /24s and even /30's into their
neighbors.



home help back first fref pref prev next nref lref last post