[98032] in North American Network Operators' Group
Re: How should ISPs notify customers about Bots (Was Re: DNS Hijacking
daemon@ATHENA.MIT.EDU (Sean Donelan)
Mon Jul 23 18:27:54 2007
Date: Mon, 23 Jul 2007 17:02:13 -0400 (EDT)
From: Sean Donelan <sean@donelan.com>
To: Joe Greco <jgreco@ns.sol.net>
cc: nanog@merit.edu
In-Reply-To: <200707232052.l6NKqw4B071425@aurora.sol.net>
Errors-To: owner-nanog@merit.edu
On Mon, 23 Jul 2007, Joe Greco wrote:
> "Some privacy advocates" will be upset with ISP's doing what Cox is doing.
> Maybe you missed that. If we assume that it is okay for Cox to actually
> intercept the IRC sessions of their users, we're wayyyy far into that
> mess anyways. I'm saying "do it right" if you're going to do it at all.
Would it be better if ISPs just blackholed certain IP addresses associated
with Bot C&C servers instead of trying to give the user a message. That
doesn't require examining the data content of any messages. The user just
gets a connection timeout.
> Personally, I'd prefer that they didn't do it, but that set of solutions
> is more complex.
So it is better for ISPs to do nothing, than attempt something that isn't
perfect. Thanks. I'll remember that the next time someone complains about
ISPs not caring about abuse or bots on networks.
Someone will find something to complain about no matter what ISPs do.
