Repeated Blacklisting / IP reputation

Tue Sep 15 20:46:19 UTC 2009

so... this thread has a couple of really interesting characteristics.
a couple are worth mentioning more directly (they have been alluded to elsewhere)...

	Who gets to define "bad" - other than a blacklist operator?
	Are the common, consistent defintions of "contamination"?

	If these are social/political - recognise that while the ARIN
	region is fairly consistent in its general use and interpretation
	of law, there are known varients - based on soveriegn region.

this whole debate/discussion seems based on the premise that there are well
known, consistent, legally defendable choices for defining offensive behaviours.
and pretty much all of history shows us this is not the case.

	(is or is not a mother nursing her child in public pornographic?)

So - I suspect that in the end, a registry (ARIN) or an ISP (COMCAST) is only
going to be able to tell you a few things about the prefix you have been handed.

	a) its virginal - never been used (that we know of)
	b) its been used once.
	c) it has a checkered past

and it will be up to the receipient to trust/accept the resource for what it
currently is or chose to reject it and find soliace elsewhere.

--bill

On Tue, Sep 15, 2009 at 04:31:04PM -0400, Christopher Morrow wrote:
> On Tue, Sep 15, 2009 at 4:23 PM,  <Valdis.Kletnieks at vt.edu> wrote:
> > On Tue, 15 Sep 2009 08:01:48 PDT, Shawn Somers said:
> >
> >>   Anyone that intentionally uses address space in a manner that they
> >> know will cause it to become contaminated should be denied on any
> >> further address space requests.
> >
> > You *do* realize that the people you're directing that paragraph at are
> > able to say with a totally straight face: "We're doing nothing wrong and
> > we have *no* idea why we end up in so many local block lists"?
> 
> Also, you can very well disable new allocations to Spammer-Bob, did
> you also know his friend Sue is asking now for space? Sue is very
> nice, she even has cookies... oh damn after we allocated to her we
> found out she's spamming :(
> 
> Spammers have a lot of variables to change in this equation, RIR's
> dont always have the ability to see all of the variables, nor
> correlate all of the changes they see :(
> 
> -Chris
> 