North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet)

  • From: Chris Adams
  • Date: Wed Jan 12 11:34:57 2005

Once upon a time, Steven Champeon <[email protected]> said:
> 7) all ISPs MUST act on ANY single abuse report (including being
>    informed of infected customer machines, which MUST be removed from
>    the Internet ASAP. No excuses)

One problem I have with this one is people do forge reports, and there
is no way around that.  Also, as long as there are networks that don't
enforce source address filtering, port probing complaints cannot be
validated (I take them as valid unless proven otherwise, but we have had
a few that appear after the fact to be forged and/or spoofed).  If you
_always_ take someone off-line on a single complaint, you make it easy
for someone to get someone else kicked off.

-- 
Chris Adams <[email protected]>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.