IP blacklists

[phi-incident () EXORSUS NET (phi-incident () EXORSUS NET)]

Just a note regarding the current arguments against the blacklist, I have
seen a lot of people simply throw away the idea with the statement that
they could obviously "just spoof some packets" from someone they didn't
like and have them blackholed.

None of the current mail blackhole systems would act on that level of
information (equivalent to me telling the RBL "Bob relays!" and having
Bobs network blackholed straight off), even ORBS, the least forgiving of
the lists, does actually check itself. I would anticipate that this
blacklist, should it wish to become anything more than a novelty, would
naturally use tactics similar to the RBL and others, ie, several
complaints must be filed, the offender themselves would be contacted and
given a chance to explain/patch things up, and a decent amount of effort
made to ensure that as soon as things were fixed, the offender would be
removed from the list.

On top of that I would recommend multiple levels of severity for
blackholed entities, such that administrators running machines where
security rather than connectivity was paramount, they could select
"Utterly paranoid" level and have their system blackhole IPs that had only
a minimal amount of checking (perhaps, multiple complaints registered,
contact hasn't replied in 3 days), whereas ISPs etc could run under "Most
confirmed" level and only be blackholing those addresses people were
_sure_ were bad, and which looked as if there was little hope of ever
getting repaired.

Certainly there are issues to do with who makes such judgements, but with
the careful creation of a charter for the service, and multi-level blocks
with a well defined set of rules explaining how entities would move
between levels, such issues could be minimalised. Interaction between
humans, which this by necessity must be, will always be partially
political, but I think this problem is well defined enough that the
politics could be reduced to background noise.

It is a good, but potentially dangerous idea, and most certainly worthy of
far more consideration than it is currently recieving.

Phi.