nanog mailing list archives

Re: Repeated Blacklisting / IP reputation


From: Ronald Cotoni <setient () gmail com>
Date: Tue, 08 Sep 2009 15:00:46 -0500

Joe Greco wrote:
there is a fundamental disconnect here.  the IP space is neutral.
it has no bias toward or against social behaviours.  its a tool.
the actual/real target here are the people who are using these tools
to be antisocial. blacklisting IP space is always reactive and should only beused in emergency and as a -TEMPORARY- expedient.

IMHO of course., YMMV.

Show me ONE major MTA which allows you to configure an expiration for
an ACL entry.

The problem with your opinion, and it's a fine opinion, and it's even a
good opinion, is that it has very little relationship to the tools which
are given to people in order to accomplish blocking.  Kind of the question
I was contemplating in my other message of minutes ago.

If people were given an option to "block this IP for 30 minutes, 24 hours,
30 days, 12 months, 5 years, or forever" - I wonder how many people would
just shrug and click "forever."

This may lead to the discovery of another fundamental disconnect - or two.

Sigh.

... JG
A cron job/schedule task with a script that removes said line would most likely do wonderous things for you. I could see a comment before each listing with a time/date that you use some regex fu on to figure out how long it was there and how long it should be there for. Simple! You could also automate it with a web frontend for noobs so they don't have to manually edit configuration files.

Current thread: