Slashdot Mirror
IIALP - Abuse Logging Protocol
George Davey sent us a press release about abuselog.org, a site for the development of a generalized protocol for logging internet annoyances and abuses to a set of central servers, which could then be queried to find out which IPs are luserish.
which could then be queried to find out which IPs are luserish.
Interesting: 66.35.250.150 and 66.35.250.151 are the only entries. Truly uncanny AI.
Trolling is a art,
More LIKE ILAP I lap !
Cool
It saves every packet to disk allowing you to go back and look through all your packets for signs of abuse.
Im a gay asshole trying for the first post. Look at me, Im original
There's some form of verification.
In and of itself, this could be very easily abused by, say, people with a grudge who want to essentially get someone else an internet death penalty.
By summer it was all gone...now shesmovedon. --
Should I log myself?
Trolls untied!
That's a sure way to make sure the standard isn't adopted. (snicker)
--Have a good night's sleep. Don't forget to brush your tooth.
How will this work with DHCP where the IP address is not constant at all. How about using the MAC address of the card? At least it's something that can't be cheaply replaced (I get a different IP everytime I log on) or at least not by the majourity of people.
Your CPU is not doing anything else, at least do something.
a site for the development of a generalized protocol for logging internet annoyances and abuses
I wonder if slashdot will ever use this, for controlling the trolls and ACs?
Red Bull gave me wings and I flew into the ceiling fan.
wats odd, is that they have us tagged as a luserish IP :(
so what about all the people out there who get their ip from a DHCP server. Someone can be abusive and then within a given time have a new ip and some poor old grandma is now with this lusers old ip is flagged as an internet mischief.
Nineth Post! Eat it Trolls!
Our firewalls get port scanned many times daily. Our weblogs are filled with this kind of garbage: /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ x
63.189.X.196 - - [12/Jul/2004:16:31:04 -0700] "SEARCH
I could probably contribute a thousand IPs from last month alone.
There are too many 'incidents exchange', 'intrusion detection', 'log', 'firewall log' standards to count. Many of them IETF drafts. IDMF has a little bit of traction. There is one format the music industry came out with to ease notifications of ISPs....
/dev/null.
Do we need yet another "standard", or do we just need ISPs that are actually reading/handling any kind of abuse notice. Some are great about this, but others just route them to
---- join dshield.org Distributed Intrusion Detec
The annoyance logs on a particular IIALP Server are condensed and forwarded up the IIALP hierarchy to central Root IIALP Servers for central annoyance queries.
Come on... this is a joke, right? After annoyance queries, we can move on to annoyance mining and then the troll database and the lousy-speller's database with new improved SQL (Soundex Query Language for the spelling-impaired).
Annoyance queries? Pshaw.
Maybe we can also start a website that blacklists Communists, too.
If I had known the first "I" was for "IOWA", I wouldn't haver clicked through on this one.
how it was supposed performing.' Even fact there won't RRadt's stubborn move any equipment turned over to yet had at lunchtime
Can I report repeat luser/cheater/lamers from my mud? I bet I'm not the only sysadmin they abuse...
Try to guess which high-traffic website is going to be classified as public enemy no.1 due to its sustained absolute lack of respect to low-bandwidth websites by posting sensationalistic stories including links to them, while a *very simple* local caching system could solve easily the problem.
Tiny Violin Protocol.
Always appear to have the most crap on it of any system I see, the bugger is always falling over and its never the same site when I look back a few months later.
And why oh why does the owner of this "localhost" system insist on using non-standard ports all the time.
An Eye for an Eye will make the whole world blind - Gandhi
Would be cool to see the press release mentioned?
:-P
Digging in standard drafts when you aren't involved in them isn't too fun.
I'm browsing the RFC, and it sounds like they're planning on having people's firewalls spit out IIALP messages in response to port scans, etc. In my opinion, this is a really bad idea! Worm activity, someone running a stupid automated scan against an entire class A (whoooops!) by mistake, or a port scan trying to locate a particular machine whose ip has changed (which I have had to do), etc need to be differentiated from actual malicious activities. I can see this being used by overzealous admins to try to drop ALL traffic at the firewall level from anyone *ever* who gets a complaint propagated to them via this. Also, does anyone really expect their STUPID!@!!@ .log TLD proposal to be accepted?!??!! Jeez, everyone knows that this will never go through. Why do people insist on changing DNS, creating namespace pollution or breaking some other protocol (SMTP for a lot of spam "spolutins") for every problem facing the net!
We already have an RFC for the security flag in the IPv4 header (AKA "Evil Bit").
Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
Who's to say that spam corps can't get a hold of this? Now they have even more direct access to a list of people. Even if a half a dozen are revolving IPs (which in and of itself can be dangerous to your average "innocent" user), you can still get a few good hits to do your worst.
On a personal note, I feel that it should be carefully reviewed before the internet as a whole adopts this.
...unless they first define and implement the Abuse Logging Abuse Protocol or IIALAP.
Oh, it'd still be created, it just wouldn't evolve.
Senator McCarthy rises from the grave to bring us his Internet blacklist!
I don't see this going anywhere useful, that's all.
-Erwos
Plausible conjecture should not be misrepresented as proof positive.
..a database of Slashdot users? /. effect beware! :p
YHBT, YHL, HAND.
Evil bit.
Do not taunt Happy Fun Ball(TM)
I would like to submit my first abuse entry. The IP network 131.107.0.0/16 repeatedly pushes onto the Internet a combination of viruses (such as one called "Windows"), spyware (such as one called "Internet Explorer"), and hate speech (particularly against the Linux community).
All network administrators should blackhole this address space.
Tired of FB/Google censorship? Visit UNCENSORED!
Soon a reality... how exciting...
Having just skimmed the draft, there's a fatal flaw with this solution. To quote:
However, they don't seem to address the idea that one person controlling a million drones that send spam today... can control a million drones that submit IIALP reports about, say, cnn.com tomorrow, resulting in an DOS from all the sites that block based on the IIALP lists. They rely upon the reports of end-users, but do not take into account the fact that massive volumes of "end-user" machines are compromised and usable as drones for whatever nefarious uses their 0wner wants.
In short, their anti-spoof assumes individual malicious user endpoint hosts. If the malicious users on the Internet were limited to individual endpoint hosts, we wouldn't need solutions like IIALP!
A site about (internet) abuse logging... made in Front Page?
(speechless)
I'm a very experienced Gobolinux user. What's "/dev/null"??
"Talk minus action equals nothing" - Joey Shithead, D.O.A.
"Talk minus action equals
Am I the only one who went to check if verisign was first on the list? :-P
"Orthodoxy is unconsciousness" - Orwell
As one poster mentioned, it is because they want a new tld ".log" dedicated to their system.
Please someone squash this and while youare at it, please throw WS-I, XML, SOAP, AOP, UDDI, WDSL into the burlap sack before chucking it in the river.
Everytime you use IIALP, god kills a kitten.
Funny, seems to me that Slashdot is exactly the system described.
Isn't this site just a repository of linux users complaining about windows abuses instead of doing anything useful with their lives?
That's all the described system would ever be, all you linux bastards would spend your lives logging imaginary problems with windows systems, preventing any real value arising from the repository.
In Soviet Washington the swamp drains you.
Situation can also change when IP gets new owner.
Some kind of web of trust or probabilistic modelling is needed to get good results with
inaccurate,
spoofed,
missing and
wrong information.
Just take a look at the mess going on at their user support forum, it's virtualy owned by a 12year old.
www.iriver.com/community
I know cut & paste sucks.
Port scanning is legitimate, harmless investigative activity (unless it is part of a Denial-of-Service attack, but that applies to all forms of connection anyway - obviously, you can be DOSsed with half-pings or even GRE packets).
Are you going to claim you never have to port-scan in order to solve a problem? C'mon, man, get a grip. Sometimes even end-users have a legitimate need to portscan! Log it and move on, the real bad guys don't stop with a simple port-scan.