Slashdot Mirror
Proposal To Limit ISP Contact Data Draws Fire
An anonymous reader writes "A proposal to let Internet service providers conceal the contact information for their business customers is drawing fire from a number of experts in the security community, who say the change will make it harder to mitigate the threat from spam and malicious software, according to a story at Krebsonsecurity.com. From the piece: 'The American Registry for Internet Numbers (ARIN) — one of five regional registries worldwide that is responsible for allocating blocks of Internet addresses — later this month will consider a proposal to ease rules that require ISPs to publish address and phone number information for their business customers. Proponents of the plan couch it in terms of property rights and privacy, but critics say it will only lead to litigation and confusion, while aiding spammers and other shady actors who obtain blocks of addresses by posing as legitimate businesses.'"
Only for businesses, of course, since they have the money and don't mind paying extra to be untraceable. In fact, why not just go ahead and pass a law that bans popup blockers and mandates every citizen to an hour of forced ad viewing per day?
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
Person A says to cops: "I received spam. Here is copy."
Cop identifies IP.
Cop says to provider "Give me billing info on this IP b/c of spam."
Provider gives billing info. If not, does so after quick court order. If still not, gets shut down.
Cop contacts business. If hijacked computer, refers to techies. If not hijacked, quick court case by DA. IF spam, gets shut down and pays large statutory damages and prohibited from using net again for X years.
Or something like that.
The problem is having a quick, efficient, and intelligent police response in place, and having people know where they can go to get it. We will never stop spam unless we decide to commit sufficient resources to doing so.
We might use civil causes of action, class actions, and/or private atty general statutes. (But have to be careful to limit abuse.)
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
If GB is passing laws to cut off file sharers, who do so for personal use only, why can't they move quickly to impede spam?
... oh right. Spam is enterprise, brings in money. Piracy takes it away. Never mind that everyone loves piracy and hates spam ...
Quartz Extreme and Core Image. Are there any other real reasons to spend all that money on generic hardware?
You have a license plate on your car that's publicly viewable, and you don't have the right to obstruct/hide it. What's the problem with that?
You have an address on the door to your place that's publicly viewable. What's the problem with that?
You have a face that's publicly viewable when you go on the street - and you don't have the right to wear a mask to hide it, What's the problem with that?
You have your name, address, bank account number and signature on any cheques you write. What's wrong with that?
You have your medical condition and contact info listed on your MedicAlert bracelet. What's wrong with that?
You want to host something on the net? Fine - be prepared to post valid contact info. Otherwise, make arrangements for someone else to host it, or host it off the net.
In these cases, access is limited (by line-of-sight), or the information does not provide back-tracability. That no longer happens when posted online.
Or would you like to prove this isn't a big issue by posting your phone number, address, license plate number, and check routing/account numbers here for us?
Write your representatives! Repeal the 2nd Law of Thermodynamics!
STRANGELY ENOUGH the people who argue against privacy never seem to want to do that. They aren't terribly committed to their statements after all.
It is a miracle that curiosity survives formal education. - Einstein
Ever think that it's the way you treat them online that convinces them to let out their inner demons?
You have a license plate on your car that's publicly viewable, and you don't have the right to obstruct/hide it. What's the problem with that?
A license plate is an indexed key. To actually obtain the data associated with the key, you have to be in a position of authority (e.g. a police officer).
You have an address on the door to your place that's publicly viewable. What's the problem with that?
You're already there.
You have a face that's publicly viewable when you go on the street - and you don't have the right to wear a mask to hide it, What's the problem with that?
You don't? Tell that to Anonymous.
You have your name, address, bank account number and signature on any cheques you write. What's wrong with that?
You can contest things that happen to your bank account. Nonetheless, I don't let just anyone have the information on my checks.
You have your medical condition and contact info listed on your MedicAlert bracelet. What's wrong with that?
No, I don't. :^P Further, even if I did, people have to get close enough to view it. It's not in a publicly accessible database, like WHOIS data for domains.
I like the ability to anonymously post information to the internets. Part of that is the ability to be free from WHOIS spam as part of a domain registration.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Follow the link to today's spammer tracking report, and see how handy the information can be to track down spam. Also, feel free to do a whois. My contact info is on-line. It's been on-line, under various domain registrations, since I registered my first domain in 1994.
Spammers need a legit server to receive those clicks. See how I tracked down one spammer half an hour ago to learn more.
Pay particular attention to the section around the "Directory Listing Denied" segment.
You might also want to help ...
I'm still waiting for the "year of the linux desktop", so I don't hold out much hope for end-user education :-)
Then use a subdomain on a responsible person's SLD registration.
Proper contact information really is a requirement for registering a domain name.
"Domain by proxy" services are sneaky, the practice should be banned, for among other reasons (due to the fact) that the proxy service is officially the legal owner of the domain name, as far as the internet domain registry is concerned.
You have your medical condition and contact info listed on your MedicAlert bracelet. What's wrong with that?
A Medic...what??? Of course I do not.
You have your name, address, bank account number and signature on any cheques you write. What's wrong with that?
I have only name, bank account number, and issuing bank. No need for an address on a cheque, that's a security risk.
Also, don't write checks.... paper checks are a security risk, because they are easily forged, and should be kept locked up at all times and not used on a regular basis.
You have an address on the door to your place that's publicly viewable. What's the problem with that?
Some people do. Some people do not have an address printed on the door.
You have a face that's publicly viewable when you go on the street - and you don't have the right to wear a mask to hide it, What's the problem with that?
Huh? Of course you do. Although it may be at your peril
Real question because I don't honestly know: how much spam is actually sent from people with registered domain names who own blocks of IP addresses? How does this number compare to the spam sent from compromised Windows machines that participate in various botnets? If the latter is a much larger source, then this looks more like another ineffective feel-good measure.
You realize, these are not disjoint sets?
There are a lot of Windows machines on the networks of companies that hold IP addresses.
These are business networks, and often they are a source of spam. Often other people need to contact them to give them a friendly alert that some of their machines are sending spam, so they can deal with the infection.
Often residential users who are not on business networks with their own IP addresses, have ISPs that block or filter port 25.
Basically, if you have your own IP addresses, and your own network, then you have a responsibility to be contactable so you can mitigate abuse.
If you are a single user without IP addresses of your own, then your ISP is your network manager (to an extent, obviously they won't come to your house and clean the infection for you, and it's not ISP support's job to walk you through cleaning or fixing your infections, either, although some ISPs will offer this service, probably at substantial additional cost).
Getting rid of "private" domains won't do a damn thing except INCREASE the amount of spam that domain holders get. Spammers don't hide behind private domains, they hide behind huge botnets!
I used to not hide my whois information. In fact, I was proud to display my contact information in my whois entry when owning my own domain was a novel thing. Then the spam started on the contact accounts. Annoying, but I could handle it. Soon after, I started getting phone calls from people who barely spoke English claiming to be from my "hosting company" or from NetSol and they need access to my host right away or there was a "billing problem" and they need my credit card information to resolve it.
I set my domain information private right after that and never looked back.
No thank you. I use private domains to HIDE from spammers and scammers.
The