Slashdot Mirror
Carrier Trick To Save IPv4 Could Help Spammers
Julie188 writes "As public IPv4 addresses dwindle and carriers roll out IPv6, a new problem has surfaced. We have to move through a gray phase where the only new globally routable addresses we can get are IPv6, but most public content we want to reach is still IPv4. Multiple-layers of NAT will be required to sustain the Internet for that time, perhaps for years. But use of Large Scale NAT (LSN) systems by service providers will cause problems for many applications and one of them is reputation filtering. Many security filtering systems use lists of public IPv4 addresses to identify 'undesirable' hosts on the Internet. As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt."
Domain name != IP address
There's no -1 for "I don't get it."
Because when one of our university email account gets hacked and starts spamming, other providers block our SMTP server, effectively knocking out communications between us and that ISP. NATing wouldn't change that, unless spammers use their own SMTP server behind a NAT router.
Bring on DNSSEC and DKIM.
I'm sure if we wait just a little while some spammer will send us the 'magic bullet' for this problem via their preferred delivery method.
IP filtering has always been useless from a security standpoint. Same goes for MAC address filtering.
Anyone anywhere can change both easily. Blocking addresses is only a matter of convenience.
This "news" just means that tons of "security" software and filtering hardware (Barricuda, anyone?), is being exposed as the useless, inflexible crap that they are, and the companies behind them are trying to point fingers at large network operators while simultaneously touting their next version, which will have IPv6 support. Maybe. Which totally won't solve the IPv4 issues, but never you mind that.
Subdomains have nothing to do with IP addresses, other than they can point to them using A Records. DNS != IPV4
Comment removed based on user account deletion
Keep all your bullshit about NAT saving the world in this thread where it can be ignored by people who actually know what they are talking about please.
Welcome back, Gopher.
end user customer networks (the ones most likely to go this route) are already on various "mail shouldn't be coming from here" blacklists, and those customers also should be already using the isp's mail servers for outgoing mail. it's a small incremental step, nothing more. Those running servers will necessarily get unique addresses and not be affected by reputable blacklists that are correctable.
NAT is fine for people who only make outgoing connections; i.e. the passive internet consumer.
It's hell for the rest of us, but hey, since when did the massive media conglomerates ever have the techies' interests at heart?
ISP level nat sucks but I don't think we have a lot of choice.
IPv4 IPs will become a scarce resource and as such will get reallocated from less lucrative customers to more lucrative ones. Whether that allocation will only happen within ISPs or whether it will be allowed to happen between ISPs is unclear at the moment but it is pretty sure to happen.
Those who aren't profitable enough to give a public V4 IP will still need to reach IPV4 only servers and/or use IPV4 only applications (remember apps both client and server have to support v6, not just the OS) for the forseeable future. ISP level NAT is the only way to deliver that.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
remember apps both client and server have to support v6, not just the OS
Really badly written programs.
Seriously. I've written stuff in C with the sockets API that is IPv4/v6 agnostic. It's easy to do; there is no excuse for not implementing it.
I work for an IP reputation company (and am not representing it in this post).
This is not a complicated issue. The LSN portals will merely have to add a tracking header to all mail they process (and block anonymous direct mail if they want to escape DNSBLs' wrath). This is already an issue with webmail (e.g. Google doesn't add the tracking header, so it's MUCH harder to trap spam originating through GMail than it is through providers like Hotmail who do provide this extra tracker).
Use my userscript to add story images to Slashdot. There's no going back.
It's not just spammers. A lot of on-line games, for instance, record the IP address used to log in to a game in the account's history. Customer Support then uses that to help determine eg. whether a claim of a hacked account is valid or bogus. Large-scale NAT is going to mess with that by confusing the record: one computer may appear to be using a different IP address for each login, and multiple unrelated computers can appear to have the same IP address. And with a lot of games moving towards RMT, a hacked account can mean the loss of real money for the player. When CS tells that player "Sorry, the login where the items were sold/transferred came from one of the IP addresses you normally log in from, the problem's on your end." and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.
is delicious.
So, why not just have a public database of LSNs and have them run extended ident service? (I.e., you supply it with local-remote port pair and it will tell you the IPv6 address of the NAT'd peer. Then you just use that for the peer identification from then on.)
It's not the fall that kills you. It's the sudden stop at the end. -Douglas Adams
Seriously, IPv6 is there to replace IPv4. Tell everyone who whines 'tough shit' switch over already. If I have to pay an extra 5 dollars a month for a year to my ISP for that to happen then I would. Just stop trying to extend the life of IPv4 when there is a suitable replacement already available.
NAT is fine for people who only make outgoing connections; i.e. the passive internet consumer.
Unless the passive internet consumer uses P2P software, or VoIP (from a provider which is not their ISP), which is harder with NAT and probably requires active participation from the ISP to make it work. The RIAA might have a few things to say about that.
My ISP (AAISP) actively encourage IPv4 address exhaustion AFAICT.
They gave me a /29 + a /32 for my router for home use and probably would have given me more if I'd asked. At work I asked for a /28 and got a /27.
They also give out a /48 IPv6 subnet to all customers and instructions for use. They can do IPv6 over PPPoA (this is the UKoGB) natively and provide a IPv6 to 4 tunnel broker for those that need it.
Have a look at your Spam Assassin headers and see that quite a lot of marks are not related to IP address. I have found DNSBLs handy up to now but I think I'll accept that as these lose their efficiency during IP version handover my spamds and MTAs will get a bit more of a battering for a while.
Never mind processing power is pretty cheap.
I have a customer with around 16 million unique IPs trying to get in each week - a spambot net of some sort (Russian and Chinese IP feature a lot). An Exim process is being spawned for each connection along with a spamd and possibly clamd session. The box is a dinky Dell single processor server and it barely breaks a sweat.
Cheers
Jon
Having been intimately involved with spammers over the years I can say that this change will only escalate the ongoing game of use / burn / blacklist / move on. Yes, more poor commercial entities will unknowingly and unwillingly have to call in Wally the IT guy to help them get off some blacklist somewhere so their mail will flow, but in the grand scheme this will not change the processing power of the mail bots or tilt the scales in a significant manor. IMHO.
Really badly written programs.
Or just old programs.
Afaict windows didn't have getaddrinfo until XP (unless you count the version in the IPV6 technology preview for 2K). It's predecessor gethostbyname only supports IPV4. MS does offer a wrapper to help with this but afaict that only helps if you are coding with MSVC[++] (I ended up writing my own wrappers for fpc/delphi, not too hard but definitely extra effort)
Further it seems while windows has wsaasyncgethostbyname there is no wsaasyncgetaddrinfo. So if you want to do a v6 capable name lookup without blocking the rest of your app you have to do it on another thread.
P.S. yes I HAVE implemented code (in delphi style pascal) directly on the low level apis that supported both v4 and v6 and async lookups (by using a thread) and supported older operating systems (by using getprocaddress and my own "v4onlygetaddrinfo" if the getprocaddress fails). I wouldn't exactly call it trivial though.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
My ISP (AAISP) actively encourage IPv4 address exhaustion AFAICT.
It's really not in ISPs interests to conserve IPs at this point. The more IPs they can get out of the RIRs now the more IPs they will have to reuse for more lucrative customers later.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
... lists of public IPv4 addresses to identify "undesirable" hosts ...
Legitimate mail servers will still need an IP address, whether that is IPv4 or IPv6. Their outbound SMTP connections can just use that same IP address. The real issue involves all those end user (broadband and dialup) IP addresses, which more and more will be multiple users sharing them for outbound connections, with no inbound. Make those have zero reputation. Let the IP addresses which are associated with real mail servers have the reputation earned by its behavior.
One big difficulty will be mail servers stuck only on IPv6 trying to deliver mail to those on IPv4, and visa-versa. But this is at least a substantial subset of the IP space. That means it can hold out for a while on IPv4, until enough IPv6 is deployed to make a "mad rush to IPv6 for email" can happen. But in the mean time, those who can do mail exchange between servers on IPv6 will be pretty much spam free, for at least a while. When spammers get on IPv6, then we know IPv6 is "happening".
To encourage IPv6, those who are on it can do things like adding extra goodies to IPv6 users. I do know a lot of porn is already there. Maybe extra features on web sites can be made to work on IPv6, too.
now we need to go OSS in diesel cars
-1 for not even remotely knowing what you're talking about.
But anyway, IPv6 is essentially the same thing as using a longer name. Instead of having only 2^32 addresses, IPv6 has 2^128 addresses. Enough to give every man woman and child on earth a trillion permanent addresses a year for 4.85*10^16 years. (caveat: assuming the population will stay at 7 billion people for 4.85*10^16 years)
Hectice, baby, Mercator says hello to you
Maybe as all mail behind NATs get blocked by spam filters the network administrators will actually start blocking mail from infected hosts in their network so that legit mail is accepted again. Wishful thinking?
As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt.
That doesn't follow. The folks in dynamic space (the same space that will be served by LSNs) are already considered spammers when they connect to a non-local SMTP server. The only reason they're scored instead of outright blocked is that there's no rigorous list of what is and isn't a dynamic space. It makes no difference to the server whether it filters a range of IPs or a single IP.
Identifying the individual spammer from an abuse report is slightly more difficult, but only slightly. And if you're behaving like a good net citizen, you probably blocked outbound 25 at the LSN box to begin with so you're not getting any reports because your virus-laden customers aren't able to successfully spam.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
If your mail server supports IPv6, the mail will go sender's client to sender's MTA to your MTA, all via IPv6, with full headers. So the problem only affects recipients who are slow getting their mail servers IPv6 enabled, who force senders to reroute their mail through an IPv6 to IPv4 gateway. So seems to me it's a good reason to hurry up and get your servers on IPv6.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
I still think the best way to handle this would have been by high bit extension in each octet field.
Yeah, I know, the theoretical non-constant numeric address length would have been a serious pain to predict the hardware for back in the '80s, when (ergo, I wish) they might have had the foresight to reserve the high bits at each level for possible other uses.
But it would have been nice if an ISP could have, by definition, its own extendable address space to allocate out of, and any customer could further extend their own allocation, down to, say, 6 octets max in the '80s, 7 max in the '90s, 8 in the decade just completing.
I appreciate the fact that IPV6 should give us this ability, at least in a one- or two-shot way, but I think it's generally a mistake when the data structure itself limits a resource that is known to have a tendency to expand.
(And, yes, I consider the above to be funny in the sick humor sort of way.)
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
The last time I contacted my ISP about this they told me (again) that they have no plans to implement IPv6.
This was just a few months ago.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Or non-dedicated game hosting. Wasn't Modern Warfare dependent on users hosting the games themselves? How would that work with NAT?
Dilbert RSS feed
My requests have been meeting deaf ears for years.
Unfortunately, the alternative ISPs are doing the same thing here. (But I should check again soon. I'm getting tired of these guys since the legacy monopoly here bought them out.)
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
"Damn you filthy file-sharers! Thanks to you, at my last party I only had seven buckets of blow and forty hookers rather than the ten buckets and sixty hookers that are accepted as an industry-norm for this type of affair. Damn you all!"
for example
Requiem for the American Dream
Those aren't insurmountable. We're talking about a transition period here, so the assumption is that people will have unNATed IPv6 addresses, and you can use those to connect to peers. VoIP also doesn't necessarily need to allow incoming traffic, as long as there's a central server that can bounce the traffic. Services like Skype and MSN already do this, because customers usually aren't handy with opening ports.
The details are trivial and useless; The reasons, as always, purely human ones.
All of the players will either have:
* an IPv6 address and a (possibly NATed) IPv4 address, or
* an unNATed IPv4 address.
If the entire group of players falls into the same category, then it's a non-issue. If it's mixed, then one of the players in the second category should run the server.
The details are trivial and useless; The reasons, as always, purely human ones.
Pastebin example code or it didn't happen.
You shouldn't be running a "server" at home anyways. The internet was created so that you could buy services from large companies like your ISP. Running your own server at home is socialist. Think of the children!
Many IT professionals including myself feel that IPv6 is a joke and is unnecessary in most practical scenarios. Arguments I tend to throw out on face value are "why not IPv6?" and "we're running out of IPv4 addresses". Keep NAT'ing IPv4 until the cows come home - no one except tech geeks will really care if we do.
While what you say is true, what you and the other "just switch to IPV6 already" folks seem to be missing out on is if everyone was to switch at noon tomorrow in all likelihood you would be looking at MASSIVE outages, which would go on for weeks if not months. Why? Multiple reasons:
One, thanks to offshoring IT has been a dying field for quite awhile now, with fewer and fewer new blood coming in. What that means is in the flyover states you have most if not all the backbones being run by old guys who haven't kept up on the tech, and from the ones I've talked to most are looking to get out of IT if at all possible. That means the experience just isn't there, it isn't gonna be there, and many will take early retirement or just get out rather than deal with the IPV6 mess. That in turn means things that take minutes to fix in IPV4 will take days in IPV6 simply because nobody knows how to use the new tools.
Two: Infrastructure. There is a hell of a lot of VERY expensive equipment out there that either cannot be upgraded to IPV4, or could be but is no longer "supported" by the OEM, which means a MASSIVE amount of money will have to be spent in a dead economy. Now considering these cableco/teleco duopoly sure as hell ain't gonna take a CEO pay cut, that either means pay for it by gouging the customers even deeper, which in most flyover areas Internet usage is declining thanks to price gouging, or make it up by screwing the workers even harder, which results in number one above. Then add in the fact a good 90%+ of the routers and firewalls and other network devices in consumer homes WILL NOT support IPV6, and in fact most of the routers sold today STILL DON'T support IPv6 and the ones that do are triple price compared to the others, means you are talking MASSIVE amount of eWaste is about to be hitting the environment. You are talking truckloads of routers, modems, all having to be shitcanned. Again this will raise cost that the consumer WILL get stuck with in a dead economy.
So you see, there is a damned good reason that they are gonna string along IPV4 for every last second they can. They will do so because it is gonna be a massive clusterfuck when the switchover comes, with complaining customers because NOTHING in their house works, no IT guys with experience enough to fix even the simplest of problems, and warehouses worth of gear, both dirt cheap and ridiculously expensive, all having to be taken straight to the dump. Frankly it is NOT gonna be pretty, not at all.
ACs don't waste your time replying, your posts are never seen by me.
heh sweet that means slashdot can never ban me right?
your friendly neighborhood synonymous coward
wait did i do that right?
all dynamic ip users, are restricted to their provider (isp) smtp service. ISP acts as the only smtp relay. Users are not allowed to open port 25 beyond the ISP's address space.
they filter and monitor everything (e.g. torrents). why not filter port 25, even validate against proper SPF. Am I the only one using SPF for my domains...?
In short, the gold rush is beginning.
Until the day when a major ISP implements LSN and then gets blocked. Then they do figure that it's a bad idea.
However most ISP:s are extremely lazy and aren't even considering IPv6 because they are waiting for everyone else to do it.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
async calls in WinSock are deprecated - use a worker thread
I work for an IP reputation company by Khopesh (112447)
on Friday December 17, @07:00PM (#34594978) Homepage
What's that mean exactly? What sort of work goes on around that (in other words, online? What is it you & your colleagues do to protect "IP reputation"??)??
Just curious.
A responsible ISP already blocks outgoing smtp port by default unless explicitly requested otherwise by the user. Let's hope more ISPs will join that camp with LSN because they are too lazy to cope with the abuse mails...
The protocol agnostic socket functions (getaddrinfo() and friends) were not part of POSIX until 2004, and were not widely supported until a bit later (even now, most resolvers don't check SRV records when using getaddrinfo()). If you've got any C libraries that are more than a couple of years old, they'll either only support IPv4 or need different code paths for different network protocols (and guess how well tested the IPv6 path will be).
I am TheRaven on Soylent News
While what you say is true, what you and the other "just switch to IPV6 already" folks seem to be missing out on is if everyone was to switch at noon tomorrow in all likelihood you would be looking at MASSIVE outages, which would go on for weeks if not months.
If that's all, I'll be fine with it.
Oh, the beautiful gloss of greality!
Many ISPs hate P2P software because it uses so much bandwidth they are forced to spend more on their infrastructure, and some also hate VoIP because it competes with their very lucrative phone businesses. I imagine that if they were to incidentially break both while deploying NAT, they would be quite happy with this. Plus many of those ISPs are also cable TV companies, or otherwise have business ties to media production, which gives them another reason to celebrate their 'accidential' breaking of P2P.
And if all the players have a NATed IPv4 address?
It's a vague term. I've seen it before, but it can mean anything from a company that gets mistakes removed from IP blacklists (usually a consequence of a computer being compromised - once it's resecured, the blacklists need fixing too) to companies hired to manipulate google rankings, submit glowing product reviews to shopping sites and threaten critics with legal action. Just a very vague description
So I won't be subject to LSN (NAT) ever.
I'm not sure what you mean by that.
If you meant "What if all the players fall in the first category?", then that's a non-problem. In that scenario, everybody has IPv6 access, so they'll have no problem talking over that.
If you meant "Isn't there another category where players have a NATed IPv4 address and no IPv6 address?", then that's unlikely. NATing IPv4 addresses is a transitional technique, so it doesn't make much sense to do that until you support IPv6.
It's not going to be flawless -- there's a lot of routers in peoples homes that don't support IPv6, and there's doubtlessly a lot of games that don't support IPv6 -- but it's not the end of the world, and being behind a NAT is actually good incentive to get people to switch to IPv6.
The details are trivial and useless; The reasons, as always, purely human ones.
Nat only wil be sold as lowly "browse and mail" , for gaming you need the advanced internet subscription. The provider cannot help this becuase of the limited amount of ipv4 adresses available.
Many security filtering systems use lists of public IPv4 addresses to identify 'undesirable' hosts on the Internet. As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt."
In other words, as IPv4 dies, using IPv4 for stuff won't work as well.
Using an IP address to determine the content of a message is a bad idea anyway.
It's like determining what cars are carrying drugs by looking at the license plates, and then punishing the car dealer for selling the car.
Your IPv4 black list is broken. IPv6 makes it more broken. Cry me a river.
Ah, you assume actual forwards planning takes place. Let's look at a more cynical scenario:
Techie: We can't grow the network any longer! There's just no space.
Manager: Anything you can do to fix it?
Techie: I can throw together something with NAT in a few weeks, that'll let us keep going, but really we need to move to IPv6. It's going to cost millions to fix.
Manager: But... this NAT thing... that'll fix it? And it's cheap?
Techie: Well, yes, but -
Manager: And it'll let us keep getting new customers?
Techie: Yes, for years, but the long-term consequences for the wider internet -
Manager: Do it. We can't afford millions. I've got shareholder dividends to pay.
IPv6 has 2^128 addresses
Network addressing is hierarchical, so we will probably be running out of IPv6 addresses long before ~2^48 subnets are allocated. Of course that is still a few trillion.
You couldn't make a router big enough to process 2^48 subnets (let alone 2^64) directly. The hierarchy is necessary, and hierarchy means lots of "wasted" address space. To say nothing of the fact that the right most 2^64 bits of each IPv6 address aren't really routable at all - not without playing games at any rate.
So the whole idea that IPv6 supports 2^128 addresses in real life is some sort of cosmic joke. I bet it won't be a hundred years before people are chafing at the limitations of the IPv6 addressing system.
err, right most 64 bits, not 2^64...
"IP Reputation" systems are basically a step beyond DNSBLs (which only consider things as white vs black). There is a decent explanation in Wikipedia's Sender's IP verification section of their E-mail authentication article.
Use my userscript to add story images to Slashdot. There's no going back.
Let's not turn this into another NAT vs IPv6 debate...
The only problem between large scale NAT and ip-reputation-based ip systems is that the mappings are too transient and too broad to be useful for reputation, also they are talking about sharing ips between subscribers, right now, that's more rarely done and not to that scale(socks4/5 let people share addresses with a process on the natting machine to act as a nat-helper, so it's not a new problem). And that suggests the fix the fix has always been to move the id of the system behind the nat. Aka, you'd need providers using LSN to have reputation based systems already and not letting just anyone connect and relay.
Most providers already hook into systems like sorbs, so telling them they need to run and update something like bld-toolshttp://packages.debian.org/sid/bld-tools should not make it impossible.
We have a fix(ipv6) for not using nat, and there are many hurdles to getting the new design in place. Now I'm sure we will have a long slashdot-classic discussion about the merits of NAT and applications that can't use it, but IMHO, they're all off-topic to the article.
So what you're saying is that Google has decided to fully claim reputation-ownership of the mail their users are sending. They're staking their reputation that their users don't generally spam. If it was a big enough problem you would blackhole all of gmail, right now you're upset because due to the large volume that gmail sends, any percentage of spam is a problem.
I see no reason for that kind of gall. It's merely not a priority for them to open up that kind of information because it helps third party spam filters. Suppressing that data grants a competitive advantage to the GMail (and possibly Postini) services as using that internal information would lead to better filtering of a large email source. ... Don't forget that Google wants to manage your corporate email.
If you're considering the privacy angle, that's rather far-fetched. All other email systems (including webmail and SMTP) track this (so there is no reasonable expectation to place on this sort of behavior; those who want to hide their IP should be using TOR or some other anonymizing proxy).
Use my userscript to add story images to Slashdot. There's no going back.
you really slid that anti-networking jab in there, didn't you.
the idea that network people aren't as smart as graphics people is ludicrous, and mostly highlights the chip on your shoulder.
Until the day when a major ISP implements LSN and then gets blocked.
No one is going to put mail servers or any other kind of server on an LSN IP address if they can help it. With the gradual re-allocation of 'consumer' IPv4 address blocks to LSN, there will be enough static IPv4 addresses for public facing servers for decades to come. Not pretty, but that's the way it is.
And if there were a shortage of static IPv4 addresses for servers and others willing to pay extra for them, there are no end of much more effective techniques to multiplex IPv4 addresses for server usage than NAT. Application layer proxies, in particular.
Most small businesses could run with a single static IPv4 address if they operate their own servers, or if they outsource proxy services hundreds of small businesses could share the same static IPv4 address for server usage using a central proxy and SNI.
The real question is for how long will 'residential' customers be able to get a static IPv4 address, and how much will it cost them. I imagine that most will be able to get static IPv4 addresses at a reasonable monthly fee for some time to come. Unless they are so unfortunate as to be Comcast customers, of course.
authenticated mail (which can be done on port 25, it doesn't have to be 587, but should be these days because of port 25 filtering) is not normally subjected to blacklist filtering
Authenticated mail on port 25 is subject to port 25 blocks by those ISPs that don't deep-packet-inspect to distinguish unauthenticated SMTP from authenticated SMTP (RFC 2554) or encrypted SMTP (RFC 2487). But I guess ISPs are far less likely to block 465 or 587.
If your isp has unreliable mail service, then find another one --- there is no shortage of options there.
Find another what? Did you mean find another mail service, aka a "smarthost"? That's difficult if your ISP blocks the ports that smarthosts use. Find another ISP? In a lot of cases, it's either the one broadband ISP in your area or dial-up.
""IP Reputation" systems are basically a step beyond DNSBLs (which only consider things as white vs black). There is a decent explanation in Wikipedia's Sender's IP verification section of their E-mail authentication article" - by Khopesh (112447) on Saturday December 18, @01:54PM (#34601326) Homepage
Thanks - that's to BOTH yourself, and SuricouRavenn, who also replied here in regards to "IP Reputation" & what it is (I have a message for SuricouRavenn here also -> http://yro.slashdot.org/comments.pl?sid=1903798&cid=34559886 regarding Windows Defender/Microsoft Security Essentials) - thank you!
I do MUCH THE SAME as a DNSBL, albeit locally... via custom HOSTS files - here is why (long read, but detailed & I think you MAY find it, informative, possibly):
---
20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders
7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:
GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):
http://ddanchev.blogspot.com/
http://www.malware.com.br/lists.shtml
http://www.stopbadware.org/
http://blog.fireeye.com/
http://mtc.sri.com/
http://news.netcraft.com/
http://www.shadowserver.org/
REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):
http://www.mvps.org/winhelp2002/hosts.htm
http://someonewhocares.org/hosts/
"It's a vague term. I've seen it before, but it can mean anything from a company that gets mistakes removed from IP blacklists (usually a consequence of a computer being compromised - once it's resecured, the blacklists need fixing too) to companies hired to manipulate google rankings, submit glowing product reviews to shopping sites and threaten critics with legal action. Just a very vague description" - by SuricouRaven (1897204) on Saturday December 18, @10:39AM (#34599726)
Thanks - that's to BOTH yourself, and Khopesh, who also replied here in regards to "IP Reputation" & what it is, since he does it also!
YOU MAY FIND HIS EXPLANATION INFORMATIVE -> http://tech.slashdot.org/comments.pl?sid=1915408&cid=34606948 because it's quite detailed, & of course, it comes from "the horses' mouth" (in that he does that & works for such a concern, etc./et al).
(NOW - I also have a message for YOU, which I believe you WILL FIND HELPFUL! It's in regard to Windows Defender also -> http://yro.slashdot.org/comments.pl?sid=1903798&cid=34559886 regarding Windows Defender/Microsoft Security Essentials).
USE WINDOWS DEFENDER or MICROSOFT SECURITY ESSENTIALS "SETTINGS" TAB, & "Excluded Files and Location" list item IF NEED BE, to exclude custom HOSTS files from scanning!
That's just information you may be able to use, to overcome hassles you say you saw with Windows Defender (the precursor to Microsoft Security Essentials) & HOSTS files!
Funny part is, even though I use a custom HOSTS file with well over 913,000++ items blacklisted in it? I have YET TO SEE MICROSOFT SECURITY ESSENTIALS BOTHER ME ON HOSTS FILES! I give you the "work-around"... easy to do!
APK
P.S.=> Again - Thats information on Windows Defender OR Microsoft Security Essentials? That's in return for your, and Khopesh's reply, on what an "IP REPUTATION" service is, & what it does... apk