Hacker News Reader

Comment by golem14 | Hacker News Reader

I think that's fair, and I had the same initial reaction. However, people are generally fine with DMARC or other crowdsourced spam signals, so it's not clearly bad.

I haven't looked at the source, but it should be easy to turn the crowdfiltering off or self-host if you have your own larger enterprise, no ?

It also depends on what exactly is transmitted. Transmitting all IP addresses in the clear might be bad, sending out hashes might be better ?

I think it's actually a good idea to try to detect those IP at scale. On your own individual server, you just see a million login attempts from a million different nodes on a botnet. But if you have millions of servers report the bad IPs and aggregate, you can see patterns and hopefully catch whole botnets.

View on HN

> However, people are generally fine with DMARC or other crowdsourced spam signals, so it's not clearly bad.

DMARC isn't a crowdsourced spam signal. And from my memories chatting with people running mail servers—the crowdsourced spam filtering is fairly controversial.

Apologies, I was thinking of the spamhaus list, which I'm also not sure now is crowdsourced in the sense most people would use.

But most email providers build spamfilters using 'crowdsourced' techniques between their users (if enough users mark a sender spam it might be marked spam for all users).

And while that may be controversial, it's also highly effective.

Speaking from personal experience working with these reputation warehouses and with handling a good deal of incoming and outgoing email volume, they aren't any more effective than other IP-based spam heuristics and if everyone configured their DKIM correctly these warehouses would be largely obsolete. I don't see a problem with crowdsourcing heuristic data per se, but email is a much narrower field than internet traffic at large and I can see a lot of the ways that poorly configured fail2ban type software could accidentally ban a lot of valid traffic.

> Transmitting all IP addresses in the clear might be bad, sending out hashes might be better

How many IP adresses are valid? Can't you hash them all and compare them with the hash you receive?

2^32 IPs is 4GB * 4 Bytes (1 IP) + 4GB * size of the hash should be the needed space I think.

1) That is not what DMARC is.

2) I won't be using any "security" tool that automatically shares details on active mitigation efforts.

> I think it's actually a good idea to try to detect those IP at scale.

It is! But not with my machines.

Reply on news.ycombinator.com