Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Ken Simpson
Source IP blocking makes up a large portion of today's spam arrest approach, so we shouldn't discount the CPU benefits of that approach too quickly. I'm not sure where today's technology is in regards for caching the first 1 to 10kB of a sessiononce enough information is garnered to

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Frank Bulk - iNAME
PROTECTED] Cc: 'Christopher Morrow'; nanog@nanog.org Subject: Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)] Source IP blocking makes up a large portion of today's spam arrest approach, so we shouldn't discount

Re: EC2 and GAE means end of ip address reputation industry? (Re:

2008-06-24 Thread Valdis . Kletnieks
On Tue, 24 Jun 2008 00:03:20 -, Paul Vixie said: [EMAIL PROTECTED] writes: One could argue that the botnets for rent business model is in more widespread use than either EC2 or gridserver... I'm unclear whether that statement needs a smiley or not... i'd say that since EC2 won't

Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Frank Bulk - iNAME
, 2008 9:20 PM To: [EMAIL PROTECTED] Subject: Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs) snip This is far different from free email Google or Hotmail - these cloud services (EC2, Mosso, Slicehost, Terremark's Enterprise Cloud

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-23 Thread William Herrin
On Sun, Jun 22, 2008 at 12:55 PM, Andy Davidson [EMAIL PROTECTED] wrote: On 22 Jun 2008, at 17:17, Paul Vixie wrote: with EC2, it's game-over for the IP reputation industry, I was discussing this on an e-commerce practitioners list earlier today, and argued basically that, from an abuse point

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-23 Thread Valdis . Kletnieks
On Mon, 23 Jun 2008 11:38:16 EDT, William Herrin said: Concur. From an address-reputation perspective EC2 is no different than, say, China. Connections from China start life much closer to my filtering threshold that connections from Europe because a far lower percentage of the connections

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-23 Thread Paul Vixie
with EC2, it's game-over for the IP reputation industry Realistically speaking, did you not expect that to be inevitable? i didn't, no. when i unknowingly launched the IP reputation industry back in the mid 1990's, the risk i was managing was a spammer who planned to give away free T1 lines

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-23 Thread Steven Champeon
on Sun, Jun 22, 2008 at 01:24:43PM -0500, Al Iverson wrote: I'm not going to pretend I manage inbound mail service for thousands-to-millions of users (as most of the participants of other lists like SPAM-L are fond of imagining themselves), but I know enough about how IP reputation systems

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Frank Bulk
, June 23, 2008 9:16 AM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)] On Mon, Jun 23, 2008 at 6:01 PM, Frank Bulk - iNAME [EMAIL PROTECTED] wrote

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Joel Jaeggli
: Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)] snip dpi boxes from a number of vendors can do that sort of thing... whether they can do it fast enough to be inline with your compute cloud is another question

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Christopher Morrow
On Mon, Jun 23, 2008 at 10:31 PM, Frank Bulk - iNAME [EMAIL PROTECTED] wrote: Ken: Thanks for the info, but that still requires the domain owner to change their MX records. I was wondering if there was something that could literally be placed in the flow of traffic, like an FWSM in

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Paul Vixie
hi andy. with EC2, it's game-over for the IP reputation industry, I was discussing this on an e-commerce practitioners list earlier today, and argued basically that, from an abuse point of view, EC2 is the same as any other bad neighborhood, and that operators needing to make impact fast,

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Al Iverson
On Sun, Jun 22, 2008 at 11:55 AM, Andy Davidson [EMAIL PROTECTED] wrote: On 22 Jun 2008, at 17:17, Paul Vixie wrote: with EC2, it's game-over for the IP reputation industry, I was discussing this on an e-commerce practitioners list earlier today, and argued basically that, from an abuse

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Paul Vixie
From: Troy Davis [EMAIL PROTECTED] ... AWS already tracks VM instances and their internal IP allocations. They recently added elastic IPs, which are assigned to a customer rather than a specific instance. To the rest of the world, they're static IPs. abusers don't have specific identities.

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Steve Gibbard
On Sun, 22 Jun 2008, Paul Vixie wrote: it seems that amazon has succeeded where google and microsoft failed. with e-mail only services like hotmail and gmail, it was still possible to treat an IP address as having a reputation, and to therefore blackhole hotmail and gmail (and other free

Re: EC2 and GAE means end of ip address reputation industry? (Re:

2008-06-22 Thread Paul Vixie
[EMAIL PROTECTED] (Steve Gibbard) writes: ... So yeah, if big shared services that include important stuff aren't being adequately policed, that's probably a problem for IP address reputation services. But that's not really a new problem being introduced by EC2. this may be an argument

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Suresh Ramasubramanian
On Mon, Jun 23, 2008 at 1:13 AM, Steve Gibbard [EMAIL PROTECTED] wrote: Likewise, anybody blocking EC2 would miss out on whatever bad stuff might be coming out of EC2, but would miss out on being able to access services hosted there as well. Would they miss it more than they'd miss their

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Nathan Ward
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 23/06/2008, at 4:17 AM, Paul Vixie wrote: as randy bush often says, it's just business. amazon has solid business reasons for creating EC2 and there's no way it could be profitable if they can't scale the user base, and there's no way to

Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)

2008-06-22 Thread Laird Popkin
] To: Nathan Ward [EMAIL PROTECTED] Cc: nanog [EMAIL PROTECTED] Sent: Monday, June 23, 2008 1:45:03 AM (GMT-0500) America/New_York Subject: Re: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs) On 6/23/08, Nathan Ward [EMAIL PROTECTED] wrote