Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Carrier Trick To Save IPv4 Could Help Spammers

Soulskill posted more than 3 years ago | from the routed-into-a-corner dept.

Networking 124

Julie188 writes "As public IPv4 addresses dwindle and carriers roll out IPv6, a new problem has surfaced. We have to move through a gray phase where the only new globally routable addresses we can get are IPv6, but most public content we want to reach is still IPv4. Multiple-layers of NAT will be required to sustain the Internet for that time, perhaps for years. But use of Large Scale NAT (LSN) systems by service providers will cause problems for many applications and one of them is reputation filtering. Many security filtering systems use lists of public IPv4 addresses to identify 'undesirable' hosts on the Internet. As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt."

cancel ×

124 comments

Sorry! There are no comments related to the filter you selected.

Why not just use longer names? (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#34594596)

Like microsoft.company.com Simple solution.

Re:Why not just use longer names? (2)

MrEricSir (398214) | more than 3 years ago | (#34594618)

Domain name != IP address

Re:Why not just use longer names? (1)

windcask (1795642) | more than 3 years ago | (#34594640)

Subdomains have nothing to do with IP addresses, other than they can point to them using A Records. DNS != IPV4

Re:Why not just use longer names? (1)

cozzbp (1845636) | more than 3 years ago | (#34594650)

Adding more subdomains does nothing to resolve the problem of the dwindling number of IPv4 addresses available.

Re:Why not just use longer names? (-1)

Anonymous Coward | more than 3 years ago | (#34595150)

The grandparent sounds ignorant, but in essence is correct. This is what was done with phone numbers and area codes for example, and by simple logic is the way around this problem. It's the DNS implementation that is the technical difficulty, but only because the people who work on networks tend to be the PhDs who picked networking as a specialty because they weren't smart enough to work with the better people in their department, and do graphics or programming languages for example.

Re:Why not just use longer names? (2)

ldobehardcore (1738858) | more than 3 years ago | (#34595526)

-1 for not even remotely knowing what you're talking about.
But anyway, IPv6 is essentially the same thing as using a longer name. Instead of having only 2^32 addresses, IPv6 has 2^128 addresses. Enough to give every man woman and child on earth a trillion permanent addresses a year for 4.85*10^16 years. (caveat: assuming the population will stay at 7 billion people for 4.85*10^16 years)

Re:Why not just use longer names? (3, Interesting)

hairyfeet (841228) | more than 3 years ago | (#34597140)

While what you say is true, what you and the other "just switch to IPV6 already" folks seem to be missing out on is if everyone was to switch at noon tomorrow in all likelihood you would be looking at MASSIVE outages, which would go on for weeks if not months. Why? Multiple reasons:

One, thanks to offshoring IT has been a dying field for quite awhile now, with fewer and fewer new blood coming in. What that means is in the flyover states you have most if not all the backbones being run by old guys who haven't kept up on the tech, and from the ones I've talked to most are looking to get out of IT if at all possible. That means the experience just isn't there, it isn't gonna be there, and many will take early retirement or just get out rather than deal with the IPV6 mess. That in turn means things that take minutes to fix in IPV4 will take days in IPV6 simply because nobody knows how to use the new tools.

Two: Infrastructure. There is a hell of a lot of VERY expensive equipment out there that either cannot be upgraded to IPV4, or could be but is no longer "supported" by the OEM, which means a MASSIVE amount of money will have to be spent in a dead economy. Now considering these cableco/teleco duopoly sure as hell ain't gonna take a CEO pay cut, that either means pay for it by gouging the customers even deeper, which in most flyover areas Internet usage is declining thanks to price gouging, or make it up by screwing the workers even harder, which results in number one above. Then add in the fact a good 90%+ of the routers and firewalls and other network devices in consumer homes WILL NOT support IPV6, and in fact most of the routers sold today STILL DON'T support IPv6 and the ones that do are triple price compared to the others, means you are talking MASSIVE amount of eWaste is about to be hitting the environment. You are talking truckloads of routers, modems, all having to be shitcanned. Again this will raise cost that the consumer WILL get stuck with in a dead economy.

So you see, there is a damned good reason that they are gonna string along IPV4 for every last second they can. They will do so because it is gonna be a massive clusterfuck when the switchover comes, with complaining customers because NOTHING in their house works, no IT guys with experience enough to fix even the simplest of problems, and warehouses worth of gear, both dirt cheap and ridiculously expensive, all having to be taken straight to the dump. Frankly it is NOT gonna be pretty, not at all.

Re:Why not just use longer names? (1)

Pf0tzenpfritz (1402005) | more than 3 years ago | (#34599358)

While what you say is true, what you and the other "just switch to IPV6 already" folks seem to be missing out on is if everyone was to switch at noon tomorrow in all likelihood you would be looking at MASSIVE outages, which would go on for weeks if not months.

If that's all, I'll be fine with it.

Figures (0)

DarkKnightRadick (268025) | more than 3 years ago | (#34594600)

Those who said NAT wasn't the answer: You are correct, unless you are a spammer, in which case this is a windfall.

Re:Figures (2, Insightful)

Ironchew (1069966) | more than 3 years ago | (#34594740)

NAT is fine for people who only make outgoing connections; i.e. the passive internet consumer.
It's hell for the rest of us, but hey, since when did the massive media conglomerates ever have the techies' interests at heart?

Re:Figures (1)

jamesh (87723) | more than 3 years ago | (#34595202)

NAT is fine for people who only make outgoing connections; i.e. the passive internet consumer.

Unless the passive internet consumer uses P2P software, or VoIP (from a provider which is not their ISP), which is harder with NAT and probably requires active participation from the ISP to make it work. The RIAA might have a few things to say about that.

Re:Figures (2)

icebraining (1313345) | more than 3 years ago | (#34595994)

Or non-dedicated game hosting. Wasn't Modern Warfare dependent on users hosting the games themselves? How would that work with NAT?

Re:Figures (2)

Skrapion (955066) | more than 3 years ago | (#34596466)

All of the players will either have:
* an IPv6 address and a (possibly NATed) IPv4 address, or
* an unNATed IPv4 address.

If the entire group of players falls into the same category, then it's a non-issue. If it's mixed, then one of the players in the second category should run the server.

Re:Figures (1)

SuricouRaven (1897204) | more than 3 years ago | (#34599632)

And if all the players have a NATed IPv4 address?

Re:Figures (2)

easyTree (1042254) | more than 3 years ago | (#34596222)

The RIAA might have a few things to say about that.

"Damn you filthy file-sharers! Thanks to you, at my last party I only had seven buckets of blow and forty hookers rather than the ten buckets and sixty hookers that are accepted as an industry-norm for this type of affair. Damn you all!"

for example

Re:Figures (1)

Skrapion (955066) | more than 3 years ago | (#34596438)

Those aren't insurmountable. We're talking about a transition period here, so the assumption is that people will have unNATed IPv6 addresses, and you can use those to connect to peers. VoIP also doesn't necessarily need to allow incoming traffic, as long as there's a central server that can bounce the traffic. Services like Skype and MSN already do this, because customers usually aren't handy with opening ports.

Re:Figures (1)

SuricouRaven (1897204) | more than 3 years ago | (#34599620)

Many ISPs hate P2P software because it uses so much bandwidth they are forced to spend more on their infrastructure, and some also hate VoIP because it competes with their very lucrative phone businesses. I imagine that if they were to incidentially break both while deploying NAT, they would be quite happy with this. Plus many of those ISPs are also cable TV companies, or otherwise have business ties to media production, which gives them another reason to celebrate their 'accidential' breaking of P2P.

Re:Figures (2)

petermgreen (876956) | more than 3 years ago | (#34594842)

ISP level nat sucks but I don't think we have a lot of choice.

IPv4 IPs will become a scarce resource and as such will get reallocated from less lucrative customers to more lucrative ones. Whether that allocation will only happen within ISPs or whether it will be allowed to happen between ISPs is unclear at the moment but it is pretty sure to happen.

Those who aren't profitable enough to give a public V4 IP will still need to reach IPV4 only servers and/or use IPV4 only applications (remember apps both client and server have to support v6, not just the OS) for the forseeable future. ISP level NAT is the only way to deliver that.

Re:Figures (4, Insightful)

Ironchew (1069966) | more than 3 years ago | (#34594892)

remember apps both client and server have to support v6, not just the OS

Really badly written programs.
Seriously. I've written stuff in C with the sockets API that is IPv4/v6 agnostic. It's easy to do; there is no excuse for not implementing it.

Re:Figures (4, Interesting)

petermgreen (876956) | more than 3 years ago | (#34595348)

Really badly written programs.
Or just old programs.

Afaict windows didn't have getaddrinfo until XP (unless you count the version in the IPV6 technology preview for 2K). It's predecessor gethostbyname only supports IPV4. MS does offer a wrapper to help with this but afaict that only helps if you are coding with MSVC[++] (I ended up writing my own wrappers for fpc/delphi, not too hard but definitely extra effort)

Further it seems while windows has wsaasyncgethostbyname there is no wsaasyncgetaddrinfo. So if you want to do a v6 capable name lookup without blocking the rest of your app you have to do it on another thread.

P.S. yes I HAVE implemented code (in delphi style pascal) directly on the low level apis that supported both v4 and v6 and async lookups (by using a thread) and supported older operating systems (by using getprocaddress and my own "v4onlygetaddrinfo" if the getprocaddress fails). I wouldn't exactly call it trivial though.

Re:Figures (0)

Anonymous Coward | more than 3 years ago | (#34597950)

async calls in WinSock are deprecated - use a worker thread

Re:Figures (2)

segin (883667) | more than 3 years ago | (#34596678)

Pastebin example code or it didn't happen.

Re:Figures (1)

TheRaven64 (641858) | more than 3 years ago | (#34599268)

The protocol agnostic socket functions (getaddrinfo() and friends) were not part of POSIX until 2004, and were not widely supported until a bit later (even now, most resolvers don't check SRV records when using getaddrinfo()). If you've got any C libraries that are more than a couple of years old, they'll either only support IPv4 or need different code paths for different network protocols (and guess how well tested the IPv6 path will be).

Re:Figures (4, Interesting)

JSG (82708) | more than 3 years ago | (#34595334)

My ISP (AAISP) actively encourage IPv4 address exhaustion AFAICT.

They gave me a /29 + a /32 for my router for home use and probably would have given me more if I'd asked. At work I asked for a /28 and got a /27.

They also give out a /48 IPv6 subnet to all customers and instructions for use. They can do IPv6 over PPPoA (this is the UKoGB) natively and provide a IPv6 to 4 tunnel broker for those that need it.

Have a look at your Spam Assassin headers and see that quite a lot of marks are not related to IP address. I have found DNSBLs handy up to now but I think I'll accept that as these lose their efficiency during IP version handover my spamds and MTAs will get a bit more of a battering for a while.

Never mind processing power is pretty cheap.

I have a customer with around 16 million unique IPs trying to get in each week - a spambot net of some sort (Russian and Chinese IP feature a lot). An Exim process is being spawned for each connection along with a spamd and possibly clamd session. The box is a dinky Dell single processor server and it barely breaks a sweat.

Cheers
Jon

Re:Figures (4, Insightful)

petermgreen (876956) | more than 3 years ago | (#34595478)

My ISP (AAISP) actively encourage IPv4 address exhaustion AFAICT.
It's really not in ISPs interests to conserve IPs at this point. The more IPs they can get out of the RIRs now the more IPs they will have to reuse for more lucrative customers later.

Re:Figures (1)

shentino (1139071) | more than 3 years ago | (#34597754)

In short, the gold rush is beginning.

Re:Figures (2)

Z00L00K (682162) | more than 3 years ago | (#34597758)

Until the day when a major ISP implements LSN and then gets blocked. Then they do figure that it's a bad idea.

However most ISP:s are extremely lazy and aren't even considering IPv6 because they are waiting for everyone else to do it.

Really? (1)

lymond01 (314120) | more than 3 years ago | (#34594630)

Because when one of our university email account gets hacked and starts spamming, other providers block our SMTP server, effectively knocking out communications between us and that ISP. NATing wouldn't change that, unless spammers use their own SMTP server behind a NAT router.

Bring on DNSSEC and DKIM.

Re:Really? (1)

AvitarX (172628) | more than 3 years ago | (#34594684)

They wouldn't need to hack the server anymore.

Re:Really? (3, Informative)

icebike (68054) | more than 3 years ago | (#34595084)

More to the point, SMTP hosts will be pretty much forced to do something more productive than blocking via IP, which amounts to group punishment. (Something apparently only tolerated on the internet).

Its sad that the most broken of protocols has this much sway over the net. SMTP needs a ground up re-write, and it will need it just as much (if not more) after IPV6 is deployed.

Re:Really? (1)

dimeglio (456244) | more than 3 years ago | (#34595894)

All that's required is a more creative solution to prevent spamming. Only one of many system may become problematic with ipv6. That's all. I'm looking forward to having my fridge order groceries automatically when we're about to run out.

Re:Really? (3, Insightful)

afidel (530433) | more than 3 years ago | (#34596190)

Actually, we will just ban or greatly increase the spam score of anything coming from these NAT pools just like we do today with dialup and consumer broadband IP pools today. People with real servers will continue to have dedicated IP addresses that aren't behind these NAT pools and so we will judge them individually based on reputation (or lack thereof).

Re:Really? (1)

grahammm (9083) | more than 3 years ago | (#34597934)

It is interesting that even now we are still using Simple Mail Transfer Protocol. With spam, phishing etc, maybe it is time to replace SMTP by either a plain Mail Transfer Protocol or even a Complex Mail Transfer Protocol.

Re:Really? (1)

mibus (26291) | more than 3 years ago | (#34598206)

More to the point, SMTP hosts will be pretty much forced to do something more productive than blocking via IP, which amounts to group punishment. (Something apparently only tolerated on the internet).

Not really. By the time you're talking about LSN/CGN, you're talking about customers that send mail via their ISP's mailserver, not directly. Business customers wanting to send mail direct to the Internet without worrying about NAT making "their" IP look worse, will undoubtedly be able to buy a non-NATted IP.

(Disclaimer: I work for an ISP but am not speaking for them).

Re:Really? (1)

SuricouRaven (1897204) | more than 3 years ago | (#34599668)

That solves it for email, but think of the trolling concerns. Forums, wikis and IRC channels would no longer be able to ban individuals by IP address, only massive blocks of translated addresses. Just imagine Wikipedia getting persistantly trolled by one person vandalising pages, and having no way to stop it short of banning every Comcast customer in a major city.

Re:Really? (1)

flonker (526111) | more than 3 years ago | (#34598224)

What would you change about SMTP that would have an effect on spam? (And why can it not be done as an extension for SMTP?)

Re:Really? (1)

hardwarefreak (899370) | more than 3 years ago | (#34598688)

SMTP needs a ground up re-write, and it will need it just as much (if not more) after IPV6 is deployed.

SMTP isn't the problem and is not in need of a ground up rewrite. The problem is social, between spammers and suckers, their victims. As has been shown via NNTP, instant messaging, and Facebook spam et al, there is no technology immune to spam. Spam will be with us as long as suckers exist, and there are people willing to exploit those suckers. Yes, basically for eternity.

There will start to be IPv6 dnsbls and mail OPs will start keeping IPv6 local block lists. It's the same old game with a new numbering scheme. As for multilayer NAT I don't see it being a problem WRT SMTP. As others have stated it will be relegated to consumer broadband ISP space and possibly colocation centers, which most mail OPs already outright SMTP block (if they're smart).

Re:Really? (1)

JSG (82708) | more than 3 years ago | (#34595144)

Are you seriously telling me (us) that your Uni doesn't check outgoing as well as incoming mail? At the very least, pass it through ClamAV.

I hope your IT staff don't teach "mail relaying 101"

You *do* check incoming mail, don't you?

Cheers
Jon

Re:Really? (0)

Anonymous Coward | more than 3 years ago | (#34598882)

Are you seriously telling me (us) that your Uni doesn't check outgoing as well as incoming mail? At the very least, pass it through ClamAV.

I hope your IT staff don't teach "mail relaying 101"

You *do* check incoming mail, don't you?

Cheers
Jon

Here's how things are going to progress.
1. Keep in mind that right now we are close to running out of unsold IP's, but most ISP's have plenty of unused IP space.
2. Many ISP's bought enough wiggle room to get them through to 2012 or 2013 without changing anything. The slow economy has had a huge impact on subscriber growth rates.
3. The first mitagation technique will NOT be large-scale NAT. It will be customer-level NAT; the ISP's will start telling customers they only get ONE public IP, and will have to use their own NAT'd router if they want multiple devices at home. Right now most ISP's allow more than 1, and many of them will allow up to around 8 or 12. I used to work at an ISP with about 2 million internet subscribers, and as recently as last month they averaged 3 public IP's per account so right off the bat they'd free up 2/3's of their space by restricting to 1 IP per sub. (exceptions for business subscribers who have a need for static IP's of course)
4. If for some wild, insane reason those measures don't last long enough, the ISP's will start implementing wide-scale NAT for Residential classes of service. These classes of service have no business sending mail on port 25 to any server other than the ISP-provided mail relay... which is how they already work at 99% of the ISP's today. This would be a stop-gap measure, but other than trying to run a VPN tunnel through the NAT won't cause problems for most consumers.

5. Most of the largest ISP's are already planning to be fully ipv6 by the end of next year. Point 3 above will provide more than enough time and address space to get us through the end of 2012 no problem, even when the usable space has pretty much run bone dry.

Re:Really? (0)

Anonymous Coward | more than 3 years ago | (#34595512)

Because when one of our university email account gets hacked and starts spamming

Another satisfied Microsoft customer?

Seriously, though ... you guys ever think about, oh I dunno, securing your e-mail servers?

Re:Really? (1)

blue trane (110704) | more than 3 years ago | (#34595564)

I like how efnet bans all ip ranges for virgin mobile broadband because someone was spamming email (not even affecting efnet!) from one of them. Maybe this will change that :)

It'll Be OK (1)

WrongSizeGlass (838941) | more than 3 years ago | (#34594634)

I'm sure if we wait just a little while some spammer will send us the 'magic bullet' for this problem via their preferred delivery method.

Useless (2)

sexconker (1179573) | more than 3 years ago | (#34594636)

IP filtering has always been useless from a security standpoint. Same goes for MAC address filtering.

Anyone anywhere can change both easily. Blocking addresses is only a matter of convenience.

This "news" just means that tons of "security" software and filtering hardware (Barricuda, anyone?), is being exposed as the useless, inflexible crap that they are, and the companies behind them are trying to point fingers at large network operators while simultaneously touting their next version, which will have IPv6 support. Maybe. Which totally won't solve the IPv4 issues, but never you mind that.

Re:Useless (0)

Anonymous Coward | more than 3 years ago | (#34594694)

IP filtering has always been useless from a security standpoint. Same goes for MAC address filtering.

Anyone anywhere can change both easily. Blocking addresses is only a matter of convenience.

Foolproof? No. Useless? Hardly.

Locks on your front door are useless. You can buy a hammer really cheap from, well, pretty much anywhere. The fact that windows exist, however, does not diminish the fact that door locks provide a very important layer of security - just as IP filtering does.

Re:Useless (1)

sexconker (1179573) | more than 3 years ago | (#34595098)

IP filtering has always been useless from a security standpoint. Same goes for MAC address filtering.

Anyone anywhere can change both easily. Blocking addresses is only a matter of convenience.

Foolproof? No. Useless? Hardly.

Locks on your front door are useless. You can buy a hammer really cheap from, well, pretty much anywhere. The fact that windows exist, however, does not diminish the fact that door locks provide a very important layer of security - just as IP filtering does.

Bad analogy is bad.

Blocking an IP or a MAC address is completely pointless. It requires less than 5 seconds of effort to get a new one. There are no windows or hammers involved. You simply walk right in the front door because it will be unlocked when you say "My name is ... Mr. Snrub.".

Re:Useless (1)

icebraining (1313345) | more than 3 years ago | (#34596092)

How do you simply get a new IP address accepted by the ISP?

Re:Useless (1)

SuricouRaven (1897204) | more than 3 years ago | (#34599690)

Depends on the ISP. If it's dialup, you can usually just reconnect. DSL, trickier. Cable, I find it is associated with the MAC address of the device connected to the modem. Release DHCP, change MAC, get new lease... takes about five seconds if you script it.

Re:Useless (1)

icebraining (1313345) | more than 3 years ago | (#34599966)

I don't think my (ISP issued) ARRIS TM502G allows to programmatically change its MAC address.

inb4 NAT (2, Funny)

Anonymous Coward | more than 3 years ago | (#34594658)

Keep all your bullshit about NAT saving the world in this thread where it can be ignored by people who actually know what they are talking about please.

Thank you. (0)

reiisi (1211052) | more than 3 years ago | (#34595952)

I still think the best way to handle this would have been by high bit extension in each octet field.

Yeah, I know, the theoretical non-constant numeric address length would have been a serious pain to predict the hardware for back in the '80s, when (ergo, I wish) they might have had the foresight to reserve the high bits at each level for possible other uses.

But it would have been nice if an ISP could have, by definition, its own extendable address space to allocate out of, and any customer could further extend their own allocation, down to, say, 6 octets max in the '80s, 7 max in the '90s, 8 in the decade just completing.

I appreciate the fact that IPV6 should give us this ability, at least in a one- or two-shot way, but I think it's generally a mistake when the data structure itself limits a resource that is known to have a tendency to expand.

(And, yes, I consider the above to be funny in the sick humor sort of way.)

The Only Real Solution (4, Funny)

windcask (1795642) | more than 3 years ago | (#34594686)

Welcome back, Gopher.

Re:The Only Real Solution (2, Insightful)

windcask (1795642) | more than 3 years ago | (#34594712)

First rule of Slashdot...never be in such a hurry to make a joke as to expose your own ignorance about a topic. IGNORE.

Nonsense (1)

vanyel (28049) | more than 3 years ago | (#34594728)

end user customer networks (the ones most likely to go this route) are already on various "mail shouldn't be coming from here" blacklists, and those customers also should be already using the isp's mail servers for outgoing mail. it's a small incremental step, nothing more. Those running servers will necessarily get unique addresses and not be affected by reputable blacklists that are correctable.

Re:Nonsense (2)

tepples (727027) | more than 3 years ago | (#34594784)

end user customer networks (the ones most likely to go this route) are already on various "mail shouldn't be coming from here" blacklists, and those customers also should be already using the isp's mail servers for outgoing mail.

I assume you're talking about end users connecting on port 25 (MTA-to-MTA communication), not port 587 (MSA-to-MTA). Otherwise, what should people do when the monopoly broadband ISP has unreliable mail servers, or when they're using mail on a laptop temporarily connected to an ISP other than their own?

Re:Nonsense (2)

vanyel (28049) | more than 3 years ago | (#34595750)

authenticated mail (which can be done on port 25, it doesn't have to be 587, but should be these days because of port 25 filtering) is not normally subjected to blacklist filtering, and is thus not affected.

The vast majority of people don't run their own mail servers though, so their mail clients are configured to use their isp's mail server. Again, not affected.

If your isp has unreliable mail service, then find another one --- there is no shortage of options there. For practical purposes, in that case, you're roaming, in which case you have to authenticate to send mail anyhow to bypass the relaying blocks, and thus again, not affected.

Trivial if you want to go the extra mile (4, Interesting)

Khopesh (112447) | more than 3 years ago | (#34594978)

I work for an IP reputation company (and am not representing it in this post).

This is not a complicated issue. The LSN portals will merely have to add a tracking header to all mail they process (and block anonymous direct mail if they want to escape DNSBLs' wrath). This is already an issue with webmail (e.g. Google doesn't add the tracking header, so it's MUCH harder to trap spam originating through GMail than it is through providers like Hotmail who do provide this extra tracker).

Re:Trivial if you want to go the extra mile (1)

fbartho (840012) | more than 3 years ago | (#34595820)

How much spam actually is originating through gmail?

How does one prevent a spammer from spoofing these headers?

Re:Trivial if you want to go the extra mile (5, Informative)

Khopesh (112447) | more than 3 years ago | (#34595938)

How much spam actually is originating through gmail?

Sorry, I can't give you data. Suffice it to say it's a problem.

How does one prevent a spammer from spoofing these headers?

The headers aren't spoofed. When you use Hotmail or Yahoo, your IP is added to a tracking header by the webmail server so that IP reputation systems can pass along the blame as if it were a Received: header (there's more to it than that, but this should give you the principle). Since GMail doesn't do that, there's nothing to be done; the tracking can't go beyond Google's servers.

If a spammer spoofs headers so as to pretend to pass blame on, the trust [apache.org] doesn't extend far enough; the relay used by the spammer to add those fake headers isn't trusted and so the buck stops there. When dealing with real webmail providers, the trust can be extended to the established webmail relays and then followed into the IP tracking header.

We have meandered a bit off topic here ... my point is that this is possible for the nearly identical problem of webmail, so somebody merely needs to figure out how to do it for the IPv6->IPv4 routing process. The simplest solution is the one I outlined above; require a mail relay that speaks both protocols so it can properly record the conversion with a Received header. Modern IP reputation systems (and the clients that poll them) are fully IPv6-ready and will process this perfectly.

Re:Trivial if you want to go the extra mile (2)

fbartho (840012) | more than 3 years ago | (#34596074)

So what you're saying is that Google has decided to fully claim reputation-ownership of the mail their users are sending. They're staking their reputation that their users don't generally spam. If it was a big enough problem you would blackhole all of gmail, right now you're upset because due to the large volume that gmail sends, any percentage of spam is a problem.

I don't mean to attack or defend anyone here, just curious.

I think the deal is just that anything that comes through gmail needs a more heuristics based filter, and you can't just blackhole on the particular client. As long as the percentage of bad e-mails coming through there is lower than the percentage of good e-mail then the reputation system is working...

Re:Trivial if you want to go the extra mile (0)

Anonymous Coward | more than 3 years ago | (#34596212)

So 51% ham means their system works? By GMail's own filtering proficiency on incoming mail is vastly superior to their ability to stop outgoing spam. (It's not 51% --that was merely an illustration of what you were saying-- but it isn't 0.0% either.)

Re:Trivial if you want to go the extra mile (1)

TheRaven64 (641858) | more than 3 years ago | (#34599322)

Yes, it's working. It is in Google's interest for gmail accounts to have less spam than other email accounts. Aggressively filtering incoming email and not caring if their users are sending spam (unless they are sending it to other gmail users) helps this.

Re:Trivial if you want to go the extra mile (2)

John Hasler (414242) | more than 3 years ago | (#34596300)

So what you're saying is that Google has decided to fully claim reputation-ownership of the mail their users are sending. They're staking their reputation that their users don't generally spam.

Google Groups is a major source of Usenet spam.

Re:Trivial if you want to go the extra mile (1)

fbartho (840012) | more than 3 years ago | (#34596318)

I could have sworn we were talking about "email"

I totally have experienced the google-groups spam. I'm hoping this is a symptom of an improving spam service and this will eventually go away.

Re:Trivial if you want to go the extra mile (2)

Arlet (29997) | more than 3 years ago | (#34597842)

Google Groups is a major source of Usenet spam.

And Google has shown no willingness to filter Groups spam. I used to read Usenet through Google Groups, but it's now totally unusable.

Re:Trivial if you want to go the extra mile (0)

Anonymous Coward | more than 3 years ago | (#34597908)

That's not trivial if I'm requiring TLS end-to-end from my MTA to the recipients MTA, how does the LSN portal inject headers? Even if the start TLS, they will not match the certificate chain.

I work for an IP reputation company (What's that?) (0)

Anonymous Coward | more than 3 years ago | (#34598666)

I work for an IP reputation company by Khopesh (112447)
on Friday December 17, @07:00PM (#34594978) Homepage

What's that mean exactly? What sort of work goes on around that (in other words, online? What is it you & your colleagues do to protect "IP reputation"??)??

Just curious.

Re:I work for an IP reputation company (What's tha (1)

SuricouRaven (1897204) | more than 3 years ago | (#34599726)

It's a vague term. I've seen it before, but it can mean anything from a company that gets mistakes removed from IP blacklists (usually a consequence of a computer being compromised - once it's resecured, the blacklists need fixing too) to companies hired to manipulate google rankings, submit glowing product reviews to shopping sites and threaten critics with legal action. Just a very vague description

Not just spammers (5, Interesting)

Todd Knarr (15451) | more than 3 years ago | (#34595010)

It's not just spammers. A lot of on-line games, for instance, record the IP address used to log in to a game in the account's history. Customer Support then uses that to help determine eg. whether a claim of a hacked account is valid or bogus. Large-scale NAT is going to mess with that by confusing the record: one computer may appear to be using a different IP address for each login, and multiple unrelated computers can appear to have the same IP address. And with a lot of games moving towards RMT, a hacked account can mean the loss of real money for the player. When CS tells that player "Sorry, the login where the items were sold/transferred came from one of the IP addresses you normally log in from, the problem's on your end." and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.

Re:Not just spammers (3, Funny)

jamesh (87723) | more than 3 years ago | (#34595256)

and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.

</reality>... and he goes to forums where such things are discussed and finds out that other users are using IPv6 and don't have problems like that and asks his ISP why they don't support IPv6. The ISP listens to their customers and makes rolling out IPv6 their #1 priority. IPv6 gets everywhere, world peace is finally achieved, and we enter a golden age of the internet.<reality>

Re:Not just spammers (0)

Anonymous Coward | more than 3 years ago | (#34595372)

I see what your non-standard-order-HTML tags did there...

+1 funny (3, Informative)

reiisi (1211052) | more than 3 years ago | (#34595986)

The last time I contacted my ISP about this they told me (again) that they have no plans to implement IPv6.

This was just a few months ago.

Re:Not just spammers (1)

icebraining (1313345) | more than 3 years ago | (#34596156)

Assuming the game & its servers support IPv6...

Re:Not just spammers (2)

DarkOx (621550) | more than 3 years ago | (#34596532)

Easy enough solution to that. Just run a local 4to6 NAT. You can do SNAT from as many v4 192 addresses as you need to translate to the 6 hosts you want to connect to remotely. Then just use the 192 address in your app. It will be an extra step and you might have to set up the NAT on both the client and the server but it should work.

Re:Not just spammers (1)

Anonymous Coward | more than 3 years ago | (#34595760)

It's not just spammers. A lot of on-line games, for instance, record the IP address used to log in to a game in the account's history. Customer Support then uses that to help determine eg. whether a claim of a hacked account is valid or bogus. Large-scale NAT is going to mess with that by confusing the record: one computer may appear to be using a different IP address for each login, and multiple unrelated computers can appear to have the same IP address. And with a lot of games moving towards RMT, a hacked account can mean the loss of real money for the player. When CS tells that player "Sorry, the login where the items were sold/transferred came from one of the IP addresses you normally log in from, the problem's on your end." and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.

I'm not sure what the likelihood of the hacker winding up behind the same NAT as you is going to be. Generally the hackers will be in a different country from you. So while this may have the potential to cause that problem I think they will be very
  few and far between.

Re:Not just spammers (4, Insightful)

mewsenews (251487) | more than 3 years ago | (#34596088)

When CS tells that player "Sorry, the login where the items were sold/transferred came from one of the IP addresses you normally log in from, the problem's on your end." and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.

I understand the point you are trying to make, and I agree with you. I just have to be pedantic and point out that currently, for WoW accounts that have been tampered with, it doesn't matter that the activity was on the same IP address.

If it did matter, there would be a lot of guys with neglected girlfriends that would be unable to get their characters restored.

Re:Not just spammers (2)

mcrbids (148650) | more than 3 years ago | (#34596536)

When CS tells that player "Sorry, the login where the items were sold/transferred came from one of the IP addresses you normally log in from, the problem's on your end." and the player learns that that's because his ISP is NATing their entire network, he's not going to be happy.

Further missing the point: the NAT referenced here isn't the kind of NAT that you are thinking, between an IPV4 public address (EG: 208.39.22.13) and a non-routable IPV4 address. (EG: 192.168.1.19)

The NAT being referenced here is between IPV4 (which doesn't understand IPV6 address space) and IPV6. All connections coming from an IPV4 address to an IPV6 address will have to involve NAT, where the ISP has a NAT gateway so that internally hosted IPV6 addresses initiate connections through NAT to the IPV4 network, and vice-versa. In this scenario, WoW can fix the problem simply by providing an IPV6 host, bypassing the need for the NAT gateway.

Re:Not just spammers (1)

fast turtle (1118037) | more than 3 years ago | (#34596654)

and blizzard is already adressing this problem through the use of 2nd channel Authentication. If you've got a Blizzard account, simply spend the $7.00 U.S and buy their stand-alone authenticator and configure your account to use it. Problem solved and cheaply at that.

The irony... (0)

Anonymous Coward | more than 3 years ago | (#34595104)

is delicious.

identd? (1)

paskie (539112) | more than 3 years ago | (#34595138)

So, why not just have a public database of LSNs and have them run extended ident service? (I.e., you supply it with local-remote port pair and it will tell you the IPv6 address of the NAT'd peer. Then you just use that for the peer identification from then on.)

Re:identd? (1)

blair1q (305137) | more than 3 years ago | (#34595462)

If I have IPv6 why do I need this?

Re:identd? (0)

Anonymous Coward | more than 3 years ago | (#34595540)

So that you can talk to all these pitiful IPv4-only hosts.

Can we just stop using IPv4? (3, Insightful)

asm2750 (1124425) | more than 3 years ago | (#34595172)

Seriously, IPv6 is there to replace IPv4. Tell everyone who whines 'tough shit' switch over already. If I have to pay an extra 5 dollars a month for a year to my ISP for that to happen then I would. Just stop trying to extend the life of IPv4 when there is a suitable replacement already available.

Re:Can we just stop using IPv4? (1)

Khopesh (112447) | more than 3 years ago | (#34595640)

Seriously, IPv6 is there to replace IPv4. Tell everyone who whines 'tough shit' switch over already.

Are you trying to create the massive failures we were supposed to have for Y2K? IPv6 compliance is a rather low priorities for most companies and is not being taken seriously to the level that Y2K was. You're asking for a lot of "tough shit" to come your way even if you and your immediate provider are fully IPv6-compliant.

If I have to pay an extra 5 dollars a month for a year to my ISP for that to happen then I would. Just stop trying to extend the life of IPv4 when there is a suitable replacement already available.

You want to pay $5/mo in order to stick it to those who don't think like you? This is a capitalist system -- use it: discount customers five dollars a month to be stuck without IPv4 (or to spin the same concept differently, charge an extra $5/mo for a public IPv4 address). Heck, this doesn't even require IPv6 since it can be done with a NAT, but if it's aspiring to promote IPv6, the service would merely issue public IPv6 addresses and NAT anything using IPv4 as a temporary measure.

Please talk to my ISP. (1)

reiisi (1211052) | more than 3 years ago | (#34596034)

My requests have been meeting deaf ears for years.

Unfortunately, the alternative ISPs are doing the same thing here. (But I should check again soon. I'm getting tired of these guys since the legacy monopoly here bought them out.)

Re:Can we just stop using IPv4? (1)

shutdown -p now (807394) | more than 3 years ago | (#34598152)

Fine. You are the first to switch, though (IPv6 only, otherwise it is pointless).

Only an escaltion of the ongoing game (2)

NoExQQ (1961082) | more than 3 years ago | (#34595344)

Having been intimately involved with spammers over the years I can say that this change will only escalate the ongoing game of use / burn / blacklist / move on. Yes, more poor commercial entities will unknowingly and unwillingly have to call in Wally the IT guy to help them get off some blacklist somewhere so their mail will flow, but in the grand scheme this will not change the processing power of the mail bots or tilt the scales in a significant manor. IMHO.

Re:Only an escaltion of the ongoing game (1)

skids (119237) | more than 3 years ago | (#34595566)

I'm beginning to think there's only one way to stop email spam. Develop some new flashy service that "replaces" email. Then get everyone who is stupid enouh to fall for aPhish or to answer a UCE to switch to this new-fangled fad. Then once only people smart enough to never reply to spam are using email, there will be no motivation to spam.

Re:Only an escaltion of the ongoing game (1)

John Hasler (414242) | more than 3 years ago | (#34596338)

> Develop some new flashy service that "replaces" email.

Perhaps we could call it "Facebook" or "Twitter".

Re:Only an escaltion of the ongoing game (1)

skids (119237) | more than 3 years ago | (#34597198)

Nah it has to be work-friendly-sounding. You have to be able to use it for job related things.

LinkedIn might work.

Reputation by IP (2)

Skapare (16644) | more than 3 years ago | (#34595488)

... lists of public IPv4 addresses to identify "undesirable" hosts ...

Legitimate mail servers will still need an IP address, whether that is IPv4 or IPv6. Their outbound SMTP connections can just use that same IP address. The real issue involves all those end user (broadband and dialup) IP addresses, which more and more will be multiple users sharing them for outbound connections, with no inbound. Make those have zero reputation. Let the IP addresses which are associated with real mail servers have the reputation earned by its behavior.

One big difficulty will be mail servers stuck only on IPv6 trying to deliver mail to those on IPv4, and visa-versa. But this is at least a substantial subset of the IP space. That means it can hold out for a while on IPv4, until enough IPv6 is deployed to make a "mad rush to IPv6 for email" can happen. But in the mean time, those who can do mail exchange between servers on IPv6 will be pretty much spam free, for at least a while. When spammers get on IPv6, then we know IPv6 is "happening".

To encourage IPv6, those who are on it can do things like adding extra goodies to IPv6 users. I do know a lot of porn is already there. Maybe extra features on web sites can be made to work on IPv6, too.

Help in the short term only (1)

XCondE (615309) | more than 3 years ago | (#34595586)

Maybe as all mail behind NATs get blocked by spam filters the network administrators will actually start blocking mail from infected hosts in their network so that legit mail is accepted again. Wishful thinking?

Doesn't follow (3, Informative)

Spazmania (174582) | more than 3 years ago | (#34595806)

As more ISPs deploy LSN systems, the effectiveness of these IPv4 filtering systems will be hurt.

That doesn't follow. The folks in dynamic space (the same space that will be served by LSNs) are already considered spammers when they connect to a non-local SMTP server. The only reason they're scored instead of outright blocked is that there's no rigorous list of what is and isn't a dynamic space. It makes no difference to the server whether it filters a range of IPs or a single IP.

Identifying the individual spammer from an abuse report is slightly more difficult, but only slightly. And if you're behaving like a good net citizen, you probably blocked outbound 25 at the LSN box to begin with so you're not getting any reports because your virus-laden customers aren't able to successfully spam.

It might even help against the spammers. (0)

Anonymous Coward | more than 3 years ago | (#34598944)

A responsible ISP already blocks outgoing smtp port by default unless explicitly requested otherwise by the user. Let's hope more ISPs will join that camp with LSN because they are too lazy to cope with the abuse mails...

So move to IPv6 (1)

metamatic (202216) | more than 3 years ago | (#34595878)

If your mail server supports IPv6, the mail will go sender's client to sender's MTA to your MTA, all via IPv6, with full headers. So the problem only affects recipients who are slow getting their mail servers IPv6 enabled, who force senders to reroute their mail through an IPv6 to IPv4 gateway. So seems to me it's a good reason to hurry up and get your servers on IPv6.

Don't worry! (1)

saleenS281 (859657) | more than 3 years ago | (#34596690)

You shouldn't be running a "server" at home anyways. The internet was created so that you could buy services from large companies like your ISP. Running your own server at home is socialist. Think of the children!

Most of us are afraid to admit it aloud but... (2)

JoltinJoe77 (1199263) | more than 3 years ago | (#34597086)

Many IT professionals including myself feel that IPv6 is a joke and is unnecessary in most practical scenarios. Arguments I tend to throw out on face value are "why not IPv6?" and "we're running out of IPv4 addresses". Keep NAT'ing IPv4 until the cows come home - no one except tech geeks will really care if we do.

Re:Most of us are afraid to admit it aloud but... (1)

shutdown -p now (807394) | more than 3 years ago | (#34598170)

Oh, the non geeks will care a lot when they suddenly cannot download new releases via P2P of the day, because there are no seeders.

it was the subject, not the cat (0)

Anonymous Coward | more than 3 years ago | (#34597264)

heh sweet that means slashdot can never ban me right?

your friendly neighborhood synonymous coward

wait did i do that right?

very simple solution (0)

Anonymous Coward | more than 3 years ago | (#34597670)

all dynamic ip users, are restricted to their provider (isp) smtp service. ISP acts as the only smtp relay. Users are not allowed to open port 25 beyond the ISP's address space.

they filter and monitor everything (e.g. torrents). why not filter port 25, even validate against proper SPF. Am I the only one using SPF for my domains...?

I use a static IPv4 (0)

Anonymous Coward | more than 3 years ago | (#34599924)

So I won't be subject to LSN (NAT) ever.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>