[connect24h:1536] Re: 放置サーバは規制すべきか？

[Hiroshi Tsukamoto <hirobo-24@xxxxxxx>]

塚本です

FURUHATA Yoshinori <gtk@xxxxxxxxxx> wrote:

> 自主規制の名の下でブラックリスティング・・・ってどうでしょ。
> ＃ よほどタチ悪いわい、と言われそうですけど。てゆか自分でもそう思う。

unsecureなサーバのブラックリスティング(dnsbl)をmonkeys.comの
Ronald F. Guilmetteが計画していて、自分もちょっぴりだけ関わっ
ております。

おもしろいのは、ブラックリスティングされたネットワークからの
ウェブアクセスに対し、「あなたのサーバはこういうリストに入っ
ていて、そのままだとネットを利用する上でいろいろ制限が生じる
から、管理者に連絡しなさい」という、違う画面やポップアップウィ
ンドウを表示させる仕組みを用意して、利用者にも知らせる(そして
管理者のケツを叩いてもらう)点です。

ちょっと長いのですが、彼がSPAM-Lとspamtoolsに投稿したメールを
転送します。
=======================================================================

I was thinking recently about a new way of attacking the `security
notification' problem... something where we make better use of web
servers.

For those of you who don't already know, perhaps THE most major problem
we still have on the net with regards to the many many sites that are still
suffering from various forms of inept server administration (e.g. open
mail relays, open proxies, and other obvious flaws that would allow,
for example, rooting of the relevant boxes) is that we (the royal we,
as in everybody who works on these problems) have a hard time even just
getting in contact with the relevant system administrators, to let them
know that they have a problem.

Oh sure, you can try to send e-mail to postmaster@ and to other seemingly
relevant contact addresses, but I believe that many/most of the current
blacklists of open relays out there are already trying to do this, and
obviously, the success rate is rather limited, or else we wouldn't still
have 100+ thousand open relays on the net.

So anyway, I did a little work recently, hacking on Apache internals
(specifically mod_rewrite, to which I added a couple of potentially new
and useful features) with the idea in mind that (as in the case of mail
servers) it _should_ theoretically be possible to get a web server
(Apache, for instance) to consult an outside DNS-based blacklist, and
to display some different web pages (perhaps containing security warnings)
to any and all visitors who happen to try to view any pages that are
served up (by a suitably-modified web server), if and only if the visitor
happens to be coming at the web server from an IP address that is listed
on some specific DNS-based blacklist.

Alternatively, it might be possible to force some additional Javascript
code (e.g. some code which would put up one of those slightly annoying
grey `notice' pop-up boxes, where you have to click on `OK' to continue)
into each page that gets served up to any IP address that is on some
specified DNS-based blacklist.  The Javascript notice in this case would
be something like ``Are you aware that your local system administrator is
an idiot, and that your local mail server is being abused by spammers
because it is not properly secured?''  (Remember that the visitor has to
click on `OK' to continue wherever one of these `notice' pop-ups shows
up.)

There are many possible variations on this general theme, of course.  If
a given site didn't want to harass and annoy their visitors too much,
then they could perhaps get the grey pop-up notice boxes to appear (ONLY
to visitors who are visiting from some blacklisted IP address) but then
a cookie could be set on the visitor's machine to flag it as one that has
already seen the notice once.  Then, the display of the notice could be
made conditional on the presence/absence of that cookie, so that once
the visitor got past the original notice, that visitor could browse the
rest of the site _without_ having to see the notice again.

Anyway, I think that the general idea of employing web servers to get the
message across (e.g. that the visitor's site has a security problem, or that
is is considered to be on a spam-friendly network) may be an idea that has
some merit... _if_ it can be implemented (which is something that I'm still
not quite sure about).  This sort of anti-spam tactic could even be employed
by larger sites (and by major ISPs) that are otherwise very reluctant to
use any of the publically-available blacklists to do outright blocking of
incoming e-mail that arrives from `bad' sites/networks.  The web servers
at such sites could play an important role in a less disruptive, but still
effective protest movement against either (a) spam-supporting sites/networks,
or (b) incompetently unsecured sites/networks, or (c) both.

Harkening back to the original concept of the MAPS RBL (which simply blocks
all packets from a given `bad' IP address or address range), it is clear
that some folks, at least, do agree that web services can and should be
used to get the message across to `bad' sites that they have a problem.
But just dropping packets isn't an optimal solution in any sense, as it
leaves the web visitor just scratching his/her head, wondering if what
they are seeing is just an accidental and/or temporary network outage.

It seems abundantly clear to me that it would be much much better to be
able to arrange things so that (for example) a visitor from a `bad' IP
address would get a clear and unambiguous message that his/her site is
considered `bad' for this specific reason, or for that specific reason,
where the web pages that would be displayed (to any visitor from a `bad'
site or network) would clarify what the exact problem or offense is.

In short, we know that the World Wide Web is not only a great medium for
communicating ideas, clearly, and, when appropriate, in multiple languages,
but also that it is probably THE most popular service provided by/on the
Internet at the present time.  Given that, it seems like a Damn Shame that
we haven't made better use of the web to communicate our collective dis-
pleasure, both to dedicated spamming sites/networks and to ineptly un-
secured sites and networks.

I think that we could rectify that breach, but it would take quite some
work.

Is anybody other than me interested in this possibility?  If I, or someone
else built it, would anybody come?


Regards,
rfg


P.S.  The general idea I've put forward above would probably be most
particularly helpful in the case of dealing with (i.e. notifying) the
owners of unsecured proxies... a serious and growing problem.  Just
think about the reaction of an end user who got a notice like ``You can't
view this web site because the person who administers your local proxy
is an idiot, and he/she has left the proxy wide open for abuse.''

(Of course, some sites would opt to use more polite language in the notices,
but the basic idea is still the same... getting the message across.)


P.P.S.  I've been having some DNS difficulties in the past couple of days,
all of my own making.  If you send me private e-mail, and if it doesn't
seem to go through, either right away or at all, please try it again in
about 24 hours.  Thanks.

-- 
塚本  弘
hirobo-24@xxxxxxx


--[PR]------------------------------------------------------------------
【FreeMLからのお知らせ】
 ユーザー登録すると、MyPageっていうとっても便利なページが使えるように
 なります。
 例えば、MLの過去ログが見られたり、アドレス変更も簡単に行えます。
 　　　　　　　 http://www.freeml.com/reg_member1.php
------------------------------------------------------------------[PR]--
<GMO GROUP> Global Media Online  www.gmo.jp