[SURBL-Discuss] RFC: Storm URI IPs to XS list?

Phil (Medway Hosting) phil at medwayhosting.com
Sat Aug 18 20:17:47 CEST 2007


----- Original Message ----- 
From: "Kevin A. McGrail" <kmcgrail at pccc.com>
To: "SURBL Discussion list" <discuss at lists.surbl.org>
Sent: Saturday, August 18, 2007 6:45 PM
Subject: Re: [SURBL-Discuss] RFC: Storm URI IPs to XS list?


> You have two customers (A & B) of an ISP that uses DHCP.  Customer A gets
an
> IP address, has a storm infection and sends out some emails that list his
IP
> address (or possibly even other machines in the P2P Storm Network).
>
> A few minutes, hours, days, whatever later, Customer B of the same ISP
gets
> the same DHCP address.  Customer B will now be a victim of FPs for anyone
> using the list being discussed.

Hiya

Yes I understand you completely - and I still say leave it blocked. If
someone is running a server on a dynamic IP then they should really be using
dyndns or similar so instead of giving out URL's like http://123.123.12.1 or
similar they could give people a URL like http://dynamicexample.dyndns.org
which also would not have the disadvantage of having to tell people a
different URL every time their IP changes. Anyone simply using an IP in a
link on a dynamic IP needs to learn how to do it properly. I don't see why
WE (email admins etc) should make allowances for the uninformed.

I have a webserver on a dynamic IP myself. Only for testing things, but its
there. I am lucky in that my ISP only changes the IP every 2 years or so, so
a normal DNS setup suits me just fine. IF the IP were to change every week
however then I would use dyndns.

As far as this issue is concerned however the "false positives" you speak of
would be negligible, and as an email admin (amongst other things) the 1 or 2
people worldwide who would be adversely affected by this would be able to
get around the problem simply by using google for 5 mins.

Sorry but I really can't see where your argument against them being
blacklisted has any validity. It would ONLY be a problem if the IP itself
were in the URL and that is a pretty stupid thing to do for any critical
uses if it's a dynamic IP.

All the best

Phil


_____________________________________________

Website Hosting from only £5.00 per month.
www.medwayhosting.com - +44 (0)1634 856965
_____________________________________________

Digital & Traditional Printing, and much more
www.medwayprint.com - +44 (0)1634 281199
_____________________________________________


More information about the Discuss mailing list