Re: Blacklisting methodology

On Thursday, May 8, 2003, at 16:21 US/Eastern, Matthew Schmidt wrote:
> Hey guys.  I'm working on banning people from JLCP via the admin 
> console and I was wondering if anyone had a nice way of blocking IPs.  
> We can get the IP from the request as it comes in and check in our 
> database to see if its blocked.  My question is how far up do we want 
> to block.  If someone's IP is 216.27.54.20, just blocking that exact 
> address won't work for a dynamic range.  Do we need to block all the 
> way up to 216.27.*.*? or just 216.27.54.*.  Your thoughts?  We are 
> also blocking by username, but this doesn't do a whole lot of good 
> since someone could just create another user with a different > username.
>
> -Matt

Let say, hypothetically speaking (I hope), you wanted to block me.  The 
problem is that my ISP changes my IP address every once in a while.  So 
if you block that ipaddr, in a few days you'll be blocking someone 
else, probably an innocent person who just happens to live in the same 
town.  Now, I doubt more than 1 o 2 people from my town would visit 
JLCP, just because the population in north central PA is not as 
technology-minded as, say, the folks in the big cities or Silicon 
Valley.  But let's say the address you want to block is coming from 
MIT:  would you then want to block out a whole segment of that campus?

Maybe you could do something like this:  when someone creates an 
account, they have to have a valid email address.  You acknowledge the 
account creation, but mark it as tentative until the new person replies 
to your email test, confirming they really exist.  That is the way many 
things I sign up for these days (mostly mailing lists) seem to work.  
And is JLCP so different (in terms of it being a community vulnerable 
to abuse) from a mailing list?

Geoffrey
--
Geoffrey S. Knauth | http://knauth.org/gsk