Re: tin.it and others non collaborative isps.

[bejtlich () ALTAVISTA NET (Richard Bejtlich)]

Hello Osvaldo,

I believe that blocking ISPs should be a short-term 
defensive step, usually taken if the offending host finds a 
vulnerability on your network.  Blocking MAY give you 
enough time to correct the vulnerability, if you have 24x7 
real time monitoring and can fix the problem before the 
black-hat exploits it.

On another level, blocking in response to any perceived 
malicious activity must be weighed against other factors.  
Determined black-hats laugh at blocking, as they maintain 
multiple compromised hosts as staging points.  Also, one 
can trivially conduct a decoy attack, causing you to block 
traffic from completely innocent sites.

For these reasons and more, I could not support an 
IP "black list."  I do believe sites which advertise "smurf 
amplifying networks" are useful, as their scope is limited 
and the accuracy easily verifiable.

Richard Bejtlich

--

        IMHO it's a good idea if we unite and block ips 
from ISP's like
tin.it. They will collaborate as soon as their clients 
start to complain
that they can't access some address. What about a page that 
contains all
the IPs that we must block and the reasons for that?

--

 Osvaldo Janeri Filho