Should ISP block child pornography?
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it. On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it. Wondering if any operator is actively doing it or has ever considered doing it? Thanks. With Gratitude, Pratik Lotia “Information is not knowledge.” E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
where is this list of dirty domains? On Thu, Dec 6, 2018, 10:08 PM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Thanks.
With Gratitude,
*Pratik Lotia*
“Information is not knowledge.” The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
https://www.interpol.int/Crime-areas/Crimes-against-children/Access-blocking From: NANOG <nanog-bounces@nanog.org> on behalf of Mark Seiden <mis@seiden.com> Date: Friday, 7 December 2018 at 11:54 AM To: "Lotia, Pratik M" <Pratik.Lotia@charter.com> Cc: "nanog@nanog.org" <nanog@nanog.org> Subject: Re: Should ISP block child pornography? where is this list of dirty domains? On Thu, Dec 6, 2018, 10:08 PM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote: Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
thanks, suresh. what it seems to say is get in touch with the ncb in your country to sign an nda and get instructions. (but it's actually quite hard to figure out how to do that, no email address or phone numbers apparent for interpol dc) On Thu, Dec 6, 2018, 10:28 PM Suresh Ramasubramanian <ops.lists@gmail.com> wrote:
https://www.interpol.int/Crime-areas/Crimes-against-children/Access-blocking
*From: *NANOG <nanog-bounces@nanog.org> on behalf of Mark Seiden < mis@seiden.com> *Date: *Friday, 7 December 2018 at 11:54 AM *To: *"Lotia, Pratik M" <Pratik.Lotia@charter.com> *Cc: *"nanog@nanog.org" <nanog@nanog.org> *Subject: *Re: Should ISP block child pornography?
where is this list of dirty domains?
On Thu, Dec 6, 2018, 10:08 PM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
In the USA, you need to contact NCMEC - http://www.missingkids.com/home or the FBI. From: Mark Seiden <mis@seiden.com> Date: Friday, 7 December 2018 at 12:16 PM To: Suresh Ramasubramanian <ops.lists@gmail.com> Cc: "Lotia, Pratik M" <Pratik.Lotia@charter.com>, "nanog@nanog.org" <nanog@nanog.org> Subject: Re: Should ISP block child pornography? thanks, suresh. what it seems to say is get in touch with the ncb in your country to sign an nda and get instructions. (but it's actually quite hard to figure out how to do that, no email address or phone numbers apparent for interpol dc)
When I receive a report, we follow our procedures with the Cyber Tip Line, and then immediately null route the IP address until the content is removed. From: NANOG <nanog-bounces@nanog.org> On Behalf Of Suresh Ramasubramanian Sent: Thursday, December 06, 2018 10:49 PM To: Mark Seiden <mis@seiden.com> Cc: nanog@nanog.org Subject: Re: Should ISP block child pornography? In the USA, you need to contact NCMEC - http://www.missingkids.com/home or the FBI. From: Mark Seiden <mis@seiden.com<mailto:mis@seiden.com>> Date: Friday, 7 December 2018 at 12:16 PM To: Suresh Ramasubramanian <ops.lists@gmail.com<mailto:ops.lists@gmail.com>> Cc: "Lotia, Pratik M" <Pratik.Lotia@charter.com<mailto:Pratik.Lotia@charter.com>>, "nanog@nanog.org<mailto:nanog@nanog.org>" <nanog@nanog.org<mailto:nanog@nanog.org>> Subject: Re: Should ISP block child pornography? thanks, suresh. what it seems to say is get in touch with the ncb in your country to sign an nda and get instructions. (but it's actually quite hard to figure out how to do that, no email address or phone numbers apparent for interpol dc)
On Fri, 7 Dec 2018 at 08:09, Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Some jurisdictions legally must, some legally cannot. It's very sensitive subject, with some reductio ad absurdum ghost hiding behind the corner. My thought is, if we know this data exists, and we know where it exists, why are we not following the data to find the people? It seems we're very good at putting leverage in AML/KYC across jurisdictions of arbitrary length, how come same tools don't seem to work here? If ISPs do start to block, voluntarily or involuntarily, are we removing incentives to fix the problem by hiding some of the symptoms? In my opinion leave the infrastructure alone, where ever the road may lead, removing the road won't remove the destination. Does the content create the culprits? Is there research into this? Are people with evolutionarily normal sexual appetites turned pedophiles after exposed to the material? -- ++ytti
Does the content create the culprits? Is there research into this? Are people with evolutionarily normal sexual appetites turned pedophiles after exposed to the material?
I've helped the FBI get child pornographers arrested and I would do it again. But to answer your question the concern is for the children, they are being sexually abused. Consumers of child pornography are creating a market for it thus encouraging more production which requires more children be sexually abused. There's really no way around that. Splitting the hair of whether the actual perp paid for the material is irrelevant, they can let their lawyer argue that in court if they like but it's a weak defense (e.g., ad supported, same as paying, whatever.) -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
How is it that Interpol isn’t taking over/shutting down these domains in the DNS at the registry/registrar level? The GAC pushed hard for the provisions that allow them to do so and there’s a pretty clear (and quick) process for it. Owen
On Dec 6, 2018, at 22:06 , Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it. On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Thanks.
With Gratitude,
Pratik Lotia
“Information is not knowledge.” The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
Agree El 7/12/18 a las 06:14, Owen DeLong escribió:
How is it that Interpol isn’t taking over/shutting down these domains in the DNS at the registry/registrar level?
The GAC pushed hard for the provisions that allow them to do so and there’s a pretty clear (and quick) process for it.
Owen
On Dec 6, 2018, at 22:06 , Lotia, Pratik M <Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com>> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it. On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it. Wondering if any operator is actively doing it or has ever considered doing it? Thanks. With Gratitude, * * *Pratik Lotia* “Information is not knowledge.” The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
I block stuff all the time (like ROKSO's DROP list). The only issue with blocking domains of CPE is I imagine those domains change all the time as they get shutdown, if you block the IP (from domain lookup) its likely that IP maybe be legitimate in the future. It should be stopped it at the DNS level, but even that has workarounds. I would think CPE is a violation of terms of "most" registrars. -John On 12/7/18 1:06 AM, Lotia, Pratik M wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Thanks.
With Gratitude,
**
*Pratik Lotia*
“Information is not knowledge.”
The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
What is “ROKSO's DROP list” ?
ROKSO: The Register of Known Spam Operations database is a depository of information and evidence on known persistent spam operations, assembled to assist service providers with customer vetting and the Infosec industry with Actor Attribution. Spamhaus (https://www.spamhaus.org) provides a 'DROP' list which is a list of domains which are hijacked or leased by professional spam operations. As per them this is Not a list of just 'suspicious' domains - they are 100% sure that these are bad domains and one should not peer with them or have a route to them. With Gratitude, Pratik Lotia “Information is not knowledge.” On 12/7/18, 11:47, "NANOG on behalf of Aaron1" <nanog-bounces@nanog.org on behalf of aaron1@gvtc.com> wrote: What is “ROKSO's DROP list” ? Aaron > On Dec 7, 2018, at 8:57 AM, John Von Essen <john@essenz.com> wrote: > > ROKSO's DROP list E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
The only issue with blocking domains of CPE is I imagine those domains change all the time as they get shutdown, if you block the IP
(from domain lookup) its likely that IP maybe be legitimate in the future.
The list would be updated daily/weekly. The ACLs would have to be updated accordingly – this can be automated. This way no stale entries are present. With Gratitude, Pratik Lotia From: NANOG <nanog-bounces@nanog.org> on behalf of John Von Essen <john@essenz.com> Date: Friday, December 7, 2018 at 08:59 To: "nanog@nanog.org" <nanog@nanog.org> Subject: Re: Should ISP block child pornography? I block stuff all the time (like ROKSO's DROP list). The only issue with blocking domains of CPE is I imagine those domains change all the time as they get shutdown, if you block the IP (from domain lookup) its likely that IP maybe be legitimate in the future. It should be stopped it at the DNS level, but even that has workarounds. I would think CPE is a violation of terms of "most" registrars. -John On 12/7/18 1:06 AM, Lotia, Pratik M wrote: Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it. On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it. Wondering if any operator is actively doing it or has ever considered doing it? Thanks. With Gratitude, Pratik Lotia “Information is not knowledge.” The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited. E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
Hi All, we are fighting with censorship in our country. So I have something to say. First, censorship is not just "switch off this website and that webpage". No magic button exist. It is more complex, if you think as for while system. Initially, networks was build without systems (hardware and software) can block something. Yes, you may nullroute some IP with some site, but as the collateral damage you will block part of Cloudflare or Amazon, for example. So you have to buy and install additional equipment and software to do it a bit less painful. That's not so cheap, that should be planned, brought, installed, checked and personal should be learned. After that, your system will be capable to block some website for ~90% of your customers will not proactively avoid blocking. And for *NONE* who will, as CP addicts, terrorists, blackmarkets, gambling, porn and others do. Yep. Now you network is capable to censor something. You just maid the first step to the hell. What's next? Some people send you some websites to ban. This list with CP, Spamhaus DROP, some court orders, some semi-legal copyright protectors orders, some "we just want to block it" requests... And some list positions from time to time became outdated, so you need to clean it from time to time. Do not even expect people sent you the block request will send you unblock request, of course. Then, we have >6000 ISPs in our country - it is not possible to interact with all of them directly. So, you end up under a lot of papers, random interactions with random people and outdated and desyncronized blocking list. It will not work. Next, government realizes there should be one centralized blocking list and introduces it. Ok. Now we have censored Internet. THE SWITCH IS ON. In a very short time the number of organizations have permission to insert something in the list dramatically increases. Corruption rises, it becomes possible, and then becomes cheap to put your competitor's website into the list for some time. And of course, primary target of any censorship is the elections... What about CP and porn addicts, gamblers, killers, terrorists? Surprise, they are even more fine than at the beginning! Why? Because they learned VPN, TOR and have to use it! Investigators end up with TOR and VPN exit IP addresses from another countries instead of their home IPs. Hey. It is a very very bad and very very danger game. Avoid it. Goal of that game is to SWITCH ON that system BY ANY REASON. CP, war, gambling - any reason that will work. After the system will be switched on - in several months you will forget the initial reason. And will awake in another world. 07.12.18 08:06, Lotia, Pratik M пише:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Thanks.
With Gratitude,
* *
*Pratik Lotia*
“Information is not knowledge.”
The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
Well said On 12/07/2018 07:48 PM, Max Tulyev wrote:
Hi All,
we are fighting with censorship in our country. So I have something to say.
First, censorship is not just "switch off this website and that webpage". No magic button exist. It is more complex, if you think as for while system.
Initially, networks was build without systems (hardware and software) can block something.
Yes, you may nullroute some IP with some site, but as the collateral damage you will block part of Cloudflare or Amazon, for example. So you have to buy and install additional equipment and software to do it a bit less painful. That's not so cheap, that should be planned, brought, installed, checked and personal should be learned. After that, your system will be capable to block some website for ~90% of your customers will not proactively avoid blocking. And for *NONE* who will, as CP addicts, terrorists, blackmarkets, gambling, porn and others do.
Yep. Now you network is capable to censor something. You just maid the first step to the hell. What's next? Some people send you some websites to ban. This list with CP, Spamhaus DROP, some court orders, some semi-legal copyright protectors orders, some "we just want to block it" requests... And some list positions from time to time became outdated, so you need to clean it from time to time. Do not even expect people sent you the block request will send you unblock request, of course. Then, we have >6000 ISPs in our country - it is not possible to interact with all of them directly.
So, you end up under a lot of papers, random interactions with random people and outdated and desyncronized blocking list. It will not work.
Next, government realizes there should be one centralized blocking list and introduces it.
Ok. Now we have censored Internet. THE SWITCH IS ON.
In a very short time the number of organizations have permission to insert something in the list dramatically increases. Corruption rises, it becomes possible, and then becomes cheap to put your competitor's website into the list for some time. And of course, primary target of any censorship is the elections...
What about CP and porn addicts, gamblers, killers, terrorists? Surprise, they are even more fine than at the beginning! Why? Because they learned VPN, TOR and have to use it! Investigators end up with TOR and VPN exit IP addresses from another countries instead of their home IPs.
Hey. It is a very very bad and very very danger game. Avoid it. Goal of that game is to SWITCH ON that system BY ANY REASON. CP, war, gambling - any reason that will work. After the system will be switched on - in several months you will forget the initial reason. And will awake in another world.
07.12.18 08:06, Lotia, Pratik M пише:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Thanks.
With Gratitude,
* *
*Pratik Lotia*
“Information is not knowledge.”
The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
Very well explained, Max! With Gratitude, Pratik Lotia “Information is not knowledge.” On 12/7/18, 13:16, "NANOG on behalf of nanog@jack.fr.eu.org" <nanog-bounces@nanog.org on behalf of nanog@jack.fr.eu.org> wrote: Well said On 12/07/2018 07:48 PM, Max Tulyev wrote: > Hi All, > > we are fighting with censorship in our country. So I have something to say. > > First, censorship is not just "switch off this website and that > webpage". No magic button exist. It is more complex, if you think as for > while system. > > Initially, networks was build without systems (hardware and software) > can block something. > > Yes, you may nullroute some IP with some site, but as the collateral > damage you will block part of Cloudflare or Amazon, for example. So you > have to buy and install additional equipment and software to do it a bit > less painful. That's not so cheap, that should be planned, brought, > installed, checked and personal should be learned. After that, your > system will be capable to block some website for ~90% of your customers > will not proactively avoid blocking. And for *NONE* who will, as CP > addicts, terrorists, blackmarkets, gambling, porn and others do. > > Yep. Now you network is capable to censor something. You just maid the > first step to the hell. What's next? Some people send you some websites > to ban. This list with CP, Spamhaus DROP, some court orders, some > semi-legal copyright protectors orders, some "we just want to block it" > requests... And some list positions from time to time became outdated, > so you need to clean it from time to time. Do not even expect people > sent you the block request will send you unblock request, of course. > Then, we have >6000 ISPs in our country - it is not possible to interact > with all of them directly. > > So, you end up under a lot of papers, random interactions with random > people and outdated and desyncronized blocking list. It will not work. > > Next, government realizes there should be one centralized blocking list > and introduces it. > > Ok. Now we have censored Internet. THE SWITCH IS ON. > > In a very short time the number of organizations have permission to > insert something in the list dramatically increases. Corruption rises, > it becomes possible, and then becomes cheap to put your competitor's > website into the list for some time. And of course, primary target of > any censorship is the elections... > > What about CP and porn addicts, gamblers, killers, terrorists? Surprise, > they are even more fine than at the beginning! Why? Because they learned > VPN, TOR and have to use it! Investigators end up with TOR and VPN exit > IP addresses from another countries instead of their home IPs. > > Hey. It is a very very bad and very very danger game. Avoid it. > Goal of that game is to SWITCH ON that system BY ANY REASON. CP, war, > gambling - any reason that will work. After the system will be switched > on - in several months you will forget the initial reason. And will > awake in another world. > > 07.12.18 08:06, Lotia, Pratik M пише: >> Hello all, was curious to know the community’s opinion on whether an ISP >> should block domains hosting CPE (child pornography exploitation) >> content? Interpol has a ‘worst-of’ list which contains such domains and >> it wants ISPs to block it. >> >> On one side we want the ISP to not do any kind of censorship or >> inspection of customer traffic (customers are paying for pipes – not for >> filtered pipes), on the other side morals/ethics come into play. Keep in >> mind that if an ISP is blocking it would mean that it is also logging >> the information (source IP) and law agencies might be wanting access to it. >> >> >> >> Wondering if any operator is actively doing it or has ever considered >> doing it? >> >> >> >> Thanks. >> >> >> >> >> >> With Gratitude, >> >> * * >> >> *Pratik Lotia* >> >> >> >> “Information is not knowledge.” >> >> The contents of this e-mail message and >> any attachments are intended solely for the >> addressee(s) and may contain confidential >> and/or legally privileged information. If you >> are not the intended recipient of this message >> or if this message has been addressed to you >> in error, please immediately alert the sender >> by reply e-mail and then delete this message >> and any attachments. If you are not the >> intended recipient, you are notified that >> any use, dissemination, distribution, copying, >> or storage of this message or any attachment >> is strictly prohibited. E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
I've done a bit of work in this space, wont elaborate ..... but here are some thoughts : * many less-engaged or new pedophiles may indeed search such content in the clear, however .... * the persistent abusers tend to form communities within TOR hidden services, making them difficult to find. Most are likely just consumers of the material, but many are producers (inc kidnappers) * some underground communities require that prospective members contribute new abuse imagery/videos in order to prove they are not law enforcement. Tragically this encourages abusers to abuse a family member * other communities have plenty of essays espousing the viewpoint that such behavior is quite natural, which does convince some to excuse their behavior. This content itself does have the ability to convert non-offenders to offenders, IMHO. - The following article discuss these communities and their underlying agendas. I'll warn you that you may need therapy after reading it ..... * http://www.cracked.com/personal-experiences-1760-5-things-i-learned-infiltra... * Some of the content is indeed quite traumatic - it's as bad as they say it is, and many people working in this space have long-term psychological problems * While many of these communities hide in TOR, making it difficult to find the perpetrators, many of the images there actually link to images hosted in public-facing image-hosting servers. This means that the abusers access it through 3 hops through the proxy network instead of 6, for hidden servers. This means that indeed, the majority of people accessing that content on your network may be doing so from hotlinks posted to a hidden server somewhere. You may see them primarily being accessed via known TOR exit nodes. My recommendations : * First, reach out to NCMEC for guidance on filtering/logging * Second, Ive done a teensy bit of work for these guys at Thorn (Ashton Kutchers nonprofit). They have an interesting program that attempts to recognize people searching for abuse imagery, and redirects them to material urging them to seek psychological help for their problem. : https://www.wearethorn.org/deterrence-prevent-child-sexual-abuse-imagery/ On Fri, Dec 7, 2018 at 11:32 AM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Very well explained, Max!
With Gratitude, Pratik Lotia
“Information is not knowledge.”
On 12/7/18, 13:16, "NANOG on behalf of nanog@jack.fr.eu.org" < nanog-bounces@nanog.org on behalf of nanog@jack.fr.eu.org> wrote:
Well said
On 12/07/2018 07:48 PM, Max Tulyev wrote: > Hi All, > > we are fighting with censorship in our country. So I have something to say. > > First, censorship is not just "switch off this website and that > webpage". No magic button exist. It is more complex, if you think as for > while system. > > Initially, networks was build without systems (hardware and software) > can block something. > > Yes, you may nullroute some IP with some site, but as the collateral > damage you will block part of Cloudflare or Amazon, for example. So you > have to buy and install additional equipment and software to do it a bit > less painful. That's not so cheap, that should be planned, brought, > installed, checked and personal should be learned. After that, your > system will be capable to block some website for ~90% of your customers > will not proactively avoid blocking. And for *NONE* who will, as CP > addicts, terrorists, blackmarkets, gambling, porn and others do. > > Yep. Now you network is capable to censor something. You just maid the > first step to the hell. What's next? Some people send you some websites > to ban. This list with CP, Spamhaus DROP, some court orders, some > semi-legal copyright protectors orders, some "we just want to block it" > requests... And some list positions from time to time became outdated, > so you need to clean it from time to time. Do not even expect people > sent you the block request will send you unblock request, of course. > Then, we have >6000 ISPs in our country - it is not possible to interact > with all of them directly. > > So, you end up under a lot of papers, random interactions with random > people and outdated and desyncronized blocking list. It will not work. > > Next, government realizes there should be one centralized blocking list > and introduces it. > > Ok. Now we have censored Internet. THE SWITCH IS ON. > > In a very short time the number of organizations have permission to > insert something in the list dramatically increases. Corruption rises, > it becomes possible, and then becomes cheap to put your competitor's > website into the list for some time. And of course, primary target of > any censorship is the elections... > > What about CP and porn addicts, gamblers, killers, terrorists? Surprise, > they are even more fine than at the beginning! Why? Because they learned > VPN, TOR and have to use it! Investigators end up with TOR and VPN exit > IP addresses from another countries instead of their home IPs. > > Hey. It is a very very bad and very very danger game. Avoid it. > Goal of that game is to SWITCH ON that system BY ANY REASON. CP, war, > gambling - any reason that will work. After the system will be switched > on - in several months you will forget the initial reason. And will > awake in another world. > > 07.12.18 08:06, Lotia, Pratik M пише: >> Hello all, was curious to know the community’s opinion on whether an ISP >> should block domains hosting CPE (child pornography exploitation) >> content? Interpol has a ‘worst-of’ list which contains such domains and >> it wants ISPs to block it. >> >> On one side we want the ISP to not do any kind of censorship or >> inspection of customer traffic (customers are paying for pipes – not for >> filtered pipes), on the other side morals/ethics come into play. Keep in >> mind that if an ISP is blocking it would mean that it is also logging >> the information (source IP) and law agencies might be wanting access to it. >> >> >> >> Wondering if any operator is actively doing it or has ever considered >> doing it? >> >> >> >> Thanks. >> >> >> >> >> >> With Gratitude, >> >> * * >> >> *Pratik Lotia* >> >> >> >> “Information is not knowledge.” >> >> The contents of this e-mail message and >> any attachments are intended solely for the >> addressee(s) and may contain confidential >> and/or legally privileged information. If you >> are not the intended recipient of this message >> or if this message has been addressed to you >> in error, please immediately alert the sender >> by reply e-mail and then delete this message >> and any attachments. If you are not the >> intended recipient, you are notified that >> any use, dissemination, distribution, copying, >> or storage of this message or any attachment >> is strictly prohibited.
E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
Makes we want to cry, so sad Aaron
On Dec 7, 2018, at 1:43 PM, cosmo <clinton.mielke@gmail.com> wrote:
I've done a bit of work in this space, wont elaborate ..... but here are some thoughts :
* many less-engaged or new pedophiles may indeed search such content in the clear, however .... * the persistent abusers tend to form communities within TOR hidden services, making them difficult to find. Most are likely just consumers of the material, but many are producers (inc kidnappers) * some underground communities require that prospective members contribute new abuse imagery/videos in order to prove they are not law enforcement. Tragically this encourages abusers to abuse a family member * other communities have plenty of essays espousing the viewpoint that such behavior is quite natural, which does convince some to excuse their behavior. This content itself does have the ability to convert non-offenders to offenders, IMHO. - The following article discuss these communities and their underlying agendas. I'll warn you that you may need therapy after reading it ..... * http://www.cracked.com/personal-experiences-1760-5-things-i-learned-infiltra... * Some of the content is indeed quite traumatic - it's as bad as they say it is, and many people working in this space have long-term psychological problems * While many of these communities hide in TOR, making it difficult to find the perpetrators, many of the images there actually link to images hosted in public-facing image-hosting servers. This means that the abusers access it through 3 hops through the proxy network instead of 6, for hidden servers.
This means that indeed, the majority of people accessing that content on your network may be doing so from hotlinks posted to a hidden server somewhere. You may see them primarily being accessed via known TOR exit nodes.
My recommendations : * First, reach out to NCMEC for guidance on filtering/logging * Second, Ive done a teensy bit of work for these guys at Thorn (Ashton Kutchers nonprofit). They have an interesting program that attempts to recognize people searching for abuse imagery, and redirects them to material urging them to seek psychological help for their problem. : https://www.wearethorn.org/deterrence-prevent-child-sexual-abuse-imagery/
On Fri, Dec 7, 2018 at 11:32 AM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote: Very well explained, Max!
With Gratitude, Pratik Lotia
“Information is not knowledge.”
On 12/7/18, 13:16, "NANOG on behalf of nanog@jack.fr.eu.org" <nanog-bounces@nanog.org on behalf of nanog@jack.fr.eu.org> wrote:
Well said
On 12/07/2018 07:48 PM, Max Tulyev wrote: > Hi All, > > we are fighting with censorship in our country. So I have something to say. > > First, censorship is not just "switch off this website and that > webpage". No magic button exist. It is more complex, if you think as for > while system. > > Initially, networks was build without systems (hardware and software) > can block something. > > Yes, you may nullroute some IP with some site, but as the collateral > damage you will block part of Cloudflare or Amazon, for example. So you > have to buy and install additional equipment and software to do it a bit > less painful. That's not so cheap, that should be planned, brought, > installed, checked and personal should be learned. After that, your > system will be capable to block some website for ~90% of your customers > will not proactively avoid blocking. And for *NONE* who will, as CP > addicts, terrorists, blackmarkets, gambling, porn and others do. > > Yep. Now you network is capable to censor something. You just maid the > first step to the hell. What's next? Some people send you some websites > to ban. This list with CP, Spamhaus DROP, some court orders, some > semi-legal copyright protectors orders, some "we just want to block it" > requests... And some list positions from time to time became outdated, > so you need to clean it from time to time. Do not even expect people > sent you the block request will send you unblock request, of course. > Then, we have >6000 ISPs in our country - it is not possible to interact > with all of them directly. > > So, you end up under a lot of papers, random interactions with random > people and outdated and desyncronized blocking list. It will not work. > > Next, government realizes there should be one centralized blocking list > and introduces it. > > Ok. Now we have censored Internet. THE SWITCH IS ON. > > In a very short time the number of organizations have permission to > insert something in the list dramatically increases. Corruption rises, > it becomes possible, and then becomes cheap to put your competitor's > website into the list for some time. And of course, primary target of > any censorship is the elections... > > What about CP and porn addicts, gamblers, killers, terrorists? Surprise, > they are even more fine than at the beginning! Why? Because they learned > VPN, TOR and have to use it! Investigators end up with TOR and VPN exit > IP addresses from another countries instead of their home IPs. > > Hey. It is a very very bad and very very danger game. Avoid it. > Goal of that game is to SWITCH ON that system BY ANY REASON. CP, war, > gambling - any reason that will work. After the system will be switched > on - in several months you will forget the initial reason. And will > awake in another world. > > 07.12.18 08:06, Lotia, Pratik M пише: >> Hello all, was curious to know the community’s opinion on whether an ISP >> should block domains hosting CPE (child pornography exploitation) >> content? Interpol has a ‘worst-of’ list which contains such domains and >> it wants ISPs to block it. >> >> On one side we want the ISP to not do any kind of censorship or >> inspection of customer traffic (customers are paying for pipes – not for >> filtered pipes), on the other side morals/ethics come into play. Keep in >> mind that if an ISP is blocking it would mean that it is also logging >> the information (source IP) and law agencies might be wanting access to it. >> >> >> >> Wondering if any operator is actively doing it or has ever considered >> doing it? >> >> >> >> Thanks. >> >> >> >> >> >> With Gratitude, >> >> * * >> >> *Pratik Lotia* >> >> >> >> “Information is not knowledge.” >> >> The contents of this e-mail message and >> any attachments are intended solely for the >> addressee(s) and may contain confidential >> and/or legally privileged information. If you >> are not the intended recipient of this message >> or if this message has been addressed to you >> in error, please immediately alert the sender >> by reply e-mail and then delete this message >> and any attachments. If you are not the >> intended recipient, you are notified that >> any use, dissemination, distribution, copying, >> or storage of this message or any attachment >> is strictly prohibited.
E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
There's a reason that the subreddit for hidden services has this as a title ..... https://www.reddit.com/r/onions [image: image.png] On Fri, Dec 7, 2018 at 11:54 AM Aaron1 <aaron1@gvtc.com> wrote:
Makes we want to cry, so sad
Aaron
On Dec 7, 2018, at 1:43 PM, cosmo <clinton.mielke@gmail.com> wrote:
I've done a bit of work in this space, wont elaborate ..... but here are some thoughts :
* many less-engaged or new pedophiles may indeed search such content in the clear, however .... * the persistent abusers tend to form communities within TOR hidden services, making them difficult to find. Most are likely just consumers of the material, but many are producers (inc kidnappers) * some underground communities require that prospective members contribute new abuse imagery/videos in order to prove they are not law enforcement. Tragically this encourages abusers to abuse a family member * other communities have plenty of essays espousing the viewpoint that such behavior is quite natural, which does convince some to excuse their behavior. This content itself does have the ability to convert non-offenders to offenders, IMHO. - The following article discuss these communities and their underlying agendas. I'll warn you that you may need therapy after reading it ..... * http://www.cracked.com/personal-experiences-1760-5-things-i-learned-infiltra... * Some of the content is indeed quite traumatic - it's as bad as they say it is, and many people working in this space have long-term psychological problems * While many of these communities hide in TOR, making it difficult to find the perpetrators, many of the images there actually link to images hosted in public-facing image-hosting servers. This means that the abusers access it through 3 hops through the proxy network instead of 6, for hidden servers.
This means that indeed, the majority of people accessing that content on your network may be doing so from hotlinks posted to a hidden server somewhere. You may see them primarily being accessed via known TOR exit nodes.
My recommendations : * First, reach out to NCMEC for guidance on filtering/logging * Second, Ive done a teensy bit of work for these guys at Thorn (Ashton Kutchers nonprofit). They have an interesting program that attempts to recognize people searching for abuse imagery, and redirects them to material urging them to seek psychological help for their problem. : https://www.wearethorn.org/deterrence-prevent-child-sexual-abuse-imagery/
On Fri, Dec 7, 2018 at 11:32 AM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Very well explained, Max!
With Gratitude, Pratik Lotia
“Information is not knowledge.”
On 12/7/18, 13:16, "NANOG on behalf of nanog@jack.fr.eu.org" < nanog-bounces@nanog.org on behalf of nanog@jack.fr.eu.org> wrote:
Well said
On 12/07/2018 07:48 PM, Max Tulyev wrote: > Hi All, > > we are fighting with censorship in our country. So I have something to say. > > First, censorship is not just "switch off this website and that > webpage". No magic button exist. It is more complex, if you think as for > while system. > > Initially, networks was build without systems (hardware and software) > can block something. > > Yes, you may nullroute some IP with some site, but as the collateral > damage you will block part of Cloudflare or Amazon, for example. So you > have to buy and install additional equipment and software to do it a bit > less painful. That's not so cheap, that should be planned, brought, > installed, checked and personal should be learned. After that, your > system will be capable to block some website for ~90% of your customers > will not proactively avoid blocking. And for *NONE* who will, as CP > addicts, terrorists, blackmarkets, gambling, porn and others do. > > Yep. Now you network is capable to censor something. You just maid the > first step to the hell. What's next? Some people send you some websites > to ban. This list with CP, Spamhaus DROP, some court orders, some > semi-legal copyright protectors orders, some "we just want to block it" > requests... And some list positions from time to time became outdated, > so you need to clean it from time to time. Do not even expect people > sent you the block request will send you unblock request, of course. > Then, we have >6000 ISPs in our country - it is not possible to interact > with all of them directly. > > So, you end up under a lot of papers, random interactions with random > people and outdated and desyncronized blocking list. It will not work. > > Next, government realizes there should be one centralized blocking list > and introduces it. > > Ok. Now we have censored Internet. THE SWITCH IS ON. > > In a very short time the number of organizations have permission to > insert something in the list dramatically increases. Corruption rises, > it becomes possible, and then becomes cheap to put your competitor's > website into the list for some time. And of course, primary target of > any censorship is the elections... > > What about CP and porn addicts, gamblers, killers, terrorists? Surprise, > they are even more fine than at the beginning! Why? Because they learned > VPN, TOR and have to use it! Investigators end up with TOR and VPN exit > IP addresses from another countries instead of their home IPs. > > Hey. It is a very very bad and very very danger game. Avoid it. > Goal of that game is to SWITCH ON that system BY ANY REASON. CP, war, > gambling - any reason that will work. After the system will be switched > on - in several months you will forget the initial reason. And will > awake in another world. > > 07.12.18 08:06, Lotia, Pratik M пише: >> Hello all, was curious to know the community’s opinion on whether an ISP >> should block domains hosting CPE (child pornography exploitation) >> content? Interpol has a ‘worst-of’ list which contains such domains and >> it wants ISPs to block it. >> >> On one side we want the ISP to not do any kind of censorship or >> inspection of customer traffic (customers are paying for pipes – not for >> filtered pipes), on the other side morals/ethics come into play. Keep in >> mind that if an ISP is blocking it would mean that it is also logging >> the information (source IP) and law agencies might be wanting access to it. >> >> >> >> Wondering if any operator is actively doing it or has ever considered >> doing it? >> >> >> >> Thanks. >> >> >> >> >> >> With Gratitude, >> >> * * >> >> *Pratik Lotia* >> >> >> >> “Information is not knowledge.” >> >> The contents of this e-mail message and >> any attachments are intended solely for the >> addressee(s) and may contain confidential >> and/or legally privileged information. If you >> are not the intended recipient of this message >> or if this message has been addressed to you >> in error, please immediately alert the sender >> by reply e-mail and then delete this message >> and any attachments. If you are not the >> intended recipient, you are notified that >> any use, dissemination, distribution, copying, >> or storage of this message or any attachment >> is strictly prohibited.
E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
On 07/12/2018 20:48, Max Tulyev wrote:
Yes, you may nullroute some IP with some site, but as the collateral damage you will block part of Cloudflare or Amazon, for example. So you have to buy and install additional equipment and software to do it a bit less painful. That's not so cheap, that should be planned, brought, installed, checked and personal should be learned. After that, your system will be capable to block some website for ~90% of your customers will not proactively avoid blocking. And for *NONE* who will, as CP addicts, terrorists, blackmarkets, gambling, porn and others do. It is even more complex. As you said filtering by IP address causing
collateral damage to multi-host sites. But there are sites that use primarily IPv6 addresses so you need to filter not only IPv4 but IPv6 as well. Also, sites change their IP address after they find out they are blocked, so you need a cron job which checks the IP addresses every 10-15 minutes and updates the filters (if you are willing to accept collateral damage).
But when requested to block a FQDN, and filtering by IPv4 or IPv6 is not an option, again there are issues. You filter/block in your central DNS server, but what about the user at home who is using 8.8.8.8 or 9.9.9.9? Or the corporate link to some Fortune 500 company with their own DNS servers that bypass the ISP servers. So now you are in a situation where you have to divert/capture *all *udp/53 and tcp/53 and pass it to some scrubbing server which will only block the requests to the forbidden FQDNs. Oh but wait, what about DoH? Governments that require ISPs to block "certain" sites have no clue what is required technologically to adhere to their demands. -Hank
Correct. Also if you update IPs automatically by cron (and you have to automate it as lists only growing and growing) - blocked sites will troll the censorship system. They put IP of some government or critical (for example, VISA/Mastercard processing) sites in their blocked domain - and those victim sites will be blocked. This trolling is very popular in Russia, for example. 08.12.18 19:41, Hank Nussbacher пише:
On 07/12/2018 20:48, Max Tulyev wrote:
Yes, you may nullroute some IP with some site, but as the collateral damage you will block part of Cloudflare or Amazon, for example. So you have to buy and install additional equipment and software to do it a bit less painful. That's not so cheap, that should be planned, brought, installed, checked and personal should be learned. After that, your system will be capable to block some website for ~90% of your customers will not proactively avoid blocking. And for *NONE* who will, as CP addicts, terrorists, blackmarkets, gambling, porn and others do. It is even more complex. As you said filtering by IP address causing
collateral damage to multi-host sites. But there are sites that use primarily IPv6 addresses so you need to filter not only IPv4 but IPv6 as well. Also, sites change their IP address after they find out they are blocked, so you need a cron job which checks the IP addresses every 10-15 minutes and updates the filters (if you are willing to accept collateral damage).
But when requested to block a FQDN, and filtering by IPv4 or IPv6 is not an option, again there are issues.
You filter/block in your central DNS server, but what about the user at home who is using 8.8.8.8 or 9.9.9.9? Or the corporate link to some Fortune 500 company with their own DNS servers that bypass the ISP servers. So now you are in a situation where you have to divert/capture *all *udp/53 and tcp/53 and pass it to some scrubbing server which will only block the requests to the forbidden FQDNs. Oh but wait, what about DoH?
Governments that require ISPs to block "certain" sites have no clue what is required technologically to adhere to their demands.
-Hank
They put IP of some government or critical (for example, VISA/Mastercard processing) sites in their blocked domain - and those victim sites will be blocked. This trolling is very popular in Russia, for example.
This should be very popular everywhere in the free world -- explaining why it is popular in Russia but not in non-free countries such as the United States of America ... --- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.
Because of USA does not have any block lists for example ;) 08.12.18 22:29, Keith Medcalf пише:
They put IP of some government or critical (for example, VISA/Mastercard processing) sites in their blocked domain - and those victim sites will be blocked. This trolling is very popular in Russia, for example.
This should be very popular everywhere in the free world -- explaining why it is popular in Russia but not in non-free countries such as the United States of America ...
--- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.
Makes complete! sense \o/ #MoreKnowledgeKneeded On Sat, Dec 08, 2018 at 10:44:43PM +0200, Max Tulyev wrote:
Because of USA does not have any block lists for example ;)
08.12.18 22:29, Keith Medcalf пише:
They put IP of some government or critical (for example, VISA/Mastercard processing) sites in their blocked domain - and those victim sites will be blocked. This trolling is very popular in Russia, for example.
This should be very popular everywhere in the free world -- explaining why it is popular in Russia but not in non-free countries such as the United States of America ...
--- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.
-- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.
On December 8, 2018 at 19:41 hank@efes.iucc.ac.il (Hank Nussbacher) wrote:
Governments that require ISPs to block "certain" sites have no clue what is required technologically to adhere to their demands.
Well that's certainly true. Australia just passed a law mandating decryption be made available to law enforcement simply ignoring the many technical explanations about why we don't know how to do this without compromising security entirely. I've often said if a judge in their court orders you to raise your left foot in the air you would be well-advised to lift that foot. If the judge orders you to also raise your right foot the judge doesn't have a problem, YOU have a problem. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
Which is it… It’s being reported on NPR as “Australia required Apple and others to remove encryption protections from their devices.” That’s a massively different (and arguably even worse) outcome than “Australia is requiring Apple and others to provide decryption technology to law enforcement.” Owen
On Dec 8, 2018, at 14:41 , bzs@theworld.com wrote:
On December 8, 2018 at 19:41 hank@efes.iucc.ac.il (Hank Nussbacher) wrote:
Governments that require ISPs to block "certain" sites have no clue what is required technologically to adhere to their demands.
Well that's certainly true.
Australia just passed a law mandating decryption be made available to law enforcement simply ignoring the many technical explanations about why we don't know how to do this without compromising security entirely.
I've often said if a judge in their court orders you to raise your left foot in the air you would be well-advised to lift that foot.
If the judge orders you to also raise your right foot the judge doesn't have a problem, YOU have a problem.
-- -Barry Shein
Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
My impression is that like the judge in my previous note they did neither, or both, or all of the above. The law apparently just says if LE or a court of competent jurisdiction demands the contents of a device it has to be provided in a readable form and how that's accomplished is not their (the legislature's, LE's, et al's) problem to specify. Provide it or face consequences. So what you list are two possible solutions, remove encryption entirely or add a backdoor, or sniff and save everything submitted to the encryption routine, etc. I suppose the mischievous thought is whenever one receives such a demand send back a cleartext copy of the Australian Constitution, or the lyrics to the Sex Pistols' "God Save The Queen". How can they prove that's not the correct decryption without the encryption key? I suppose they can drag you in to testify under oath. Next Up: Australia's Legislature Outlaws Cancer! On December 8, 2018 at 18:26 owen@delong.com (Owen DeLong) wrote:
Which is it…
It’s being reported on NPR as “Australia required Apple and others to remove encryption protections from their devices.”
That’s a massively different (and arguably even worse) outcome than “Australia is requiring Apple and others to provide decryption technology to law enforcement.”
Owen
On Dec 8, 2018, at 14:41 , bzs@theworld.com wrote:
On December 8, 2018 at 19:41 hank@efes.iucc.ac.il (Hank Nussbacher) wrote:
Governments that require ISPs to block "certain" sites have no clue what is required technologically to adhere to their demands.
Well that's certainly true.
Australia just passed a law mandating decryption be made available to law enforcement simply ignoring the many technical explanations about why we don't know how to do this without compromising security entirely.
I've often said if a judge in their court orders you to raise your left foot in the air you would be well-advised to lift that foot.
If the judge orders you to also raise your right foot the judge doesn't have a problem, YOU have a problem.
-- -Barry Shein
Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
-- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
On Sat, Dec 08, 2018 at 06:26:21PM -0800, Owen DeLong wrote:
Which is it…
It’s being reported on NPR as “Australia required Apple and others to remove encryption protections from their devices.”
That’s a massively different (and arguably even worse) outcome than “Australia is requiring Apple and others to provide decryption technology to law enforcement.”
Part of the problem is... nobody really knows. There's very little meaningful oversight or judicial review of the whole system, and the law is *very* badly written, vague and without any clear guidance as to what is *actually* required. It doesn't even define things like "systemic weakness", which is the standard by which a required change is judged when determining whether it is within the scope of the law: anything which doesn't introduce a "systemic weakness" is a-OK. I'd say lawyers are going to make a fortune out of arguing this, except as I said, there's very little judicial oversight. Someone who is asked to do something which they think introduces a systemic weakness is basically SOL if the Attorney General and Communications Minister disagree. - Matt
As everyone has stated, blocking/filtering is a rabbit hole that we dare not go down or we set ourselves on the same path as oppressive regimes. For a similar situation that's far less depressing, see the numbers of threads about whether or not enterprises should block certain sites. This is an employee behavior problem, so it ought to fall under HR, not IT. But IT should be happy to provide data about what employees visit prohibited sites to HR so that discipline can be administered accordingly. Blocking doesn't stop the problem, it just forces employees to use more cell phone data. Personally, I prefer a policy of direct cooperation with authorities to put these folks where they should be, behind bars (and hopefully) with general population where they have to lie about why they're locked up out of fear of being torn apart for what they've been a part of and the children they've hurt. These animals have always found ways to satisfy their horrid urges. Before the internet was popular, they used sneakernets; we have the opportunity to use the data we have available to make the job of the authorities easier, and we should all strive to contribute to the elimination of child exploitation. If you think cooperation with authorities is also a rabbit hole or violates customer privacy, then know that your AUP should always include a special clause about this specific scenario and you don't "have" to cooperate if you don't think there is sufficient evidence, you can leave that up to a judge to decide. (In the USA at least). If your company refuses to cooperate, all you can do is politely remind them of the reprocussions of obstructing any investigation of this nature, like how when Uncle Sam brings a warrant to the table, it's usually WAY wider reaching than you could have imagined and almost always comes with a free gag order so you can't defend yourself to your customers. This could have unintended consequences the business. We'll never eliminate this problem, even if we shut down all TOR nodes and block all known endpoint IPs/domains. But we can help catch some of them and I take pride whenever I feel like I'm directly contributing to that. -Matt P.S. opening discussion about whether or not null routing on-sight is a good idea because yes, it makes the content inaccessible, which is the end goal, but it also alerts the offender that they've been caught and could initiate a scorched Earth strategy, thus impeeding any investigation by authorities. On Fri, Dec 7, 2018, 01:07 Lotia, Pratik M <Pratik.Lotia@charter.com wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic (customers are paying for pipes – not for filtered pipes), on the other side morals/ethics come into play. Keep in mind that if an ISP is blocking it would mean that it is also logging the information (source IP) and law agencies might be wanting access to it.
Wondering if any operator is actively doing it or has ever considered doing it?
Thanks.
With Gratitude,
*Pratik Lotia*
“Information is not knowledge.” The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
On December 8, 2018 at 14:05 merculiani@gmail.com (Matt Erculiani) wrote:
As everyone has stated, blocking/filtering is a rabbit hole that we dare not go down or we set ourselves on the same path as oppressive regimes.
For a similar situation that's far less depressing, see the numbers of thread
Being ordered to block & filter criminals has been a norm for many years at least in the US. What needs to be responded to are the conditions of such orders. What's not acceptable are vague demands to block all child porn or "terrorist" content etc. That's just transferring the entire investigatory and enforcement problem to the folks who happen run the pipes. What we are seeing with facebook, twitter, etc is no less than the privatization of censorship and law enforcement by government fiat. And governments, even well-intentioned governments, are going to find that very attractive and addictive. Why not? Just write down some high-minded objectives like no more criminals allowed, all in favor say aye?, order passed! No budget, no plan, just threaten the people who run the infrastructure with serious penalties if they don't comply. This is potentially billions of dollars in law enforcement being transferred to infrastructure operators with no remuneration. It could easily run all but the absolute largest operators out of business. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years. https://en.wikipedia.org/wiki/Child_abuse_image_content_list -n
I can't imagine a single rational argument against this. On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
-n
Right... When would it ever be wrong to stop terrible internet activity such as this?! Aaron
On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com> wrote:
I can't imagine a single rational argument against this.
On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
-n
Remember what I said... If the censorship system will be created FOR ANY, ANY REASON - you will forget the initial reason very quickly. 11.12.18 19:34, Aaron1 пише:
Right... When would it ever be wrong to stop terrible internet activity such as this?!
Aaron
On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com <mailto:mrallen1971@gmail.com>> wrote:
I can't imagine a single rational argument against this.
On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com <mailto:neuro@well.com> wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com>> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
-n
... The only thing I can think of is the idea that I’ve heard before is the way to catch someone is to watch them well they are accessing, the concept of honeypots comes to mind Aaron
On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com> wrote:
I can't imagine a single rational argument against this.
On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
-n
...and you will see the TOR exit nodes instead of crime home IP if censorship is implemented. 11.12.18 19:35, Aaron1 пише:
... The only thing I can think of is the idea that I’ve heard before is the way to catch someone is to watch them well they are accessing, the concept of honeypots comes to mind
Aaron
On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com <mailto:mrallen1971@gmail.com>> wrote:
I can't imagine a single rational argument against this.
On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com <mailto:neuro@well.com> wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com>> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
-n
It is my understanding that ISPs block IP addresses and domains under court order now for copyright violations, criminal activity which would include CP. They require a court order as they cannot ascertain if it is CP or not, that is a Law Enforcement decision. The US Supreme Court decision's was just being nude is not lewd, also with aging software which can regress photos, LEOs in the US have to ascertain if this is CP or photo shopped. On Tue, Dec 11, 2018 at 12:54 PM Max Tulyev <maxtul@netassist.ua> wrote:
...and you will see the TOR exit nodes instead of crime home IP if censorship is implemented.
11.12.18 19:35, Aaron1 пише:
... The only thing I can think of is the idea that I’ve heard before is the way to catch someone is to watch them well they are accessing, the concept of honeypots comes to mind
Aaron
On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com <mailto:mrallen1971@gmail.com>> wrote:
I can't imagine a single rational argument against this.
On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com <mailto:neuro@well.com> wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com>> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
-n
Yes, in some countries (NOT in US, AFAIK) court can issue an order to block IP/domain/URL. If home operator of crime man is blocking the direct access - he have to use TOR/VPN/... to avoid blocking (or may be you really believe he just stop any tries to watch his lovely CP?) If he use TOR/VPN/... to avoid blocking - the original home IP address will be changed to the exit node of TOR/VPN - and we will lost any chance to catch the crime man. Is it clear? 11.12.18 21:06, John Lee пише:
It is my understanding that ISPs block IP addresses and domains under court order now for copyright violations, criminal activity which would include CP. They require a court order as they cannot ascertain if it is CP or not, that is a Law Enforcement decision. The US Supreme Court decision's was just being nude is not lewd, also with aging software which can regress photos, LEOs in the US have to ascertain if this is CP or photo shopped.
On Tue, Dec 11, 2018 at 12:54 PM Max Tulyev <maxtul@netassist.ua <mailto:maxtul@netassist.ua>> wrote:
...and you will see the TOR exit nodes instead of crime home IP if censorship is implemented.
11.12.18 19:35, Aaron1 пише: > ... The only thing I can think of is the idea that I’ve heard before is > the way to catch someone is to watch them well they are accessing, the > concept of honeypots comes to mind > > Aaron > > On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com <mailto:mrallen1971@gmail.com> > <mailto:mrallen1971@gmail.com <mailto:mrallen1971@gmail.com>>> wrote: > >> I can't imagine a single rational argument against this. >> >> On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com <mailto:neuro@well.com> >> <mailto:neuro@well.com <mailto:neuro@well.com>> wrote: >> >> On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M >> <Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com> <mailto:Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com>>> wrote: >> >> Hello all, was curious to know the community’s opinion on >> whether an ISP should block domains hosting CPE (child >> pornography exploitation) content? Interpol has a ‘worst-of’ >> list which contains such domains and it wants ISPs to block it. >> >> >> This already happens in the UK, and has done for years. >> >> https://en.wikipedia.org/wiki/Child_abuse_image_content_list >> >> >> -n >>
Thank you everybody for sharing your views. I think I've got a clear answer. It's better to not go down this slippery path. With Gratitude, Pratik Lotia “Security is like legos. You can build pretty much whatever you want if you have a clear vision of the final product and the skill to put the pieces together correctly.” On 12/11/18, 12:27, "NANOG on behalf of Max Tulyev" <nanog-bounces+pratik.lotia=charter.com@nanog.org on behalf of maxtul@netassist.ua> wrote: Yes, in some countries (NOT in US, AFAIK) court can issue an order to block IP/domain/URL. If home operator of crime man is blocking the direct access - he have to use TOR/VPN/... to avoid blocking (or may be you really believe he just stop any tries to watch his lovely CP?) If he use TOR/VPN/... to avoid blocking - the original home IP address will be changed to the exit node of TOR/VPN - and we will lost any chance to catch the crime man. Is it clear? 11.12.18 21:06, John Lee пише: > It is my understanding that ISPs block IP addresses and domains under > court order now for copyright violations, criminal activity which would > include CP. They require a court order as they cannot ascertain if it is > CP or not, that is a Law Enforcement decision. The US Supreme Court > decision's was just being nude is not lewd, also with aging software > which can regress photos, LEOs in the US have to ascertain if this is CP > or photo shopped. > > On Tue, Dec 11, 2018 at 12:54 PM Max Tulyev <maxtul@netassist.ua > <mailto:maxtul@netassist.ua>> wrote: > > ...and you will see the TOR exit nodes instead of crime home IP if > censorship is implemented. > > 11.12.18 19:35, Aaron1 пише: > > ... The only thing I can think of is the idea that I’ve heard > before is > > the way to catch someone is to watch them well they are accessing, the > > concept of honeypots comes to mind > > > > Aaron > > > > On Dec 11, 2018, at 10:43 AM, Larry Allen <mrallen1971@gmail.com > <mailto:mrallen1971@gmail.com> > > <mailto:mrallen1971@gmail.com <mailto:mrallen1971@gmail.com>>> wrote: > > > >> I can't imagine a single rational argument against this. > >> > >> On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com > <mailto:neuro@well.com> > >> <mailto:neuro@well.com <mailto:neuro@well.com>> wrote: > >> > >> On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M > >> <Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com> > <mailto:Pratik.Lotia@charter.com <mailto:Pratik.Lotia@charter.com>>> > wrote: > >> > >> Hello all, was curious to know the community’s opinion on > >> whether an ISP should block domains hosting CPE (child > >> pornography exploitation) content? Interpol has a ‘worst-of’ > >> list which contains such domains and it wants ISPs to > block it. > >> > >> > >> This already happens in the UK, and has done for years. > >> > >> https://en.wikipedia.org/wiki/Child_abuse_image_content_list > >> > >> > >> -n > >> > E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
On 12/11/18 11:43 AM, Larry Allen wrote:
On Tue, Dec 11, 2018, 10:56 William Anderson <neuro@well.com wrote:
On Fri, 7 Dec 2018 at 06:08, Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content? Interpol has a ‘worst-of’ list which contains such domains and it wants ISPs to block it.
This already happens in the UK, and has done for years.
https://en.wikipedia.org/wiki/Child_abuse_image_content_list
I can't imagine a single rational argument against this.
I've fixed your broken quoting. The simple argument against this; once a system is in place to block cp, it can be used for other things. Don't like a political party? lets add it as extreme "speech" to the list, then we can add AR-15 3d plans and it goes down from there. -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net
On Fri, Dec 7, 2018 at 12:08 AM Lotia, Pratik M <Pratik.Lotia@charter.com> wrote:
Hello all, was curious to know the community’s opinion on whether an ISP should block domains hosting CPE (child pornography exploitation) content?
"Whether an ISP should block" ?! Probably not in most cases, except may be required in some jurisdictions mostly outside our region that are under authoritarian regime requiring ISPs block any resource banned at the whim of any blanket order from their executive (without due process); this is within the same vein as a phone company hearing a rumor that a certain payphone is being used for illegal activity and banning all calls from their customers to/from the number, under the presumption that _all_ calls from that phone are for criminal acts. Assuming: said hosting IP address is on a remote network: the ISP does not provide authoritative name service for that domain, and the customer accesses the resource over the network not through a cache or application proxy/other service provided by the ISP ---- the customer expects their ISP merely routes packets and does not participate in content, and an ISP deliberately interfering with expected connectivity jeapordizes stability of the network and the ISP's business relationship with their customers; the best possible affect on the ISP is neutral. Notable exception is emergencies where blocking an IP address or domain actually stops behavior such as DoS that directly disrupts the network, and blocking mitigates a negative affect on the network. For example, let's say we receive a report that www.twitter.com[104.244.42.65] hosts CPE. In that example, the report should be sent to law enforcement and Twitter: no action by anyone else should be required UNLESS Law Enforcement produces to the public a court order to disconnect/block Twitter's communication services, that would normally come after a hearing, and same principle applies regardless of if the domain name is a top1000 domain or not. If each ISP wants to be extra helpful, then perhaps they would like to log all their traffic to Twitter (in that example) and forward to law enforcement as suspected CPE trafficking activity -- although that is a risky invasion of customer privacy; at least reporting suspected potential of access to CPE doesn't deliberately lobomitze IPs from the network or disrupt traffic: not all of which traffic is necessarily CPE-related. In case the ISP oversteps and blocks Twitter traffic that includes legitimate non-CPE traffic (It may even affect e-mail traffic where people are communicating with the site to try to identify the CPE for removal); the ISP may face a loss of subscribers, and in that example Twitter would hopefully pursue various lawsuits or regulatory complaints against the ISPs blocking their IPs for deliberately creating an unreasonable disruption to the network. Possible negatives for the ISP are the risk of those repercussions PLUS the ongoing maintenance costs, personnel time, and other resources required for the ISP to maintain the blocking policy -- and service the extra blocklist, any removals or exceptions needed --- helpdesk hours for all the additional customer complaints that will occur; potential loss of good will and negative reputational affects on the ISP. It begins to seem fairly difficult to business justify the policy and likely fiscally irresponsible for an ISP to start opening this can of worms.
On one side we want the ISP to not do any kind of censorship or inspection of customer traffic [snip]
Blocking domains or IP resources is not MERELY censorship. Censorship, which is itself far less objectionable: is selective blocking or removing content, for example, redacting a chapter from a book. Blocking domains or IPs is disconnecting infrastructure, for example: seeking to block twitter due to alleged CPE has an impact that affects much more than the CPE --- its like blocking an entire publisher; it doesn't matter they have printed mostly books that don't contain the content you've objected to - since you (ISPs) lack a censorship system --- censorship is not even an option, and the measures you're talking about are much more drastic than censoring content. Also, when the domain holder eventually responds and works with law enforcement to remove the found example of CPE, the domain block does not go away on its own -- therefore evidencing it is MUCH more than censorship. Furthermore, if the domain is then unblocked any other examples of CPE that had been overlooked (not detected by anybody yet) may become accessible again. Its fair to say a domain block is not technically related to content at all --- its in effect an "Independent ban" of access to a generic host identifier registered to a remote network. (Generic host identifiers aren't content, don't refer to content, and don't have a 1:1 relationship to content)
Pratik Lotia -- -JH
participants (24)
-
Aaron1 -
Alejandro Acosta -
Bryan Fields -
bzs＠theworld.com -
cosmo -
Hank Nussbacher -
J. Hellenthal -
Jimmy Hess -
John Lee -
John Von Essen -
Keith Medcalf -
Larry Allen -
Lotia, Pratik M -
Mark Seiden -
Matt Erculiani -
Matt Palmer -
Max Tulyev -
nanog＠jack.fr.eu.org -
Owen DeLong -
Ryan Hamel -
Saku Ytti -
Seth Mattinen -
Suresh Ramasubramanian -
William Anderson