Suspension of Cogent Access to ARIN Whois | Hacker News Reader

Suspension of Cogent Access to ARIN Whois

mailman.nanog.org

163 pointscnst53 comments

Cogent salespeople are the worst in the industry. If your contact information lands in their database, they'll never stop soliciting. At least once a year for the past 6 years Cogent calls my personal cell phone. This continues despite my repeated requests for them to stop calling and to remove me from their list.

I had DataDog do this to me as well.

For many of these sales orgs "remove me from your list" just means "flag my entry so that they'll endeavor to find the flimsiest excuse to call you again." DataDog's justification for "call me again after I told them to never call me again" was that an employee had made the mistake of giving them his information at a conference and was interested in using them for a personal project. So that justified them contacting me even after I told them to remove me from their list.

DataDog has the absolute pushiest sales folks I've ever dealt with.

I used to get daily calls from them and I'd tell them that we already had another monitoring solution and that they'll need to send me written material to present to my team if we were going to switch. They would always say sure, never do it and then call me again the next day.

For a double-digit number of months.

+1 for this, almost as bad as ZeroTurnaround several years ago.

And New Relic, while we're at it.

I get spam near daily. I actually just got spam from a "new" cogent salesperson _as I was reading the ARIN pdf_. I've told them "don't contact me again" and it's a different person the next week.

It's absurd and I'm glad at least something is starting to be done.

The usual reaction in the US should be: sue them. You have the CAN-SPAM act and the Do Not Call Registry… why don't people make use of that to stop the companies from spamming them?

Because actually doing so is difficult, can be expensive, and is largely pointless.

Small claims. Up to $10k in most jurisdictions.

Maybe, but that only covers the court portion. The more problematic portion is gathering admissible evidence.

Also, it's not clear if small claims would have jurisdiction with companies that aren't in the same state.

Additionally, winning in small claims only gives you the right to chase after the award (the court is not going to collect on your behalf) -- so you still have to go to the time, hassle, and expense of trying to collect.

http://www.killthecalls.com/suing-telemarketers.html

https://www.nbc12.com/2019/12/05/consumers-winning-financial... (robocall specific)

https://www.mahanyertl.com/2018/robocalls-can-sue-telemarket... (conduct your business over mobile)

Specific to business lines, where harassment remains a legal recourse:

https://pocketsense.com/stop-telemarketers-calling-business-...

https://paysimple.com/blog/small-business-tips-for-dealing-w...

https://www.infoworld.com/article/2626467/how-to-sue-telemar...

More to the point, establishing yourself as a litigious asshole may change the counterparty's marketing calculus. Which is the principle point.

Very interesting. Thank you for this!

For what sort of damages would I sue them? I was annoyed by a 2 minute phonecall or email?

Its a regulatory thing, bump the FTC (and in this case ARIN) so they can take action.

I don't think either CAN-SPAM nor Do Not Call provides a private right of action that would apply here.

It is all about creating asymmetry into your favor i.e. make them waste their time.

Make them jump through a bazillion hoops. Their will bring their managers and directors involved. Make those waste their time as well. Have them write proposals. Get their bosses involved. Have their bosses waste their time. Eventually it would get to an SVP/EVP level of sales which will permanently fix the issue.

What’s crazy is that when buying IP transit for a freaking ISP, your are not shopping for some chocolate at the supermarket.

I would hope most network administrators would know enough about their job to not fall for car-salesman kind ridiculous methods.

it is not the network administrators making those calls or putting them on that list. a job many moons ago:

my phone: ringing off the hook for the past three days. WHY.

CEO: "hey we need better internet access at the new office, I setup a call with Cogent, let me know how it goes"

my phone: answered to find its cogent blowing me up

Cogent: car-salesman methods

me: I quit

Cogent every two months since then: "hey I heard you left your job, any need for business internet access?"

I was briefly listed as a contact for a network circa 2002, had the same issue.

They definitely keep you active, they probably successfully establish contact every 2-3 years, as I’m aggressive about not answering calls from numbers I don’t know.

Ask to be added to their "do not call" list. Then they can't re-add you to their "call list" when they recieve your contact details again in future.

oh can’t they. don’t be so naive.

FYSA Curran clarifies scope of the 6-month suspension a bit later[1]:

> ARIN has suspended service for all Cogent-registered IP address blocks. Customers with their own IP blocks that are simply being announced by Cogent are not affected.

[1] https://mailman.nanog.org/pipermail/nanog/2020-January/10523...

I appreciate the gesture, but what's to keep them from moving their scraper to a third-party cloud provider, or sales folks using a VPN?

Removing “We didn’t know better” as a plausible excuse is sometimes sufficient to stop abuse. Nothing prevents Cogent from circumventing, but if they do so, that will likely be interpreted as willful violation if they are taken to court by ARIN, who is prepared to do so.

How does this square with the recent court ruling that linkedin scraping is legal? After all, it's all public data, and I have no doubt that linkedin tried to IP block the scrapers.

Unknown, since no court has ruled one way or the other in the ARIN matter.

Nothing. And I think they address that at the end of the message.

But hopefully this will be noticed by the higher ups and they’ll take sone action.

US corp, legal reasons.

Registrars like Namecheap now offer free WHOIS guard and I see why it is essential.

This is for ASN/IP whois, there is not sanctioned way of privacy/guard there, other then having a generic NOC line/email

netadmin-general-box@mydomain.net.

then let the email filters do their thing.

Cogent's behavior is obnoxious but, really, if you have a direct allocation from ARIN you should probably have a mailbox / phone number set up to handle lots of spam -- you're gonna get way more than just Cogent.

If only some GDPR-type legislation existed which made it more difficult for companies like Cogent to misuse contact info in this way.

your phrasing suggests sarcasm, however no such law exists.

i feel the outrage, however the whois is public data. enforcing some usage restriction is beyond silly. if you actually want to restrict it, require a login to make a query. make those logins cost money so that you have a valid contract.

Correct. Or have the whois state tie to a channel that can be filtered (such as a voicemail service that transcribes incoming calls).

If you can afford to host an Internet service, you can afford transcribing voicemail service in 2020.

Cool. Now I'll just go around signing up random ARIN addresses to Oracle, IBM and Google sales mailing lists.

Cogent can die in a fire but this is stupid.

Has anyone seen the network map of Cogent’s? https://www.cogentco.com/en/network/network-map

This thing is enormous. This just looks...like the whole internet. Do they fully own those undersea lines too like Google does now with theirs? Or are they leased?

I sure hope they don’t turn out to be a front company for a foreign nation’s military lol like I am always on here saying.

Their map is a bit misleading - they only cover North America and Europe well, which is not really "the whole internet". Their coverage in Asia, Oceania, South America, the Middle East and Africa is poor or non-existent.

Level3 (now CenturyLink) have better coverage - http://www.centurylink-business.com/demos/network-maps.html - but even they have poor coverage in some areas.

Cogent does not own the underlying cables. They buy transport from companies like zayo, CenturyLink/level3.

This is just (paid) peering and leased fiber, no?

How much of it is dark fiber vs. lit?

I think this is the wrong approach. The data is public.

The place to filter unwanted mail is at the SMTP/MTA level, in my view; not at the distribution of already-public data.

As pointed out by others, this will absolutely not prevent Cogent from spidering this public data. It will, however, negatively affect legitimate users of the data within Cogent’s IP space.

This is the wrong place for a spam filter.

So it will hopefully harm cogents business and customers will move away. Corporations only understand the bottom line.

If you're already a cogent customer, you're unlikely to drop Cogent because they spam. There's costs and risks associated with onboarding new transits, and (one of) your current providers being spammy to other people isn't generally likely to drive a business decision.

If you're not a cogent customer, you're either not going to become one because of their tactics, or you are going to become one because of their tactics. I guess it's working towards the latter given how long it's been going on for.

> "I think this is the wrong approach. The data is public."

But why should the registration data be in the public domain?

I don't publish my name/address/phone number in a phone book (remember those?) for obvious reasons. My domain registration info shouldn't be any different.

'No privacy' shouldn't be the default setting, with the customer having to pay extra for 'private' registration.

The reason that the RIRs operate whois databases for IP address assignments is so that in the event of a network misconfiguration or error, responsible parties can be emailed or even called on the phone quickly to resolve problems.

This is how the system has worked for a long time, and the data has always been public. It doesn't get abused much, despite and including Cogent's recent spam to the emails that appear there.

Regardless of how you think it should work in the future, this is how it works today. The data is 100% public now. It has been published. The cat is out of the bag.

Blocking Cogent from accessing their WHOIS service will not un-publish the data, and will not prevent those same humans from retrieving the (again, entirely public) information from a different IP range.

> This is how the system has worked for a long time, and the data has always been public. It doesn't get abused much, despite and including Cogent's recent spam to the emails that appear there.

It gets abused plenty (I get tonnes of spam to an email address that is published nowhere and is used for nothing except the RIPE whois db), and Cogent's spam is anything but recent. Cogent has been doing this for over a decade.

I expect spammers to be spammy. I expect reputable companies to behave in a reputable way.

Cogent sales people do their best to ensure that nobody confuses Cogent for a reputable company.

> But why should the registration data be in the public domain?

Because IPs are a finite and non-sharable resource and if there is an issue with some IP address, there needs to be a point of contact that anyone on the network can access.

Since the network is public, that contact information is public.

This is not about domain registration data. This is IP/AS registration data, which is very different and not something anyone can just buy for $8.95/year.

Yeah, in some cases, it's free. I have a /24 block registered and don't pay anything for it. It is a legacy registration from 1993.

It's a historical accident. IP registration information has been public for decades. The 80's internet was a friendlier place. Spam was unheard of.

It isn't a spam filter. It is a violation of a contractual agreement regarding PII that happened to manifest as spam.

Agreed. I prefer the approach of e.g. .se who have removed all sensitive data from whois and did so long before GDPR even. While it is a bit more work to reach out to domain holders now it is not like it was easy before since people rarely checked the email addresses which they used to register domains.

I wish registrars allowed you to set the details you want published in whois before they put them in (at least mine doesn't). Hours after buying a domain I started getting spam on a very private email, one which I only used for services I pay for. Sure enough I found my account email in the whois details, luckily I was able to quickly change it before more bots got hold of it.

I work on a registrar and I think the registries are much to blame here. Sure, the registrars should definitely improve their UIs to allow for better control over what is displayed in the whois information but since every registry have their own set of weird rules for domain contact details it is unnecessarily hard for us.

And I wish every registry was as sensible as .se and cared as much about the privacy of domain owners as .se does.

Reply on news.ycombinator.com