Hacker News Reader

Comment by someonebaggy | Hacker News Reader

All of the spam blocklists are like this.

At one time quite recently, Cloudflare was on Spamhaus's "Don't Route Or Peer" list. Imagine where the world would be if anyone cared about that list.

But if an entire ISP is blocking you based on UCEPROTECT, which is designed for email spam filters - are you sure? An ISP that blocked all of DO would get so many complaints and be open to so much legal liability. Usually these are only used for email filtering.

View on HN

>At one time quite recently, Cloudflare was on Spamhaus's "Don't Route Or Peer" list.

it was only 2 /23's (only 1024 IPs, ASN14061 is 3,140,680 IPs), and was resolved without a monthly subscription in ~24 hours after being posted to the NANOG mailing list

https://lists.nanog.org/archives/list/nanog@lists.nanog.org/...

Why does that make it good?

i'm adding context to your comment.

the scale of the issue is significantly different and the resolution is significantly different (both in time and in money). that's important when comparing the situations.

highlighting those differences does not mean i think either situation is "good". one of them is "less bad" though.

I disagree. Normally you can reach out to request delisting, and it's free.

As I explained, Orange's security filter seems to automatically block requests at the DNS level if your website's domain resolves to an IP listed on UCEPROTECT Level 3. In this case, that appears to be the entire DigitalOcean ASN.

You probably have standing to sue Orange for damages if they're blocking your customers from you based on bullshit criteria.

I am not a lawyer, so consult one.

Spamhaus does not offer the ability to pay for removal. UCEPROTECT is uniquely evil in insisting on payment. It's a good thing that their lists are not widely used, so, in practice, it doesn't matter if your IPs are listed by them. Their revenue comes from unwitting victims who don't know any better.

Their lists are definitely used, which is the only way I knew about them - some years ago one major email provider was not receiving email from my DO hosted site at all, completely blackholed. I knew enough of what I was doing to know this was practically impossible, spent over a week running every kind of configuration scan and test I could think of, and finally narrowed it down to this organization in particular blacklisting all of DO IP space. Needless to say I was shocked and annoyed at such an unprofessional looking and sounding website wielding such control over the operation of my site (which, lest it needs to be said, was a completely legitimate site).

Reply on news.ycombinator.com