[BLKNSLVR]

Disagree fairly strongly. IP addresses known to be malicious are unequal and should be treated as such.

Just because the idea of net neutrality exists doesn't mean it's true. I'm sure there's a specific context for it, and 'security' is not that context. It was about data/packet prioritisation wasn't it? Unrelated to security.

[bharatsuthar]

Yeah, mail server IP reputation is a good example. I wouldn't want to be flooded by emails from spammy mailservers IPs and I'm glad that my provider de-priortizes them.

[AnthonyMouse]

The reason that works for mail servers is that they first require the IP address to have a valid reverse DNS entry, which is not just compromising a random machine with a random IP address but having administrative control over that IP block, which basically limits you to data centers and business internet providers, and then blocks IP addresses that send spam, i.e. that are owned by providers who give reverse DNS entries to spammers. The premise is that most people aren't trying to run a mail server so you require something that takes unusual bureaucratic interaction in order to get.

Trying to restrict things to end-users is the total opposite of that. The common addresses everybody gets automatically are the thing you're trying to allow. Address reputation is pointless because residential customers get dynamic IPs and the reputation you're trying to record for some IP address can get swapped with a different customer at any time.

[BLKNSLVR]

Sounds like a good reason that residential proxies are a bad thing, or at least require better regulation, so as to minimise damage to unwitting end-users.

It also feels like a description of the perfect camouflage to facilitate doing bad things: "don't block them because you might block an innocent bystander". Putting innocent bystanders in harms way sounds like someone else is the bad guy, not the person doing the blocking.

[AnthonyMouse]

> Sounds like a good reason that residential proxies are a bad thing, or at least require better regulation, so as to minimise damage to unwitting end-user

The problem being that attack traffic is disproportionately coming from devices that are compromised, which is already illegal, and you can't fix that by making it harder to use residential proxies for things that are legitimate, like sharing IP addresses between real users so they can't be used as a personal tracking ID.

> It also feels like a description of the perfect camouflage to facilitate doing bad things: "don't block them because you might block an innocent bystander".

Cloudflare promotes putting your site behind Cloudflare to inhibit censorship, because then the censors have to block their entire service (which is half the internet) to block anything. It's not always a bad thing.

> Putting innocent bystanders in harms way sounds like someone else is the bad guy, not the person doing the blocking.

If there is an alleged thief on the subway and you respond by lobbing a grenade into the subway, there is more than one bad guy.