Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Thu, Feb 04, 2010 at 09:09:20AM -0500, Matt Drew wrote:
> > What makes our current system great is
> > that for $20/month I can have pretty excellent hosting that can reach
> > anybody in the world up to a certain number of concurrent users, and
> > with free or cheap tools I can publish text, video, and more on that
> > platform.
> 
> The examples you give are perfect examples of why mostly leaving the
> FCC out of things has been extremely beneficial to all of us.  Hosting
> providers are in a highly competitive business with few rules, mostly
> focused around preventing outright fraud and theft.  Since customers
> can simply move their entire operation in a few hours, hosting
> providers are constantly driven to provide better service at lower
> cost.  This has driven down prices to the point where virtually anyone
> can set up and publish on the internet - for free, in cases such as
> blogspot.com and wordpress.com. 

It has also made it impossible for most in the hosting business to
provide security audits, abuse desks, and other functions of any
responsible commercial Internet entity, attracted hordes of snowshoe
spammers, and driven many high-quality hosting service providers out of
the business for good. We certainly had to get out of hosting, because
we couldn't compete with ridiculous $5/month hosting providers, and did
not want to (and we still have trouble finding /quality/ hosting, for
customers who have needs beyond the cpanel/ensim/etc. control panel
software that is endemic in the business). "Better service" here perhaps
in the eyes of know-nothing customers, but certainly not in the eyes of
the sysadmins and netadmins who have to deal with the nonstop effluent
that streams out of most of these places. We routinely had former
hosting customers ask us if they could come back after their newer,
cheaper, host failed in every aspect of service. And we routinely had to
charge more in tech support costs than they would have saved in several
years' hosting costs just to get their new hosts to configure their
setups properly.

I see nothing at all good about the current rush to the bottom in
hosting, nor in the market forces that practically require that webhosts
be fully automated, light-on-but-nobody-watching spam havens with no
sense of responsibility for the abuses their customers are allowed to
perpetrate on the rest of the Internet at large.

We block inbound mail from several dozen web hosting companies as a
matter of course due to their complete lack of oversight of their
customers. Many others we have to periodically block at the /28 or /27
or /24 level as they sell out to snowshoers, and suffer endless abuse by
way of phishing and 419 scams sent via insecure webmail and cpanel
setups, or machines with accounts with weak passwords on their networks.
And we've had to come up with patterns for the default naming conventions
used by webhosts in order to block and/or quarantine all mail from their
customers; we currently have almost 3K patterns for some ~2300 known
web hosting providers worldwide.

And with no incentive to provide oversight in security matters, because
they're barely making money as it is, the situation will continue. And
because of stiff competition, there are many hosting providers whose
entire networks, when the reverse DNS is scanned, reveal huge snowshoe
installations - and very little else other than unallocated space and
maybe a few legit customers or shared hosting boxes.

Sure, there are a few large providers with good service /and/ a decent
reputation for dealing with reported abuse, Rackspace, thePlanet/ev1,
ServerBeach, and a few others, mostly in the colo business rather than
shared hosting, but they're the exception. The rise of "cloud" computing
has made matters worse, with providers routinely failing to address core
matters such as naming statically assigned instances something different
from the dynamically spawned abuse vectors, or for that matter, as with
Amazon, even bothering to provide abuse desk staff for dealing with
the inevitable abuse. It never even occurred to them to do so - though
anyone with a credit card (even stolen) can set up a spam blaster on
as many Ec2 instances as they can "afford".

And there are no laws against most of the crap everyone has to suffer
from (just against the fraud or trespass or whatever, not the state that
allows such abuse on a massive scale to continue). CAN-SPAM is a joke,
widely recognized as a complete failure by those of us in the antispam
industry and in the relevant governmental organization such as the FTC.

But hey, at least the market isn't regulated. 

-- 
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2553 w: http://hesketh.com/
antispam news and intelligence to help you stop spam: http://enemieslist.com/