Biggest data heist and most obvious US intelligence operation in human history. I can't fathom why AVs don't treat "Outlook New" as info stealer malware.
"easy to fix" is relative. This "new domain equals bad" thinking has spread in the IT security world. My corporate anti-virus blocks them too and I see it a lot while browsing HN on the job.
The only real solution, as a "holder of a young domain" is to wait 30 days before you use it.
Or somehow get it reclassified. But waiting is probably fine for most purposes, give you might have to make the classification effort in several places.
Melodramatic mutch? The first new IDE HDD I ever bought died within a week. The first new USB HDD I ever bought was dead on arrival. My first server SSD became read only after a year.
Better telling everyone not to buy this things. /s
It's just a fundamental problem of encoding the boundary between different (meta-)languages in-band. It will always be a problem, until it's possible to implement the separation out-band, which makes the respective language no longer self-contained, as it needs to be implemented in the layer above.
This occurs now with LLMs too. It's a fundamental problem, of the problem description, not the implementation.
Yeah, the innovation would be to not make everything in-band. Which implies proper file formats for source code for example. I know, that is blasphemy against 7bit ASCII.
It's like the telephone networks of old. They eventually realized that that is not so good. The computer world is still in its analog telephone phase. ;-)
www.uceprotect.net does that for email. It's a DNS blacklist that puts hole networks on it, even if "only" a individual hosts SPAMs.
It's a double-edged sword. That is how you end up with most ISPs blocking port 25 completely. If your hosting provider is on the list you are collateral damage. You yourself can do very little to remedy the situation except to beg your provider "to look into it".
What do you expect the ISPs to do in this story? We are talking about TSL connections. Block port 80 and 443 and expect the costumers to use your HTTPS-Proxy. Than they could inspect and block individual actions.
> If your hosting provider is on the list you are collateral damage.
Yes, and this sucks. I moved ISPs because the original one had burned IP addresses that you can't send email from. Every ISP that gets the ranges burned like that will eventually either goes out of business or gets their act together. Not by tomorrow, but eventually
Like, the only other alternative outcome I see is that everyone has to pass through a central surveillance point that decides who's benign and who's naughty, and since nobody wants that... what else are we to do but report abuse?
> What do you expect the ISPs to do in this story? We are talking about TLS connections.
What they've done to me when I abused a service as a teenager, the ISP got an abuse notification: cut off the connection, ask the subscriber wtf this traffic is and how they're going to make sure it doesn't happen again (at which point my dad, the subscriber, came to me and asked if I knew something about this.... yeah ^^')
TLS doesn't matter because the ones receiving the abusive traffic can say what it was. Their access logs will contain the decrypted information and that should be put in an abuse report. If the customer denies everything, turn on netflow logging for a month and see if a future abuse report comes in that can be correlated against the netflow logs. Or have netflow logs stored for 1h by default and retain the entries for which an abuse notification came in (grep for IP addresses in incoming notifications). Lots of reasonable options there; this isn't the difficulty. It's getting people to send that abuse notification so the ISP can identify the problematic subscribers
Biggest data heist and most obvious US intelligence operation in human history. I can't fathom why AVs don't treat "Outlook New" as info stealer malware.
reply