Posts Tagged 'Abuse'

January 12, 2012

How the Internet Works (And How SOPA Would Break It)

Last week, I explained SoftLayer's stance against SOPA and mentioned that SOPA would essentially require service providers like SoftLayer to "break the Internet" in response to reports of "infringing sites." The technical readers in our audience probably acknowledged the point and moved on, but our non-technical readers (and some representatives in Congress) might have gotten a little confused by the references to DNS, domains and IP addresses.

Given how pervasive the Internet is in our daily lives, you shouldn't need to be "a techie" to understand the basics of what makes the Internet work ... And given the significance of the SOPA legislation, you should understand where the bill would "break" the process. Let's take a high level look at how the Internet works, and from there, we can contrast how it would work if SOPA were to pass.

The Internet: How Sites Are Delivered

  1. You access a device connected in some way to the Internet. This device can be a cell phone, a computer or even a refrigerator. You are connected to the Internet through an Internet Service Provider (ISP) which recognizes that you will be accessing various sites and services hosted remotely. Your ISP manages a network connected to the other networks around the globe ("inter" "network" ... "Internet").
  2. You enter a domain name or click a URL (for this example, we'll use since we're biased to that site).

Internet Basics

  1. Your ISP will see that you want to access "" and will immediately try to find someone/something that knows what "" means ... This search is known as an NS (name server) lookup. In this case, it will find that "" is associated with several name servers.

Internet Basics

  1. The first of these four name servers to respond with additional information about "" will be used. Domains are typically required to be associated with two or three name servers to ensure if one is unreachable, requests for that domain name can be processed by another.
  2. The name server has Domain Name System (DNS) information that maps "" to an Internet Protocol (IP) address. When a domain name is purchased and provisioned, the owner will associate that domain name with an authoritative DNS name server, and a DNS record will be created with that name server linking the domain to a specific IP address. Think of DNS as a phone book that translates a name into a phone number for you.

Internet Basics

  1. When the IP address you reach sees that you requested "," it will find the files/content associated with that request. Multiple domains can be hosted on the same IP address, just as multiple people can live at the same street address and answer the phone. Each IP address only exists in a single place at a given time. (There are some complex network tricks that can negate that statement, but in the interest of simplicity, we'll ignore them.)
  2. When the requested content is located (and generated by other servers if necessary), it is returned to your browser. Depending on what content you are accessing, the response from the server can be very simple or very complex. In some cases, the request will return a single HTML document. In other cases, the content you access may require additional information from other servers (database servers, storage servers, etc.) before the request can be completely fulfilled. In this case, we get HTML code in return.

Internet Basics

  1. Your browser takes that code and translates the formatting and content to be displayed on your screen. Often, formatting and styling of pages will be generated from a Cascading Style Sheet (CSS) referenced in the HTML code. The purpose of the style sheet is to streamline a given page's code and consolidate the formatting to be used and referenced by multiple pages of a given website.

Internet Basics

  1. The HTML code will reference sources for media that may be hosted on other servers, so the browser will perform the necessary additional requests to get all of the media the website is trying to show. In this case, the most noticeable image that will get pulled is the SoftLayer logo from this location:

Internet Basics

  1. When the HTML is rendered and the media is loaded, your browser will probably note that it is "Done," and you will have successfully navigated to SoftLayer's homepage.

If SOPA were to pass, the process would look like this:

The Internet: Post-SOPA

  1. You access a device connected in some way to the Internet.
  2. You enter a domain name or click a URL (for this example, we'll use since we're biased to that site).

*The Change*

  1. Before your ISP runs an NS lookup, it would have to determine whether the site you're trying to access has been reported as an "infringing site." If was reported (either legitimately or illegitimately) as an infringing site, your ISP would not process your request, and you'd proceed to an error page. If your ISP can't find any reference to the domain an infringing site, it would start looking for the name server to deliver the IP address.
  2. SOPA would also enforce filtering from all authoritative DNS provider. If an ISP sends a request for an infringing site to the name server for that site, the provider of that name server would be forced to prevent the IP address from being returned.
  3. One additional method of screening domains would happen at the level of the operator of the domain's gTLD. gTLDs (generic top-level domains) are the ".____" at the end of the domain (.com, .net, .biz, etc.). Each gTLD is managed by a large registry organization, and a gTLD's operator would be required to prevent an infringing site's domain from functioning properly.
  4. If the gTLD registry operator, your ISP and the domain's authoritative name server provider agree that the site you're accessing has not been reported as an infringing site, the process would resume the pre-SOPA process.

*Back to the Pre-SOPA Process*

  1. The domain's name server responds.
  2. The domain's IP address is returned.
  3. The IP address is reached to get the content for
  4. HTML is returned.
  5. Your browser translates the HTML into a visual format.
  6. External file references from the HTML are returned.
  7. The site is loaded.

The proponents of SOPA are basically saying, "It's difficult for us to keep up with and shut down all of the instances of counterfeiting and copyright infringement online, but it would be much easier to target the larger sites/providers 'enabling' users to access that (possible) infringement." Right now, the DMCA process requires a formal copyright complaint to be filed for every instance of infringement, and the providers who are hosting the content on their network are responsible for having that content removed. That's what our abuse team does full-time. It's a relatively complex process, but it's a process that guarantees us the ability to investigate claims for legitimacy and to hear from our customers (who hear from their customers) in response to the claims.

SOPA does not allow for due process to investigate concerns. If a site is reported to be an infringing site, service providers have to do everything in their power to prevent users from getting there.


January 6, 2012

SOPA: Bad for Hosting

SoftLayer manages more than 100,000 servers in thirteen data centers around the world. We have more than 23,000 customers, and those customers are responsible for millions of websites (which get billions of pageviews every month). We're one of the largest hosting providers in the world, and we want to talk a little about the Stop Online Piracy Act (H.R. 3261 or "SOPA").

Many in our industry have already commented (and in some cases, "changed their minds") on SOPA and its equally evil twin, the PROTECT IP Act ("PIPA") in the Senate, but we wanted to share our perspective on the legislation. Even with these Dudley-Do-Right, Goody-Two-Shoes titles and their ambitious goals, SoftLayer opposes these bills in their current forms because they expose innocent and law-abiding hosting companies to uncertain liabilities.

Because this legislation has gotten quite a bit of attention in the past few months, you're probably already familiar with it, but if you haven't paid much attention, we can give you a quick summary: As you can read in the name of the bill, SOPA is being proposed to "Stop Online Piracy." SOPA is under consideration by the House Judiciary Committee, and its intent is to provide additional enforcement tools to combat foreign 'rogue' websites that are dedicated to copyright infringement or counterfeiting. That's a great goal, and SoftLayer does not oppose the intent of the Act ... As you saw from Kevin Hazard's blog post a few weeks ago, we have a team of people working all the time to track down and immediately address any violations of our terms of service (including copyright infringement), so we wholeheartedly agree that copyright infringement and counterfeiting are bad.

The way SOPA tries to address the problem is where we disagree with the bill, so let's talk about the most pertinent part of the bill for a service provider like SoftLayer. If SOPA were to pass, when a case of infringement is reported, we would have to "take such measures as [we determine] to be the least burdensome, technically feasible, and reasonable means designed to prevent access by [our] subscribers located within the United States to the foreign infringing site that is subject to the order."

What that means: We would be forced to turn off our customers' access to a small piece of the Internet.

How are we to do that? Well the "least burdensome, technically feasible, and reasonable means designed to prevent access" are not made clear, but most of the discussions about the bill have focused on changing the way the Doman Name System (DNS) resolves to an "infringing site." We'd be more or less ordered to break DNS ... DNS was designed to simply, accurately and quickly match a domain name with the IP address that domain's owner provides, and if SOPA were to pass, we'd have to tell DNS to behave correctly for every site EXCEPT the reported infringing sites. Again, that's not spelled out in the legislation, so it's like being given a job by someone who has no idea how to do the job nor whether the job is even possible to successfully complete.

And that's all assuming that the order to suspend access to an "infringing site" is legitimate. Many of the organizations that oppose SOPA have explained possible scenarios where orders could be filed under the guise of preventing copyright infringement. A competing site/business could claim:

"the operator of the site operates the site with the object of promoting, or has promoted, its use to carry out acts that constitute a violation of section 501 or 1201 of title 17, United States Code, as shown by clear expression or other affirmative steps taken to foster such violation."

In another scenario, a copyright holder could pull the trigger on an order simply at the thought that a user could infringe on a copyright on/via the "infringing site."

When the United States House of Representatives reconvenes after its winter recess, we will be watching intently with hopes that the Internet's response to the bill has effectively derailed it in its current form. As SoftLayer General Council Suzy Fulton mentioned in her post about Texas House Bill 1841, we've been working with an industry group called TechAmerica which submitted a letter to Congress about SOPA and many of the issues that could negatively affect our industry. Additionally, we've gotten involved with to speak out against laws that can hurt our customers.

As discussions continue about SOPA, we'll look for opportunities to share more of our insight with you here on our blog. Please let us know your thoughts about the legislation below.


December 15, 2011

Fighting SPAM and Abuse on a Global Network

For better or worse, one of the most engaging posts on the SoftLayer Blog is "We are a No-Spam Network," written by Jacob Linscott in June 2007. When it was posted, it celebrated a completely clear Spamhaus listing page – quite an accomplishment for a large hosting provider (for reasons I'll illustrate below). Since the post was published, it has become a hotbed of conversation about any and all abuse-related issues. Google "SoftLayer SPAM," and you'll see the post show up as the second result, so a lot of Internet passers-by will come across the post and use the comment section as a platform to share abuse-related concerns they have for us.

That engagement is a double-edge sword: It's good because we hear the concerns people have. It's bad because the post was meant to be a celebration of the continuous work that the abuse department does, and uninitiated visitors seem to consider it a unilateral claim that we've beaten spam once and for all. In the course of responding to comments on that post, I shared an analogy to convey what it's like to run abuse for a large hosting provider:


Let's say you're the security manager for a huge mall. This mall has 100,000 stores with people walking in and out 24x7x365. In this scenario, there are "good guys" and "bad guys" who walk into and out of the mall, and every person looks exactly the same. Some of those people are store owners while others are customers of those stores. As the security manager for the mall, you want to maintain the safest, most well-maintained mall in the world, so when you find bad guys walking in and out of your mall, you do everything you can to kick them out and keep them out. Sometimes those bad guys are store owners who attract and send the wrong crowd; sometimes they are bad guy customers of a good guy store owner.

How would you manage your mall? It's not possible to differentiate whether a store owner will be a good guy or a bad guy when they're applying to lease space in your mall, so you can't "keep the bad guys out" in that regard. You can't have a security team of 100,000 people monitoring what's happening in those 100,000 stores, much less have someone individually check the millions of visitors streaming in and out of the stores. What's a security manager to do?

If you look at how Las Vegas casinos address that concern, it's clear that your best bet is to install security cameras and have a team monitoring them all the time. You might not be able to watch everything at the same time, but you can document what's happening around your mall and respond if you notice something unusual (or if someone calls in to report that they've seen bad guys coming from a store in your mall).

That's the position we're in.

SoftLayer Abuse Team

SoftLayer's network is the mall, the stores are servers, the store owners are our customers (who are often responsible for several "stores"), and the good guys and bad guys are traffic into and out of the network. We try to differentiate good guys and bad guys, but even if we know that all good guys have purple eyes and all bad guys have neon green eyes, it's still difficult to look 26,000+ store owners in the eye every day as they're walking into and out of the mall.

We staff a team of people intent on clearing the bad guys from our mall, and we know that even though good guy store owners may inadvertently host their own bad guy customers, they want to remove those customers from their store as well, so they appreciate us helping them pinpoint those customers so they can be removed.

We keep an eye on our security cameras and get our security guards to the stores where bad guys are reported as quickly as possible. If no one reports that the people coming out of store #73,403 are all bad guys, it's hard for us to know that they aren't good guys ... Which is why we encourage anyone and everyone to report abuse-related concerns to so we can mobilize our security force.

As Edmund Burke once said, "When bad men combine, the good must associate; else they will fall one by one, an unpitied sacrifice in a contemptible struggle." Or more colloquially, "All that is necessary for the triumph of evil is that good men do nothing."

Given that illustration, the abuse team deserves a LOT of credit for the work they do behind the scenes. They are constantly investigating reports and working with customers to get remove any and all content that violate SoftLayer's MSA, and too often, that can be a thankless job. Fighting abuse is an ongoing process, and while the nature of the beast might suggest the overall war will never be won, we're always getting faster and stronger, so the individual battles are easier and easier to win.


October 15, 2011

Lower Latency: Neutrino Network?

SoftLayer is on the "bleeding edge" of technology, and that's right where I'm comfortable. I love being a part of something new and relevant. I also love science fiction and find that it's mixing together with reality more and more these days. Yay for me and my nerdyness! Beam me up Luke Skywalker! (I wonder how many nerds cringed at that statement!)

In a recent post from New Scientist, a test showed neutrino particles being clocked faster than the speed of light, and a dimension-hop might be the reason. Rather than go into the nerdy parts of the article that I'm sure you read before continuing to this sentence, I want to compare how SoftLayer would use this to our (and more importantly our customers') advantage: A neutrino network! We could have the fastest network in the world, and we could use the technology for faster motherboards and components too. Because that's how we roll.

BanzaiEnter science fiction. Let's say neutrinos were indeed using another dimension to travel. Like, say, the 8th dimension as referred to in "The Adventures of Buckaroo Banzai Across the 8th Dimension." This dimension also happens to be a prison used by the Lectroids of Planet 10 to store criminals. Go figure, right? Obstacles always come up, so if our neutrino network was targeted by those Lectroids, Dody Lira and the abuse team would have no problems taking them down ... After all, Lectroid's fiddling with data can be bad for business (Not to mention the possibility of Lectroid's using our network to come back to this dimension, wreak havoc, and eat all our junk food). Dody would have to upgrade some of the tools his team uses, like a Jet Car with an "Oscillation Overthruster" (which looks eerily similar to the Flux Capacitor) to travel in and out of the 8th dimension to hunt down those pesky Lectroids that won't comply.

Then, after Dody and crew wrangle the Lectroids (as I'm sure they would), we could offer the Lectroids email and Internet service. Bam! More customers on top of a supernatural network!

Coming back to reality (a bit), we have an interesting world ahead of us. Technologies we have only seen in movies and some we haven't even imagined yet are becoming reality! If they fall into the usable realm of SoftLayer, you can bet we'll be one of the first to share them with the world. But not before we get all the bugs (and Lectroids) out.


June 27, 2007

Spammers Beware: We're on Guard

Something happened today that we feel everyone should be aware of: We currently have no SBL listings for our IP space and we were recognized by the Spamhaus Team as a proactive no-spam-tolerance network.

Our hard work here at keeping spammers off of the network, and our reaction when they do make it on has been recognized. If you visit the Spamhaus ISP page, type in You will find something that is very rare and something we are very proud of. To be recognized in this manner means a great deal to us.

Abuse is something that happens, there is no way around it. What does matter is how we are perceived to handle the situation, and working day in and day out with other abuse desks and networks does indeed pay off.


Subscribe to abuse