Why is the US Green Party's site blocked?(github.com)
github.com
Why is the US Green Party's site blocked?
https://github.com/blocklistproject/Lists/issues/453
50 comments
My static home IP was blocked by my new energy supplier.
It took almost 4 months to get through to someone who would accept my problem wasn't forgetting my password.
In the end, I was pointed to their third provider and told "sort it out yourself, not our problem". Thankfully that other company had a reasonable-ish appeals process...
...obviously I got relisted in their db a few times but things seem to have calmed down now.
https://pricey.uk/blog/connection-reset/
It took almost 4 months to get through to someone who would accept my problem wasn't forgetting my password.
In the end, I was pointed to their third provider and told "sort it out yourself, not our problem". Thankfully that other company had a reasonable-ish appeals process...
...obviously I got relisted in their db a few times but things seem to have calmed down now.
https://pricey.uk/blog/connection-reset/
Ah, "Reputation" and "Threat Intelligence". One of the things I didn't expect but should have after BeyondCorp and Zero Trust is that some people would decide they need to go the exact opposite direction.
Instead of designing our systems as though they all face the hostile public Internet like Google, why not instead police all of the public Internet as though it's our internal network? That way we don't need to adopt any actual security practices. What could go wrong?
As you saw, basically everything, all the time.
I actually moved energy supplier a few months ago. I had a good quote from a new supplier, and when I tried to sign in to see how close the quote from my old supplier was their site wouldn't load in my browser, tried again a day later, no joy. OK cool, bye then.
Instead of designing our systems as though they all face the hostile public Internet like Google, why not instead police all of the public Internet as though it's our internal network? That way we don't need to adopt any actual security practices. What could go wrong?
As you saw, basically everything, all the time.
I actually moved energy supplier a few months ago. I had a good quote from a new supplier, and when I tried to sign in to see how close the quote from my old supplier was their site wouldn't load in my browser, tried again a day later, no joy. OK cool, bye then.
One of my coworkers ended up blocked because Amazon maintains a block list of bot like users and our WAF was subscribed to it. This coworker was using scrapers for find GTX 3080s.
Surprisingly, Amazon does not block customers they put on this list.
Surprisingly, Amazon does not block customers they put on this list.
A place I worked blocked hackernews bcs of "hacking". Never had the nerve to try to get it unblocked.
A place I worked blocked Github for "hacking tools." Each new software developer hire had to request access and get it approved by their manager, a process that took a few hours.
A place I worked blocked their own website, we never found out why
The company I work for blocks Google Translate. IT claims it's the default that comes with the filtering software it uses.
Fortunately, since I build multi-lingual web sites, I was able to get an exemption from the security department.
(No, I don't use Google Translate to translate web sites. The company has three internal and two external professional translators for that. But sometimes when I'm copying-and-pasting between versions, I like a little reassurance that what I'm pasting is what I think it is.)
Fortunately, since I build multi-lingual web sites, I was able to get an exemption from the security department.
(No, I don't use Google Translate to translate web sites. The company has three internal and two external professional translators for that. But sometimes when I'm copying-and-pasting between versions, I like a little reassurance that what I'm pasting is what I think it is.)
Google Translate was a popular way to bypass filters when I was in high school since it could be used as a proxy and nobody blocks google.com
Hah! I have used Google Translate to do some naïve translations. Was creating portlet code that supported i18n, and took a crack at a few of the labels. Much to the amusement of the folks I demoed to, I used the French word for a person's back, not back in the context of navigation.
The funny thing is that they often are blocking the well known sites but don’t block less known and potentially shady sites. I always notice this when I try to download a software I need. Popular sites are blocked but very questionable sites are open.
Does UK honor "net neutrality"? If yes, that could be a way to hold them (ISP, whoever it be) accountable.
Ofcom (the UK’s coms regulator) has just announced a review of net neutrality [1]. Which will have some big companies aiming to give themselves more “flexibility”.
Currently however, providers are bound by EU mandates to treat every packet the same (roughly speaking).
I hope it stays that way.
[1] - https://www.techradar.com/uk/news/ofcom-to-review-uks-net-ne...
Currently however, providers are bound by EU mandates to treat every packet the same (roughly speaking).
I hope it stays that way.
[1] - https://www.techradar.com/uk/news/ofcom-to-review-uks-net-ne...
Yeah, the airport provides the Internet uplink and contractually it can be as locked-down and broken as they like. Boingo just manages the WiFi infrastructure and payment/login. Usually they're extremely lazy and just use a DNS service with business-style blocking rules and unblock popular stuff one at a time when people notice and complain.
I've worked with several kinds of public blocking lists and one thing I learned is that they are all full of false positives. For whatever reason, I would not be surprised if just nobody ever noticed the mistake.
Yeah, that's a given because they're not constructed manually ie. no manual verification.
Give them some time to react. My wife complained to me she could not visit a website (I run Pi-Hole on our network, and our mobile devices get routed to it even on external networks). I looked through the logs, figured the offending rule, contacted the maintainer, and they fixed it within a few hours.
The issue has been up for one hour thus far.
Give them some time to react. My wife complained to me she could not visit a website (I run Pi-Hole on our network, and our mobile devices get routed to it even on external networks). I looked through the logs, figured the offending rule, contacted the maintainer, and they fixed it within a few hours.
The issue has been up for one hour thus far.
Yeah, same here, I run OPNsense and make use of Unbound's blacklist feature to similar (and surprisingly potent!) effect, along with Suricata and Sensei. I have had to manually whitelist some stuff though.
False-positives, things that are good defaults but advanced users should be able to bypass, or just plain unfortunately necessary workarounds are certainly all issues though. I think user available fallbacks can be useful sometimes for that reason. Like at a site using 802.1x auth, set it up so users can append "-noblock" to their login and then it'll change them into a different VLAN which can just point at a different DNS (or alternately Unbound supports views for split-brain DNS).
False-positives, things that are good defaults but advanced users should be able to bypass, or just plain unfortunately necessary workarounds are certainly all issues though. I think user available fallbacks can be useful sometimes for that reason. Like at a site using 802.1x auth, set it up so users can append "-noblock" to their login and then it'll change them into a different VLAN which can just point at a different DNS (or alternately Unbound supports views for split-brain DNS).
I don't want to educate my wife about how to circumvent the blockade with an all or nothing decision. I mean, its possible, and I taught her to update Google Play over 4G because else it does not work (on Nvidia Shield and Google Pixel 3a it does not; on all my other devices it works, not sure why). The reason I don't want to teach her that, is that the measure helps her (and our) privacy and security. By temporarily giving that up, we open up the whole attack surface for that time, which is kinda OK if you remember to switch back immediately but people tend to forget... The correct way to solve the problem is by fixing the blacklist and/or whitelist, (temporary) collateral damage be damned.
I use Pi-Hole on EdgeOS with a second server with Docker as backup. I also have NextDNS as fallback. I'll probably switch to OPNsense at some point though.
I use Pi-Hole on EdgeOS with a second server with Docker as backup. I also have NextDNS as fallback. I'll probably switch to OPNsense at some point though.
Or someone quietly slipped it onto a block list knowing that it'd take a while to get noticed.
If you're talking about the Green Party site, there is explanation at the bottom of the GitHub issue. It appears they were either compromised at some point in the past and used as a relay for spam ads or somebody with legitimate authority to edit the site abused their privileges and ran a spam ad operation on the side.
In either case, blocklistproject interprets spam ad vendors as damage and routes around them.
In either case, blocklistproject interprets spam ad vendors as damage and routes around them.
When I clicked the link (and when the link was posted), only the original comment was present: https://github.com/blocklistproject/Lists/issues/453#issue-9...
They probably got hacked ages ago and it was added at that point. I wouldn't be assuming malice here.
It's also on VirusTotal
I can no longer visit End-To-End encrypted sites anymore at work. It sucks because I use ProtonMail and end up having to use my phone to forward things from there or to my Google email, which I wanted to stop using entirely.
I am confused? Does your employer just block any https site?
Probably doing MITM SSL inspection. Basically, a corporate security appliance with trusted certs on the endpoint sits in the middle of everything to inspect for malware/viruses/blocked content.
A relatively common corporate practice, honestly. It's a shame more people aren't aware of it.
A relatively common corporate practice, honestly. It's a shame more people aren't aware of it.
I had a problem once when I was testing setting up a central VPN for all my devices to go through, but I forgot to exclude the work laptop. So I got a call by security that they got an alert of somebody trying to connect using my credentials on an overseas location.
I explained the guy on the other line the reason why that happened and he told me not to worry about it, but warned me that they were going to monitor my traffic by protocol for a few hours, so I should avoid looking at porn in the meantime. I replied that I wouldn't look at porn on the work laptop, and he told me that the warning was also routine and that I wouldn't believe what people watch during working hours.
I explained the guy on the other line the reason why that happened and he told me not to worry about it, but warned me that they were going to monitor my traffic by protocol for a few hours, so I should avoid looking at porn in the meantime. I replied that I wouldn't look at porn on the work laptop, and he told me that the warning was also routine and that I wouldn't believe what people watch during working hours.
>Probably doing MITM SSL inspection.
Probably not, judging by the gp's use of the term "end to end encrypted". Nearly every site uses HTTPS, so if they were really doing MITM, either everything would be broken (because the root certs aren't installed), or everything works. My guess is that his employer's network has some sort of network filter installed, and "end to end encrypted" is a classification category for sites that is blocked for whatever reason.
Probably not, judging by the gp's use of the term "end to end encrypted". Nearly every site uses HTTPS, so if they were really doing MITM, either everything would be broken (because the root certs aren't installed), or everything works. My guess is that his employer's network has some sort of network filter installed, and "end to end encrypted" is a classification category for sites that is blocked for whatever reason.
HTTPS is not an obstacle to this.
As I mentioned before, the methodology requires publishing a trusted cert to endpoints. This is done with GPOs or whatever RMM tool is used to manage workstations + MDM to push to mobile.
You will find this implemented in nearly any high-security network environment (finance, government, etc.), primary schools, and a lot of miscellaneous businesses.
As I mentioned before, the methodology requires publishing a trusted cert to endpoints. This is done with GPOs or whatever RMM tool is used to manage workstations + MDM to push to mobile.
You will find this implemented in nearly any high-security network environment (finance, government, etc.), primary schools, and a lot of miscellaneous businesses.
Depending on your place of work, it's a very good thing they block personal email.
They are a phishing site
https://webcache.googleusercontent.com/search?q=cache:HWH6z4...
Perhaps they have fixed it in the past 3 weeks, maybe they haven't.
From yesterday, so not fixed -
https://webcache.googleusercontent.com/search?q=cache:rMUgla...
Also love the way it's signed, the persons online profile is "I'm Black Hat SEO Expert" if anyone wants to write any Green policy I guess contact them?
https://webcache.googleusercontent.com/search?q=cache:HWH6z4...
Perhaps they have fixed it in the past 3 weeks, maybe they haven't.
From yesterday, so not fixed -
https://webcache.googleusercontent.com/search?q=cache:rMUgla...
Also love the way it's signed, the persons online profile is "I'm Black Hat SEO Expert" if anyone wants to write any Green policy I guess contact them?
This is just streaming spam and any site that accepts user-generated content is susceptible to it.
Having been on their side it can sometimes be very difficult to mitigate without manual approval. This is not automated - it's done by humans and they adjust their patterns against any automatic mitigation attempts.
Having been on their side it can sometimes be very difficult to mitigate without manual approval. This is not automated - it's done by humans and they adjust their patterns against any automatic mitigation attempts.
> This is just streaming spam and any site that accepts user-generated content is susceptible to it.
Not if the site polices user-generated content.
Not if the site polices user-generated content.
> This is just streaming spam
It's fraud not spam, you never got to watch the fight after paying - https://ici.radio-canada.ca/recit-numerique/2140/adcenter-hy...
And 6 weeks ago it might have been ISIS spam or a link to a exe or phishing.
> and any site that accepts user-generated content is susceptible to it
This site doesn't have user-generated content/events/calendar, it's employee generated.
It's fraud not spam, you never got to watch the fight after paying - https://ici.radio-canada.ca/recit-numerique/2140/adcenter-hy...
And 6 weeks ago it might have been ISIS spam or a link to a exe or phishing.
> and any site that accepts user-generated content is susceptible to it
This site doesn't have user-generated content/events/calendar, it's employee generated.
> This site doesn't have user-generated content/events/calendar, it's employee generated.
That's incorrect. There's a call to action to register to submit an event here:
https://www.gp.org/earth_day_to_may_day_events_calendar
That's how the spam got in.
Edit: here, I made one for you: https://www.gp.org/janon/aaron695_hello
Edit2: it's deleted, looks like someone is finally doing cleanup
That's incorrect. There's a call to action to register to submit an event here:
https://www.gp.org/earth_day_to_may_day_events_calendar
That's how the spam got in.
Edit: here, I made one for you: https://www.gp.org/janon/aaron695_hello
Edit2: it's deleted, looks like someone is finally doing cleanup
Apologises. You are correct. Good find
They did the same with a 'job ad' on the hosts web site -
https://webcache.googleusercontent.com/search?q=cache:2Uw0_n...
They did the same with a 'job ad' on the hosts web site -
https://webcache.googleusercontent.com/search?q=cache:2Uw0_n...
Hmm, that doesn't look like content the GP would put up intentionally.
No, it looks like they have glaring security issues of their website and the site regularly gets used for phishing, spam, etc.
So maybe that only has been an issue for 3 weeks (which is bad enough), but all things considered, it’s possible it’s been like this for years.
So maybe that only has been an issue for 3 weeks (which is bad enough), but all things considered, it’s possible it’s been like this for years.
It looks like they allow user generated posts on a calendar, and every site that allows user generated content regularly gets used for phishing, spam, etc.
I read an interesting article on the Big Lie over the weekend and it mentioned an example from 2016 where private non-profit conservative groups were involved in promoting Green and Independent candidates with the intention of diluting vote for Dem candidates.
Probably not related, but worth mentioning the coincidence just because it was such a good article https://www.newyorker.com/magazine/2021/08/09/the-big-money-...
Probably not related, but worth mentioning the coincidence just because it was such a good article https://www.newyorker.com/magazine/2021/08/09/the-big-money-...
This should be the top answer -- it is a phishing/spam site, whether due to being hacked or poor moderation policies.
No outrage to see here, please move along
No outrage to see here, please move along
By that logic, any site that allows to display third party content is a phishing/spam site and should be blocked - including twitter, facebook, HN and of course gmail.
hhlbf(2)
The annoying thing is not the false positives: these things happen, and mostly it's not all that urgent to resolve immediately. The annoying thing is a total lack of obvious appeals process to resolve a false positive. At least the OP's example is on GitHub and thus can easily be issued.