Forget hackers versus 'freedom', etc. for a moment. I'm trying to figure out why a server or firewall administrator would subject themselves to semi-dynamic rules by using a resource like http://serifos.eecs.harvard.edu/cgi-bin/exit.pl?textonly=1 in the first place.
Lets see... wait for the first time ~that site~ gets compromised and you pull a nice list of address space for major ISPs. Or when Tor servers are run on/NAT at the border and the IPs are the same as a major 'legitimate' proxies. Or you pull a poisoned DNS record and don't see that site at all but get a nicely planted fake list. Yeah, a majority of 'abusers' aren't going to go to great length but then again that majority aren't the people you're worried about in the first place. I say if you have the excess energy audit code, fuzz, install application protocol proxies, etc. and don't bother with blacklists. -Ali _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/