Why Bluetack lists are useless.......

[..Ñøßߥ..]

http://slyck.com/forums/viewtopic.php?t=38295

Slyck then obtained a copy of the publicly available 14.3MB compressed text file which lists all of the Media Defender's IP addresses. At this point, it became obvious that testing such a large volume of IPs would prove to be an overly time-consuming challenge, at least by hand. In order to alleviate this problem, it was best to test one particular IP range. Conveniently enough, the first range started with 116. Slyck then decided to test all of the IPs that started with the number 116.

The total number of IPs used by Media Defender starting with 116 was 1,474. Obviously, BlueTack did block all IPs that started with 116, but how many Media Defender IPs were successfully blocked? When Slyck investigated, there was a common theme that blocklists seemingly jumped over several ranges used by Media Defender. After some extensive study using the Level1 list for anti-p2p companies and the 'Paranoid' list, BlueTack would have successfully blocked 16 IPs. Thus, this sample test offered 1.09% protection against Media Defender in that range.

The IPs that were successfully blocked were: 116.255.1.109, 116.255.1.154, 116.255.1.244, 116.255.1.27, 116.255.1.52, 116.255.1.85, 116.215.157.243, 116.212.14.223, 116.199.202.170, 116.199.202.240, 116.199.207.83, 116.199.207.84, 116.199.226.78 , 116.199.227.11, 116.199.227.27, 116.199.227.67. The remaining 1,458 IPs would still be allowed through even with these two filters being used today.

While BlueTack may still perpetuate the idea that their filters are 99% effective, these latest findings will only fuel criticisms towards BlueTack's actual effectiveness. A complete test might not be possible short of creating a simple program to test every single number or spending weeks hand-testing every single Media Defender IP address. In the mean ime, it seems very apparent that BlueTack's filters have a few holes.

KM actually had some useful input here also:

A while back I handed them a list of around 250 dynamic IP Addresses that were all actively being used to flood various p2p networks with fake files, none of which were on any of their block lists (excluding a couple which were on ISPs where bluetack had the entire ISP blocked, blocking thousands of legitimate users and about 2-3 flooders, and a couple that were flooding winmx which had been copied from the winmxworld block list - in fact the only ones on there that weren't entire ISP blocks were the ones from winmxworld...)

It took bluetack just over 24 hours to respond with the fact that they would not be blocking them because they don't know how to check if they are flooders or not - which for them to even try claiming their lists are accurate when they admit they don't have a clue what should and shouldn't be blocked just brings up questions of exactly what they are smoking...

The message remains Blue Tack sucks.........for Winmx users ensure you are using the MXpie blocking patch, with WmW winmx specific blocklist.

Media Defender have begun Winmx flooding operations again, ofc on a new set of IP's, by the direct admission of Media Defender, they are slamming mxpie.info hosts users hard, you have again been warned.

[bacon665]

blue tack isnt totally useless like you said it only loads a text file. you can use the auto updater to update the pg file but delete pglite and import the pgblocklist file to bluetack. bluetack and protowall are nothing but alternative programs for people who dont like pg. i personally prefer to use bluetack as i can see and manage whats happening. where as pglite just runs in the background and you can never really tell if its doing any good or not

[Love]

where as pglite just runs in the background and you can never really tell if its doing any good or not

Not true. U can see pglite is working esp after using it ... u can see yr S value is decreased (as in P=8 S=7 spm=13249 like mine.) When not using any protection, usually the S value is around 19. In that case, it is like pglite is helping me save 19-7=12 secondary slots that riaa can't use to flood with.

For those who do not know, pglite comes included in yr Pie Auto Updater patch available here : http://www.vladd44.com/mx/piepatch.php

[..Ñøßߥ..]

Correct Love, although i think Bacon was refering to the fact you can actually watch PG2 blocking connections, but then ofc you have to pay for that function with addition system resources.

[DragonRider]

Wouldn't it be wise to have users reporting flooders to be added to a blocklist that could be updated hourly if necessary? After all we are the first ones to notice flooders, fake files, and etc. If there was a central point for reports that could update as often as needed it would plug more security holes and eventually make the flooders realize that their efforts were in vain. It seems that right now we are depending on PG and PGLyte which update every 24 hours, when we could be doing more on our own. Just a thought.

[Canada Joe]

Wouldn't it be wise to have users reporting flooders to be added to a blocklist ....:

Trouble with that idea is the average user has no idea how to find out what anyone's IP is..

[..Ñøßߥ..]

Wouldn't it be wise to have users reporting flooders to be added to a blocklist that could be updated hourly if necessary? After all we are the first ones to notice flooders, fake files, and etc. If there was a central point for reports that could update as often as needed it would plug more security holes and eventually make the flooders realize that their efforts were in vain. It seems that right now we are depending on PG and PGLyte which update every 24 hours, when we could be doing more on our own. Just a thought.

Actually Dragon, you are slightly ill informed, there is already a small team dedicated to finding and adding flooders to the blocklist MXpie auto patch users. PG2 lists as far as i am aware, cover precious little of the Winmx flooders and talking to bluetack about blocking new ips is painfull in the extreme (see quote from KM). The system used for PGlyte however is somewhat different, when myself and Vladd arranged the coding of the patches auto update function, we built in a 2 hours update cycle for blocking and a 24 hr cycle for caches changes. In essense, if the flooders upped their game and began moving IP's fast, MXpie auto patch users could have their lists automatically updated every 2 hours. The patch users the WmW winmx specific list.