digitalsidhe

I found another way to check on whether my router is rewriting source IP addresses when doing port forwarding: see what the Received: headers in my emails say.

Up until about a week ago, they said things like this. Here's one from a message I got from a Gmail address:

Received: from mail-pa0-f46.google.com (mail-pa0-f46.google.com [209.85.220.46])
	(using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
	(No client certificate requested)
	by finrod.silmemar.org (Postfix) with ESMTPS id C935421C4386
	for <silmemar@silmemar.org>; Sat, 13 Sep 2014 12:04:43 -0700 (PDT)

And here's one from Livejournal:

Received: from livejournal.com (mail.livejournal.com [208.93.0.48])
	by finrod.silmemar.org (Postfix) with ESMTP id 0040A21C49E0
	for <digitalsidhe@silmemar.org>; Fri, 12 Sep 2014 23:44:32 -0700 (PDT)

In both cases, the stuff in the blue is the IP address that connected to Finrod, and the stuff in pink is the result of a hostname lookup on that IP address. (The stuff before that, after the word "from", is what the remote machine claimed as its hostname or domain.)

Then, starting on Saturday the 13th (when I switched to the new TP-Link router), they start looking like this:

Received: from mail-pa0-f47.google.com (unknown [162.245.22.24])
	(using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
	(No client certificate requested)
	by finrod.silmemar.org (Postfix) with ESMTPS id C2FF821C3E80
	for <silmemar@silmemar.org>; Thu, 18 Sep 2014 14:51:53 -0700 (PDT)

Received: from livejournal.com (unknown [162.245.22.24])
	by finrod.silmemar.org (Postfix) with ESMTP id 7445921C3D1C
	for <digitalsidhe@silmemar.org>; Thu, 18 Sep 2014 17:51:31 -0700 (PDT)

In both of these cases, 162.245.22.24 is my own IP address — or rather, the external (WAN) address of the router. The "unknown" result comes because this is a dynamic, residential IP address, and has no hostname associated with it.

This goddamn, piece-of-shit, TP-Link router is forwarding the connection, but not rewriting the source address, so any kind of tracking, spam likelihood analysis, or traceability goes right out the window.

Fuck this shit. I am so pissed right now.

Why would anyone even sell a piece of crap like that? And why did I throw away the packaging and receipt already?

First, a note about pingbacks: Pingbacks simply let you know when another LJ user posts an entry (on LJ) that links to one of yours. It does this by adding a screened comment to your entry, which also means you get your usual comment notification. If you take no action, nobody else sees a thing. (You could unscreen the comment, if you want.)

I have no problem with this.

Then there's that Facebook crosspost feature. That's a little more dodgy. Just to make clear what it does and doesn't do (based on Livejournal's FAQ entry called "How do I update my Facebook or Twitter when I post to LiveJournal?"):

• If you set it to crosspost your own entries by default (or automatically), it will do just that — but only for public entries. As I understand it, it will not send your friends-locked posts to other services.
• If you set it to crosspost your comments by default (or automatically), it will crosspost every comment you write... even if that comment is on someone else's journal. Even if that comment is on someone else's friends-locked post.

Note that I'm taking Livejournal's word on this, perforce, because I deleted my Facebook account a few months ago. (Yes, because of privacy concerns. Funny, that.)

A public comment on the announcement about this sums up the problem pretty well: “Say, for example, you complain about your manager at work under f-lock. Someone can then reply with, "Man, your manager sounds like a bitch", and crosspost that to their Facebook. The possibility for badness is epic.” (I see no problem in linking to or quoting a public post. The main substance of the objections to this is that it tends to publicize information that was intended to be friends-locked.)

Some people have pointed out that a person who can see one of your protected entries can always copy-paste the whole thing. True enough, and that's not even really a technological problem; it's a social problem. If you tell a friend a secret verbally, they can always violate your confidence and spread the "secret" far and wide. No technology can guard against people deliberately breaking trust with you.

However, this setting would automatically and habitually publish one's comments to Facebook, without the person having to take any deliberate action. This makes it very easy to forget about. And totally aside from the way people can leak information by posting things that make it obvious what they're responding to, there are also the people who sometimes quote part of the post they're responding to.

In general, this is a good thing. Heck, I do it myself whenever I feel it's warranted. But until now, we've all done so with the knowledge and understanding that what we copied and quoted was staying on the same page, with the same read permissions.

That's no longer true. Now, if Joe or Jane responds to someone's friends-locked post, their comment can be automatically crossposted to Facebook without my even thinking about it, based on a checkbox they ticked at some point in the past.

Or, more apropos to my life: If I write a locked post, and my friend Stan writes a response that quotes some of my text (because it's the sensible thing to do in that context), Stan can accidentally export my words out to a service that I've deliberately severed all ties with. Even if he'd never consciously, deliberately do so.

That's what bugs so many people about this. That what bugs me about it, too.

My policy has always been that if I post something publicly, with no friends-lock, that means it's intended to be public. Link to it freely, no permission needed. I see no reason to change that policy, and you'll note that I've made this post public.

But to my friends who comment on my journal: Please, don't crosspost my locked stuff to other services. And don't crosspost text that makes it obvious what I must have written, either. I locked it for a reason.