From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fVc0n2SWqz330h for ; Tue, 10 Mar 2026 14:37:29 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fVc0n11WLz2xHh for ; Tue, 10 Mar 2026 14:37:29 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4fVc0l5Y6FzF2; Tue, 10 Mar 2026 14:37:27 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1773153448; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=InakGS1APJ9Rj3pOJND2TQ89ix/hr1//US+15cxHKB4=; b=AZiEVgVdFoRRix7e89YSNkDTnMpM6FDveJCkxeOC3vd0fbff4ehPCiXujH20D2Nqn9Qv0F X7OAaX2toCdKwgDQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1773153448; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=InakGS1APJ9Rj3pOJND2TQ89ix/hr1//US+15cxHKB4=; b=gquGEDvfC5TJjLOfO/pkAEvq8fniwFFh+KFhSfT/LJfFpo/mEqUhY7gSlFc9pbjFmrljYO MQgkDlvO64KT1/3Eid74SfBbyWEfvD3vp/dZa7hNCgtilqnrEZLu2GKPmanXVvNCeTd57h 2eDmkz9qTGb3dvIIQkhzZkWVTaM2G3lB1IbWxqoIKJB3XNUsgAlmoTJ5Hmauy+YACr/Dbh oae3HvS2wFnSDbJOgJz1p+ucUGoIeRnsGLZe/ibVx13CcvshH/9kajM/yqXI9hqtRlj7Qx 8J/cRcMygl38I3jekyobTqhol3Zj/Rafa1XAQsxOcJoUB8FXFsDmOJIlf205lQ== Content-Type: text/plain; charset=utf-8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: To block `jumpcloud.com` or not. From: Michael Tremer In-Reply-To: Date: Tue, 10 Mar 2026 14:37:26 +0000 Cc: Adam G , dbl@lists.ipfire.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <4F315C9F-DC24-4931-9FF6-E259AF1A55F7@ipfire.org> To: Tim Zakharov Hello, None of this is malware. The upstream list is garbage for our use-case = and I have removed it. -Michael > On 10 Mar 2026, at 12:15, Tim Zakharov = wrote: >=20 > I just noticed that secure.logmein.com is also categorized as malware. = Do we know what others may be on this list? TeamViewer? RustDesk? >=20 > On Tuesday, March 10th, 2026 at 7:07 AM, Tim Zakharov = wrote: >> Here is my dilemma. First, there is no way to whitelist this = specific rule as it is currently set up in IPfire DBL IPS ruleset. = Second, the software itself is not coded with malicious intent. It is = legitimate commercial software. One could potentially find ways of = maliciously using many other legit software packages. Would we then have = to categorize each of them as malware? There is a difference between = malware and malicious actors that needs to be part of this conversation.=20= >>=20 >> On Tuesday, March 10th, 2026 at 6:38 AM, Adam G = wrote: >>> Hi all, >>>=20 >>> I've moved this discussion about jumpcloud.com from the forum to the = correct place. >>>=20 >>> This domain was specifically added to the upstream list =E2=80=9Cmtxad= min - Malware Remote=E2=80=9D, which covers remote administration tools. = These can potentially be used as Command & Control (C&C) domains by = malware and people with bad intentions. >>>=20 >>> In Tim=E2=80=99s case it=E2=80=99s blocking devices on his guest = network. Most people will never need this domain, so I think it should = stay blocked by default and be added to personal whitelists where = required. >>>=20 >>> If we remove this one, we should remove the entire upstream list too = for consistency. >>>=20 >>> Thanks, >>> Adam >>=20 >=20