upvote
Grey market residential proxy service providers are one of the most common methods of implementing bot spam, social media manipulation and plenty of straight-out fraud.

There's all kinds of things that malicious actors want to do where they value coming from an ordinary (comcast, charter, centurylink, shaw cable, whatever) residential IP.

reply
You make a good point. I've reassessed and agree this is shady, and not a good pattern. And should be disabled/abolished.
reply
I mean, some of us have legitimate business needs to get past cloudflares frankly somewhat bs gatekeeping business model, however
reply
Sure, I do as well, I have my own VPN into my home office that lets me run traffic outbound through its default gateway while I'm somewhere else. But letting random third parties I don't know run traffic through my house is another thing entirely.
reply
Do you really need residential ip for this? for my news scraping i have choose static datacenter proxy first, rotating only as fallback, direct as last. flaresolverr covered cloudflare js challenge, but it wedge on memory time to time, so i add healthcheck for it. on my own site aws waf meet datacenter ua with captcha, so i understand other side too. residential never was necessary for me, but maybe my targets are just easier, what do you scrape?
reply
To be clear, bot spam and social media manipulation are legitimate business needs for the business selling said services.
reply
You can't have legitimate business needs if you're not a legitimate business in the first place. Ban them all.
reply
Just because others abuse privacy doesn't mean that we should remove privacy from everyone else. They also let you get around geoblocking.
reply
You're free to let strangers download illegal images from a proxy running on your IP, but I sure as hell won't.
reply
If you don't want to share your internet with others, that is your choice, but please don't make seem like you are only sharing the internet with criminals. That is a harmful belief to spread.
reply
Only if the app provides 1. prominently-displayed, informed consent, 2. an option to opt-out without losing app functionality, or 3. joining the botnet provides some kind of actual benefit to the user, besides just money to the developer.
reply
Add to that list respecting the TOS of the user's ISP so that the user does not get banned, and providing some sort of remuneration if illicit activity through the proxy causes problems for the primary user, and then _maybe_ you could call this all not shady as fuck.
reply
If only ISPs would actually crack down on (usually unwitting) users whose systems are participating in a malicious botnet or otherwise have their networks compromised. They could offer temporary disconnection + anti-malware support to get the user cleaned up, if they actually gave a shit.
reply
No residential last mile broadband ISP at the scale of hundreds of thousands or millions of customers is presently willing to spend the salary/benefits/fully loaded employee cost on the massive teams of (somewhat technically clued in, not low wage) people it would take to effectively implement this.
reply
They would be willing if they were themselves held liable for the illicit activity originating from their network otherwise.
reply
There is really not good excuse to bundle this functionality with an unrelated app in the first place.
reply
Apparently at least one of the apps mentioned does that. From the article

>A Pac-Man smart TV app from Bright Data offers users the choice between viewing ads in the game or agreeing to allow their TV to serve as a residential proxy node.

reply
I wonder how informed the end user actually is, and if it's disclosed to them what kind of content might pass through their network as a result of agreeing.
reply
Most traffic is normal scraping like checking amazon prices.
reply
Some residential proxy providers offer a few cents for the use of your network.
reply
No need of (2) and (3) - the user can choose to not install/use the app. (1) is the right fair boundary.
reply
Those apps just shouldn't exist.

I don't know how "join your users to a botnet" became some kind of legitimized monetization scheme. Ads are bad enough. What's next? "Participate in a DDOS in order to use our app?"

reply
It is the same as when javascript was used to mine cryptocurrency before web browsers blocked it, exploiting other users computers for unfair gain.
reply
Exactly. If there is a legitimate use case for sharing your connection it should be a separate apps users intentionally install.
reply
Sometimes it's botnet, sometimes it's just accessing netflix without hitting big IP range bans.

If there are proxy apps that only do the latter sort of work than I'm actually in favor of them existing and being widespread.

reply
"train our machine to identify traffic lights" or something
reply
No.

I'm surprised Comcast or some other ISP doesn't step in with a claim of tortious interference. Reselling or granting access to the ISPs services like this is almost always against the ISPs terms of service.

The consumer is in no place to consent to this exchange.

reply
On the other hand if you want to resell 2% of your bandwidth the ISP shouldn't have any say in that.
reply
Oh yes they can. If I'm a consumer, I pay for my connection that is sold to me and held in my name. I have no right to "resell" or "sublet" part of that. It is usually spelled out in the Terms of Service or Acceptable Use Policy.

At the very least, consumer connections explicitly disallow "Commercial Use". That means that you can't use them to run a business. You can't use them to turn a profit. You can't use them to generate revenue. That means no running servers, and that means no "reselling 2% of your bandwidth" for a few pennies because some Euro-Trash-Stranger wants to borrow it!

reply
> At the very least, consumer connections explicitly disallow "Commercial Use".

And that's really bad! Far more than reselling, you should very much be able to run a website from home!

reply
> And that's really bad!

No, it’s fair, and probably federally regulated.

You wanna run a business? Then get a business license, pay your business taxes, and sign up for a business Internet connection. That’s what they’re made for. Then run your servers to your heart’s content.

reply
What if I don't want to run a business? I just want to run a website!
reply
We have this invention called money so that individuals don't need to wrangle complex swap trades and instead sell the things (usually their time) that they are OK with selling with informed consent and buy the things they want without having to give up things they don't want to or don't understand. If selling your internet connection was a reasonable thing to do there would be dedicated apps/boxes for that instead of this being packaged into random apps.
reply
[dead]
reply