Every now and then someone posts some strange log entries and asks what is going on. Sometimes these contains IP adresses of the presumed attackers.
It that OK? Or should they be edited out and anonymised? On one hand, I can imagine knowing the IP could be useful when answering sometimes, but on the other hand it might have privacy implications to leave them there. What is the correct response?
I raise the question because of a suggested edit to this question, that I did not know how to handle.
It is a fairly touchy question as both options have their good and bad sides.
I have seen a good 25-35% of IP related questions that get resolved much more easily when it is shown as is.
Askers often make mistakes in the way they present the IP to hide it, or they hide part of the problem by hiding the IP.
Add to that the possibility of getting a thorough investigation by someone that knows how to dig a little deeper.
On the other hand, specifying an IP address in reference to something that happened should at the very least avoid accusing the mentioned IP address as that could be viewed as defamation.
In my opinion, we don't need to know the IP addresses, at least not in their complete form.
Maybe if those addresses are already blacklisted, and the OP doesn't know it, we could tell with some confidence that they are probably being used to carry out some attack, as opposed to be (for example) the addresses of normal users who entered the wrong password.
But usually, after the third or so login attempt, we can already say that an attack is going on. As far as DDoS attacks are concerned, they most likely use botnets, and if a regular user is caught in the crosshairs of an anti-DDoS IP ban, a successful DDoS defence may be well worth it. In all other situations (SQL injections, port scanning, etc.), the knowledge of the IP address is - in my opinion - useless for the purpose of an answer, and could only be useful if the OP decided to file a report to the police.
Another possible reason could be geolocation. Once in a while, questions arise on whether to block or not IP addresses based on geolocation. Sometimes this might be useful (e.g. to protect SSH servers from Chinese IP addresses, if it is only used by devices in the USA, without the need of a VPN, etc.), but sometimes it is not. In any case, the last octet is of no use, and in most cases the last two octets are irrelevant, since most country-level IP blocks are defined by the first two octets.
In the end, I think we should at least redact the last octet, and possibly the last two octets.
By the way, Lasagna pointed out that the edit history is visible. I don't think this is a serious issue, given that IP addresses are not meant to be secret, and that they cannot be easily tied to an individual. Even if that was a problem, moderators can intervene and redact the history.
Having the full IP address would allow other users to:
And removing the IP address won't remove it from the edit history, anyway. For a proper hiding, it should have been performed by the OP before asking.
Generally, assuming that the logs are faithful, there shouldn't be much an issue that the attack logs get public.
However, if some addresses prove to not be from an attacker (whoops, there are IPs from several legitimate users there), I would support its hiding.
An IP address is, by definition, not private. It's not personally identifiable information. An IP address alone means nothing, and can't be connected to an individual.
At best, you MIGHT be able to tie it to a company where the traffic is coming from.
IP addresses of attackers is often times very useful information. There's well known sites on the internet that host spambots, attack tools, etc. This can be very revealing to the nature of the attack or the attacker.
So in general, I think the advice is to keep the IP information in. If you can show that it's harmful, take it out.
Well, if it is a sophisticated attack, an attacker might be able to use Google to automatically scan forums including StackExchange for their IP(s), alerting them if they are discovered so they can use countermeasures.
If you are using a website, simply add a clause in your website's TOS or whatever saying something along the lines of "Your IP address might be shown publicly (without any private personal data you have provided) for the purposes of determining, identifying, and revealing security threats". Im not a lawyer or anything but in my opinion, that should get you off the hook for merely disclosing IP adresses. Just keep in mind that slander and defamation of character could still be issues. So just be careful not to portray any provided IP addresses as doing intentionally wrongful or illegal actions (except when it is blatantly obvious), and you will be just fine.
As for stack exchanges policy.... Ask a moderator.
