31–40 of 44 posts
I'm waiting for Dalton to complain about the use of the Svbtle theme...It seems to happen to every post that links to somewhere not svbtle that uses it.
I looked at the links in the article and its comments, but this one seemed much more "immediately useful" for me: (and not China-specific either, you can pick any ISO country code to add to your iptables) http://www.cyberciti.biz/faq/block-entier-country-using-ipta... If you have a linux-based router, this can be a 5 minute job. In fact, I'll save you some time. I modified the script slightly to better suit my needs.…
I'm waiting for Dalton to complain about the use of the Svbtle theme...It seems to happen to every post that links to somewhere not svbtle that uses it.
https://github.com/gravityonmars/wp-svbtle
We were very seriously considering if we should block China from our game servers recently. The reason is massive account compromises of our users. There are 300,000 IPs from China that are just trying public leaked email / password databases against our servers. With so many IPs, any kind of normal per IP limiting just doesn't work. Each IP is only trying 10 or so accounts per day. Blocking China was potentially a v…
Earlier quoted context omitted.
Password length and complexity aren't all that critical if it's salted and hashed. Unless your users' passwords are something like "password" or their user names. Password length and complexity are important, if overplayed.
Ah yes, well... if they're using 'password' for the password, they've got bigger problems ;) Passwords that can be guessed in 1-3 tries should be excluded, naturally: password, 12345, 11111 etc... But mixed case, special character stuff is a bit redundant.
I looked at the links in the article and its comments, but this one seemed much more "immediately useful" for me: (and not China-specific either, you can pick any ISO country code to add to your iptables) http://www.cyberciti.biz/faq/block-entier-country-using-ipta... If you have a linux-based router, this can be a 5 minute job. In fact, I'll save you some time. I modified the script slightly to better suit my needs.…
You're right. Outright blocking is not a solution. I understand that. But, there comes a time when you just don't want to tell people to stop knocking on your door. You know?
It's important to me to preserve the open nature of the internet. So I hope the karma bonus of posting some code offsets the karma loss from the code being "racist" ;-)
Great article, thanks!
This would backfire. The goal, I suppose, is that the Chinese government go after hackers in China more; but even if this happened on a mass scale, the Chinese government would /love/ for more services to be run domestically. They don't need Google or Facebook, what makes you think they won't survive well without any of our sites?
Many of us have users (actual valid users) who live in and visit China and other countries in the world. So we don't block a IP because we think it is in China. Use rate limiting and block bad IPs that are brute-forcing services (don't lock accounts) then you'll be able to serve your users while keeping the bad guys out.
If you resort to blocking IP ranges to prevent attacks, you are missing the point of how to properly respond to an attack. Blocking ranges might by an extra layer of security (philosophy of defense in depth), but in addition to that you should analyze how this email user account was compromised. Weak password was bruteforced? Start enforcing strong passwords. Email server vulnerability exploited? Patch your server. E…
Blocking an entire country sounds very stupid from the technological and moral point of view (and yes, it may make sense from the financial/time pov). 1) that doesn't make your shitty (lets be rough here) passwords & web apps secure. You didn't care for security yesterday, it's not going to come to you by blocking "china". 2) that doesn't stop anyone from proxying elsewhere 3) the more doing it, the more segmented th…