Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Now Blocking 56,037,235 IP Addresses, and Counting

cheapskatesguide.org

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#21

Post by Izkata »

WarOnPrivacy wrote: post #7
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

>>1-5-2024 >For the love of all that is holy, what is this date format. Most commonly used in the US. 'Cause we gotta show it like we say it . I think.

No, you have it confused with 1/5/2024. We don't use dashes with this order.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#22

Post by WarOnPrivacy »

Bluecobra wrote: post #10
devinjon wrote: post #2

"I imagine that if this article makes its way onto Hacker News, I will be criticized."

I think it’s a healthy thing to read other’s opinions, even if you disagree with it. HN does a good job of keeping the trolls out. Edit: FWIW I think you’re fighting the good fight and I wish I could implement something similar at work, in where I constantly have bots trying to login to my corporate VPN.

> I think it’s a healthy thing to read other’s opinions, even if you disagree with it. HN does a good job of keeping the trolls out.

I like to think world class nits are picked here but you're right - this is one of the more rational neighborhoods.

> I wish I could implement something similar at work, in where I constantly have bots trying to login to my corporate VPN.

I kludged some bash together to grep the logs and give me IP hit-counts and network owners. I next struggled to make decisions about the IPs - due to 1) the prevalence of residential proxies and 2) learning one of our widgets refreshes 3x/min.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#23

Post by TekMol »

montroser wrote: post #14
TekMol wrote: post #9

What is the issue they are trying to solve? It seems to be a static site. Bots should cause only a neglible amount of traffic per month. My guess would be less than $1. And aren't there free CDNs for static sites these days? I guess you can just push the whole frontent data (html+assets) into a public git repo, put it behind a github page with custom domain and call it a day?

No, this craziness(!) here suggests that it's not a static site: > "I added hyphens to the opening and closing PHP statements to prevent my web server from interpreting them as code." It could be a static site, and one could also automate the job that this person spends their precious time doing every day, copying and pasting text (IP addresses) that matches a pattern from one place to another. But they seem content,…

If they read this: You can use < instead of Anyhow, it does not matter how they produce the frontend html+assets. They can still take it all and push it somewhere where it is hosted for cheap or free. "wget -r 127.0.0.1" and a few more lines of code should be all that is needed to autmate it.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#24

Post by WarOnPrivacy »

wccrawford wrote: post #11
WarOnPrivacy wrote: post #7

Earlier quoted context omitted.

>>1-5-2024 >For the love of all that is holy, what is this date format. Most commonly used in the US. 'Cause we gotta show it like we say it . I think.

With dashes? We almost always use slashes here in the US. The only time I see dashes is for ISO format, and that's year-first.

Sure. It was the dominant written style throughout the 20th cent and folks kept on with it.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#25

Post by justsomehnguy »

> It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line.

Oh, tell me, how much? The whopping $5/month? Oh, maybe this is a high load WordPress/like CMS running on LAMP stack... so $8/month?

> I wrote the following small PHP script to search though my Nginx configuration file and tally up the number of IP addresses that I am blocking.

Holy shit. Blocking bots through nginx configuration, more so, blocking 56M addresses through nginx configuration...

Okay, for those of you who never did the thing or have no idea:

Just use the firewall (most of the time it is built-in in your OS), use some way to tell the firewall about the 'offenders' (eg fail2ban though there are options) and don't ever block something indefinitely, it's totally meaningless, just use timeouts.

If some Bob got his computer infected in 2015 and that computer tried to access /wp-admin.php then there is absolutely no reason to assume what in 2024 the IP address Bob's computer had in 2015 is still 'malicious'.

Automatic activity like the scans, bruteforcing and whatever is all about opportunity. They are searching for an easy opportunities to exploit and scanning a server what actively blocks you even for 30m at time is just pointless, there is way, way more opportunities in other places than wasting ~4 weeks trying to scan this server.

> I have custom 403 and 404 error pages that explain to those who may care why they are being blocked and how to regain access to the website

https://cheapskatesguide.org/custom404really.html

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#26

Post by TacticalCoder »

monkeynotes wrote: post #17
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

Don't bots also get covertly installed on regular folks machines? And those machines will be running from domestic ISP IP address blocks which are commonly shared/cycled between the ISP's customers. Block those and you are blocking legit customers.

> Block those and you are blocking legit customers.

The block doesn't need to be permanent. There are people out there publishing list of IPs known to belong to botnets and they're regularly updated. You can ban an IP for, say, 72 hours, and update your ipset regularly.

But anyway I've got a philosophical question...

If a customer has its computer owned by a botnet operator and that computer connects to a banking website, is the customer legit?

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#27

Post by tamiral »

hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

seeing month-day-year is one of my biggest pet peeves, why not just use day/month/year or year/month/day in a logical order.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#29

Post by Filligree »

jdietrich wrote: post #13
TekMol wrote: post #9

What is the issue they are trying to solve? It seems to be a static site. Bots should cause only a neglible amount of traffic per month. My guess would be less than $1. And aren't there free CDNs for static sites these days? I guess you can just push the whole frontent data (html+assets) into a public git repo, put it behind a github page with custom domain and call it a day?

> What is the issue they are trying to solve? Apparently, he self-hosts on a Raspberry Pi 3B+. I guess you need to block half the internet if your server has about the same performance as a decade-old smartphone. It's charming in a way, like someone who daily-drives a classic car. https://cheapskatesguide.org/articles/self-hosters-nightmare...

> After a loss of power, my routers and web server must be restarted in a specific sequence for my home network to function properly.

There's a certain charm to Rube Goldberg machines as well.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#30

Post by justsomehnguy »

Fb24k wrote: post #16

After reading his three part multi-month series about how he can't set up a firewall, I don't think this guy is probably someone who should be providing any useful information on how to use the internet (or anything attached to it).

Now I read it too (well, skimmed).

>> -A INPUT -j DROP

Yep, it's all is needed to know about this guy.

Post reply on HN