Ban me at the IP level if you don't like me • Hacker News Board

Re: Ban me at the IP level if you don't like me

#281

Post by immibis » Mon, Aug 25, 2025, 2:05 PM UTC

rollcat wrote: post #227

threeducks wrote: post #203

Earlier quoted context omitted.

> The best way to mitigate the load from diffuse, unidentifiable, grey area participants is to have a fast and well engineered web product. I wonder what all those people are doing that their server can't handle the traffic. Wouldn't a simple IP-based rate limit be sufficient? I only pay $1 per month for my VPS, and even that piece of trash can handle 1000s of requests per second.

> I only pay $1 per month for my VPS, and even that piece of trash can handle 1000s of requests per second. Depends on the computational cost per request. If you're serving static content from memory, 10k/s sounds easy. If you constantly have to calculate diffs across ranges of commits, I imagine a couple dozen can bring your box down. Also: who's your webhost? $1/m sounds like a steal.

You can sometimes find special (loss-leader) deals in this range on LowEndTalk. Typically you'll have to pay upfront for a block of one or two years.

Re: Ban me at the IP level if you don't like me

#282

Post by GuinansEyebrows » Mon, Aug 25, 2025, 2:09 PM UTC

davsti4 wrote: post #274

dotancohen wrote: post #158

Earlier quoted context omitted.

Are you familiar with port knocking? My servers will only open port 22, or some other port, after two specific ports have been knocked on in order. It completely eliminates the log files getting clogged.

I've used that solution in the past. What happens when the bots start port knocking?

Fail2ban :)

Re: Ban me at the IP level if you don't like me

#283

Post by immibis » Mon, Aug 25, 2025, 2:12 PM UTC

BLKNSLVR wrote: post #96

bobbiechen wrote: post #8

Earlier quoted context omitted.

Unfortunately, well-behaved bots often have more stable IPs, while bad actors are happy to use residential proxies. If you ban a residential proxy IP you're likely to impact real users while the bad actor simply switches. Personally I don't think IP level network information will ever be effective without combining with other factors. Source: stopping attacks that involve thousands of IPs at my work.

Blocking a residential proxy doesn't sound like a bad idea to me. My single-layer thought process: If they're knowingly running a residential proxy then they'll likely know "the cost of doing business". If they're unknowingly running a residential proxy then blocking them might be a good way for them to find out they're unknowingly running a residential proxy and get their systems deloused.

Let's suppose I'm running a residential proxy. Of course my home IP address changes every day, so you'll end up blocking my entire ISP (a major one) or city (a major one) one by one.

And what if I'm behind CGNAT? You will block my entire ISP or city all in one go, and get complaints from a lot of people.

Re: Ban me at the IP level if you don't like me

#284

Post by immibis » Mon, Aug 25, 2025, 2:13 PM UTC

throwawayffffas wrote: post #94

bobbiechen wrote: post #8

Earlier quoted context omitted.

Unfortunately, well-behaved bots often have more stable IPs, while bad actors are happy to use residential proxies. If you ban a residential proxy IP you're likely to impact real users while the bad actor simply switches. Personally I don't think IP level network information will ever be effective without combining with other factors. Source: stopping attacks that involve thousands of IPs at my work.

> If you ban a residential proxy IP you're likely to impact real users while the bad actor simply switches. Are you really? How likely do you think is a legit customer/user to be on the same IP as a residential proxy? Sure residential IPS get reused, but you can handle that by making the block last 6-8 hours, or a day or two.

Very likely. You can voluntarily run one to make ~$10/month in cryptocurrency. Many others are botnets. They aren't signing up for new internet connections solely to run proxies on.

Re: Ban me at the IP level if you don't like me

#285

Post by Nemi » Mon, Aug 25, 2025, 2:15 PM UTC

lwansbrough wrote: post #35

lxgr wrote: post #31

Earlier quoted context omitted.

Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?

Don't care, works fine for us.

Worked great for us, but I had to turn it off. Why? Because the IP databases that the two services I was using are not accurate enough and some people in the US were being blocked as if they had a foreign IP address. It happened regularly enough I reluctantly had to turn it off and now I have to deal the non-stop hacking attempts on the website.

For the record, my website is a front end for a local-only business. Absolutely no reason for anyone outside the US to participate.

Re: Ban me at the IP level if you don't like me

#286

Post by conradev » Mon, Aug 25, 2025, 2:17 PM UTC

grandinj wrote: post #60

sugarpimpdorsey wrote: post #38

Earlier quoted context omitted.

There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of the ocean inhabited by... bots apparently? Cyprus is another one. Re: China, their cloud services seem to stretch to Singapore and beyond. I had to blacklist all of Alibaba Cloud and Tencent and the ASNs stretched well beyond PRC borders.

There is a Chinese player that has taken effective control of various internet-related entities in the Seychelles. Various ongoing court-cases currently. So the seychelles traffic is likely really disguised chinese traffic.

Interesting: https://techafricanews.com/2025/07/24/smart-africa-calls-for...

Re: Ban me at the IP level if you don't like me

#287

Post by alistairSH » Mon, Aug 25, 2025, 2:30 PM UTC

kevin_thibedeau wrote: post #278

alistairSH wrote: post #272

Earlier quoted context omitted.

Generic American English pronounces the 'h' in hospital, hero, heroine, but not hour. Same is true for RP English. Therefore, for both accents/dialects, the correct phrases are "a hotel", "a hero", "a heroine", and "an hour". Cockney, West Country, and a few other English accents "h drop" and would use "an 'our", "an 'otel", etc.

Now do historic. Suddenly all Brits turn into Cockney's.

Sure, and all Americans sound like they're from Ocracoke or Tangier.

Re: Ban me at the IP level if you don't like me

#288

Post by TylerE » Mon, Aug 25, 2025, 2:33 PM UTC

threeducks wrote: post #203

bob1029 wrote: post #132

I think a lot of really smart people are letting themselves get taken for a ride by the web scraping thing. Unless the bot activity is legitimately hammering your site and causing issues (not saying this isn't happening in some cases), then this mostly amounts to an ideological game of capture the flag. The difference being that you'll never find their flag. The only thing you win by playing is lost time. The best wa…

> The best way to mitigate the load from diffuse, unidentifiable, grey area participants is to have a fast and well engineered web product. I wonder what all those people are doing that their server can't handle the traffic. Wouldn't a simple IP-based rate limit be sufficient? I only pay $1 per month for my VPS, and even that piece of trash can handle 1000s of requests per second.

It starting hitting endpoints that do lots of db thrashing, and it’s usually ones that are NOT common or recent so caching won’t save you.

Serving up a page that takes a few dozen db queries is a lot different than serving a static page.

Re: Ban me at the IP level if you don't like me

#289

Post by socksy » Mon, Aug 25, 2025, 2:33 PM UTC

dmesg wrote: post #255

JohnFen wrote: post #244

Earlier quoted context omitted.

How are passwords ending up in your logs? Something is very, very wrong there.

Does an attacking bot know your webserver is not a misconfigured router exposing its web interface to the net? I often am baffled what conclusions people come up with from half reading posts. I had bots attack me with SSH 2.0 login attempts on port 80 and 443. Some people underestimate how bad at computer science some skids are.

Also baffled that three separate people came to that conclusion. Do they not run web servers on the open web or something? Script kiddies are constantly probing urls, and urls come up in your logs. Sure it would be bad if that was how your app was architected. But it's not how it's architected, it's how the skids hope your app is architected. It's not like if someone sends me a request for /wp-login.php that my rails app suddenly becomes WordPress??

Re: Ban me at the IP level if you don't like me

#290

Post by edoceo » Mon, Aug 25, 2025, 2:33 PM UTC

lxgr wrote: post #166

ordu wrote: post #81

Earlier quoted context omitted.

It is not silly pseudo-security, it is economics. Ban Chinese, lower your costs while not losing any revenue. It is capitalism working as intended.

Not sure I'd call dumping externalities on a minority of your customer base without recourse "capitalism working as intended". Capitalism is a means to an end, and allowable business practices are a two-way street between corporations and consumers, mediated by regulatory bodies and consumer protection agencies, at least in most functioning democracies.

Moving a cost outside the business and then calling it improved margin is exactly what MBA school teaches and the market rewards.