Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Now Blocking 56,037,235 IP Addresses, and Counting

cheapskatesguide.org

Post reply on HN
Print view View original

41–50 of 62 posts

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#41

Post by senorrib »

tamiral wrote: post #27
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

seeing month-day-year is one of my biggest pet peeves, why not just use day/month/year or year/month/day in a logical order.

Month: 1-12 Day: 1-31 Year: unbounded

I come from a dd/mm/yyyy country, but you can’t say mm/dd/yyyy is completely illogical.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#42

Post by Sweepi »

justsomehnguy wrote: post #25

> It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line. Oh, tell me, how much? The whopping $5/month? Oh, maybe this is a high load WordPress/like CMS running on LAMP stack... so $8/month? > I wrote the following small PHP s…

Maybe the custom "blocked" 403/404 error page only shows up if your IP is blocked?

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#44

Post by thfuran »

jampekka wrote: post #15
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

I don't think the IP blocking refers to Google, Bing etc. The site has a robots.txt that allows for these. Of course if robots.txt isn't honored, an IP block is in order. For-profit corporations aren't inherently malicious or benevolent. They are legal structures that maximize return on capital without moral judgement or care about what it does to others. A bit like Cthulhu. https://cheapskatesguide.org/robots.txt

Corporations are legal entities incapable of any action. The actions carried out in their name are performed by people who very well can be malicious.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#45

Post by mainde »

mrb wrote: post #19
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

" the IP may be renewed every day or every hour) " What a coincidence! Right now from my phone on my carrier's network while traveling in the UK I am unable to reach https://cheapskatesguide.org My phone's IP address is likely on this guy's blacklist of 56M addresses. So I am forever going to remember whatever service this website provides may be arbitrarily unavailable unless I'm on a know good IP address. Overly ag…

[dead]

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#47

Post by gmuslera »

There are some real bad actors behind IP blocks, or hosting providers that have no problem hosting them nor take actions on abuse reports. Referrer spamming, searching for vulnerabilities (some of them with very big URL list to try), misbehaving crawlers, or just plain DoS are some of the ways they may sites, specially the ones serving dynamic content. This space is usually fixed and used by servers, or VPNs exitpoits. Blocking all the blocks associated to their autonomous systems would avoid to put in the rules a lot of /24.

But then there are residential IP blocks, specially some with dynamic enough IPs or NATed ISPs. Some people of those blocks may have hostile or clueless behaviour, some may be used as proxy because malware or because they intentionally installed some of the residential proxy servers agents. There you may be blocking legitimate visitors, if a few clients of some ISP are very active you may end blocking a lot of innocent people. And, in this case too, you can target the IP blocks of its autonomous system if you feel that from there you only get bad traffic.

But in the end, is your site. you are free to decide to block what you understand that are bad neighbourhoods.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#48

Post by SushiHippie »

Could it be that the slight delay between opening this page and my browser receiving the first bytes is nginx checking these 50 million IPs? How is this delay so small if there are really 50 million deny statements?

Is there a reason why they don't use a firewall?

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#49

Post by johnklos »

TekMol wrote: post #9

What is the issue they are trying to solve? It seems to be a static site. Bots should cause only a neglible amount of traffic per month. My guess would be less than $1. And aren't there free CDNs for static sites these days? I guess you can just push the whole frontent data (html+assets) into a public git repo, put it behind a github page with custom domain and call it a day?

Just because there are things that we can do about symptoms of a problem doesn't change the fact that the problem itself might bother some of us.

For instance, it bothers me that certain networks quite literally do nothing about malicious actors attempting intrusion from those networks. Abuse complaints are ignored. Some people might say, "just run blocklistd", "use a non-standard port", et cetera, but the real issue is that people shouldn't be allowed to attempt intrusion, and when I send an email to a netblock's contacts with 1,000 login attempts, they should remove the accounts linked to that attempted intrusion.

They don't, so I block whole netblocks based on the lack of response and action. Should I also run blocklistd? Sure, and I do, but that's orthogonal to blocking.

So while the person running this site could do things differently and/or better, for certain definitions of better, they're doing what works for them.

Is reporting spam going to make a change in the world? No, but it FEELS better to do it, and it does affect my mailbox. Likewise, is blocking IPs making a change in the world? No, but it probably makes Cheapskate feel more in control of their server.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#50

Post by TekMol »

johnklos wrote: post #49
TekMol wrote: post #9

What is the issue they are trying to solve? It seems to be a static site. Bots should cause only a neglible amount of traffic per month. My guess would be less than $1. And aren't there free CDNs for static sites these days? I guess you can just push the whole frontent data (html+assets) into a public git repo, put it behind a github page with custom domain and call it a day?

Just because there are things that we can do about symptoms of a problem doesn't change the fact that the problem itself might bother some of us. For instance, it bothers me that certain networks quite literally do nothing about malicious actors attempting intrusion from those networks. Abuse complaints are ignored. Some people might say, "just run blocklistd", "use a non-standard port", et cetera, but the real issue…

    when I send an email to a netblock's contacts with 1,000
    login attempts, they should remove the accounts linked
    to that attempted intrusion.
What proof can you give them that those login attempts really took place?
Post reply on HN