Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Now Blocking 56,037,235 IP Addresses, and Counting

cheapskatesguide.org

Post reply on HN
Print view View original

51–60 of 62 posts

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#51

Post by ghusto »

mrb wrote: post #19
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

" the IP may be renewed every day or every hour) " What a coincidence! Right now from my phone on my carrier's network while traveling in the UK I am unable to reach https://cheapskatesguide.org My phone's IP address is likely on this guy's blacklist of 56M addresses. So I am forever going to remember whatever service this website provides may be arbitrarily unavailable unless I'm on a know good IP address. Overly ag…

Not everyone on the internet is trying to get customers though.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#52

Post by ghusto »

Thorrez wrote: post #40
tamiral wrote: post #27

Earlier quoted context omitted.

seeing month-day-year is one of my biggest pet peeves, why not just use day/month/year or year/month/day in a logical order.

mm/dd/yyyy is the most common format in the US. When speaking, I might say December 5, 2023, and this format matches that. dd/mm/yyyy isn't objectively better IMO. It's what you're used to, making it easier for you to read. It's not what I'm used to, making it harder for me to read. yyyy-mm-dd is the best format because it's sortable and unambiguous and standard: https://en.wikipedia.org/wiki/ISO_8601 yyyy/mm/dd isn'…

dd.mm.yyyy is better because it’s in an order, but that’s besides the point. If lots of native English speakers (Americans) use one way, and lots (U.K. and bros) use another, the only logical thing to do is use the unambiguous one (yyyy.mm.dd).

People who use mm.dd.yyyy in English text with no indication that they’re American, writing for Americans, have no place on this planet. Joking not joking.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#54

Post by monkeynotes »

TacticalCoder wrote: post #26
monkeynotes wrote: post #17

Earlier quoted context omitted.

Don't bots also get covertly installed on regular folks machines? And those machines will be running from domestic ISP IP address blocks which are commonly shared/cycled between the ISP's customers. Block those and you are blocking legit customers.

> Block those and you are blocking legit customers. The block doesn't need to be permanent. There are people out there publishing list of IPs known to belong to botnets and they're regularly updated. You can ban an IP for, say, 72 hours, and update your ipset regularly. But anyway I've got a philosophical question... If a customer has its computer owned by a botnet operator and that computer connects to a banking web…

Well you'd need to know if the customer or the bot is connecting. Both are on the same IP which was my point. Rationally I'd want to block any compromised device regardless of the customer, but it's a complex problem for sure.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#55

Post by mrb »

mrb wrote: post #19
hifromwork wrote: post #5

>It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line There's a significant mental leap here. "I block these IP to conserve my resources, therefore they belong to clueless or malicious organisations". It's wrong in both dire…

" the IP may be renewed every day or every hour) " What a coincidence! Right now from my phone on my carrier's network while traveling in the UK I am unable to reach https://cheapskatesguide.org My phone's IP address is likely on this guy's blacklist of 56M addresses. So I am forever going to remember whatever service this website provides may be arbitrarily unavailable unless I'm on a know good IP address. Overly ag…

I will also add the mentality of choosing to allow or deny access to your service for millions of IP addresses at a time based on some ill-defined rule or based on the service operator's whim is EXACTLY the same mentality that lead us to the current difficulty of running self-hosted email/outgoing SMTP servers.

"Oh because your dynamic IP address was assigned to and used by shady guys 2 years ago, now you cannot access my website, or all your emails will be flagged as spam."

Don't do that people.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#57

Post by nijave »

Sweepi wrote: post #42
justsomehnguy wrote: post #25

> It means that more than one percent of the IPv4 real estate on the Internet (and probably much more) is occupied by people and organizations who are either clueless or just do not care how much the rest of us are paying to keep our websites on line. Oh, tell me, how much? The whopping $5/month? Oh, maybe this is a high load WordPress/like CMS running on LAMP stack... so $8/month? > I wrote the following small PHP s…

Maybe the custom "blocked" 403/404 error page only shows up if your IP is blocked?

They could run a web server (or listener/virtual host) on a separate port and use a firewall to rewrite the destination port for "blocked" requests.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#58

Post by nijave »

SushiHippie wrote: post #48

Could it be that the slight delay between opening this page and my browser receiving the first bytes is nginx checking these 50 million IPs? How is this delay so small if there are really 50 million deny statements? Is there a reason why they don't use a firewall?

>How is this delay so small if there are really 50 million deny statements?

More a testament to the years of optimization nginx has undergone.

>Is there a reason why they don't use a firewall?

Some other comment said they have a custom error page for blocked requests although I think you could still have the firewall rewrite the destination port and have a listener that serves the custom access denied page there.

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#59

Post by Thorrez »

ghusto wrote: post #52
Thorrez wrote: post #40

Earlier quoted context omitted.

mm/dd/yyyy is the most common format in the US. When speaking, I might say December 5, 2023, and this format matches that. dd/mm/yyyy isn't objectively better IMO. It's what you're used to, making it easier for you to read. It's not what I'm used to, making it harder for me to read. yyyy-mm-dd is the best format because it's sortable and unambiguous and standard: https://en.wikipedia.org/wiki/ISO_8601 yyyy/mm/dd isn'…

dd.mm.yyyy is better because it’s in an order, but that’s besides the point. If lots of native English speakers (Americans) use one way, and lots (U.K. and bros) use another, the only logical thing to do is use the unambiguous one (yyyy.mm.dd). People who use mm.dd.yyyy in English text with no indication that they’re American, writing for Americans, have no place on this planet. Joking not joking.

>dd.mm.yyyy is better because it’s in an order,

DD/MM/YYYY vs MM/DD/YYYY each have pros and cons. I don't think we can objectively say 1 is better than the other. I agree YYYY-MM-DD is best. The standard is YYYY-MM-DD, not YYYY.MM.DD, so the dashed version is better than the dot version.

>People who use mm.dd.yyyy in English text with no indication that they’re American, writing for Americans, have no place on this planet. Joking not joking.

The same would apply to dd.mm.yyyy or dd/mm/yyyy with people who don't indicate what country they're from. A few other countries use DD/MM/YYYY:

https://en.wikipedia.org/wiki/Date_format_by_country

Re: Now Blocking 56,037,235 IP Addresses, and Counting

#60

Post by johnklos »

TekMol wrote: post #50
johnklos wrote: post #49

Earlier quoted context omitted.

Just because there are things that we can do about symptoms of a problem doesn't change the fact that the problem itself might bother some of us. For instance, it bothers me that certain networks quite literally do nothing about malicious actors attempting intrusion from those networks. Abuse complaints are ignored. Some people might say, "just run blocklistd", "use a non-standard port", et cetera, but the real issue…

when I send an email to a netblock's contacts with 1,000 login attempts, they should remove the accounts linked to that attempted intrusion. What proof can you give them that those login attempts really took place?

Logs.

If you're seriously suggesting that others shouldn't care because I could be making them up, then I suppose there's always vigilantism. After all, it can't be illegal if other people can't prove they didn't make up their own logs.

Are logs not real, like some people think birds and the Moon landings aren't real?

Post reply on HN