71–80 of 516 posts
Earlier quoted context omitted.
At that point it almost sounds like we're doing "peering" agreements at the IP level. Would it make sense to have a class of ISPs that didn't peer with these "bad" network participants?
Why not just ban all IP blocks assigned to cloud providers? Won't halt botnets but the IP range owned by AWS, GCP, etc is well known
One starts to wonder, at what point might it be actually feasible to do it the other way around, by whitelisting IP ranges. I could see this happening as a community effort, similar to adblocker list curation etc.
Many US companies do it already. It should be illegal, at least for companies that still charge me while I’m abroad and don’t offer me any other way of canceling service or getting support.
We block China and Russia. DDOS attacks and other hack attempts went down by 95%. We have no chinese users/customers so in theory this does not effect business at all. Also russia is sanctioned and our russian userbase does not actually live in russia, so blocking russia did not effect users at all.
How did you choose where to get the IP addresses to block? I guess I'm mostly asking where this problem (i.e. "get all IPs for country X") is on the scale from "obviously solved" to "hard and you need to play catch up constantly". I did a quick search and found a few databases but none of them looks like the obvious winner.
If your site is behind cloudflare, blocking/challenging by country is a built-in feature.
Earlier quoted context omitted.
At that point it almost sounds like we're doing "peering" agreements at the IP level. Would it make sense to have a class of ISPs that didn't peer with these "bad" network participants?
Why not just ban all IP blocks assigned to cloud providers? Won't halt botnets but the IP range owned by AWS, GCP, etc is well known
Not sure what my point is here tbh. The internet sucks and I don't have a solution
We block China and Russia. DDOS attacks and other hack attempts went down by 95%. We have no chinese users/customers so in theory this does not effect business at all. Also russia is sanctioned and our russian userbase does not actually live in russia, so blocking russia did not effect users at all.
How did you choose where to get the IP addresses to block? I guess I'm mostly asking where this problem (i.e. "get all IPs for country X") is on the scale from "obviously solved" to "hard and you need to play catch up constantly". I did a quick search and found a few databases but none of them looks like the obvious winner.
If ipv6 ever becomes a thing, it'll make blocking all that much harder.
No, it's really the same thing with just different (and more structured) prefix lengths. In IPv4 you usually block a single /32 address first, then a /24 block, etc. In IPv6 you start with a single /128 address, a single LAN is /64, an entire site is usually /56 (residential) or /48 (company), etc.
/128: single application
/64: single computer
/56: entire building
/48: entire (digital) neighborhood
Since I posted an article here about using zip bombs [0], I'm flooded with bots. I'm constantly monitoring and tweaking my abuse detector, but this particular bot mentioned in the article seemed to be pointing to an RSS reader. I white listed it at first. But now that I gave it a second look, it's one of the most rampant bot on my blog. [0]: https://news.ycombinator.com/item?id=43826798
Earlier quoted context omitted.
[flagged]
The origin of the term 'black list' had absolutely nothing to do with the melanin content of anyone . In fact, when that term was coined, it had nothing to do with the melanin content of anyone . It was a list of the enemies of Charles II. That's why I posted that. I'd also point out that in my lifetime , folks with darker skin called themselves black and proudly so. As Mr. Brown[0][1] will unambiguously tell you. Re…
You can blunt instrument 403 geoblock entire countries if you want, or any user agent, or any netblock or ASN. It’s entirely up to you and it’s your own server and nobody will be legitimately mad at you.
You can rate limit IPs to x responses per day or per hour or per week, whatever you like.
This whole AI scraper panic is so incredibly overblown.
I’m currently working on a sniffer that tracks all inbound TCP connections and UDP/ICMP traffic and can trigger firewall rule addition/removal based on traffic attributes (such as firewalling or rate limiting all traffic from certain ASNs or countries) without actually having to be a reverse proxy in the HTTP flow. That way your in-kernel tables don’t need to be huge and they can just dynamically be adjusted from userspace in response to actual observed traffic.
We solved a lot of our problems by blocking all Chinese ASNs. Admittedly, not the friendliest solution, but there were so many issues originating from Chinese clients that it was easier to just ban the entire country. It's not like we can capitalize on commerce in China anyway, so I think it's a fairly pragmatic approach.
Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?