I have my own system of IP reputation whereby if an IP address hits one of my systems with some probe or scan that I didn't ask for, then it's blocked for 12 months.
P.S. just to add a note here that I have been blocked out of my own systems occasionally from mobile / remote IPs due to my paranoia-level setup. But I treat that as learning / refinement, but also can accept that as the cost of security sometimes.
Yeah, my setup is purely for my own security reasons and interests, so there's very little downside to my scorched earth approach.
I do, however, think that if there was a more widespread scorched earth approach then the issues like those mentioned in the article would be much less common.
In such a world you can say goodbye to any kind of free Wi-Fi, anonymous proxy etc., since all it would take to burn an IP for a year is to run a port scan from it, so nobody would risk letting you use theirs.
Fortunately, real network admins are smarter than that.
Pretty much. I think there's also a responsibility on the part of the network owner to restrict obviously malicious traffic. Allow anonymous people to connect to your network and then perform port scans? I don't really want any traffic from your network then.
Yes, there are less scorched-earth ways of looking at this, but this works for me.
As always, any of this stuff is heavily context specific. Like you said: network admins need to be smart, need to adapt, need to know their own contexts.
This is how you get really annoying restrictions on public networks, because some harmless traffic will inevitably be miscategorized by an overeager firewall/DPI system.
I’m not saying that there should be zero consequences for allowing bad traffic from your network, but there’s a balance, and I would hate a world in which your policy were more common.
Arguably we are already partially living in that world, as some companies are already blanket-banning entire countries, VPNs etc., rather than coming up with more fine-grained strategies or improving their authentication systems to make brute force login attempts harder. It’s incredibly annoying.
Not all of us have cell plans with hotspots ($$$), hotspots often have data caps, cell is often slower or congested, and there are some areas without cell signal. It's also kind of silly from a wider perspective to shove everyone onto the cellular network when most businesses have perfectly decent fiber internet nowadays.
Sure, I'm usually on hotspot, but I personally appreciate when businesses have wifi. Either way, there are always going to be shared networks somewhere.
What we should actually be doing is WiFi using SIM cards as authentication.
Have it count against your data cap (but make it much cheaper than cellular data). Pay part of that revenue to hotspot-owning businesses. If something bad happens, use the logs that telecoms are already required to keep.
It's very strange to me that we don't have something like this already.
How about we don't? We really don't need to tie even more things to SIM cards and phone numbers.
Criminals have more than enough ways to still get anonymous SIM cards (at least until every country on the planet makes KYC mandatory for prepaid SIMs), and legitimate users are greatly inconvenienced by this.
> Pay part of that revenue to hotspot-owning businesses.
To subsidize a network connection they probably already need for their business operations, e.g. their payment terminal or POS? Why should I? The marginal cost of an incremental byte on wired Internet connections is basically zero, these days. It's literally too cheap to meter, so why bother?
Besides the centralization and tracking concerns, not nearly every device has a SIM card. Why does my Laptop not deserve to access a coffee shop Wi-Fi, my Kindle to use an in-flight conenction, or my smartwatch to use the gym's network for podcasts?
It's very strange to me that people keep trying to willingly ruin the open Internet.
I live in a country that has mandatory SIM registration, and it's stopping exactly zero organized criminals – these can just pay a tiny bit more and buy burner phones and use out-of-country SIM cards – while it's making life more complicated and expensive for the average citizen.
Expensive because KYC isn't cheap, and guess who pays for that in the end... And that is assuming that your form of ID is even accepted as a foreigner. In a different country, I literally just spent two days sending back and forth selfies holding my passport(!) to little success. And I guess the customer support reps could now just use the same photos to impersonate me elsewhere, since passport photos provide absolutely zero domain binding and are just about the dumbest thing still seeing widespread adoption.
I don't often use registration-free public Wi-Fis, but I love that they exist, and I would hate if they'd be taken away too. I also just transited at an airport that requires passport scans for Wi-Fi usage, and it feels so backwards.
Thanks for being honest about this, though. I was always wondering who all these people were that are seriously in favor of all this dystopian stuff. Would love to hear why you think that it's a net positive for society.
> What an incredibly short-sighted, dystopian view.
You do recognize that the person I kept replying to was not asking these questions in earnest, right? They were all carefully directed questions, specifically designed to confirm their world view. I played into it, because I think they're pitiful and hilarious. Serves them right. Their latest question about government criticisms completes the caricature perfectly. All they're missing is referencing or quoting Orwell.
> I live in a country that has mandatory SIM registration, and it's stopping exactly zero organized criminals – these can just pay a tiny bit more and buy burner phones and use out-of-country SIM cards – while it's making life more complicated and expensive for the average citizen.
Pretty much the same here to my understanding. There's no credible evidence I'm aware of that'd suggest the criminal use of phone networks decreased significantly thanks to these. It might have improved on the exhaustion rate of the numbering pool, but I don't think we were particularly close to exhausting it anyways. Most benefit I can think of is a chance at traceability, but how well realized vs abused that is, no idea. Just like with IP leasing described in the article above, enlisting the help SIM mules has a long standing tradition, after all.
Any addressing system that relies on non-cryptographic identifiers will be prone to all kinds of mass misuse. There's no amount of lawmaking, honest or not, that could be implemented to counteract these. It's just like email.
> Thanks for being honest about this, though.
Except I really wasn't, and I find it both remarkably funny but also extremely concerning how on board you guys are with it. Propaganda and culture sure are powerful.
The current ways of identity verification are broken, and are prone to enable surveillance: this is something I fully recognize. What I refuse to recognize however is that the concept of identity verification would be wrong wholesale. There was another thread on here a few days ago that I did comment on, but the bottom line is, in my understanding there's no mathematical reason that things would have to be this way. Its shortcomings, including its enablement of mass surveillance, are an implementation issue, not something fundamental to the idea per se.
Being able to trust that a stranger you're talking to is
- an actual specific person
- is actually a stranger
are bottom of the barrel human expectations that communications technology have completely shattered. Technologically guaranteeing these, to the extent the analog hole problem allows for it, does not require dystopian practices. I'm confident that the lack of these guarantees is the root of many societal problems we see at large today. For better or for worse, a lot of people live a lot of their lives on the internet these days, but the internet is no hospitable place for them, among else for these exact reasons.
Accountability is a good thing. I refuse to let it be monkey paw-d by people who mean unwell into being recognized as a tool for evil, and I think you should too. Trust being abused by a centralized system does not mean trust is wrong. It means there are abusers at the wheel. The solution is not mistrust, or even systems that require less trust necessarily, although both can be useful. The solution is reworking the system to get more trustworthy people into the leading positions, and to make it so that those who have demonstrated to be not deserving are thrown out more readily. It is most unfortunate that this listing is ordered exactly by difficulty, from easiest to hardest. Trust is easily broken, and human systems are impossibly hard to get right. I don't think this justifies giving up though.
My profile is not blank. You can page through all my comments, posts, and favorites to your liking.
Did you actually bother to understand what I said by the way? Are you able to formulate a post that isn't just a bare minimum asinine rhetorical question?
> The current ways of identity verification are broken, and are prone to enable surveillance: this is something I fully recognize. What I refuse to recognize however is that the concept of identity verification would be wrong wholesale. There was another thread on here a few days ago that I did comment on, but the bottom line is, in my understanding there's no mathematical reason that things would have to be this way. Its shortcomings, including its enablement of mass surveillance, are an implementation issue, not something fundamental to the idea per se.
Put into more exact terms, your way of wanting to verify my identity is the same one you criticize governments and businesses for doing. It is not one I think is a good idea either, despite how you're trying to present this. I just retain the opportunity for there being other, better ways, whereas you don't.
Mind you, there's no reason to think that those who do publish such information do it because they're here to champion accountability. Note the type of forum this was originally supposed to be. It's in part a place for self-advertising. Many contact details you find on bios are visibly and explicitly HN specific.
Haha, nice, I run something similar.. But more manualy managed and I put those bans pernametly. Currneltly, there are 1360 blocks in drop list and growing.
I never really remove them, because even those leased blocks move from one spam/abuse operator to another, so no big loss.
And indeed, if people would fight w/ spam/abuse better and more aggresivly, the problem would be much smaller. I dont care anymore, In my opinion Internet is done. Time to start building overlay networks with services for good guys...
If you actually wanted your site or service to be accessible you’d run in to issues immediately since once IP would have cycled between hundreds of homes in a year.
Additional explanation: this is primarily a personal setup.
There would be a lot of refinement and contingencies to implement something like this for corporate / business.
Having said that, I still exist on the ruthless side of blocking equation. I'd generally prefer some kind of small allow list than a gigantic block list, but this is how it's (d)evolved.
How is this better than blocking after a certain quantity in a range of time instead?
Single queries should never be harmful to something openly accessible. DOS is the only real risk, and blocking after a certain level of traffic solves that problem much better with less possibility of a false positive, and no risk to your infrastructure, either.
I haven't manually reviewed my lists for a while, but I did similar checks for X IP addresses detected from within a /24 block to determine whether I should just block the whole /24.
Manual reviewing like this also helped me find a bunch of organisations that just probe the entire IPv4 range on a regular basis, trying to map it for 'security' purposes. Fuck them, blocked!
P.S. I wholeheartedly support your choice of blocking for your reasons.
But not that much, unfortunately. Those same "cYbeRseCUrITy" orgs also ingest SSL transparency logs, resolve A and AAAA for all the names in the cert, then turn around and start scanning those addresses.
In my experience, it only takes a few hours from getting an SSL certificate to junk traffic to start rolling in, even for IPv6-only servers.
Small percentage of that could be attributed directly, based on "BitSightBot", "CMS-Checker", "Netcraft Web Server Survey", "Cortex-Xpans" and similar keywords in user-agent and referer headers. And purely based on timing, there's a lot more of that stuff where scanners try and blend in.
Yes. Fucking censys and internet-measurement and the predatory "opt-out" of scans. What about opting-in to scan my website? Fuck you, i'm blocking you forever
Back in the day - port knocking was a perfect fit for this eventuality.
Nowadays, wireguard would probably be a better choice.
(both of above of course assume one is to do a sensible thing and add "perma-bans" a bit lower in firewall rules, below "established" and "port-knock")
Anything important requires wireguard, you can use that on any personal device. For situations like plex from the hotel TV on vacation, I have a workflow that lets me quickly whitelist a client with my firewall specially for access to plex.
Not everything "requires" Wireguard. Wireguard is great, and I use it myself for many things, but it's totally fine to expose some services to the public Internet.
https://github.com/UninvitedActivity/UninvitedActivity
P.S. just to add a note here that I have been blocked out of my own systems occasionally from mobile / remote IPs due to my paranoia-level setup. But I treat that as learning / refinement, but also can accept that as the cost of security sometimes.