4 ms·
> I had an idea to build a generic Webhook service. My thought was that the actual machine that does the requests should be 100% isolated from our VPS and only
by simcop2387 8y ago
> I had an idea to build a generic Webhook service. My thought was that the actual machine that does the requests should be 100% isolated from our VPS and only have public network access. Would that largely stop this attack? Perhaps it should also have a rate limiter to prevent DDOS attacks.
This would at least prevent it from attacking your own internal services but wouldn't prevent it from being made to make requests to other outside services. Effectively leaving you up as a potential proxy for other attacks. I.e. the SMTP TLS stuff, making you able to send spam on someone else's behalf. A bit nuts.
- jsjohnst 8y ago> but wouldn't prevent it from being made to make requests to other outside services. But could be done via host firewall rules to some extent.
- Kalium 8y agoVery true! Firewall rules with a strict filter could contain this! Of course, that assumes you're not doing something like running in AWS and using the AWS firewall. And that your firewall never has any issues at all. In general, defense in depth is a preferable strategy. Your entire defense should never be reliant upon a single control.
- jsjohnst 8y ago> Your entire defense should never be reliant upon a single control. Exactly why I used “to some extent” as a suffix to the statement. One tool alone doesn’t necessarily make you safe, but it might be enough for practical purposes depending on your risk profile.