3 ms·
If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of
by hueving 8y ago
If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of detecting phishing/malware sites.
Seriously, blacklisting tlds is not how to secure a network. If you can't trust your users and browsers enough to prevent phishing on a .io domain, they're gonna get phished on a .com and a .net. The existence of free dynamic dns services on both of those should be enough evidence for you to rethink that.
If your network is that sensitive you need to be whitelisting specific trusted IPs and blocking everything else. Your current approach to security is the kind of attitude that breaks the internet for nebulous gains. Do you block ipv6 too?
- AnIdiotOnTheNet 8y ago> If you're using domain tlds as a heuristic strong enough to make blocking decisions your users are going to get wrecked because you don't have a real method of detecting phishing/malware sites. You say that like it is the only measure we employ to guard against malware and phishing. We have many other measures in place. If this mechanism were causing more trouble than it was worth I'd be among the first to say we should ditch it. > Do you block ipv6 too? Sadly our ISP doesn't even support IPv6.