4 ms·

Please do not engage in IP blocking, this is one of the most evil things that you can do on a site, along with displaying a white page when the user has JS disa

Please do not engage in IP blocking, this is one of the most evil things that you can do on a site, along with displaying a white page when the user has JS disabled and using Google reCAPTCHA.

alaties 8y ago
That's easy to say in general. However, in the case of mitigation of a Denial of Service attack, using IP blocking is an effective temporary measure. From my experience in dealing with HTTP DDoS-style attacks there's usually a pretty consistent block of IP addresses where the attack originates from, i.e. an AWS or Hetzner IP range. When the choices are to block IPs temporarily or have the entire service go down due to resource exhaustion, the choice is pretty clear cut. We'd implement the block to keep our service up then report attacker IPs to AWS or whoever maintained the range in question. As the attack waned, we'd re-enable the range. Of course, IP blocks usually did not work as well with udp-based reflection style DDoS mitigation, but we'd still see certain IP ranges responsible for significant portion of the attack. We ran our own hardware though, so resources like CPU and inbound bandwidth weren't elastic enough to outpace an escalating DDoS past 120-140 Gbps. We also eventually moved to adding DDoS mitigation through third parties like CloudFlare.
lucb1e 8y ago
I assume the IPs are only blocked after a known attack and not indefinitely, not based on blocklists from third parties or indefinitely (think spamhaus, which is rather beneficial to a few big players). Of course banning users without JS and using Google's CAPTCHAs is a big pain in the ass, but if someone requests my /phpmyadmin/setup.php out of the blue (never saw the IP before, not a known person who is just curious about my site), I think it's fair game to block the IP. I don't because I'd much rather know what other attacks they are using, but I do not think it's unethical to do so, given of course temporarily and locality.
GordonS 8y ago
As long as the blocks are temporary, and of course there is a good reason for the block, I actually think it makes a lot of sense.
- AnaniasAnanas 8y ago
  I agree with you, sadly it seems that most that do ban IPs tend to do it permanently and without a good reason (I do not think that banning all the IPs of all dedicated servers and tor nodes in the world has a good reason)
- pewdiepotpie 8y ago
  if you keep banning IPs then you eventually get to a point where its more efficient, and cost effective to just yank the cable and, ignore the internet.

Please do not engage in IP blocking, this is one of the most evil things that you can do on a site, along with displaying a white page when the user has JS disabled and using Google reCAPTCHA.

alaties 8y ago

That's easy to say in general. However, in the case of mitigation of a Denial of Service attack, using IP blocking is an effective temporary measure. From my experience in dealing with HTTP DDoS-style attacks there's usually a pretty consistent block of IP addresses where the attack originates from, i.e. an AWS or Hetzner IP range. When the choices are to block IPs temporarily or have the entire service go down due to resource exhaustion, the choice is pretty clear cut. We'd implement the block to keep our service up then report attacker IPs to AWS or whoever maintained the range in question. As the attack waned, we'd re-enable the range. Of course, IP blocks usually did not work as well with udp-based reflection style DDoS mitigation, but we'd still see certain IP ranges responsible for significant portion of the attack. We ran our own hardware though, so resources like CPU and inbound bandwidth weren't elastic enough to outpace an escalating DDoS past 120-140 Gbps. We also eventually moved to adding DDoS mitigation through third parties like CloudFlare.

lucb1e 8y ago

I assume the IPs are only blocked after a known attack and not indefinitely, not based on blocklists from third parties or indefinitely (think spamhaus, which is rather beneficial to a few big players). Of course banning users without JS and using Google's CAPTCHAs is a big pain in the ass, but if someone requests my /phpmyadmin/setup.php out of the blue (never saw the IP before, not a known person who is just curious about my site), I think it's fair game to block the IP. I don't because I'd much rather know what other attacks they are using, but I do not think it's unethical to do so, given of course temporarily and locality.

GordonS 8y ago

As long as the blocks are temporary, and of course there is a good reason for the block, I actually think it makes a lot of sense.

AnaniasAnanas 8y ago
I agree with you, sadly it seems that most that do ban IPs tend to do it permanently and without a good reason (I do not think that banning all the IPs of all dedicated servers and tor nodes in the world has a good reason)
pewdiepotpie 8y ago
if you keep banning IPs then you eventually get to a point where its more efficient, and cost effective to just yank the cable and, ignore the internet.