3 ms·

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries

Ultimately the solution is probably to begin to firewall off parts of the Internet by national boundaries. We should allow cross-country traffic where countries follow the same rules of order as we do. You can remove a lot of threats by just blocking every country you have no desire to reach people in. And if major hosting and cloud providers were restricted similarly such that foreign actors can't just rent US servers to stage attacks from... I'm aware this is an unpopular opinion amongst tech crowds, but it's impossible to maintain order in an environment where some people have to obey the law and some people don't.

deleted 5y ago
[deleted]
toomuchtodo 5y ago
You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as a business decision.” (fintech) It doesn’t solve the problem, but it’s low hanging fruit, and a few checkboxes (or lines of Terraform) if you’re at a cloud provider and using the usual primitives.
- ocdtrekkie 5y ago
  Yeah, there's businesses with global markets that can't afford such a shield, but if you've got a local/physical business or you ship product only to residents of specific countries, it's basically zero cost with great upsides.
- aledalgrande 5y ago
  How does that protect you from VPNed traffic? Or residential proxies? Local botnets?
  - toomuchtodo 5y ago
    It doesn’t.
arp242 5y ago
Some services do this. I live in Indonesia at the moment and there are various Dutch websites I can't access: I can't view the website of a political party for example, and I can't access newyorkpizza.nl either to unsubscribe from their stupid newsletter emails (I just blackholed them, but still). I also couldn't view their data breach announcement from a few weeks ago. Some news websites block foreign access as well. ACM also blocked a lot of Indonesian IP addresses (because "infiltrated by sci-hub" according to their support, but since carried-grade NAT is ubiquitous here you end up blocking vast swaths of the country). All in all, it's really annoying. Yeah, you're going to stop various bad actors with this – no denying that – but you're also going to block your own nationals who happen to be abroad. Especially for a lot of critical services (banks, gov't, etc.) it's pretty much a non-starter.
tkojames 5y ago
No this is not the right approach at all in my opinion. What stops someone from one of the countries using IP's from another? Teenagers in USA are gonna try and hack your stuff as well... I was one of them in my youth. You can't just block china and half ass your setup. You will get attacked from everywhere always. Anything you put on the internet is a target. Always has been always will be.
- ocdtrekkie 5y ago
  > What stops someone from one of the countries using IP's from another? That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
  - tkojames 5y ago
    But how? How can US cloud providers stop this? I am really curious how from my understanding it is not possible with how things are currently setup.
    - ocdtrekkie 5y ago
      Of course it's possible: KYC. As it is, cloud providers already tend to require credit cards when setting up an account that can possibly generate any sort of billing.

deleted 5y ago

[deleted]

toomuchtodo 5y ago

You’re not wrong. If you don’t have a business need to talk to some IP blocks and AS’, by all means, black hole traffic from jurisdictions who aren’t going to do diddly when someone causes you harm. I see this often with client WAF configurations depending on the endpoint use case and who is expected to be hitting that endpoint. “You’re blocking everyone outside of North America?” “Yes, we’re comfortable with that as a business decision.” (fintech) It doesn’t solve the problem, but it’s low hanging fruit, and a few checkboxes (or lines of Terraform) if you’re at a cloud provider and using the usual primitives.

ocdtrekkie 5y ago
Yeah, there's businesses with global markets that can't afford such a shield, but if you've got a local/physical business or you ship product only to residents of specific countries, it's basically zero cost with great upsides.
aledalgrande 5y ago
How does that protect you from VPNed traffic? Or residential proxies? Local botnets?
- toomuchtodo 5y ago
  It doesn’t.

arp242 5y ago

Some services do this. I live in Indonesia at the moment and there are various Dutch websites I can't access: I can't view the website of a political party for example, and I can't access newyorkpizza.nl either to unsubscribe from their stupid newsletter emails (I just blackholed them, but still). I also couldn't view their data breach announcement from a few weeks ago. Some news websites block foreign access as well. ACM also blocked a lot of Indonesian IP addresses (because "infiltrated by sci-hub" according to their support, but since carried-grade NAT is ubiquitous here you end up blocking vast swaths of the country). All in all, it's really annoying. Yeah, you're going to stop various bad actors with this – no denying that – but you're also going to block your own nationals who happen to be abroad. Especially for a lot of critical services (banks, gov't, etc.) it's pretty much a non-starter.

tkojames 5y ago

No this is not the right approach at all in my opinion. What stops someone from one of the countries using IP's from another? Teenagers in USA are gonna try and hack your stuff as well... I was one of them in my youth. You can't just block china and half ass your setup. You will get attacked from everywhere always. Anything you put on the internet is a target. Always has been always will be.

ocdtrekkie 5y ago
> What stops someone from one of the countries using IP's from another? That's why this approach is only really complete if supported at a national level. Cloud providers in the US shouldn't be allowing foreign actors to rent them, for instance.
- tkojames 5y ago
  But how? How can US cloud providers stop this? I am really curious how from my understanding it is not possible with how things are currently setup.
  - ocdtrekkie 5y ago
    Of course it's possible: KYC. As it is, cloud providers already tend to require credit cards when setting up an account that can possibly generate any sort of billing.