4 ms·

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only

I DO run a "public" service, in that it provides some info to people. However I run it at totally my own cost, the information is for entertainment value only (and not in the "I just say that to get around this being horrible in some way"; it's literally information about gaming and games), and I just don't need the hassle of the constant hack attempts. I block China and Russia, and have for years, using publicly available IP ranges. Yes, I know it's not going to get just China and Russia. Yes I know I'm blocking false positives. Yes I know I'm allowing false negatives. And honestly, I couldn't care less. It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. > Your approach to security has a number of issues. Your examples are a bit of non-sequitur. If I OVERBAN, I'm not decreasing my security. The non-(Chinese hacker) visitor in China can't get in, that's not a security issue. IP's being flagged as Chinese not being in China... can't get in also not a security issue. Vice versa is a bit of a security issue, with which the second layer of my security onion deals.

Skiiing 5y ago
You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country. I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.
grog454 5y ago
Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal. To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly. Now for DOS attacks, temporary IP blocks make perfect sense.
- mrjin 5y ago
  The thing is there are so many attackers/rookies out there. I wouldn't call them hacker as they are most likely noob running scripts to scan the network. Just seconds after I exposed my server's SSH port, there were failed login attempts. I wasn't worried about someone breaking in as I've harden my server with all the patches, no password login allowed and the private key was on a YubiKey which I don't have it myself. So unless there was a 0-day I haven't patched, it's very unlikely someone else can actually gain access to it. From the logs I could see lots of failed logins using various user names/passwords most likely using a dictionary. Those nonsense soon flooded my logs and I eventually had to change the SSH port as I could not stand that any longer. As you mentioned, simply ban couldn't help less. But anyway, their servers, their choices. I've no comment on that.
- michaelcampbell 5y ago
  > Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Thousands of brute force login attempts per day gone. The effect is, as you say, small, but it was non 0 and now it is 0, and it's a bunch of noise I don't have to wade through. > Failed login attempts / brute force attempts seem like the cost of doing business in public. Yup, and I pay that cost by blocking the source of 98% of them. > purely like a fear response with no rational basis (or at least a poor understanding of probability / stats) Thanks, clearly you know me well /s. And honestly, again, I don't feel that I even NEED a rational basis. It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks. If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you.
  - grog454 5y ago
    > If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you You are free to act under whatever impetus you want and while I did call in to question your motives (implicitly), I never meant that as a derision. I frequently ask myself "why am I doing this?". It usually doesn't hurt to self reflect. Edit: Something about this kept nagging me. And I think its this: >It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks. I see parallels to a sentiment that used to be fairly common in the U.S.: "It's my store, I'll refuse whomever I feel like refusing for whatever reason I want, thanks" Laws against that kind of thing are relatively new (1964?). You have a valid reason to block certain users (hacks) but do you really not see a problem extending that to national origin?
passivate 5y ago
Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable...
- karamanolev 5y ago
  I think the commenter wouldn't have any issue calling it an "Americas/Europe"-only service and by his (and arguably, my) logic, it doesn't sound questionable. One has to make choices.
- lowwave 5y ago
  think it is totally fine. Most the web is build around ASCII text any way. Since he is running it on his own dime, it is totally ok to not have Chinese/Russian visitors.
- alasdair_ 5y ago
  > Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable... The Seattle Public Library is a public service despite not allowing residents of Guangzhou to borrow books.
  - passivate 5y ago
    That is false. They can apply for a visitor card - which has a $25 fee. In any case, physical goods and services are not analogous to digital goods and services. Or are you redoing the the piracy-is-stealing argument??
    - alasdair_ 5y ago
      I'm doing the "it's still a 'public service' even if there are location restrictions" argument, since almost anything I can think of as a typical example of a "public service" (police, fire, medical, education, access to courts, etc.) also have location restrictions and we call all of those things "public services". If you want a special definition of "public service" that means "accessible every human on earth without any exclusions" then that's fine, but telling someone something isn't a public service because you want to use a special definition of the phrase that no one else seems to use is a bit... overly argumentative?
victor106 5y ago
> It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. Nailed it!!! I feel the same
mro_name 5y ago
totally agree. I can understand that limiting services is sad, but nobody has a claim either, right? So offering to some is way better than offering to none because of overwhelming opsec work (which is still secondary to the content). If the vandals show a pattern, it's bad luck if one shows the same. And proxying should be known to those who suffer from the block. Maybe internet has to let go the mania of offering everything to everybody all the time. Like real life.

Skiiing 5y ago

You typed my thoughts exactly. I run a popular website, and I just block everything from China, and do a Captcha challenge for others such as Russia. People don't have the right to access my website. If a Chinese citizen is (correctly) angry about the situation then they need to petition their government to change the culture that permits massive continuous hacking attempts from their country. I use Cloudflare which makes blocking countries simple, no need to keep updated IP lists.

grog454 5y ago

Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Failed login attempts / brute force attempts seem like the cost of doing business in public. I assume that if my servers are accessible from 1 or more public addresses, they WILL be subject to brute force attempts. I also assume that by making my passwords sufficiently randomized, the probability of these attacks having any effect is infinitesimal. To me, blocking an IP because it tried to log in to your servers seems purely like a fear response with no rational basis (or at least a poor understanding of probability / stats). By extension, blocking a range of IPs because of some arbitrarily elevated frequency of login attempts seems equally silly. Now for DOS attacks, temporary IP blocks make perfect sense.

mrjin 5y ago
The thing is there are so many attackers/rookies out there. I wouldn't call them hacker as they are most likely noob running scripts to scan the network. Just seconds after I exposed my server's SSH port, there were failed login attempts. I wasn't worried about someone breaking in as I've harden my server with all the patches, no password login allowed and the private key was on a YubiKey which I don't have it myself. So unless there was a 0-day I haven't patched, it's very unlikely someone else can actually gain access to it. From the logs I could see lots of failed logins using various user names/passwords most likely using a dictionary. Those nonsense soon flooded my logs and I eventually had to change the SSH port as I could not stand that any longer. As you mentioned, simply ban couldn't help less. But anyway, their servers, their choices. I've no comment on that.
michaelcampbell 5y ago
> Honest question: what impact did you see when you switched from not blocking China + Russia to blocking them? What type of attacks are you seeing primarily? Thousands of brute force login attempts per day gone. The effect is, as you say, small, but it was non 0 and now it is 0, and it's a bunch of noise I don't have to wade through. > Failed login attempts / brute force attempts seem like the cost of doing business in public. Yup, and I pay that cost by blocking the source of 98% of them. > purely like a fear response with no rational basis (or at least a poor understanding of probability / stats) Thanks, clearly you know me well /s. And honestly, again, I don't feel that I even NEED a rational basis. It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks. If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you.
- grog454 5y ago
  > If you want to deride me by calling into question my motives, you can do that too for whatever reason YOU want to, but that's on you You are free to act under whatever impetus you want and while I did call in to question your motives (implicitly), I never meant that as a derision. I frequently ask myself "why am I doing this?". It usually doesn't hurt to self reflect. Edit: Something about this kept nagging me. And I think its this: >It's my system, I'll block whomever I feel like blocking for whatever reason I want, thanks. I see parallels to a sentiment that used to be fairly common in the U.S.: "It's my store, I'll refuse whomever I feel like refusing for whatever reason I want, thanks" Laws against that kind of thing are relatively new (1964?). You have a valid reason to block certain users (hacks) but do you really not see a problem extending that to national origin?

passivate 5y ago

Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable...

karamanolev 5y ago
I think the commenter wouldn't have any issue calling it an "Americas/Europe"-only service and by his (and arguably, my) logic, it doesn't sound questionable. One has to make choices.
lowwave 5y ago
think it is totally fine. Most the web is build around ASCII text any way. Since he is running it on his own dime, it is totally ok to not have Chinese/Russian visitors.
alasdair_ 5y ago
> Can you really call it a public service if its not accessible to the public? Maybe a "Americas/Europe"-only service, but then it would sound questionable... The Seattle Public Library is a public service despite not allowing residents of Guangzhou to borrow books.
- passivate 5y ago
  That is false. They can apply for a visitor card - which has a $25 fee. In any case, physical goods and services are not analogous to digital goods and services. Or are you redoing the the piracy-is-stealing argument??
  - alasdair_ 5y ago
    I'm doing the "it's still a 'public service' even if there are location restrictions" argument, since almost anything I can think of as a typical example of a "public service" (police, fire, medical, education, access to courts, etc.) also have location restrictions and we call all of those things "public services". If you want a special definition of "public service" that means "accessible every human on earth without any exclusions" then that's fine, but telling someone something isn't a public service because you want to use a special definition of the phrase that no one else seems to use is a bit... overly argumentative?

victor106 5y ago

> It's my service, my information, my time, and my money, and I don't feel the least bit bad nor swayed by some appeal to morality or fairness. Nailed it!!! I feel the same

mro_name 5y ago

totally agree. I can understand that limiting services is sad, but nobody has a claim either, right? So offering to some is way better than offering to none because of overwhelming opsec work (which is still secondary to the content). If the vandals show a pattern, it's bad luck if one shows the same. And proxying should be known to those who suffer from the block. Maybe internet has to let go the mania of offering everything to everybody all the time. Like real life.