6 ms·

> VPS IP? Bot. > The other 0.0001% are people using "workstation in the cloud" services. Yeah, no. I've been using VPNs/SSH tunnels/proxies set up on various

> VPS IP? Bot. > The other 0.0001% are people using "workstation in the cloud" services. Yeah, no. I've been using VPNs/SSH tunnels/proxies set up on various VPS hosters/"cloud" vendors for more than a decade to bypass heavy internet censorship. It is much cheaper than using ready-made VPN solutions, and the server can be reused for other purposes. I understand that may be <0.1% of your market, but it's not 0. We're definitely used to being treated as third-class internet citizens not only by our own government, but also by various internet companies, which your comment demonstrates pretty clearly. Here's a nice write-up. It's not mine, and it's not even the same country, but the experience he describes is very relatable. https://shahinsorkh.ir/2019/07/20/how-is-it-like-to-be-a-dev-in-iran https://shahinsorkh.ir/2019/07/20/how-is-it-like-to-be-a-dev...

taf2 4y ago
Just curious which cloud based software as a service subscriptions have you purchase and actively maintain? Also approximately how many $ a year to you spend on those services? I’m curious because blocking IPs from bad actors is often the most effective and immediate solution to protect a service from a bad actor… it would be nice to understand the financial impact of this.
derefr 4y ago
If there was a list of commercial VPN provider IP ranges, we’d block that too. A key property of people who aren’t willing to relinquish their anonymity for even a moment in registering for your service, is that they’ll never be able to pay money for your service, either, because doing so would reveal their identity through their credit card. (Yes, they can use Bitcoin or whatever, but then you’re basically signing up to be a dark web business, having to deal with being a money-laundering sink for stolen funds.) So, if your goal in getting users to sign up, is to feed them through a funnel that eventually ends up with them paying you money, then you can take “signs up using a VPN” (or an email anonymization service, or…) as an immediate self-disqualification. Of course, most such failed attempts are innocent first-time “I didn’t realize you cared” attempts; so we just throw a clear error message, telling them to try again with their real email+IP+etc. But when a user responds to that error by just trying more and more email proxy domains, or repeatedly rotating their VPN country… well, that’s someone who’ll never be a customer. May as well just block them and be done with it.
- leshenka 4y ago
  Have you ever considered that some people use vpn in order to be able access your service not because they want to hide from you?
  - derefr 4y ago
    Yes. Despite wanting to, those people will also be unable to ever pay for our service, because — amongst other reasons — our service is hosted on Google Cloud; and Google has decided to block people in countries which the US trade-embargoes, from interacting with any Google servers — including Google Cloud customer servers. It's a whole thing. We'd have to go multi-cloud to get around it. (AWS solved this by building an AWS China region that's actually owned-and-operated by Chinese companies without Amazon leadership.)
    - viraptor 4y ago
      That's a big assumption that they won't be able to pay you. It may be economically true enough that you don't care, but "unable to ever pay for our service" is not a given. My physical location or current internet connection does not determine where my payment method exists. This is similar to for example Vodafone not listing their mobile app in countries they don't operate in so I can't install it to recharge a sim I'm going to use in a week... in one of those countries. Or ANZ bank making it hard to get their app from abroad.
      - derefr 4y ago
        If it was practical to do so (maybe involving a clever splitting of customer dashboard pages onto different domains in different Cloudflare zones?), we would only shut off free-tier access for these people, while still allowing sign-ups that skip the promotion and take (and place a hold on) a card straight from the start. Sort of like how some people can't qualify for a post-paid cellphone plan, but anyone can get a prepaid cellphone plan. As it is, though, we can't block VPNs even if we wanted to; VPN companies are currently winning the arms race against VPN detection. (You can tell who's currently on the winning side this week by whether you see YouTube ads that make the claim that you can use a VPN to enable geo-shifting for Netflix. Netflix is legally obligated by its IP licence-agreements to do what it can to shut that down; and whenever they manage it, the VPN services stop making that claim for a while, until they figure out how to make it happen again. Currently, they're making it.)
Grimburger 4y ago
> for more than a decade Surely that is not a pleasant web browsing experience? How do you deal with the constant captchas or straight-up blocks against vps ip ranges? Commercial vpn's for all their faults are treated much better than a diy setup on average.

taf2 4y ago

Just curious which cloud based software as a service subscriptions have you purchase and actively maintain? Also approximately how many $ a year to you spend on those services? I’m curious because blocking IPs from bad actors is often the most effective and immediate solution to protect a service from a bad actor… it would be nice to understand the financial impact of this.

derefr 4y ago

If there was a list of commercial VPN provider IP ranges, we’d block that too. A key property of people who aren’t willing to relinquish their anonymity for even a moment in registering for your service, is that they’ll never be able to pay money for your service, either, because doing so would reveal their identity through their credit card. (Yes, they can use Bitcoin or whatever, but then you’re basically signing up to be a dark web business, having to deal with being a money-laundering sink for stolen funds.) So, if your goal in getting users to sign up, is to feed them through a funnel that eventually ends up with them paying you money, then you can take “signs up using a VPN” (or an email anonymization service, or…) as an immediate self-disqualification. Of course, most such failed attempts are innocent first-time “I didn’t realize you cared” attempts; so we just throw a clear error message, telling them to try again with their real email+IP+etc. But when a user responds to that error by just trying more and more email proxy domains, or repeatedly rotating their VPN country… well, that’s someone who’ll never be a customer. May as well just block them and be done with it.

leshenka 4y ago
Have you ever considered that some people use vpn in order to be able access your service not because they want to hide from you?
- derefr 4y ago
  Yes. Despite wanting to, those people will also be unable to ever pay for our service, because — amongst other reasons — our service is hosted on Google Cloud; and Google has decided to block people in countries which the US trade-embargoes, from interacting with any Google servers — including Google Cloud customer servers. It's a whole thing. We'd have to go multi-cloud to get around it. (AWS solved this by building an AWS China region that's actually owned-and-operated by Chinese companies without Amazon leadership.)
  - viraptor 4y ago
    That's a big assumption that they won't be able to pay you. It may be economically true enough that you don't care, but "unable to ever pay for our service" is not a given. My physical location or current internet connection does not determine where my payment method exists. This is similar to for example Vodafone not listing their mobile app in countries they don't operate in so I can't install it to recharge a sim I'm going to use in a week... in one of those countries. Or ANZ bank making it hard to get their app from abroad.
    - derefr 4y ago
      If it was practical to do so (maybe involving a clever splitting of customer dashboard pages onto different domains in different Cloudflare zones?), we would only shut off free-tier access for these people, while still allowing sign-ups that skip the promotion and take (and place a hold on) a card straight from the start. Sort of like how some people can't qualify for a post-paid cellphone plan, but anyone can get a prepaid cellphone plan. As it is, though, we can't block VPNs even if we wanted to; VPN companies are currently winning the arms race against VPN detection. (You can tell who's currently on the winning side this week by whether you see YouTube ads that make the claim that you can use a VPN to enable geo-shifting for Netflix. Netflix is legally obligated by its IP licence-agreements to do what it can to shut that down; and whenever they manage it, the VPN services stop making that claim for a while, until they figure out how to make it happen again. Currently, they're making it.)

Grimburger 4y ago

> for more than a decade Surely that is not a pleasant web browsing experience? How do you deal with the constant captchas or straight-up blocks against vps ip ranges? Commercial vpn's for all their faults are treated much better than a diy setup on average.