3 ms·

> Even so, we continue to serve about 100TB of “Access Denied” pages monthly! What's the carbon footprint of this?

ignoramous 4y ago
The thing with Access Denied is that these deprived clients retry with some vengeance. So, you're instead draining more resources than you'd like. I run a content-blocking DoH resolver, and this happened to us when we blocked IPs in a particular range and the result was... well... a lot of bandwidth for nothing.
- ameshkov 4y ago
  In this particular case this is not the case and they don't retry. They just really want to download updates REALLY often.
- sneak 4y ago
  Why serve any HTTP replies to those at all? If you are doing it at the IP level, why not just drop all inbound packets from the L3 address?
  - ignoramous 4y ago
    We were on Netifly way back then. So, no L3 blocks. Now on pages.dev and workers.dev, but haven't needed to enforce any rules yet.
  - DigitallyFidget 4y ago
    This is what I was wondering. I'm taking a wild guess that maybe they don't have that level of firewall access and it was being done through filtering by the webserver to provide an access denied.
- DigitallyFidget 4y ago
  But why bother with deny? Just send a blank text file (or one with as minimal data as needed to satisfy the rogue adblock) to the "blocked IPs" to mitigate the traffic for now. If firewall access exists, just drop the offending incoming traffic entirely.
  - bombcar 4y ago
    This is the correct answer, and basically you have to setup round-robin DDOS protection that provides these "wrong" answers. While still trying to allow valid traffic through.
  - ignoramous 4y ago
    > Just send a blank text file (or one with as minimal data as needed to satisfy the rogue adblock) to the "blocked IPs" to mitigate the traffic for now. The sent http body was blank, but I beleive we were still sending http head... > If firewall access exists, just drop the offending incoming traffic entirely. True, but the service we were using at the time didn't have a L3 firewall, and so we ended up moving out, after paying the bills in full, of course.
- arglebargle123 4y ago
  That reminds me of the absolutely insane amount of traffic my mother's Roku TV shits out when it can't resolve/reach its spyware and telemetry services. It's like 95-98% of the blocked traffic on her network. Is there a clean solution to this problem these days? Like some kind of adblocking router that resolves these addresses correctly but then routes packets destined for these services into a black hole so the requests eventually timeout? That would at least slow the repeat request floods down significantly.

The thing with Access Denied is that these deprived clients retry with some vengeance. So, you're instead draining more resources than you'd like. I run a content-blocking DoH resolver, and this happened to us when we blocked IPs in a particular range and the result was... well... a lot of bandwidth for nothing.

ameshkov 4y ago
In this particular case this is not the case and they don't retry. They just really want to download updates REALLY often.
sneak 4y ago
Why serve any HTTP replies to those at all? If you are doing it at the IP level, why not just drop all inbound packets from the L3 address?
- ignoramous 4y ago
  We were on Netifly way back then. So, no L3 blocks. Now on pages.dev and workers.dev, but haven't needed to enforce any rules yet.
- DigitallyFidget 4y ago
  This is what I was wondering. I'm taking a wild guess that maybe they don't have that level of firewall access and it was being done through filtering by the webserver to provide an access denied.
DigitallyFidget 4y ago
But why bother with deny? Just send a blank text file (or one with as minimal data as needed to satisfy the rogue adblock) to the "blocked IPs" to mitigate the traffic for now. If firewall access exists, just drop the offending incoming traffic entirely.
- bombcar 4y ago
  This is the correct answer, and basically you have to setup round-robin DDOS protection that provides these "wrong" answers. While still trying to allow valid traffic through.
- ignoramous 4y ago
  > Just send a blank text file (or one with as minimal data as needed to satisfy the rogue adblock) to the "blocked IPs" to mitigate the traffic for now. The sent http body was blank, but I beleive we were still sending http head... > If firewall access exists, just drop the offending incoming traffic entirely. True, but the service we were using at the time didn't have a L3 firewall, and so we ended up moving out, after paying the bills in full, of course.
arglebargle123 4y ago
That reminds me of the absolutely insane amount of traffic my mother's Roku TV shits out when it can't resolve/reach its spyware and telemetry services. It's like 95-98% of the blocked traffic on her network. Is there a clean solution to this problem these days? Like some kind of adblocking router that resolves these addresses correctly but then routes packets destined for these services into a black hole so the requests eventually timeout? That would at least slow the repeat request floods down significantly.