13 ms·

Unintended consequences of blocking IP addresses

• rolph 4y ago
  im sure most of us immediately see the fallacy to be revealed. i think TFA summed it up such as: "It would be hard to imagine, for example, that a court in response to alleged wrongdoing would blindly issue a search warrant or an order based solely on a street address without caring if that address was for a single family home, a six-unit condo building, or a high rise with hundreds of separate units. But those sorts of practices with IP addresses appear to be rampant."
  • themusicgod1 4y ago
    It's not hard for anyone who lived through the 90's/early naughts to imagine the US or other legal systems completely diverging from proportional action on computer 'crime', especially when large corporate interests are involved. The archives of Off the Hook are full of such examples https://2600.com/offthehook/ https://2600.com/offthehook/
    • rolph 4y ago
      i love breadcrumbs; thanx. i hungaround on astalavista quite a lot when it was the thing.
  • johnchristopher 4y ago
    Well, swatting is a thing.
  • CJefferson 4y ago
    However, a court will issue a search warrant for the entirety of a shared house, as there is no external way to distinguish which time are used by who from the outside. The problem with this article I have is it says "no IP banning" without, as far as I can see, suggesting an alternative which will work well in practice. DNS blocking can work, but requires hiring every DNS server, a major undertaking. Laws are no help if one country wants to block access to a server in another country.
    • lionkor 4y ago
      Just because there is no alternative, doesn't justify the means. If they cannot figure out a way to block malicious actors, they cant just randomly block every second request - though that would also work just as well. Malicious people would just try again, and the collateral often wont. Same result.
• dastbe 4y ago
  isn't it wild that not once in this article do they talk about working with governments to handle blocking in cloudflare's proxy layer? they go on and on about why ip blocking sucks, but don't actually propose anything better, especially to improve the situation for customers behind cloudflare who become collateral damage.
  • rolph 4y ago
    im older than dirt, so there wasa time when IPs were closer to 1:1 with domain name; DNS was a snazzy way of using WWW, but we would since inception, memorize or rolodex [1] the IP like a phone number. [1] https://en.wikipedia.org/wiki/Rolodex https://en.wikipedia.org/wiki/Rolodex
  • nelgaard 4y ago
    Why would they block their own customers? And even if they did agree to block e.g., Austrians from accessing some webpages of some Cloudflare costumers, they would have to base it on some geolocation, which is just one more can of worms.
    • jsnell 4y ago
      They should block their own crooked customers because the alternative of being belligerent with the authorities will deal exactly to the outcome they're whining about: the only option available is to block IPs leading to their more legit customers being caught in the blast radius. That should, ultimately, lead to the legit sites taking their business elsewhere. As for doing legal content blocks based on geo-location, that is not a can of worms. It's table stakes, and I find it hard to believe they wouldn't already have that capability.
    • yjftsjthsd-h 4y ago
      > Why would they block their own customers? Because their customers are breaking the law? I agree that there's an issue with how to handle jurisdiction, but you can hardly ignore a court and then get mad when they take action against you.
• koromak 4y ago
  Ironically this is exactly how cloudflare handles its spam prevention. Have a dynamic IP? Its Russian roulette until cloudflare decides you're dangerous. My favorite experience was building a website for a client, putting cloudflare in front of it, then discovering cloudflare blocked the IP of our client's office from seeing their own website.
  • toastal 4y ago
    One of the cool things about SourceHut Pages is that they block reverse proxying through Cloudflare because of shit like this.
  • bombolo 4y ago
    At least you've learnt quickly they were blocking wanted traffic.
• decide1000 4y ago
  On my previous job everyone on the wifi was routed through a VPN connection to a datacenter. Basically 4500 people using the same outgoing IP. CloudFlare really made me hate the captcha's and verification pages they put in front of websites. Some websites sometimes were not accessible at all, literally blocked for hours. I understand the position of CloudFlare where they basically don't like governments to block their IP's. On a smaller level this is exactly what CloudFlare is doing. Why is that justified?
  • acdha 4y ago
    Did you have problems with malware, or something like uBlock installed? Normally you won’t see issues with shared IPs unless there’s something unusual about your traffic.
    • decide1000 4y ago
      I used Firefox and might have installed uBlock. I wasn't the only one with this issue, it was a general complaint within the department.
      • AaronFriel 4y ago
        I have bad news for your colleagues at $previousJob. There was likely botnet activity in the network - on the users' machines connected through the VPN - triggering anti-DDoS protections.
      • acdha 4y ago
        I’m sure it happened - I just asked because a fair percentage of the time when I get a report like that and investigate with our CDN logs it turns out that they have something like a corporate proxy or browser extension which breaks some bot heuristic looking for standard browsers.
    • Nextgrid 4y ago
      Simply having a lot of traffic with differing user-agents/TCP/TLS stacks (yes, CF does fingerprint those too) will often look like a proxy and trigger captchas, even if there's nothing actually malicious about the traffic itself. I guess CF manually maintains lists of known NAT exit IPs to relax these restrictions for major carrier-grade NATs (mobile networks, etc) as they'd have the same problem otherwise.
• burnished 4y ago
  Their arguments around IPv4 and IPv6 and DNS felt weird, like, who cares about how large the DNS name space is if you never exhaust the limited reagent, IPv6? I guess it felt like the obvious conclusion is that IPv6 would allow for this sort of individual site blocking but they didn’t want to say that so spent a lot of word count trying to make it sound ridiculous. I hope I simply misunderstood something because it felt very dishonest.
  • zamadatix 4y ago
    IPv6 has enough bits to uniquely identify everything if you wanted but that does not mean it's structured and deployed in a way that makes it actually so just like your computer using 64 bit addresses does not mean programs should expect 18 exabytes of physical RAM instead of any other use or future-proofing of the address space. Beyond that I'm not sure I follow the "obvious conclusion" further or immediate rush to dishonesty as the explanation.
    • burnished 4y ago
      To clarify, IP blocking now produces collateral damage because there are far fewer IP addresses in use than there is demand and so different users must share, right? So in a hypothetical world where we are using IPv6 no one would need to share hence there would no longer need to be any collateral damage. I think part of the reason this feels dishonest is that they make the analogy of a skyscraper and it’s street address - obviously many tenets must share. But that relationship becomes inverted with IPv6, now everyone can have many. Problem solved. Except they deny this by comparing the size of the DNS namespace to the IPv6 address space and stating because it isn’t 1-1 that it doesn’t work. That argument doesn’t follow. They even point to the early internet as a time when everything had its own IP address and that sort of IP blocking made sense, which it would again under IPv6. I’m not sure what you are getting at with your example of RAM - if I had 64 bit addresses then I would expect that all of them should be treated as valid, which they are. It is the same here. Not every address in a 128 but space would resolve to something valid, but any of them could.
      • 4y ago
• neilv 4y ago
  > Without any notice to Cloudflare, an Austrian court had ordered Austrian Internet Service Providers (ISPs) to block 11 of Cloudflare’s IP addresses. This is a little poetic. :) Cloudflare is often blocking legitimate access to its customers' Web sites, sometimes triggered by browser privacy&security settings and blocker rulesets, sometimes triggered by using Tor exit nodes. I wonder whether Cloudflare customers are aware of this (or does it just show up in metrics of "bad" requests/hosts they've blocked), and whether the customers would prefer that those users could access. From a privacy and security perspective, I wonder whether Cloudflare often blocking a user from accessing a site they want to access encourages people to disable privacy and security measures?
  • medellin 4y ago
    Being in another country trying to access some things in the US i get blocked all the time. It lead me to canceling one of the services because i got sick or playing the vpn game
    • 8n4vidtmkvmk 4y ago
      i can imagine.. i have the same problem in reverse. i don't use a vpn because then I'm always flagged by cloudflare. very annoying
  • donkeyd 4y ago
    It is indeed. With CGNAT becoming more prevalent with the shortage of IPV4, this is starting to get really annoying. I'm actually switching providers to one that doesn't use CGNAT for this exact reason. It would be really nice if IPV6 one day actually becomes default so we no longer have to mess around with this stuff.
  • tick_tock_tick 4y ago
    > Cloudflare is often blocking legitimate access to its customers' Web sites Cloudflare allows customers to configuring blocking and captchas which is very different.
  • dredmorbius 4y ago
• causality0 4y ago
  casualty of the failure to build legal remedies and systems that reflect the Internet’s actual architecture. Help, I am drowning in the irony of Cloudflare of all people making this statement after being the company who normalized service providers kowtowing to internet mobs. Sending threats to the family members of Tier 1 provider executives to get sites blackholed is now a thing because of Cloudflare and they're going to complain a court ordered a block of eleven IP addresses.
  • voidwtf 4y ago
    Can you elaborate? Or provide some sources? I’ve not heard of this happening.
    • tbrownaw 4y ago
      KF had connectivity issues for a couple days over the holidays, reportedly because a few tier-1s had simultaneously blackholed the routes. There were unsupported rumors that this was due to threats as the parent comment mentions; I have no idea if the initial claims behind the rumors were speculation or entirely in jest or a result of non-public information.
      • sennight 4y ago
        If by "couple days" you mean "many months", sure... The whole thing is thoroughly documented by the man running the site, as well as the handful of psychopaths at the center of the campaign. They actually came very close to doing some very serious damage to the way the Internet works, not only with this harassment campaign to get the KF AS delinked - but also get the IP block revoked. For legal speech.
        • milsorgen 4y ago
          Groups have used this tactic before to great effect, it's quite versatile and it's destressing that it's a relatively unknown vector to the public at large. I think it's important to understand how decisions are made when so many people readily defer to authority in ascertaining what's right or wrong. Targeted "protest", to the right individuals, can affect anything from website availability to what's considered an illness. Realistically nothing is off the table by directing pressure to the right individuals with a bit of patience and determination. What worries me most is not the lack of resolve by people facing such pressure, but that they seem to sweep it under the rug and in short order people don't realize it played a role in the decision making process at all.
• johnklos 4y ago
  "Without any notice to Cloudflare, an Austrian court had ordered Austrian Internet Service Providers (ISPs) to block 11 of Cloudflare’s IP addresses." Maybe if Cloudflare actually paid attention to email sent to their abuse address, they'd have seen some correspondence. They ignore it, and, after avoiding answering questions for ages, finally admitted that they ignore it. They are so complete hypocritical, since they block IPs all the time, and they couldn't care less about collateral damage, unless the collateral damage happens to be their paying customers.
  • deleted 4y ago
    [deleted]
• zxcvbn4038 4y ago
  My employer is really big on blocking IP addresses, it is their primary solution to everything. I’ve been trying to educate them and I think the message is starting to resonate - anyone nefarious can switch IP addresses faster and easier then we can block them - they don’t need peer review, change approvals, or to wait for a pipeline to run - they just do it. Likewise strict IP based rate limiting will only keep honest people honest, I can send one request per second from a couple thousand IPs and it’s completely invisible to all their monitoring and WAF rules. The world has moved on - you need different strategies that consider more then IP now.
  • bushbaba 4y ago
    IP Rate limiting these days is less for DDoS protection and more to prevent System B (or user B) from overwhelming System A.
  • deleted 4y ago
    [deleted]
  • jrochkind1 4y ago
    What strategies are available?
• 1vuio0pswjnm7 4y ago
  "In September 2022, we used the authoritative zone files for the top-level domains (TLDs) .com, .net, .info, and .org, together with top-1M website lists, to find a total of 255,315,270 unique names. We then queried DNS from each of five regions and recorded the set of IP addresses returned. The table below summarizes our findings:" But of course zone files only list domainnames, not websites. More details needed on how they came up with 255M websites using top-1M website lists. Using "top-1M" lists will bias the results because those sites are more likely to use large hosting providers and CDNs. In other words, it will exclude smaller, less popular websites using a smaller hosting providers. "By looking at the CDF there are a few eye-watering observations: Fewer than 10 IP addresses are needed to reach 20% of, or approximately 51 million, domains in the set; 100 IPs are enough to reach almost 50% of domains; 1000 IPs are enough to reach 60% of domains; 10,000 IPs are enough to reach 80%, or about 204 million, domains." No surprise here. If we restrict the www to only what is popular, i.e., high-traffic, e.g., using concepts like "top-1M", then yes, the number of IP addresses we need will likely be fewer. For one because these sites all use the same handful of service providers that target high traffic websites. "Top" lists make it easier, more tidy to work with what the web actually may comprise.1 It lets "tech" companies and their service providers focus on what is commercially viable. Just ignore all those unpopular websites that cannot serve advertising. But what gets filtered out. We are prevented from knowing. Similarly, centralisation lends itself to convenience. There are obvious benefits. However, needless to say, centralisation is not appropriate in all cases. 1. Another analgous situation IMO is mobile apps. Allowing consumer to know what apps actually exist, i.e., all the millions of apps people have written, including the ones that will generate no revenue for anyone, is jettisoned in favour of "Top 10/Top20" lists or similar popularity filters. The "app store" middleman censors certain software and shows users only its view of the world's mobile app production. Searching is blunt. In the same way Google only shows the user its view of the www, rather than the actual www. Filtering can be useful, but ultimately these filtering decisions are for the benefit of the companies behind "app stores" or "web search engines". A "tech" company selling CDN services, or advertising services, is not a librarian at a university/public library. It has commercial interests. At some point "filtering" becomes "funneling", or herding.
  • 1vuio0pswjnm7 4y ago
• terlisimo 4y ago
  Alternative title: "Unintended but not unexpected consequences of proxying websites with illegal content."
  • lucb1e 4y ago
    I was already wondering why CloudFlare was blogging about how bad they are for the open internet. This title makes a lot more sense.
  • abigail95 4y ago
    Illegal in Austria, and the court apparently never served notice to CloudFlare. The simple solution is for Austria to ban or sanction CloudFlare if they think they are doing something illegal. If you think my trucking company is smuggling drugs, you don't just ban a few trucks with certain license plates regardless of cargo.
    • mike_d 4y ago
      > Illegal in Austria, and the court apparently never served notice to CloudFlare. Cloudflare ignores 100% of email sent to abuse@, so take their claim of never being notified with a huge pinch of salt.
      • worldofmatthew 4y ago
        Cloudflare are the biggest hypocrites. Blocks anyone they want in the name of stopping "abuse" but cries when they get blocked for breaking the law.....
      • tick_tock_tick 4y ago
        I mean I'd hope a court would contact there legal department rather then just sending a random email to abuse.....
        • worldofmatthew 4y ago
          The company is responsible to respond to abuse reports. It should be a valid email to get though to legal.
• uconnectlol 4y ago
  Imagine reading this article echoing what was common sense among hackers in the 90s, and thinking Cloudflare gives a shit about anything other than being a typical shit corporation. This billion dollar company has blocked[1] Tor (and VPN, and work / campus IP addresses) from 2010-2018 1. Each domain you loaded that had Cloudflare asked you for a captcha. You would normally have to solve one captcha to unblock yourself from the site, then right click on the images that didn't load to get the CDN subdomain of the site, then solve another captcha to unblock yourself on that subdomain. Eventually, in 2018, Cloudflare started allowing Tor traffic iff you use Tor Browser (it does fingerprinting). So I was right, they didn't need to block Tor, contrary to the idiots who would argue that there is no alternative. Also, it was a multi minute process to solve one captcha as they used recaptcha, which has always been the worst captcha in the world, and varies from giving Tor unsolvable problems to blocking it, to giving borderline unsolvable problems. So after a few minutes you can get past one captcha after getting lucky enough to get a few borderline unsolvable ones. Eventually hCaptcha came along and Cloudflare eventually switched to it and now there is no problem, so I'm right, contrary to idiots who argued with me claiming there is no alternative. It's still garbage though, thanks to Cloudflare the web is crippled in yet another major way. You still need to solve a captcha if you use Tor and trip the fingerprinting and WAF crap, despite that giving no security benefit to the website. Oh yeah, and they leaked private bank sessions across the internet because their little blocking scripts were too buggy (the Cloudbleed vulnerability).
• superkuh 4y ago
  It's not that the article's points are wrong. They're right and well argued. But this is real rich coming from the #1 blocker of people on the internet. What a lack of self awareness. Yes, IP blocking can be bad, but other forms of blocking that cloudflare engages in are just as bad and not everyone has cloudflare's MITM market position to exploit.
  • pverghese 4y ago
    What are the websites you feel saree blocked by cloudfare and not by court orders?
    • dspillett 4y ago
      The complaint about CF blocking is, I think, the other way around: blocking users access to sites, or making access a faf, because of the address their request comes from. It affects people behind GCNAT significantly, as well as those using commercial VPNs, because of the activity of others who appear to come from the same address*. Unfortunately there is little you can do about such collateral damage other than wistfully wonder “what if IPv6 had been implemented widely, and properly, some time ago, so such address sharing wasn't necessary”. VPN users might still end up coming from the same address/range so be indistinguishable from bad actors using the same VPN, but that is their choice to be unidentifiable and they should be aware of the ramifications†). -- [*] It can impact those with a dynamic address similarly, but more randomly. [†] I'm not saying not wanting to be identifiable is not a bad thing: just that you need to appreciate that being indistinguishable from the average non-identifiable Internet user makes you, erm, indistinguishable from the average non-identifiable Internet user[‡]. [‡] Who is trash. Or a bot written by trash.
    • donkeyd 4y ago
      That's an easy one, it's all of the ones that use Cloudflare. If your IP address is for some reason blacklisted by Cloudflare, you're screwed. With CGNAT, this means that you can have a hard time visiting many web sites if your IP is used by someone else who does nefarious things.
    • superkuh 4y ago
• nubinetwork 4y ago
  Sorry cloudflare, but my network, my rules. If I want to block an IP, there's nothing you can do to suggest me otherwise. Freeze Peach doesn't mean I'm obligated to have an empty firewall ruleset.
• lucb1e 4y ago
  After having decided on the laptop to buy in a price comparison website (Tweakers Pricewatch) last night, it showed me that this model was available in two webshops. Price was the same. I clicked the one I had never heard of to learn more about them. It showed a cloudflare captcha right off the bat. Nice store front. I closed the tab and went with the vendor I already knew and trusted anyhow. Curious what the conversion rate is from "outgoing click registered at $price_comparison_website" to "purchase made" before and after enabling cloudflare or a similar vendor, for those who have such stats available to them.
• pabs3 4y ago
  The OONI Project aims to provide tools for discovering such blockage, accepts submission of blockage info and does analyses of why the blockages occur: https://ooni.org/ https://ooni.org/
  • RajT88 4y ago
    THIS /\ I posted already in the thread an OONI analysis of how Russian ISP's are blocking IP's. Super awesome stuff they do.
• bongbongly 4y ago
  Funny to see Cloudflare complaining about being blocked for something they hadn't done, when they did the same thing to Kiwifarms.
  • Kab1r 4y ago
    I don't think anyone should be defending kiwifarms
    • bongbongly 4y ago
      Why not?
    • poszlem 4y ago
      That's cool, but that is just your opinion. Not only is kiwifarms not as bad as presented in the media, it's not even in the bottom quantile of "bad things on the internet". The reason it was blocked was purely political.
• RajT88 4y ago
  Recently saw this with Verizon CDN and a bunch of Russian ISP's. Most likely Roskomnadzor at work. Proving it definitively is difficult. This site had an awesome writeup which helped: https://ooni.org/post/2022-russia-blocks-amid-ru-ua-conflict/ https://ooni.org/post/2022-russia-blocks-amid-ru-ua-conflict... (Packet trace showed a match to one of the methods listed)
• kortilla 4y ago
  The irony of cloudflare complaining about blocking IPs is risible. Their entire business has been one of the worst abusers of ToR users based on their association of IPs to exit nodes. Before you step in and go “captchas aren’t blocking!”, consider that the end result is exactly the same with just a different statistical success rate. Cloudflare has systematically discriminated against privacy sensitive users for years based on IP and now they cry foul when it happens to them. Hilarious. Maybe this will have a decent outcome in provoking more interest in decentralization.
  • kortilla 4y ago
    This blog post is written for lay persons, presumably because it’s meant to persuade policy makers and not people who understand this is exactly how CF operates and they don’t like the taste of their own medicine.
  • bootsmann 4y ago
    The company I work for operates in the IPsec space and to be entirely fair to cloudflare here, serving captcha to anyone from a tor exit node is probably a fairly reasonable way to approach it. The amount of threats that rely on tor (and cheap untrustworthy vpn services) for anonymization more than justifies it. Any statistical model trying to block threats will naturally start flagging tor exit-nodes just by nature of the amount of attacks people try to abuse it for.
  • hackernewds 4y ago
    > "captchas aren't blocking!", consider that the end result is exactly the same with just a different statistical success rate. How so? The outcomes could be different depending on how different the statistical success rates are
    • uconnectlol 4y ago
      They essentially made the internet unusable for Tor users. If you either got lucky or sat there for 5 minutes (that's 300 seconds), you could make it onto a website. See https://news.ycombinator.com/item?id=34181351 https://news.ycombinator.com/item?id=34181351 Right now it's broken again, they just give you a captcha that breaks 90% of the time and fucktarded propaganda points that don't even make any sense to anyone over 30, like "in 2003, botnets were 1000-5000 computers now they are millions".
• iopq 4y ago
  > The first is via the Domain Name System (DNS), which translates domain names into IP addresses so that the site can be found. Instead of returning a valid IP address for a domain name ... Easily unblocked by going with a different DNS service. > The second approach is to block individual connection requests to a restricted domain name. When a user or client wants to visit a website, a connection is initiated from the client to a server name, i.e. the domain name. If a network or on-path device is able to observe the server name, then the connection can be terminated. Isn't that what encrypted client hello is meant to actually prevent? I just turned it on just for giggles
• Frostdavee3 4y ago
  Accessing websites from a "datacenter" IP address may be problematic, particularly for e-commerce sites, which may restrict traffic or block purchases from these IPs due to a belief that they are likely to be used by bots.
• fckcldflr 4y ago
  >Without any notice to Cloudflare, an Austrian court had ordered Austrian Internet Service Providers (ISPs) to block 11 of Cloudflare’s IP addresses. I wonder if that judge wrote an open letter saying "damn I really hate to block IP addresses [...] so here's why I decided to block IP addresses"
• deleted 4y ago
  [deleted]
• jesprenj 4y ago
  Unintended consequences of hosting thousands of websites on a few anycasted /24s and a TLS MiTM proxy.
• jtbayly 4y ago
  I thought this was going to be about Cloudflare. Imagine my surprise when it was written by Cloudflare. Then I hoped against hope that it was going to be a self-aware moment for them where they acknowledged the problems they cause. But no.