3 ms·

This is most likely just a security "best practice" that goes unquestioned. It is pretty much on the same level as blocking ICMP. I remember in the past how I

by m1keil 3y ago

This is most likely just a security "best practice" that goes unquestioned. It is pretty much on the same level as blocking ICMP. I remember in the past how I lost couple of hours trying to understand why I can't reach a remote instance via RDP, only to finally figure it was the port blocking on the office firewall. I spent quite a while trying to convince the local sysadmin that this doesn't make any sense. His only explanation was "security" without any actual explanation of what is he securing us from.

anilakar 3y ago
Russian and Chinese ISPs are blocked on out network in the name of "security" as if real attackers would not use AWS or a western VPS provider. It is a pain when you need to download material from your hardware suppliers' web sites.
- jeroenhd 3y ago
  To be fair to those ISPs, most SSH connection attempts in my logs seem to come from consumer IP addresses. Many of them in China, but also a whole bunch in South America. I think it's because of hacked IoT crapware and other malware adding unsuspecting people to a botnet. I doubt anyone is renting hundreds of internet connections just to brute force admin/admin all day. I can't imagine those South Americans being able to access anything without clearing twenty Cloudflare CAPTCHAs (I don't think Cloudflare operates in China), but then again, I think they'll just blame Cloudflare for sabotaging their perfectly safe 100% legit web traffic. This type of blocking wouldn't be necessary if these companies actually did something with the abuse reports they receive, but I guess blocking SSH and telnet is an easy way to stop the flood of reports coming in if you don't care about your customers.
dumpsterdiver 3y ago
Regarding “security”, consider that at one point in history there were no known security exploits for <whatever piece of software>, and so simply asking “why not” may have only elicited shrugs. After a few decades of having your software’s ass handed to it though, is it so unreasonable to stop asking “why not” and instead start asking “why the fuck should we?”

by m1keil 3y ago

anilakar 3y ago

Russian and Chinese ISPs are blocked on out network in the name of "security" as if real attackers would not use AWS or a western VPS provider. It is a pain when you need to download material from your hardware suppliers' web sites.

jeroenhd 3y ago
To be fair to those ISPs, most SSH connection attempts in my logs seem to come from consumer IP addresses. Many of them in China, but also a whole bunch in South America. I think it's because of hacked IoT crapware and other malware adding unsuspecting people to a botnet. I doubt anyone is renting hundreds of internet connections just to brute force admin/admin all day. I can't imagine those South Americans being able to access anything without clearing twenty Cloudflare CAPTCHAs (I don't think Cloudflare operates in China), but then again, I think they'll just blame Cloudflare for sabotaging their perfectly safe 100% legit web traffic. This type of blocking wouldn't be necessary if these companies actually did something with the abuse reports they receive, but I guess blocking SSH and telnet is an easy way to stop the flood of reports coming in if you don't care about your customers.

dumpsterdiver 3y ago

Regarding “security”, consider that at one point in history there were no known security exploits for <whatever piece of software>, and so simply asking “why not” may have only elicited shrugs. After a few decades of having your software’s ass handed to it though, is it so unreasonable to stop asking “why not” and instead start asking “why the fuck should we?”