3 ms·
The elephant in the room is that–at least in my experience–a lot of these attacks come from hostile nation states. This is going to be controversial, but one ma
by evantbyrne 3y ago
The elephant in the room is that–at least in my experience–a lot of these attacks come from hostile nation states. This is going to be controversial, but one may find it useful to block entire IP ranges of problematic states that you cannot do business with. I was able to block 100% of probes to one of my new services by doing this.
- macintux 3y ago15+ years ago I was reviewing server logs for small, local businesses we hosted and came to the conclusion we should just block all APNIC IP addresses.
- nerdponx 3y agoIt's not an elephant, it's just that many people aren't willing to block legitimate users from those regions.
- evantbyrne 3y agoAmerican websites don't typically have customers dialing in from North Korea. Just saying that IP blocking is something more businesses should consider. Traffic can also be routed to different subdomains for businesses that need to provide a subset of services to a region.
- tjbiddle 3y agoMost admins blocking regions aren't so selective; rather than blocking North Korea - they'll block everything not USA. As an American living abroad, it's not uncommon for me to not be able to access a website I need (or want) to, and I need to pop onto my VPN.
- redcobra762 3y agoIsn’t blocking regions just going to block the legitimate traffic, and push determined adversaries to use proxies?
- oblio 3y ago> Isn’t blocking regions just going to block the legitimate traffic I imagine blocking North Korea, Iran, etc will probably impact 0.5% of traffic and 0.001% of revenue for most sites. > and push determined adversaries to use proxies? That might mean you're left with 10% of the previous attackers so it could be worth it.
- redcobra762 3y agoIs it? Which of these "attackers" are you most concerned with? I hesitate to even call them "attackers." They're jiggling your front door knob, at worst.
- evantbyrne 3y agoThis is actually a decent analogy because a person sneaking around the neighborhood trying to open doors should be considered a threat. Nothing good happens when someone like that gets inside.
- redcobra762 3y agoEh, yeah, but at the same time, can you jiggle doorknobs from halfway around the world, and is it so overwhelmingly common that within minutes of every door being built, dozens of people come by just to jiggle the knob? It's just so unbelievably common and so frequently harmless that it's hard to take all that seriously. But you're right, it is a threat, I won't deny that.
- rvba 3y agoCan you even sell stuff to North Korea or Iran? Arent they on some embargo? A friend told me that someone in his very big company sold some random stuff to North Korea and now 1) they have obligatory training not to sell there 2) they have to go through obligatory training on non proliferation of nuclear weapons
- wooque 3y agoThat would mean blocking USA and Netherlands :) Most of probing to my server comes from USA, and a far second place is Netherlands. Probably most of it comes from AWS and other data centers.
- evantbyrne 3y agoDo what you gotta do haha
- op00to 3y agoIf only nation states had some way of purchasing servers in another country and launching their attacks from there.