4 ms·

The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The t

The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. They also use the same VPNs for connecting to your machines as your grandparents do for watching Netflix. The internet as a whole is slowly but steadily moving towards a model where IP addresses and domain names are not useful indicators for security. You can not block your users from visiting Cloudflare or AWS IP ranges and you can not block visitors to your site from major commercial VPN providers. In addition, all the traffic is encrypted, name lookups are encrypted, so a network operator can not tell anything about what you are doing on the internet. This is a good thing for multiple reasons. First, it improves privacy and anonymity for the internet users. Second, reducing the effectiveness of network security solutions will make us be able to phase out their usage, which makes the network dumb again and prevents ossification. And third, it forces us to tackle the underlying security issues, rather than supporting a whole industry of ineffective whack-a-mole.

deleted 2y ago
[deleted]
entropie 2y ago
> You can not block your users from visiting Cloudflare or AWS IP ranges Iam pretty sure reddit does. I recently needed to rewrite/patch my tumblog backend software that uses yt-dlp to download reddit videos because reddit blocked the ip ranges of hetzners dedicated servers. I circumvented this by downloading the videos on the client via javascript and upload it to my server.
skeaker 2y ago
The potential downside in my eyes is that regulators won't want to wait for the underlying issues to be solved and will instead opt for more aggressive identification. The worst case scenario is if the whole internet became like Facebook, requiring an account that's inextricably linked to your real identity just to view anything.
archerx 2y ago
> you can not block visitors to your site from major commercial VPN providers. You can if you can figure out their IP ranges. Some websites already do it and it is something I am looking into. Another thing worth doing is blocking TOR by getting the exit node ip address list. Blocking TOR has saved me a lot of grief from bad actors.
Nextgrid 2y ago
> The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. I guess that's a consequence of law enforcement being completely unable or unwilling to actually tackle online crime (as long as it's not inconveniencing a large corporation in very specific domains such as copyright). Why bother with bulletproof/etc hosts or sketchy domain registrars when you can use a mainstream one and get away with it?
halJordan 2y ago
This is a great summation of why KYC is coming to cloud hosting.

deleted 2y ago

[deleted]

entropie 2y ago

> You can not block your users from visiting Cloudflare or AWS IP ranges Iam pretty sure reddit does. I recently needed to rewrite/patch my tumblog backend software that uses yt-dlp to download reddit videos because reddit blocked the ip ranges of hetzners dedicated servers. I circumvented this by downloading the videos on the client via javascript and upload it to my server.

skeaker 2y ago

The potential downside in my eyes is that regulators won't want to wait for the underlying issues to be solved and will instead opt for more aggressive identification. The worst case scenario is if the whole internet became like Facebook, requiring an account that's inextricably linked to your real identity just to view anything.

archerx 2y ago

> you can not block visitors to your site from major commercial VPN providers. You can if you can figure out their IP ranges. Some websites already do it and it is something I am looking into. Another thing worth doing is blocking TOR by getting the exit node ip address list. Blocking TOR has saved me a lot of grief from bad actors.

Nextgrid 2y ago

> The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. I guess that's a consequence of law enforcement being completely unable or unwilling to actually tackle online crime (as long as it's not inconveniencing a large corporation in very specific domains such as copyright). Why bother with bulletproof/etc hosts or sketchy domain registrars when you can use a mainstream one and get away with it?

halJordan 2y ago

This is a great summation of why KYC is coming to cloud hosting.