5 ms·

Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to ca

by lxgr 1y ago

Why stop there? Just block all non-US IPs! If it works for my health insurance company, essentially all streaming services (including not even being able to cancel service from abroad), and many banks, it’ll work for you as well. Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad?

lwansbrough 1y ago
Don't care, works fine for us.
- yupyupyups 1y ago
  And that's perfectly fine. Nothing is completely bulletproof anyway. If you manage to get rid of 90% of the problem then that's a good thing.
  - lxgr 1y ago
    And if your competitor manages to do so without annoying the part of their customer base that occasionally leaves the country, everybody wins!
    - yupyupyups 1y ago
      Fair point, that's something to consider.
  - ruszki 1y ago
    Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still from home. Cloudflare fuck me, because I’m too suspicious as a foreigner. It broke their whole API access, which was used by their site. I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. And of course my bank card… and I just wanted to order a pizza. The most annoying is when your fucking app is restricted to your stupid country, and I should use it because your app is a public transport app. Lovely. And of course, there was that time when I moved to an other country… pointless country restrictions everywhere… they really helped. I remember the times when the saying was that the checkout process should be as frictionless as possible. That sentiment is long gone.
    - lwansbrought 1y ago
      [dead]
    - BoredPositron 1y ago
      The vpn is probably your problem there mate.
      - ruszki 1y ago
        I don’t use VPN generally, only in specific cases. For example, when I want to reach Australian news. Because of course, as a non Australian, I couldn’t care about local news. Or when American pages rather ban Europe than they would tell who they sell my data to.
      - Dylan16807 1y ago
        They tried a VPN as a backup for one of those problems. So no. It's not.
    - sarchertech 1y ago
      > I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. Your mobile provider was routing you through Austria while in the US?
      - nucleardog 1y ago
        Not OP, but as far as I know that's how it works, yeah. When I was in China, using a Chinese SIM had half the internet inaccessible (because China). As I was flying out I swapped my SIM back to my North American one... and even within China I had fully unrestricted (though expensive) access to the entire internet. I looked into it at the time (now that I had access to non-Chinese internet sites!) and forgot the technical details, but seems that this was how the mobile network works by design. Your provider is responsible for your traffic.
      - ruszki 1y ago
        Yes, newer backends for 4G and 5G networks work exactly that way.
- Nemi 1y ago
  Worked great for us, but I had to turn it off. Why? Because the IP databases that the two services I was using are not accurate enough and some people in the US were being blocked as if they had a foreign IP address. It happened regularly enough I reluctantly had to turn it off and now I have to deal the non-stop hacking attempts on the website. For the record, my website is a front end for a local-only business. Absolutely no reason for anyone outside the US to participate.
raffraffraff 1y ago
And across the water, my wife has banned US IP addresses from her online shop once or twice. She runs a small business making products that don't travel well, and would cost a lot to ship to the US. It's a huge country with many people. Answering pointless queries, saying "No, I can't do that" in 50 different ways and eventually dealing with negative reviews from people you've never sold to and possibly even never talked to... Much easier to mass block. I call it network segmentation. She's also blocked all of Asia, Africa, Australia and half of Europe. The blocks don't stay in place forever, just a few months.
- silisili 1y ago
  Google Shopping might be to blame here, and I don't at all blame the response. I say that because I can't count how many times Google has taken me to a foreign site that either doesn't even ship to the US, or doesn't say one way or another and treat me like a crazy person for asking.
- lxgr 1y ago
  As long as your customer base never travels and needs support, sure, I guess. The only way of communicating with such companies are chargebacks through my bank (which always at least has a phone number reachable from abroad), so I’d make sure to account for these.
  - closewith 1y ago
    Chargebacks aren't the panacea you're used to outside the US, so that's a non-issue.
    - lxgr 1y ago
      Only if your bank isn't competent in using them. Visa/Mastercard chargeback rules largely apply worldwide (with some regional exceptions, but much less than many banks would make you believe).
      - closewith 1y ago
silisili 1y ago
I'm not precisely sure the point you're trying to make. In my experience running rather lowish traffic(thousands hits a day) sites, doing just that brought every single annoyance from thousands per day to zero. Yes, people -can- easily get around it via various listed methods, but don't seem to actually do that unless you're a high value target.
- lxgr 1y ago
  It definitely works, since you’re externalizing your annoyance to people you literally won’t ever hear from because you blanket banned them based. Most of them will just think your site is broken.
  - aspenmayer 1y ago
    It seems to be a choice they’re making with their eyes open. If folks running a storefront don’t want to associate with you, it’s not personal in that context. It’s business.
  - raincole 1y ago
    In other words, a smart business practice.
  - marginalia_nu 1y ago
    This isn't coming from nowhere though. China and Russia don't just randomly happen to have been assigned more bad actors online. Due to frosty diplomatic relations, there is a deliberate policy to do fuck all to enforce complaints when they come from the west, and at least with Russia, this is used as a means of gray zone cyberwarfare. China and Russia are being antisocial neighbors. Just like in real life, this does have ramifications for how you are treated.
mort96 1y ago
The percentage of US trips abroad which are to China must be minuscule, and I bet nobody in the US regularly uses a VPN to get a Chinese IP address. So blocking Chinese IP addresses is probably going to have a small impact on US customers. Blocking all abroad IP addresses, on the other hand, would impact people who just travel abroad or use VPNs. Not sure what your point is or why you're comparing these two things.
thrown-0825 1y ago
If you are traveling without a vpn then you are asking for trouble
- lxgr 1y ago
  Yes, and I’m arguing that that’s due to companies engaging in silly pseudo-security. I wish that would stop.
  - ordu 1y ago
    It is not silly pseudo-security, it is economics. Ban Chinese, lower your costs while not losing any revenue. It is capitalism working as intended.
    - lxgr 1y ago
      Not sure I'd call dumping externalities on a minority of your customer base without recourse "capitalism working as intended". Capitalism is a means to an end, and allowable business practices are a two-way street between corporations and consumers, mediated by regulatory bodies and consumer protection agencies, at least in most functioning democracies.
      - ordu 1y ago
        Maybe, but it doesn't change the fact, that no one is going to forbid me to ban IPs. Therefore I will ban IPs and IPs ranges because it is the cheapest solution.
        lxgr 1y ago
        Sure, you can keep blocking IPs, and I'll keep arguing for a ban on IP country bans (at least for existing customers) :)
        ordu 1y ago
        If you don't see that your campaign is futile and want to waste you time, just go ahead, don't ask for my permission.
mvdtnz 1y ago
You think all streaming services have banned non US IPs? What world do you live in?
- lxgr 1y ago
  This is based on personal experience. At least two did not let me unsubscribe from abroad in the past.
  - throwawayffffas 1y ago
    Not letting you unsubscribe and blocking your IP are very different things. There are some that do not provide services in most countries but Netflix, Disney, paramount are pretty much global operations. HBO and peacock might not be available in Europe but I am guessing they are in Canada.
    - misiek08 1y ago
      In Europe we have all of them, with only few movies unavailable or additionally paid occasionally. Netflix, Disney, HBO, Prime and others work fine. Funny to see how narrow perspective some people have…
      - deleted 1y ago
        [deleted]
      - lxgr 1y ago
        Obligatory side note of "Europe is not a country". In several European countries, there is no HBO since Sky has some kind of exclusive contract for their content there, and that's where I was accordingly unable to unsubscribe from an US HBO plan.
    - rtpg 1y ago
      I think a lot of services end up sending you to a sort of generic "not in your country yet!" landing page in an awkward way that can make it hard to "just" get to your account page to do this kind of stuff. Netflix doesn't have this issue but I've seen services that seem to make it tough. Though sometimes that's just a phone call away. Though OTOH whining about this and knowing about VPNs and then complaining about the theoretical non-VPN-knower-but-having-subscriptions-to-cancel-and-is-allergic-to-phone-calls-or-calling-their-bank persona... like sure they exist but are we talking about any significant number of people here?
gr8n3ss 1y ago
[dead]
sylware 1y ago
Won't help: I get scans and script kiddy hack attempts from digital ocean, microsoft cloud (azure, stretchoid.com), google cloud, aws, and lately "hostpapa" via its 'IP colocation service'. Ofc it is instant fail-to-ban (it is not that hard to perform a basic email delivery to an existing account...). Traffic should be "privatize" as much as possible between IPv6 addresses (because you still have 'scanners' doing the whole internet all the time... "the nice guys scanning the whole internet for your protection... never to sell any scan data ofc). Public IP services are done for: going to be hell whatever you do. The right answer seems significantly big 'security and availability teams' with open and super simple internet standards. Yep the javascript internet has to go away and the app private protocols have too. No more whatng cartel web engine, or the worst: closed network protocols for "apps". And the most important: hardcore protocol simplicity, but doing a good enough job. It is common sense, but the planned obsolescence and kludgy bloat lovers won't let you...
motorest 1y ago
> Why stop there? Just block all non-US IPs! This is a perfectly good solution to many problems, if you are absolutely certain there is no conceivable way your service will be used from some regions. > Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? Not a problem. Bad actors which are motivated enough to use VPNd or botnets are a different class of attacks that have different types of solutions. If you eliminate 95% of your problems with a single IP filter them you have no good argument to make against it.
- calgoo 1y ago
  This. If someone wants to target you, they will target you. What this does is remove the noise and 90%+ of crap. Basically the same thing as changing the ssh port on a public facing server, reduce the automated crap attacks.
- paulcole 1y ago
  > if you are absolutely certain there is no conceivable way your service will be used from some regions. This isn’t the bar you need to clear. It’s “if you’re comfortable with people in some regions not being able to use your service.”
runroader 1y ago
Oddly, my bank has no problem with non-US IPs, but my City's municipal payments site doesn't. I always think it's broken for a moment before realizing I have my VPN turned on.
Avamander 1y ago
> Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? They usually don't bother. Plus it's easier to take action against malicious traffic within your own country or general jurisdiction.

by lxgr 1y ago

lwansbrough 1y ago

Don't care, works fine for us.

yupyupyups 1y ago
And that's perfectly fine. Nothing is completely bulletproof anyway. If you manage to get rid of 90% of the problem then that's a good thing.
- lxgr 1y ago
  And if your competitor manages to do so without annoying the part of their customer base that occasionally leaves the country, everybody wins!
  - yupyupyups 1y ago
    Fair point, that's something to consider.
- ruszki 1y ago
  Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still from home. Cloudflare fuck me, because I’m too suspicious as a foreigner. It broke their whole API access, which was used by their site. I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. And of course my bank card… and I just wanted to order a pizza. The most annoying is when your fucking app is restricted to your stupid country, and I should use it because your app is a public transport app. Lovely. And of course, there was that time when I moved to an other country… pointless country restrictions everywhere… they really helped. I remember the times when the saying was that the checkout process should be as frictionless as possible. That sentiment is long gone.
  - lwansbrought 1y ago
    [dead]
  - BoredPositron 1y ago
    The vpn is probably your problem there mate.
    - ruszki 1y ago
      I don’t use VPN generally, only in specific cases. For example, when I want to reach Australian news. Because of course, as a non Australian, I couldn’t care about local news. Or when American pages rather ban Europe than they would tell who they sell my data to.
    - Dylan16807 1y ago
      They tried a VPN as a backup for one of those problems. So no. It's not.
  - sarchertech 1y ago
    > I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. Your mobile provider was routing you through Austria while in the US?
    - nucleardog 1y ago
      Not OP, but as far as I know that's how it works, yeah. When I was in China, using a Chinese SIM had half the internet inaccessible (because China). As I was flying out I swapped my SIM back to my North American one... and even within China I had fully unrestricted (though expensive) access to the entire internet. I looked into it at the time (now that I had access to non-Chinese internet sites!) and forgot the technical details, but seems that this was how the mobile network works by design. Your provider is responsible for your traffic.
    - ruszki 1y ago
      Yes, newer backends for 4G and 5G networks work exactly that way.
Nemi 1y ago
Worked great for us, but I had to turn it off. Why? Because the IP databases that the two services I was using are not accurate enough and some people in the US were being blocked as if they had a foreign IP address. It happened regularly enough I reluctantly had to turn it off and now I have to deal the non-stop hacking attempts on the website. For the record, my website is a front end for a local-only business. Absolutely no reason for anyone outside the US to participate.

raffraffraff 1y ago

And across the water, my wife has banned US IP addresses from her online shop once or twice. She runs a small business making products that don't travel well, and would cost a lot to ship to the US. It's a huge country with many people. Answering pointless queries, saying "No, I can't do that" in 50 different ways and eventually dealing with negative reviews from people you've never sold to and possibly even never talked to... Much easier to mass block. I call it network segmentation. She's also blocked all of Asia, Africa, Australia and half of Europe. The blocks don't stay in place forever, just a few months.

silisili 1y ago
Google Shopping might be to blame here, and I don't at all blame the response. I say that because I can't count how many times Google has taken me to a foreign site that either doesn't even ship to the US, or doesn't say one way or another and treat me like a crazy person for asking.
lxgr 1y ago
As long as your customer base never travels and needs support, sure, I guess. The only way of communicating with such companies are chargebacks through my bank (which always at least has a phone number reachable from abroad), so I’d make sure to account for these.
- closewith 1y ago
  Chargebacks aren't the panacea you're used to outside the US, so that's a non-issue.
  - lxgr 1y ago
    Only if your bank isn't competent in using them. Visa/Mastercard chargeback rules largely apply worldwide (with some regional exceptions, but much less than many banks would make you believe).
    - closewith 1y ago

silisili 1y ago

I'm not precisely sure the point you're trying to make. In my experience running rather lowish traffic(thousands hits a day) sites, doing just that brought every single annoyance from thousands per day to zero. Yes, people -can- easily get around it via various listed methods, but don't seem to actually do that unless you're a high value target.

lxgr 1y ago
It definitely works, since you’re externalizing your annoyance to people you literally won’t ever hear from because you blanket banned them based. Most of them will just think your site is broken.
- aspenmayer 1y ago
  It seems to be a choice they’re making with their eyes open. If folks running a storefront don’t want to associate with you, it’s not personal in that context. It’s business.
- raincole 1y ago
  In other words, a smart business practice.
- marginalia_nu 1y ago
  This isn't coming from nowhere though. China and Russia don't just randomly happen to have been assigned more bad actors online. Due to frosty diplomatic relations, there is a deliberate policy to do fuck all to enforce complaints when they come from the west, and at least with Russia, this is used as a means of gray zone cyberwarfare. China and Russia are being antisocial neighbors. Just like in real life, this does have ramifications for how you are treated.

mort96 1y ago

The percentage of US trips abroad which are to China must be minuscule, and I bet nobody in the US regularly uses a VPN to get a Chinese IP address. So blocking Chinese IP addresses is probably going to have a small impact on US customers. Blocking all abroad IP addresses, on the other hand, would impact people who just travel abroad or use VPNs. Not sure what your point is or why you're comparing these two things.

thrown-0825 1y ago

If you are traveling without a vpn then you are asking for trouble

lxgr 1y ago
Yes, and I’m arguing that that’s due to companies engaging in silly pseudo-security. I wish that would stop.
- ordu 1y ago
  It is not silly pseudo-security, it is economics. Ban Chinese, lower your costs while not losing any revenue. It is capitalism working as intended.
  - lxgr 1y ago
    Not sure I'd call dumping externalities on a minority of your customer base without recourse "capitalism working as intended". Capitalism is a means to an end, and allowable business practices are a two-way street between corporations and consumers, mediated by regulatory bodies and consumer protection agencies, at least in most functioning democracies.
    - ordu 1y ago
      Maybe, but it doesn't change the fact, that no one is going to forbid me to ban IPs. Therefore I will ban IPs and IPs ranges because it is the cheapest solution.
      - lxgr 1y ago
        Sure, you can keep blocking IPs, and I'll keep arguing for a ban on IP country bans (at least for existing customers) :)
        ordu 1y ago
        If you don't see that your campaign is futile and want to waste you time, just go ahead, don't ask for my permission.

mvdtnz 1y ago

You think all streaming services have banned non US IPs? What world do you live in?

lxgr 1y ago
This is based on personal experience. At least two did not let me unsubscribe from abroad in the past.
- throwawayffffas 1y ago
  Not letting you unsubscribe and blocking your IP are very different things. There are some that do not provide services in most countries but Netflix, Disney, paramount are pretty much global operations. HBO and peacock might not be available in Europe but I am guessing they are in Canada.
  - misiek08 1y ago
    In Europe we have all of them, with only few movies unavailable or additionally paid occasionally. Netflix, Disney, HBO, Prime and others work fine. Funny to see how narrow perspective some people have…
    - deleted 1y ago
      [deleted]
    - lxgr 1y ago
      Obligatory side note of "Europe is not a country". In several European countries, there is no HBO since Sky has some kind of exclusive contract for their content there, and that's where I was accordingly unable to unsubscribe from an US HBO plan.
  - rtpg 1y ago
    I think a lot of services end up sending you to a sort of generic "not in your country yet!" landing page in an awkward way that can make it hard to "just" get to your account page to do this kind of stuff. Netflix doesn't have this issue but I've seen services that seem to make it tough. Though sometimes that's just a phone call away. Though OTOH whining about this and knowing about VPNs and then complaining about the theoretical non-VPN-knower-but-having-subscriptions-to-cancel-and-is-allergic-to-phone-calls-or-calling-their-bank persona... like sure they exist but are we talking about any significant number of people here?

gr8n3ss 1y ago

[dead]

sylware 1y ago

Won't help: I get scans and script kiddy hack attempts from digital ocean, microsoft cloud (azure, stretchoid.com), google cloud, aws, and lately "hostpapa" via its 'IP colocation service'. Ofc it is instant fail-to-ban (it is not that hard to perform a basic email delivery to an existing account...). Traffic should be "privatize" as much as possible between IPv6 addresses (because you still have 'scanners' doing the whole internet all the time... "the nice guys scanning the whole internet for your protection... never to sell any scan data ofc). Public IP services are done for: going to be hell whatever you do. The right answer seems significantly big 'security and availability teams' with open and super simple internet standards. Yep the javascript internet has to go away and the app private protocols have too. No more whatng cartel web engine, or the worst: closed network protocols for "apps". And the most important: hardcore protocol simplicity, but doing a good enough job. It is common sense, but the planned obsolescence and kludgy bloat lovers won't let you...

motorest 1y ago

> Why stop there? Just block all non-US IPs! This is a perfectly good solution to many problems, if you are absolutely certain there is no conceivable way your service will be used from some regions. > Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? Not a problem. Bad actors which are motivated enough to use VPNd or botnets are a different class of attacks that have different types of solutions. If you eliminate 95% of your problems with a single IP filter them you have no good argument to make against it.

calgoo 1y ago
This. If someone wants to target you, they will target you. What this does is remove the noise and 90%+ of crap. Basically the same thing as changing the ssh port on a public facing server, reduce the automated crap attacks.
paulcole 1y ago
> if you are absolutely certain there is no conceivable way your service will be used from some regions. This isn’t the bar you need to clear. It’s “if you’re comfortable with people in some regions not being able to use your service.”

runroader 1y ago

Oddly, my bank has no problem with non-US IPs, but my City's municipal payments site doesn't. I always think it's broken for a moment before realizing I have my VPN turned on.

Avamander 1y ago

> Surely bad actors wouldn’t use VPNs or botnets, and your customers never travel abroad? They usually don't bother. Plus it's easier to take action against malicious traffic within your own country or general jurisdiction.