5 ms·

If you don't need global access, I have found that Geoblocking is the best first step. Especially if you are in a small country with a small footprint and you c

by FabCH 10mo ago

If you don't need global access, I have found that Geoblocking is the best first step. Especially if you are in a small country with a small footprint and you can get away at blocking the rest of the world. But even if you live in the US, excluding Russia, India, Iran and a few others will cut your traffic by double digit percent. In the article, quite a few listed sources of traffic would simply be completely unable to access the server if the author could get away with a geoblock.

komali2 10mo ago
Reminds me of when 4chan banned Russia entirely to stop DDOSes. I can't find it but there was a funny post from Hiro saying something like "couldn't figure out how to stop the ddos. Banned Russia. Ddos ended. So Russia is banned. /Shrug"
- ralferoo 10mo ago
  Similarly, for my e-mail server, I manually add spammers into my exim local_sender_blacklist a single domain at a time. About a month into doing this, I just gave up and added * @* .ru and that instantly cut out around 80% of the spam e-mail. It's funny observing their tactics though. On the whole, spammers have moved from bare domain to various prefixes like @outreach.domain, @msg.domain, @chat.domain, @mail.domain, @contact.domain and most recently @email.domain. It's also interesting watching the common parts before the @. Most recently I've seen a lot of marketing@, before that chat@ and about a month after I blocked that chat1@. I mostly block *@domain though, so I'm less aware of these trends.
ThatPlayer 10mo ago
We've had a similar discussion at my work. E-commerce that only ships to North America. So blocking anyone outside of that is an option. Or I might try and put up Anubis only for them.
- redirectyou 10mo ago
  [dead]
- FabCH 10mo ago
  Be slightly careful with commerce websites, because GeoIP databases are not perfect in my experience. I got accidentally locked out from my server when I connected over Starlink that IP-maps to the US even though I was physically in Greece. As a practical advice, I would use a blocklist for commerce websites, and allowlist for infra/personal.
  - ThatPlayer 10mo ago
    That's a good point! I'll probably start with a blocklist.
  - dotancohen 10mo ago
    There is a small OTC medical device that is about $60 in the US, quadruple the price in my country. I tried to order one to be sent to a US family member's house, who was coming the following month to visit. However I could not order because I was not in the US. In the end I found another online store, paid $74, and got the device. So the better store lost the sale due to blocking non-US orders. I don't know how much of a corner case this is.
- lsaferite 10mo ago
  Just keep in mind, that could block legit users who are outside the country. One case being someone traveling and wanting to buy something to deliver home. Another case being a non-resident wanting to buy something to send to family in the service zone. I'm not saying don't block, just saying be aware of the unintended blocks and weigh them.
  - fragmede 10mo ago
    Also consider tourists outside of their home country. If, eg I'm in Indonesia when Black Friday hits and I'm trying to buy things back home and the site is blocked; shit. I mean, personally I can just use my house as as a VPJ exit node thanks to Tailscale, but most people aren't technical enough to do that.
  - DANmode 10mo ago
    Great comment - thank you.
krupan 10mo ago
This makes me a little sad. There's an ideal built into the Internet, that it has no borders, that individuals around the world can connect directly. Blocking an entire geographic region because of a few bad actors kills that. I see why it's done, but it's unfortunate
- FabCH 10mo ago
  I know what you mean. But the numbers don't lie. In my case, I locked down to a fairly small group of European countries and the server went down from about 1500 bot scans per day down to 0. The tradeoff is just too big to ignore.
- deleted 10mo ago
  [deleted]
- BobaFloutist 10mo ago
  It's not because of a few bad actors, it's because of a hostile or incompetent government. Every country has (at the very least) a few bad actors, it's a small handful of countries that actively protect their bad actors from any sort of accountability or identification.
  - victorbjorklund 10mo ago
    To be fair most of my bad traffic is from the US.
    - BobaFloutist 10mo ago
      I mean if that's the case, the conversation obviously changes.
- halJordan 10mo ago
  You can't make the argument that it's a small group of bad actors. It's quite a massive group of unrelentingly malicious actors
  - 10mo ago

by FabCH 10mo ago

komali2 10mo ago

Reminds me of when 4chan banned Russia entirely to stop DDOSes. I can't find it but there was a funny post from Hiro saying something like "couldn't figure out how to stop the ddos. Banned Russia. Ddos ended. So Russia is banned. /Shrug"

ralferoo 10mo ago
Similarly, for my e-mail server, I manually add spammers into my exim local_sender_blacklist a single domain at a time. About a month into doing this, I just gave up and added * @* .ru and that instantly cut out around 80% of the spam e-mail. It's funny observing their tactics though. On the whole, spammers have moved from bare domain to various prefixes like @outreach.domain, @msg.domain, @chat.domain, @mail.domain, @contact.domain and most recently @email.domain. It's also interesting watching the common parts before the @. Most recently I've seen a lot of marketing@, before that chat@ and about a month after I blocked that chat1@. I mostly block *@domain though, so I'm less aware of these trends.

ThatPlayer 10mo ago

We've had a similar discussion at my work. E-commerce that only ships to North America. So blocking anyone outside of that is an option. Or I might try and put up Anubis only for them.

redirectyou 10mo ago
[dead]
FabCH 10mo ago
Be slightly careful with commerce websites, because GeoIP databases are not perfect in my experience. I got accidentally locked out from my server when I connected over Starlink that IP-maps to the US even though I was physically in Greece. As a practical advice, I would use a blocklist for commerce websites, and allowlist for infra/personal.
- ThatPlayer 10mo ago
  That's a good point! I'll probably start with a blocklist.
- dotancohen 10mo ago
  There is a small OTC medical device that is about $60 in the US, quadruple the price in my country. I tried to order one to be sent to a US family member's house, who was coming the following month to visit. However I could not order because I was not in the US. In the end I found another online store, paid $74, and got the device. So the better store lost the sale due to blocking non-US orders. I don't know how much of a corner case this is.
lsaferite 10mo ago
Just keep in mind, that could block legit users who are outside the country. One case being someone traveling and wanting to buy something to deliver home. Another case being a non-resident wanting to buy something to send to family in the service zone. I'm not saying don't block, just saying be aware of the unintended blocks and weigh them.
- fragmede 10mo ago
  Also consider tourists outside of their home country. If, eg I'm in Indonesia when Black Friday hits and I'm trying to buy things back home and the site is blocked; shit. I mean, personally I can just use my house as as a VPJ exit node thanks to Tailscale, but most people aren't technical enough to do that.
- DANmode 10mo ago
  Great comment - thank you.

krupan 10mo ago

This makes me a little sad. There's an ideal built into the Internet, that it has no borders, that individuals around the world can connect directly. Blocking an entire geographic region because of a few bad actors kills that. I see why it's done, but it's unfortunate

FabCH 10mo ago
I know what you mean. But the numbers don't lie. In my case, I locked down to a fairly small group of European countries and the server went down from about 1500 bot scans per day down to 0. The tradeoff is just too big to ignore.
deleted 10mo ago
[deleted]
BobaFloutist 10mo ago
It's not because of a few bad actors, it's because of a hostile or incompetent government. Every country has (at the very least) a few bad actors, it's a small handful of countries that actively protect their bad actors from any sort of accountability or identification.
- victorbjorklund 10mo ago
  To be fair most of my bad traffic is from the US.
  - BobaFloutist 10mo ago
    I mean if that's the case, the conversation obviously changes.
halJordan 10mo ago
You can't make the argument that it's a small group of bad actors. It's quite a massive group of unrelentingly malicious actors
- 10mo ago