4 ms·
Good. GeoIP should be dead, and "IP reputation" should be meaningless garbage.
by ACCount37 8mo ago
Good. GeoIP should be dead, and "IP reputation" should be meaningless garbage.
- observationist 8mo agoIP Reputation is only as meaningful as the duration of ownership. If it's the same owner for years, then reputation is meaningful, and that should count; if it changes hands every 6 hours being assigned to VPS clients or whatnot, then make the reputation stick to the /24 owner, and so on, with varying degrees of scope and duration, so that the responsible party - the shady companies renting their IPs to bad people - actually have their reputations stick. Then block the /24 or larger subnets, or aggressively block all ranges owned by the company, isolating them and their clients, good and bad. That sort of pressure can work. But then you risk brigading and activist fueled social media mobs and that's definitely no way to run the internet.
- BLKNSLVR 8mo ago100% agree with your point regarding long term ownership allowing for meaningful reputation. I don't necessarily think that's 'no way to run the internet' or even 'no way to run anything', in that people can choose to whom they listen in regards to blocking, protesting, boycotting. As long as none of the different groups of opinions are forced on anyone else, then pick and choose those you apply and those you ignore. With my lists of blocking, I classify them, personally, into different tiers such as Basic, Recommended, Aggressive, and Paranoid when I apply the rules to other people's (family) setups - I'm the only one that uses Paranoid.
- gzread 8mo agoWhat's the purpose of blocking them, anyway? Is it to make you feel good? To clean up logs? To reduce spam? With the residential proxy industry - which, I note, is directly boosted by such blocking practices and funnels money into organized crime - IPs don't mean a whole lot to those who can pay.
- paulddraper 8mo agoHow do you protect against DDoS?
- deleted 8mo ago[deleted]
- gzread 8mo agoTemporary blocks if and when you are actually being DDoSed, presumably?
- johncolanduoni 8mo agoLarge DDoS botnets will have hundreds of thousands of return-path-capable IP addresses. Your temporary blocks will have to be very sensitive (i.e. trigger on a relatively small number of requests within the time window) for an application-level DDoS to be usefully mitigated.
- gzread 8mo agoSo how does your other plan solve that?
- johncolanduoni 8mo agoOnce an IP in a botnet attacks someone, it ends up on a blocklist and can’t attack anyone else who uses that blocklist. This is a big part of Cloudflare’s DDoS model: if you attack one CF property (with non-volumetric DDoS) you will not be able to attack any others with the same bot for an extended period. This makes attacks to CF properties limited in scope and way more costly, because you have to essentially “burn” IP addresses after sending relatively little traffic.
- gzread 7mo agoHow long does it take for a whole major ISP, say Verizon, to get on your blocklist?