4 ms·
What? They aren't doing anything funny, nor are they asking you for permission to do anything funny. They scan your ports. To the unobservant, that can look
by LukeShu 13y ago
What?
They aren't doing anything funny, nor are they asking you for permission to do anything funny.
They scan your ports. To the unobservant, that can look like they are trying to crack your systems. What is wrong with recognizing their IP (adding it to your "whitelist"), and knowing that it probably isn't something worth investigating.
- stephengillie 13y agoAt the very least, you know their IP, so you can search your logs for it to make sure they aren't being evil.
- noir_lord 13y agoCall me a cynic (I don't mind) but they do the sweep of the whitelisted address and then two weeks later I get an attempted break-in from a completely different address.... I'm not white-listing anyone I don't know.
- kalleboo 13y agoYou won't whitelist someone because they'll try to break in from an IP other than the one you whitelisted? How does that even begin to make sense?
- pekk 13y agoI think you missed that he was responding to this: > so you can search your logs for it to make sure they aren't being evil. This argument doesn't apply if the probe and the attack come from different IPs
- njharman 13y agoWho exactly are "they"? Other than someone with a blog post saying whitelist this ip and claiming "no monkey business, promise!" No time/interest to vet them. Also, did their webpage get hacked and that ip changed? Will someone with access to their machines network succumb to maliciously using or selling access to this widely whitelisted ip? Seven years from now will that ip still be theirs?
- LukeShu 13y agoI'm not saying that these aren't good points, just that gp's comment about lube was out of place. They aren't trying to fuck you. And we're not talking about a literal software-implemented whitelist, just a "it probably isn't worth investigating or sending complaints" whitelist. That makes the seven-years point less important.
- robertgraham 13y ago"They" are me. What's up with this belief that anybody you haven't heard of is a member of some shadowy organization? I'm a well known security researcher, I give several presentations a year at cybersec conferences, and my blog gets regularly link to from news.ycombinator.com. Also, the post above excludes the first part of that: "We are happy to add your IP addresses to our blacklist so we won't ever scan you again".
- jacquesm 13y agoWell, as long as you own that IP. So once whitelisted and you switch to a new IP that IP stays whitelisted.
- JoeAltmaier 13y agoIts safe to assume on the Internet that anybody that comes to you, is a bot or a scam of some kind. Not a surprise to you, a security consultant. I understand frustration that you can't convince everyone that you are a good guy. All good guys these days have that problem. Even the good folks at the NSA ( you aren't one of them, are you? )