5 ms·

Wondering if, for a service like github, it would be possible to setup a whitelist of allowable ip addresses. If an attack was launched only that whitelist wou

by larrys 13y ago

Wondering if, for a service like github, it would be possible to setup a whitelist of allowable ip addresses. If an attack was launched only that whitelist would be allowed until the attack was mitigated. So while certain legitimate traffic would be blocked for sure, people who connect through fixed ip addresses that were whitelisted would get through and be able to do what they needed to do. Thoughts?

aroman 13y ago
Seems like it'd be pretty trivial to circumvent that. Just have your botnet do a few regular old requests to the network a few days before launching. That way the IPs of the botnet members get white listed. For a website of GitHub's scale, I don't think it would be very effective, though maybe it could be helpful in combination with other measures.
- larrys 13y ago
  No, I'm specifically talking about clients who have signed up entering in their ip address that they access from. "Just have your botnet do a few regular old requests to the network a few days before launching." Not talking about "whitelist sites that have made access in the last x days". For example on HN it would be easy to create a white list. They do it now recognizing new people who signed up and keeping track of activity as well (by points). You could either have people identify the ip address that they accessed from and further limit the whitelist to a certain period of time and activity additionally. The idea is not to be 100% perfect but enough so that if you are a regular user of github from an IP address at your office (as opposed to wifi cafe) you will be able to get through. This is, by the way, how registries limit access to their system. It's all whitelist you have to pre identify the ip addresses that you will access the system from. The whitelist only comes into play when under attack. And for sure yes if you are connecting from a new place you will be blocked. But others will not be blocked and there will be some access for some people.
  - randunel 13y ago
    There are ISPs who change your ip address every 10 seconds, not just on reconnection. This would complicate github too much, I'd rather have 2 hrs downtime every now and then, than have to input my ip address classes from all the locations :D
imbriaco 13y ago
It's not practical with the sheer number of legitimate IP addresses that access GitHub, unfortunately.
- thebelal 13y ago
  You could handle even the large numbers of IPs that access github using a Bloom filter (http://en.wikipedia.org/wiki/Bloom_filter http://en.wikipedia.org/wiki/Bloom_filter). It will let a small percentage of non-whitelisted IPs in, but would filter the majority of them out.

by larrys 13y ago

aroman 13y ago

Seems like it'd be pretty trivial to circumvent that. Just have your botnet do a few regular old requests to the network a few days before launching. That way the IPs of the botnet members get white listed. For a website of GitHub's scale, I don't think it would be very effective, though maybe it could be helpful in combination with other measures.

larrys 13y ago
No, I'm specifically talking about clients who have signed up entering in their ip address that they access from. "Just have your botnet do a few regular old requests to the network a few days before launching." Not talking about "whitelist sites that have made access in the last x days". For example on HN it would be easy to create a white list. They do it now recognizing new people who signed up and keeping track of activity as well (by points). You could either have people identify the ip address that they accessed from and further limit the whitelist to a certain period of time and activity additionally. The idea is not to be 100% perfect but enough so that if you are a regular user of github from an IP address at your office (as opposed to wifi cafe) you will be able to get through. This is, by the way, how registries limit access to their system. It's all whitelist you have to pre identify the ip addresses that you will access the system from. The whitelist only comes into play when under attack. And for sure yes if you are connecting from a new place you will be blocked. But others will not be blocked and there will be some access for some people.
- randunel 13y ago
  There are ISPs who change your ip address every 10 seconds, not just on reconnection. This would complicate github too much, I'd rather have 2 hrs downtime every now and then, than have to input my ip address classes from all the locations :D

imbriaco 13y ago

It's not practical with the sheer number of legitimate IP addresses that access GitHub, unfortunately.

thebelal 13y ago
You could handle even the large numbers of IPs that access github using a Bloom filter (http://en.wikipedia.org/wiki/Bloom_filter http://en.wikipedia.org/wiki/Bloom_filter). It will let a small percentage of non-whitelisted IPs in, but would filter the majority of them out.