Hacker News Reader

Comment by ge0rg | Hacker News Reader

What's the problem with leaking your IP address? If you host a website or any kind of API there, your IP is public anyway?

View on HN

Not if it's behind a CDN, if you were to host a website that someone might consider a DDoS target (frankly anything can be these days), then it can be wise to keep the host's true IP off the record

If your security is only achieved by hiding your IP I have bad news for you.

Obfuscating your IP is a foundational part of strong security for websites in certain industries. For example: the video game industry has a lot of wannabe hackers and script kiddies, DDoSes are cheaper and larger than ever, which makes running services in that industry extremely expensive without proper IP security. I know the purists think the internet should be open and transparent, but some of us also build services in reality.

*weak security

One can scan the whole IPv4 address space in probably an hour, so you'll find any service you want to find. You might say, "I have a CDN in front of it", but that is just basic firewalling (or reverse proxying) and not really worth of being called "IP obfuscation".

Firewall only lets in traffic from the CDN, so you wouldn’t find anything. It’s almost like making sure this can’t happen is my job.

Yes, that's what I wrote.

Presumably the CDN would be whitelisted and scanners would therefore be unable to determine which of the many unresponsive IPs host the service in question.

It may be weak security to keep a bit of cash in my cars glovebox rather than in plain sight, but let me tell you how effective it is at keeping my windows from getting smashed...

maybe the commenter has the scenario of bare metal server at home in mind?

I was going to ask this as well, surely there shouldn't be a problem with this?

Reply on news.ycombinator.com