Comment by achillean | Hacker News Reader

Comment by achillean | Hacker News Reader

Parent Full thread

The Wikipedia article is unfortunately woefully out of date in describing what Shodan does. For example, Shodan collects data on thousands of ports:

https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=p...

And we don't concentrate on a single type of device/ service (the article mentions SCADA). We identify everything from industrial control systems (1) to Minecraft servers (2). The news coverage makes it sound like we're skewed towards ICS, webcams or vulnerabilities but our focus is on providing a comprehensive view of what's connected to the Internet.

If you want to quickly check if your IP is exposing anything unexpected to the Internet simply visit:

https://me.shodan.io

If you see a 404 then nothing public was found. Note that this looks up information in the existing Shodan database - it doesn't launch a scan.

(1) Industrial control systems: https://www.shodan.io/search/report?query=tag%3Aics

(2) Minecraft servers: https://www.shodan.io/search?query=minecraft

Entirely unrelated fun fact: my love for your service started a good number of years ago when you worked with me directly on a specific challenge (subject: "Any way to pay for shodan without Paypal?"). Glad to see the service is continuing to thrive! And that you're engaged in conversation/feedback on HN.

> https://me.shodan.io … this looks up information in the existing Shodan database - it doesn't launch a scan.

But do you discard the IP or save it for future scans? :p

That's not how it works. Shodan continuously checks all IPs on the Internet. When you visit the website you're checking for existing information in the database. Your use of the Shodan website/ API doesn't change how Shodan crawls the Internet.

"all IPs on the Internet."

I believe all IPV4 addresses. Skeptical on IPV6. Though the ntp pool thing was clever.

Yea, but website user IPs could be used as efficiency booster, proven to be live.

It doesn't matter. We check every IPv4 regardless. And for our regular crawling we don't ping before we try to connect as a lot of firewalls block ICMP.

How do I check my server, which doesn't have a browser installed?

It looks like it just redirects to https://www.shodan.io/host/<IP>, so you should be able to just plug your server's IP in instead in your regular browser.

Ah ok, I was browsing on mobile, so didn't see the entire url.

But it doesn't seem to work, unfortunately.

It does work. 404 means there's no info in the database.

Easiest is probably a SOCKS proxy

ssh -D9999 yourserver

then set up the SOCKS proxy in your browser's settings

> The Wikipedia article is unfortunately woefully out of date

so... did you fix it?

Wikipedia policy discourages entities from editing their own page.

Bingo. Many years ago I tried to fix it but it was quickly reverted. I understand their policy though and hopefully it will get fixed at some point.

I wonder if you could use a forum post of someone saying what's wrong on their page as a source to edit the page though.

Forum posts aren't outside the realm of valid sources, so where exactly is the line drawn?

Conflict of interest is totally separate from the reliability of sources issue. I think the thing that would be encouraged in this situation is to detail what you would want changed on the talk page, and have a neutral wikipedian look at it and make the changes if appropriate. See also https://en.wikipedia.org/wiki/Wikipedia:Plain_and_simple_con...

That said, as far as where the line is drawn for sources see https://en.wikipedia.org/wiki/Wikipedia:Reliable_sources i dont think forum posts are usually considered the best sources.

Was about to reply with this exact sentiment. If the page is about you or your service, propose the updates in the talk page (ideally with reliable third-party sources).

I've definitely seen posts by community managers used as reference for some gaming-related articles, which I assume would fit under "Self-published or questionable sources as sources on themselves."

But, of course, none of those posts specifically targeted their Wikipedia articles.

> I wonder if you could use a forum post of someone saying what's wrong on their page as a source to edit the page though.

You could. The person themselves couldn't. (There are guidelines about the risk of bias from primary sources, which apply very much to someone talking about themselves or their own company, so you shouldn't just blindly copy what they say into Wikipedia, but you absolutely can use them as a source)

Off-topic: this discussion reminds me a bit of what happened about five years ago when I offered to host a reddit AMA about anesthesia and anesthesiology and related subjects (I was board-certified in 1980).

The moderator asked me for proof that I was who I was, so I had to spend a couple days digging through my files to find my medical school diploma, board-certification document, medical licenses, etc., then scan and email them to reddit.

I did all that, and they said it wasn't sufficient proof: I needed to take a selfie with the documents and my driver's license to "prove" my bona fides.

At that point I said WTF? and bagged it.

No good deed goes unpunished.

What's the worst/best part of your position that people outside of it would rarely acknowledge publicly?

Huh?

They're trying to get the AMA started here.

Reply on news.ycombinator.com