Hacker News Reader

Comment by hedora | Hacker News Reader

I'd argue that this whole concept is inherently flawed. My home internet is behind a carrier grade NAT. Many services have rate limited the IP. It's to the point where I'm strongly considering paying a "streaming friendly" VPN to black hat subvert these reputation schemes.

The biggest offenders are internet of things backends for registered devices I "own" and streaming services I'm paying for.

Edit: Here's a concrete example: I looked up my CGNAT IP and saw that it was flagged as a malicious actor because someone ran a port scan from it a month ago.

Now that this offence has started to age out, a few services started working again. My entire ISP can be trivially DOS'ed with a raspberry pi and NMAP!

Of course, other services seem to just do per-IP rate limiting, so they run at << 1MB/s during peak hours. Fast.com and Speedtest.net claim the connection is healthy.

View on HN

This is an interesting point. As more users get pigeonholed into sharing the same IPv4 addresses, IP-based rate limiting will essentially become useless. I wonder if this will help drive IPv6 adoption.

> The biggest offenders are internet of things backends for registered devices I "own" and streaming services I'm paying for.

Wait those are the services that are rate-limiting you? They're not smart enough to rate-limit based on your account credentials?

If IPv6 reputation is done at the /48 level but you have, say, a /56 then you're sharing reputation with up to 255 other customers.

Even worse, there are ISP who hand out /64 which you shouldn't even do.

I ran into this problem 15 years ago or so when I built my own ipv6 tunnel for home use using a hetzner server. Couldn't edit on Wikipedia, asked why, and apparently they blocked a whole /48 because of spam. Then they argued the whole provider should be blocked because it's a "tunnel provider" (it isn't) at which point I didn't even want to argue anymore and just stopped editing.

/56? What about /64 per customer. ISP just ignores RIPE rules and explanations why /64 is not enough for complex home network.

Still better situation than v4. Assigning is tend to be fixed and never shared.

> I wonder if this will help drive IPv6 adoption.

Only if users complain enough. Often they complain to the reverse proxy host[0] or website itself[1], when it would be a solved problem if IPv6 were properly deployed further.

0: top result on google for 'Cloudflare blocked me' with 38k views https://community.cloudflare.com/t/cloudflare-is-blocking-me...

1: https://www.coursera.support/s/question/0D51U00003BlYiVSAV/y...

> They're not smart enough to rate-limit based on your account credentials?

This works until a VPN node starts having tens of thousands of users from one IP address.

Rate limiting based on account credentials is a solution to having tons of users connecting from one IP address...

depends on what they are rate limiting. if they are trying to rate limit logins to prevent brute force attacks... I could see a naive implementation being problematic for NATed users.

Now you’ve put it that way, I hope someone is a black hat accelerationist who deliberately makes a worm to turn all IPv4 addresses into spam IPs. Force v6 adoption by making the internet unusable for the laggards.

>flagged as a malicious actor because someone ran a port scan from it a month ago

I can't believe how some companies assume a port scan is some sort of attack. I've actually gotten automated abuse emails back when port scanning some addresses. Madness.

There’s always going to be tension when it’s comes to “strong signals someone is acting in bad faith” and the exceptions.

I mean if you saw someone standing on your sidewalk taking note of all the unlocked doors and windows they see you would be right to be kinda suspicious. The over under on “they’re casing your house vs they’re a window lock enthusiast” isn’t great for the enthusiast. But unlike IRL you can just say, “ya know what I don’t really care to support any exceptions and so anyone who’s checking my windows is autobanned.”

> I'm strongly considering paying a "streaming friendly" VPN to black hat subvert these reputation schemes

Nothing "black hat" with that, at all.

...Unless you're referring to that those "streaming-friendly VPNs" are (acquiring residential IPs in sketchy ways from sketchy providers, such as compromised smart devices and other customers).

To be fair, this is a real problem that you sometimes can't ignore. There are plenty of situations where you need to filter out a bad actor by ip address.

> There are plenty of situations where you need to filter out a bad actor by ip address.

It isn't so much that you need to do it that way, but that there is no more practical way despite the inherent problems. Which has effectively the same end result, but thinking that way highlights the fact that CGNAT and other IPv4 limit “solutions” cause as many problems as they solve.

Absolutely, it is a good reason to avoid providers with CGNAT.

Do you not have the ability to lease a static IP from the ISP for a nominal amount? From my experience this is always an option even on consumer lines.

>Do you not have the ability to lease a static IP from the ISP for a nominal amount? From my experience this is always an option even on consumer lines.

Where I live (US), most ISPs won't give you static IPv4 addresses unless you are on a "business" plan. Beyond that, you also have to pay for those static IP addresses (it's ~US$25/month for 5 static IPv4 addresses, with one of those wasted because I'm forced to use the ISP's router, even though I already have one).

Perhaps where you are, static IPv4 addresses are available on "consumer" plans, but here not so much.

No. It's a local rural ISP. I don't think they're particularly competent.

It may be an option, but as a consumer, why would this be the optimal answer? All this does is hide costs for you.

This is a problem with service. If the service doesn't want to fix it, then that sounds like a potential market opportunity, no? I'm new to thinking about the business side, but it seems like I want to remove any obstacle I can preventing a customer from using my service.

it takes a little getting used to. the key here it thats alot easier to convince your customers that any flaws in your service are just 'the way it is' rather than even attempt to do anything about them.

> Do you not have the ability to lease a static IP from the ISP for a nominal amount?

and this is why IPv6 isn't coming anytime soon, at least not within the next few decades.

Nah, it is. It just won't be this one great event where everyone switches at the same time. My current ISP ships you a cheapo router that has it enabled by default. My previous one did to and even had cgnat. It just works.

You read comments here on HN every time ipv6 comes up how it caused great issues for them and they turned it off, but unless they are on a really shitty small ISP, it's their own fault because they don't use the router from the ISP but had to build their own setup and messed something up.

As people switch ISPs or get replacement routers that have it enabled, the world gradually moves over, and nobody apart from the nerds takes notice.

Assuming you raised this with the services, what responses did you get - if any?

Reply on news.ycombinator.com