Hacker News Reader

Comment by zelon88 | Hacker News Reader

Geo fence them. There is no ROI to providing value to Russia or their partners. They only serve as launchpads for cyber attacks and recon anyway. Chances are any organic Russian would be forbidden from directly viewing your page anyway, so it's literally all bots. Organic Russians come from proxys and VPNs.

Russia doesn't reciprocate knowledge or technology or philosophy or anything with value. Primary Russian digital exports are bullet proof hosting, botnet-for-hire services, and low quality malware. Click spam, domain squatting... it's basically the red light district of the internet.

View on HN

I hate Russia right now, but geofencing is just... bad.

I've been geofenced and blocked my whole life, being from a small country no one gives a shit about. If not for the Internet, I'd likely be way more influenced by general media and be a pro-Russian usefu...less idiot. Because there would be no alternative, no way to learn and decide for myself.

So just my opinion, every person who can be influenced by western ideals (yes, I'm aware they're far from perfect) is worth it. Perhaps one of them can become someone of influence, either at home or as an immigrant.

Am I worth it? No. I don't add much to anything. But neither do the vast majority of Americans and Europeans. I'd just rather have a Russian/Chinese/Pakistani/Iranian/you name it as a friend than as an enemy.

If the price is learning proper configuration and/or a single core MIPS processor working overtime, I'd say it's worth it.

>Organic Russians come from proxys and VPNs.

[citation needed] - I have Russian friends and they generally don't use proxies or VPNs.

With a recent Instagram block I assume you will see much more ordinary people using VPNs.

Good point; there used to be some issues with this since my dad is an interpreter for Russian, so we used to have some legitimate business there (probably not relevant, but his clients would essentially come to Europe to be trained in certain medical equipment)...but recent events might probably force early retirement for him.

Somewhat unrelated: I have noticed that SPAM from Russian servers stopped on Feb 23 right before the invasion; I wonder what that means.

does anyone here recognize the difference between civilians and participants in armed conflict? medical in particular, right?

Tell that to the Russians bombing civilian targets in Ukraine. If the worst happening to Russian civilians right now is that they can’t access someone’s blog, well, I can think of far worse things for civilians to have to deal with.

I'm still undecided as to whether closing maccy d's is a good thing or a bad thing (for them).

probably they are talking about how sanctions make making business with Russia difficult.

Couldn't agree more---let me point out that our (i.e. the German) government started sanctions along with the rest of most (all?) European countries. It's not our choice any more---my dad used to believe in the 'Ostpolitik' of Willy Brandt, and he's heartbroken to hear about the horrors of war :(

(my research institution has also put a stop on all projects involving Russian collaborators at the moment; on the one hand, I can understand this reaction, on the other hand, it creates even more problems and, as you say, does not distinguish between those responsible for the conflict and those who are not. This is not really not an easy space to navigate.)

armies are only supported by the industry and economy created by the civilians.

Sure. But if you read the article you see the vast majority of the attacks and the most persistent ones seem to originate from China and Hong Kong.

It’s pretty common to geofence China too in my experience, for the same reasons.

It seems like malicious traffic would be more agile come from everywhere, but if you block those two countries you filter a great deal of it.

I thought that was so funny. The author even stated at the beginning that the Ukraine/Russia conflict was a reason for better security.

Russia represented a whopping 2% of his naughty list.

(Posted this above as well) I saw a spike in traffic after the invasion; this prompted the whole thing. Turns out it's not coming from Russia, though.

Yes, because I saw a spike in traffic that made me scratch my head. Turns out it's not originating from there, though :-)

Any documentation on how to do "geo fencing" without relying on third parties? Is it enough to have one big static list of ip addresses (or subnets)? How often does the list need to be updated?

I used to do this with a local copy of the IP2Location database [1]. This way you don't have to poll a third party. The caveat is you have to keep the database up to date.

https://www.ip2location.com/ [1]

See my recommendation in the top level thread.

It depends on what you’re doing and who the legit users are.

The downside of static lists is that AWS, Azure, etc frequently purchase IP spaces and realign them with US datacenters. Probably not an issue for blocking Russia or China, but if you want US only traffic, or North American traffic, you can run into problems.

You cannot know where a server is physically located, as even self-reported locations are incorrect (by accident and/or on purpose) and there is no such thing as non-3rd party data about physical location as servers as again, it's self-reported and any registry can say whatever they want in regards to where a server is located.

There are many different 3rd party sources for geo locating IP addresses, maybe MaxMinds is the most popular one. But if you acquire a few, you'll notice that sometimes even they don't agree where the location of a server is.

I'm reminded of this story[0] from a few years ago where a family in Kansas was raided by every US ABC agency because MaxMinds was using their lat/long as the default when there was no exact position.

https://www.theguardian.com/technology/2016/aug/09/maxmind-m...

Cloudflare lets you block countries, ASNs and IP blocks.

Reply on news.ycombinator.com