Hacker News Reader

Comment by evantbyrne | Hacker News Reader

The elephant in the room is that–at least in my experience–a lot of these attacks come from hostile nation states. This is going to be controversial, but one may find it useful to block entire IP ranges of problematic states that you cannot do business with. I was able to block 100% of probes to one of my new services by doing this.

View on HN

It's not an elephant, it's just that many people aren't willing to block legitimate users from those regions.

American websites don't typically have customers dialing in from North Korea. Just saying that IP blocking is something more businesses should consider. Traffic can also be routed to different subdomains for businesses that need to provide a subset of services to a region.

Most admins blocking regions aren't so selective; rather than blocking North Korea - they'll block everything not USA.

As an American living abroad, it's not uncommon for me to not be able to access a website I need (or want) to, and I need to pop onto my VPN.

If only nation states had some way of purchasing servers in another country and launching their attacks from there.

15+ years ago I was reviewing server logs for small, local businesses we hosted and came to the conclusion we should just block all APNIC IP addresses.

APNIC includes Australia, New Zealand, Japan, Taiwan and Singapore – did you block addresses from there too?

Given the length of time since then, I have no recollections beyond making the decision

Isn’t blocking regions just going to block the legitimate traffic, and push determined adversaries to use proxies?

> Isn’t blocking regions just going to block the legitimate traffic

I imagine blocking North Korea, Iran, etc will probably impact 0.5% of traffic and 0.001% of revenue for most sites.

> and push determined adversaries to use proxies?

That might mean you're left with 10% of the previous attackers so it could be worth it.

Is it? Which of these "attackers" are you most concerned with? I hesitate to even call them "attackers." They're jiggling your front door knob, at worst.

This is actually a decent analogy because a person sneaking around the neighborhood trying to open doors should be considered a threat. Nothing good happens when someone like that gets inside.

Eh, yeah, but at the same time, can you jiggle doorknobs from halfway around the world, and is it so overwhelmingly common that within minutes of every door being built, dozens of people come by just to jiggle the knob?

It's just so unbelievably common and so frequently harmless that it's hard to take all that seriously. But you're right, it is a threat, I won't deny that.

Can you even sell stuff to North Korea or Iran? Arent they on some embargo?

A friend told me that someone in his very big company sold some random stuff to North Korea and now 1) they have obligatory training not to sell there 2) they have to go through obligatory training on non proliferation of nuclear weapons

That would mean blocking USA and Netherlands :)

Most of probing to my server comes from USA, and a far second place is Netherlands. Probably most of it comes from AWS and other data centers.

Do what you gotta do haha

Reply on news.ycombinator.com