Hacker News Reader

Comment by 2OEH8eoCRo0 | Hacker News Reader

I don't trust Iran, North Korea, or China either. It's not hard, I'm an American and it's 2025. These are our adversaries (I didn't choose them) who currently commit cybercrimes against us. Hopefully in 2035 that won't be the case and we can all sing kumbaya.

View on HN

I hope that you at some point will understand that these are minorities among a huge population that you are talking about.

It sounds like you think that every butcher, barber, dancer, teacher, software dev etc in China is just thinking of how they can hack the US.

Guess what: that's the image propagated by propaganda and very far from the actual truth.

If you don't trust people, study their code and make a formed opinion about it.

This seems like woefully naive virtue-signaling to me. I geo-block all traffic from Iran, N Korea, China and Russia specifically at my clients' firewalls because I have watched the logs and could clearly see IPs from each of these countries attempt connections to American businesses every minute of every day. Try to single out the offending IP and tomorrow it moves to another; you will spend the rest of your days adding to that block list. It is perfectly sensible to block the country entirely; and better yet - as I've made a standard for my clients - block the entire world, and only allow specific countries to talk to your firewall. Then you can add more granular blocks on top of this. If something gets blocked that shouldn't, that's not painful to adjust. I have no doubt there are many fine people in Russia, but that doesn't mean there's a single computer in Russia that has any business talking to mine.

The question is why those specific countries? Do you just assume that all connections made from, say, Netherlands, are safe by default?

Basic statistics. The chance of someone from Netherlands being a state-level hacker is a lot smaller than someone from a Russian IP.

Logically, if Russians would want to infiltrate your organization, they won't do it from Russian IPs directly, but instead do it from cheap proxies, and those proxies are abundant in Netherlands or Germany.

And yet experience shows that GP is correct. The vast majority of mailicious traffic originates from those countries IME.

Only stuff like scanners and other basic stuff (that comes from devices that have been left unattended and without updates). But the actual malicious traffic is not that easy to spot, as it won't be router directly.

i used to do similar on gaming clans' forums; for local rationalized fps we didnt want folks with 300+ ping and country blocking was pretty easy (and folks on the forums were either spamming us with porn or trying to become a member). though since it was forums based i did allow GETs but restricted POSTs ect vs straight up 0 access

But if the binary came from US even with some malicious code, it would be OK simply because the origin is different?

>with some malicious code

Obviously not.

Reply on news.ycombinator.com