Hacker News Reader

Comment by mh- | Hacker News Reader

Yeah, I have mixed feelings about CT (certificate transparency) for this reason. Folks are just consuming the firehose and scanning.

And in this case, if the thing you're funnel'ing is on your residential connection, it basically amounts to you summoning a DDoS.

One (obvious?) tip I'd offer is to put your stuff on high non-standard ports if you can. It'll reduce the amount of connections you get dramatically.

View on HN

When you care about this, if you're managing your own certificates, you can issue wildcard certificates.

Hmm, yeah, that's a great suggestion, thanks!

Also serve the default website (via IP) from a basically empty self-signed certificate that doesn't give away any domain names or owner details.

You don't have to serve any certificates on the default website. Web server would just fail TLS connection, since it doesn't have a certificate for it.

Not sure if this applies to all web servers, but at least Caddy and a few others support this.

A DoS that will disappear once you close the funnel. Tailscale are proxying the traffic so your public IP isn’t exposed. Your choice of port makes no difference.

Even without CT, services on standard ports will quickly be discovered on IPv4.

> On a computer with a gigabit connection, ZMap can scan the entire public IPv4 address space on a single port in under 45 minutes.

This may discover services, but not hostnames. If the server does not disclose them (e.g. in the certificate used on the IP host), an attacker doesn't have much further to go on.

Reply on news.ycombinator.com