Hacker News Reader

You have to do that with range bans in v4 too, since you have no idea how big the pool of addresses a user can pull from is -- and with CGNAT in the picture you're kind of doomed to banning legitimate customers on v4 no matter what you do.

View on HN

Yes, you ban some legitimate customers with v4. But the span between the smallest allocations and biggest allocations is much smaller, so simple strategies (like banning the bad address) scale further.

I think the span would be about the same, or smaller even, if you limited yourself to a granularity of 4 bits for v6. Allocations are often rounded to 4 bits in v6 because it correlates to exactly one character of the v6 address.

I'd also like to note that being worried about accidental overbanning in v6 but then being dismissive of it in v4 is a double standard.

Reply on news.ycombinator.com