Hacker News Reader

Comment by kjjw | Hacker News Reader

Wonderful. So your users may occasionally be blocked due to you having a bit of fun. IP blocking is a terribly over broad way of stopping intruders.

View on HN

If my users want to go where I ask them not to go when they have no reason at all to go there, their problem. There are no links anywhere to those dirs, except for the robots.txt. Also, the blocks lift after a couple days. Honestly, nobody ever complained, and I'm sure it stops/hampers some attacks dead on.

Users share IPs.

The websites I manage aren't Facebook or Google sized. Or even HN sized. I don't see that as a real problem at all.

You see it not as problem, because user don't see you (your sites). As IPv4 are getting rare, many share the same IP. So it's really a bad practice to ban IP for a longer period.

with bots ? If an Ip does not respect the host rules, it deserves to be blocked.

For a start, the entire nation of Qatar shares 82.148.97.69.

And it's definitely not a good idea to run a bot from there.

That's actually not true. A bunch of people in Qatar use that IP though.

Good thing a whopping 0% of my expected userbase originates from Qatar.

What do you mean 'with bots'? We're talking about anyone at all hitting a link blocking the IP they have.

Some mobile networks have every person on the network originating traffic from the same IP. Some large institutions, universities, government departments, large companies have all their traffic coming from one IP.

This person has effectively created a feature that will perform a denial of service attack on their own website.

robots.txt tells robots where not to go.

I don't understand why a user would access a randomly created directory that is only mentioned in the robots.txt file. Can you explain as to why you'd think they'd stumble across this?

Curiosity?

Curiosity killed the cat, or so they say.

"But satisfaction brought him back."

As long as the block lasts not more than a few days, as he says in a nearby comment, I don't think it's much of a problem.

Oh, believe me they only last a few days at most. I don't use an infinite IP blocklist. It has like 100 IP's or so. When one goes in, one must come out. And lets just say there are enough badly behaved bots around that it doesn't take much time for 100 IP's to rotate.

This is silly. If you have a user of your site going through your bots file and specifically going to directories listed as Disallow then you deal with that user. Blocking based on the robots.txt for a directory that doesn't exist anywhere but that file is fine. I did a two bad directory ban, it seemed to work fine.

Reply on news.ycombinator.com