Hacker News Reader

Comment by ancarda | Hacker News Reader

Hacker News used to have a GitHub repo somewhere on https://github.com/HackerNews/ where they hosted an issue tracker - several people raised this and their response was something along the lines of "we can't yet as our anti-spam code relies on accurate geolocation and some other things easier/possible in IPv4".

Unfortunately I can't find a link - I think they closed the issue tracker. Perhaps dang can comment? I'm typing from memory so it might be remembering incorrectly.

View on HN

Cloudflare has pseudo IPv4 for exactly this purpose

https://support.cloudflare.com/hc/en-us/articles/202494830-P...

It doesn't sound to me like those pseudo IPv4 addresses would be useful for geolocation.

Good point, probably not. Although it does partially solve the problem.

Does someone know how to ban single users based on IPv6? Is this even possible? What is the alternative?

It's not possible on IPv4 either, your IP is one of the easiest thing for you to change...

Browser/device finger printing is probably the best option at the moment, but you'll get plenty of false positives amongst privacy aware users who block fingerprinting.

I think the rough IPv6 equivalent of a single IPv4 ban would be to ban a /64 subnet. This bans all users in that subnet which is the same as banning an IPv4 subnet hiding behind a single NAT address.

This would be the case, except home users can often get a /56 or /48.

I'd say the same way you ban them with IPv4. IP bans are trivial to circumvent, so those who won't bother to/can't circumvent them with IPv4, also won't with IPv6.

It's the same as in IPv4.

If the user has a static IP address, in IPv4 you ban a /32 (i.e., one address, his own). In IPv6 you'd have to ban the entire range allocated to the user, usually a /64. (edited)

If the user has a dynamic IP address, well, you're on your own. :D

A /32 in IPv6 often is an entire provider, so that's not a good idea. A /64 is the closest to a single IPv4 address, (although some providers give each customer a /56 or so, for creating subnets).

With CG-NAT on IPv4, banning a v6 /64 is no worse than banning an v4 /32.

The alternative is to let them post and just hide their stuff from other people; see https://blog.codinghorror.com/suspension-ban-or-hellban/ for example.

HN has a system like that, but it fails because some people can still see the 'hidden' / dead posts, and for some reason they then go and point out "your comment shows up as [dead]", which defeats the purpose.

Just ban people without letting them know.

Most people will tell someone they're hellbanned if their comments are benine and it doesn't make sense for them to be hellbanned.

Reply on news.ycombinator.com