Comment by thaumaturgy | Hacker News Reader

Comment by thaumaturgy | Hacker News Reader

Parent Full thread

I've been doing something similar to this for years on a mail server that hosts all of my mail as well as a number of customers. Contrary to the other replies, it's worked out really well, and you can rely on customers to complain pretty quickly if anything's not working right.

The bulk of the abuse comes from Russian and Chinese networks, with Brazil working hard to catch up. Those can be pretty well perma-banned without consequence. Under "folks that should be fined into oblivion", there's cogentco.com, quadranet.com, colocrossing.com, level3.com, vpls.com, softlayer.com, hostingsolutionsinternational.com, datashack.net, singlehop.com, actonsoftware.com, and a whole raft of others.

The secret sauce is a carefully tuned ban decay function that scales up with the number of abuses. Occasional hits get a network banned for an hour or less, subsequent hits get them banned a little longer, and then there's a fine line where the function goes exponential, all the way up to 6-month-plus ban periods for really big nuisances.

Otherwise it's just fail2ban on some logs and some home-brew code that does whois lookups on nuisance IPs and some data mining on the whois response.

I run a Brazilian site and the latest attack came from Europe (France and Bulgaria). I get a lot from the US and China as well.

As we are really only interesting in our state, I don't think twice about banning international IPs and they are mostly from large datacentres.

I can't ban China as our suppliers at work are partly -Chinese, it's a royal PITA, I can't even whitelist them as they have to bound around VPN's just to get around the Great Firewall of China on their end.

If your suppliers use VPNs anyway, you can absolutely ban Chinese IPs without much consequence for them. However, if it's for a user-facing site, please don't just ban all of China. After relocating, I was quite annoyed by the number of websites that are unavailable not because they are blocked by the Great Firewall, but because they banned all of China and VPNs to stop the abuse they saw from some IPs in those ranges.

If they consistently used VPN's I would but it seems to be intermittent since the GFWoC is a fickle thing.

The problem is VPN is now banned unless it's recognized by the state (must be registered). You can still try to use the underground VPN, but not guaranteed. The GFC knows everything in and out. It is one of the most acclaimed and sophisticated closed source networking system in the world. They can toggle on and off in matters of minutes. They have a huge work force monitoring their internet and censoring speech in no time.

Of course the Chinese government are aware of existing circumvention, but they still allowed them because they want to capture data. They let these circumvention to exist even though they have the brightest engineers in China working for them. I vaguely remember a talk from RealCrypto a number of years ago, someone presented how one could try to escape GFC by sending data over different protocols and then resemble by the recipient. It's an ingenious circumvention that is quite hard to decipher, until someone recognizes a traffic pattern, then Chinese government knows.

Not sure if same protocol, but iirc Dust (https://github.com/blanu/Dust) was supposed to accomplish this. Created by Brandon Wiley co-founder of freenet.

You can ask a friend to setup a vpn at home with his traditional ISP

Would you be interested in open sourcing that?

Yup, would be great!

> Under "folks that should be fined into oblivion", there's cogentco.com, quadranet.com, colocrossing.com, level3.com, vpls.com, softlayer.com, hostingsolutionsinternational.com, datashack.net, singlehop.com, actonsoftware.com, and a whole raft of others.

What do you mean these should be fined? Level3 is a transit provider for massive portions of traffic on the Internet and Softlayer has some hundred thousand servers.

He means that is the host range he saw the most attacks from. Deduction then takes his argument to the understanding that many attackers use Level3 and Softlayer for attacking purposes.

IBM SoftLayer is a reputable cloud as far as I am concerned, just like AWS and Digital Ocean. I've seen and banned a few of the other names given, after concluding that they exclusively provide spam and malicious servers.

Reply on news.ycombinator.com