Hacker News Reader

Comment by Simulacra | Hacker News Reader

Technical question maybe someone can answer: Why doesn't Amazon just block all incoming connections from .bd, etc. ? If not block then depreciate the activities locations where this problem occurs frequently?

View on HN

I have actually written a script in the past specifically to periodic collect and update all Bangladesh IP address blocks assigned from ARIN. They are the #1 source of spam on the web sites I work on. I had to go to these lengths due to getting non-stop calls all night from content teams needing help stopping them from destroying the web sites.

You think click farms in Bangladesh can't establish VPN endpoints in the USA? You can even get VPN endpoints that are specifically in Comcast, Verizon FiOS, charter, CenturyLink residential IP space so that it doesn't look like your traffic is coming from some /22 assigned to a Colo/dedicated server hosting company.

That means it wouldn't outright prevent the behavior, but it would add some cost and friction. That could reduce the sheer volume of the problem to make it worth it.

Maybe even not blocking them outright but just rate-limiting would provide comparable friction. It could even be more effective if they never try the VPN route to discover that it's faster.

You're overestimating the cost of bulk VPN services. It's like $1.50 per click worker desktop PC terminal per month, and that's if they don't have a decently skilled sysadmin to DIY it.

If you limit the IP to the residential IP space then VPN costs become huge. You need some resident to rent his IP to you. If those residents get punished by their providers for that behaviour then soon you will have to rent apartments to buy your own connections. That's hundreds of dollars.

Now, if Amazon would be sincere about preventing fraud, they would ban the IPs of fraudulent comments and somehow cooperate with the providers if they use random IPs. In other words, you would have to rent a new apartment for every bad review. That's an exhibitive cost.

I didn't make any specific cost estimate, merely stating "some". I'll grant that $1.50 is actually "none" iff it's a negligible fraction of that worker's monthly earnings.

With "wages low skilled" at 4650BDT [1] that's $55.50 at today's exchange rate. I'm standing by my estimate of "some", as a 2.7% "tax" on income isn't negligible, and could have far greater significance for those who earn at the bottom of the scale.

[1] https://tradingeconomics.com/bangladesh/indicators

I bet it's just one big echo chamber of people copy/pasting each other, just like every trend on social media (memes, etc).

Because VPNs to American servers are dirt cheap.

I think you left this comment on the wrong thread.

then they'll use some company like luminati to provide them with residential IPs instead.

This needs more visibility. I've worked for Hola briefly, their business model is truly shameless. Hola is a free p2p VPN used as a browser extension, and they sell access to this network of users via the "luminati" brand.

I used to think it was compromised routers now I'm more shocked how they monetized free vpn. I wonder what users think when sites get blocked

Reply on news.ycombinator.com