Hacker News Reader

Comment by uniqueuid | Hacker News Reader

This is a good opportunity to recommend nft blackhole [1].

Automatically block countries by CIDR blocks and known bad actor IPs. Auto-updates these lists and adds them to your firewall.

It's a 5 minute install and maintenance free afterwards.

Not perfect, but reduces attack surface and log spam.

[1] https://github.com/tomasz-c/nft-blackhole

View on HN

Looks not-so reliable. Either fetches a list of blocks from https://github.com/herrbischoff/country-ip-blocks which is a random GitHub repository that collects "straight from the Regional Internet Registries" without any stating any sources nor method for gathering it (which also, I'm assuming, is self-reported data from those registries), or it fetches it from https://www.ipdeny.com/ which currently runs with an expired TLS certificate, which on top of everything, nft-blackhole ignores any issues with certificates anyways, leaving it wide open to MITM attacks (https://github.com/tomasz-c/nft-blackhole/blob/8a656ac0a803a...)

I wouldn't run that if I'd want something to reliably block someone from a specific country.

> Not perfect, but reduces attack surface and log spam.

You know what also does that? Setting up sshd properly in the first place.

Calling the repository of Marcel Bischoff a random GitHub repository. LOL

Yes, GitHub repositories are generally not considered trust-worthy sources of information unless you actually could cite your resources in the repository itself. This information gathered there has 1) no source stated and 2) no way of reproducing the information yourself, earning it the description of "A Random GitHub Repository", even when you try to appeal to authority.

How about using a tool like https://crowdsec.net/ that collects (basic, anonymious) information from users on the attacks they see, vets it and shares it back to all users via blocklists? Currently around 800k signals are collected and there's around 19k vetted bad ips in the blocklist. Sounds more reliable to me.

Reply on news.ycombinator.com