Hacker News new | past | comments | ask | show | jobs | submit
hetspookjee | on: Residential proxies detected on White House network
There’s only that many ipv4 addresses and I believe all 5G are shared ones. That’s why they’re among the most valuable ip ranges for scraping. You can’t just naively ban that IP or you’ll ban a large group of users
BLKNSLVR | parent | next
You certainly can ban that IP.

It should be a balancing act though, somewhere between what you said and my first sentence.

Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.

It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.

IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.

neuroticnews25 | root | parent | next
>you shouldn't just leave to door open to potentially known bad users / traffic

Why not? If security is the priority, the worst that could happen from that is clutter in logs and higher resource use. Nobody wastes 0days spraying them on random hosts, and a real motivated attacker targeting your server will not be stopped by an ip blacklist.

skinfaxi | root | parent | next
> It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic

Is this like a corporate support response? I legit can't tell. Try explaining to a retail consumer why they can't buy from your site because they have TMobile service.

what | root | parent
They’re saying T-Mobile should be monitoring traffic on their network and block traffic from bad actors that ruin it for everyone for everyone else? Or at least they do in the next paragraph.
skinfaxi | root | parent
When the bad actor is grandma who has an infected computer, T-Mobile will be dealing with a lot of support calls from objectively non-malicious actors.
Gigachad | root | parent
The blocking of residential proxies might be the thing that moves the world to ipv6. These days what we need is a dynamic map of all the IPs running proxies so servers can block them. If every device gets it's own v6 address, you could block just the TV running the proxy. Modern crowd sourced security products could identify the proxies and share their IP live so you can ban and unban addresses as the device moves.
BLKNSLVR | root | parent | next
A list of proxy lists: https://proxy-scraper.de/sources/

The lists generated by this tool can be useful as well: https://github.com/maximilianfeix/proxy-scraper (which point to here: https://github.com/maximilianfeix/free-proxy-list)

There is also this bot proxy IP list: https://github.com/antoinevastel/avastel-bot-ips-lists

1e1a | root | parent | next
The TV can just pick a different address when it notices that it is being blocked.
Gigachad | root | parent
In that case you’d just block the whole subnet that the TV is using.
| root | parent
{"deleted":true,"id":50374783,"parent":50374517,"time":1793849372,"type":"comment"}
sva_ | parent
Not sure about US but where I live I can manually set the access point of my phones mobile network and it gives me a unique ipv4 (new one each time in fact)
hod6654 | root | parent
Care to elaborate? Your mobile network operator gives you a long list of APNs that you can use?