XMPP Service Operators - 2023-07-05

Exactly the same issue I see

An IPv6 address space has 1 ip for each grain of sand on earth

In such a case, how can one make sure that in public space, bot attacks won't happen?

If I have a blacklisting kind of logic where I ban IPs, it can grow till my server finds it impossible to manage the list of IPs.

generally, with IPv6, you ban entire subnets. /64 is commonly assigned to a single "user", customer or tenant.

IP blocking is usually a nice to have, you should still have actual tactful security behind it

so you'd start with /64, and if you find adjacent networks to also be problematic, you gradually escalate the prefix length

(keeping the whois information in mind to not go beyond ISP boundaries)

Even with such a subset assigned, how many IPs are we talking about?

Even after banning it, the resultant search set is very high, right?

> so you'd start with /64, and if you find adjacent networks to also be problematic, you gradually escalate the prefix length But wouldn't this even ban unrelated computersm

computers?

So say, my neighbour has [a,b] IPs. I have [b,c] My neighbour engages in bot attacks but I don't. Even I will be banned in that case!

yes.

it's not perfect, same can happen with IPv4 with carrier grade NAT though

that's the issue with IP bans

IPv6 just makes it more explicit and workaroundable really (you could add exceptions if users complain, can't add exceptions for individual users behind CGN) ✏

4,29,49,67,296 values are extremely manageable on a program. One can easily ban and prioritize individuals

If one can fix IPv6 addresses, then one can whitelist

My ISP, Jio, keeps a stable IPv6 but if I switch off the router and switch it on again, the address changes

I've daily new ips by default.. That's the thing with ips... It is only a small part of your strategy.

Menel: v6 or v4?

Both

Same here, that's why I have my TTL set to 1min and crontab updating the IP every minute

Mine changes only when router is more than a minute offline and it's only v4

1 person was mentioning how they have privacy because they are in an IPv4 network

It is a very interesting argument! Extremely true!

Cgnat doesn't give you privacy

yeah that sounds misinformed

? Come on, when a bunch of devices use a single IP, one wouldn'y be able to differentiate one packet from another that well!

That's privacy

What are your views on gopher and gemini?

Do you think they're needed?

Above 2 questions are directed to everyone

Still offtopic...

sagaracharya, please join this chat if you want to continue these diatribes: xmpp:conversations-offtopic-reloaded@conference.trashserver.net?join