undefined | Better HN

0 pointslxgr10mo ago0 comments

> I think they have to for ipv6 addresses… there’s just way too many bots and way too many addresses

Are you really arguing that it's legitimate to consider all IPv6 browsing traffic "suspicious"?

If anything, I'd say that IPv4 is probably harder, given that NATs can hide hundreds or thousands of users behind a single IPv4 address, some of which might be malicious.

> you may have gotten an address that was previously used by a bot network.

Great, another "credit score" to worry about...

0 comments

MichaelZuo10mo ago

For a whitelist system, then by definition yes?

If it’s a blacklist system, like I said I’ve not heard of any feasible solution more precise than banning huge ranges of ipv6 addresses.

Dylan1680710mo ago

> For a whitelist system, then by definition yes?

A whitelist system would consider all IPv4 traffic suspicious by default too. This is not an answer to why you'd be suspicious of IPv6 in particular.

> I’ve not heard of any feasible solution more precise than banning huge ranges of ipv6 addresses.

Handling /56s or something like that is about the same as handling individual IPv4 addresses.

trollbridge10mo ago

I try to build things to be INET6 ready, and just repeat /64s like a single host. Eventually this will probably have to broadened to /56s or /48s.

MichaelZuo10mo ago

> A whitelist system would consider all IPv4 traffic suspicious by default too.

Based on what argument…?

Dylan1680710mo ago

The definition of whitelisting. The argument you brought up.

1 more reply

j / k navigate · click thread line to collapse

0 comments

MichaelZuo10mo ago

For a whitelist system, then by definition yes?

If it’s a blacklist system, like I said I’ve not heard of any feasible solution more precise than banning huge ranges of ipv6 addresses.

Dylan1680710mo ago

> For a whitelist system, then by definition yes?

A whitelist system would consider all IPv4 traffic suspicious by default too. This is not an answer to why you'd be suspicious of IPv6 in particular.

> I’ve not heard of any feasible solution more precise than banning huge ranges of ipv6 addresses.

Handling /56s or something like that is about the same as handling individual IPv4 addresses.

trollbridge10mo ago

I try to build things to be INET6 ready, and just repeat /64s like a single host. Eventually this will probably have to broadened to /56s or /48s.

MichaelZuo10mo ago

> A whitelist system would consider all IPv4 traffic suspicious by default too.

Based on what argument…?

Dylan1680710mo ago

The definition of whitelisting. The argument you brought up.

1 more reply

j / k navigate · click thread line to collapse