Post B4MRJY8hE7YPEAeclc by ireneista@irenes.space
(DIR) More posts by ireneista@irenes.space
(DIR) Post #B4MOmetStSl0i9ic52 by mhoye@cosocial.ca
0 likes, 0 repeats
"we caught one" god. Luxurious. Once again, I strongly advise you to set up fail2ban so that anyone you serve a 404 catches at least a full day ban, and if you don't care about talking to other people's services, do your best to fully block the IP ranges associated with all the major hosting companies. https://exple.tive.org/blarg/2025/10/21/raised-shields/https://infosec.exchange/@foobardevs/116246141464905287RT: https://infosec.exchange/ap/users/116217809378584701/statuses/116246141464905287
(DIR) Post #B4MOmf5ABy7BIRBxJY by azonenberg@ioc.exchange
0 likes, 0 repeats
@mhoye a single 404 is very aggressive, all it takes is one fatfingered link in a page pointing to your site and you're banning visitors en masse.after 5-10 404s in a row for different URLs, different story.
(DIR) Post #B4MP7M1eEudgH4PlSa by mhoye@cosocial.ca
0 likes, 0 repeats
@azonenberg Nobody is fat-fingering their way to .env or backdoor .asp files.
(DIR) Post #B4MPJM71k70u1CeZ8a by azonenberg@ioc.exchange
0 likes, 0 repeats
@mhoye yes i'm all for having specific poison URLs that trigger an immediate ban.But "immediate ban on any 404 whatsoever" seems heavy handed.
(DIR) Post #B4MPZPRJ8lRoyEnJOC by mhoye@cosocial.ca
0 likes, 0 repeats
@azonenberg Read your logs, tell me what you see. Nobody's typing out URLs anymore.
(DIR) Post #B4MQFUW8eQXAsk7Vdg by ireneista@irenes.space
1 likes, 0 repeats
@mhoye @azonenberg .... we do personally do thatwe're prepared to accept that we do not exist, in a statistical sense. that is true in SO many waysbut we hesitate to put into place a rule which would lock ourselves out. we'd at least apply a threshold of a few 404s over a window of time, not just a single one
(DIR) Post #B4MQFUmneTrTiPuobo by azonenberg@ioc.exchange
0 likes, 0 repeats
@ireneista @mhoye exactly, i've copy pasted a link and truncated it or something so many times while making another blog page or sending an email etc.URLs get truncated in emails by 80 column format limits all the time too.If you ban on a single 404, or repeated hits to a single truncated/corrupted URL, you'll cut off a lot of legitimate users. Specific bogus URLs, e.g. .asp and .php URLs when your site is written in python, make a lot more sense as poison ban URLs.As someone who is currently unable to order delivery from my local grocery store due to excessively paranoid WAFs, I'm strongly against this kind of hair trigger defense mechanism.I've stopped buying components from Mouser because they lock me out constantly for reasons unknown, doing a single search for a component part number is often enough to trigger it.
(DIR) Post #B4MRJXRnnbF758aMuO by ireneista@irenes.space
0 likes, 0 repeats
@azonenberg @mhoye oh, yeah, we intentionally browse the web in ways that deny sites most of the secondary signals they use to assess human-ness, because we think it's none of anyone's business and our privacy background makes us highly aware of all the other things that data can be used for....... so we get locked out of pretty much everything, constantly, and we have a lot of habits around getting un-locked-out as part of our browsing experience. sigh.
(DIR) Post #B4MRJY8hE7YPEAeclc by ireneista@irenes.space
0 likes, 0 repeats
@azonenberg @mhoye we have noticed that mouser is a particular offender, indeed, right up there with the less-regulated financial institutions (the various money transfer services that do the things banks do but avoid being treated as banks by the law) in regard to its hair-trigger naturemouser does seem to take a much narrower list of signals into account than the money transfer services do, which makes it easier to defeat. so that's nice?
(DIR) Post #B4MRJYMsNOtdw9Hwrw by ireneista@irenes.space
0 likes, 0 repeats
@azonenberg @mhoye but yeah, we buy from digikey, it's easier and we like their filter UI better anyhow
(DIR) Post #B4MRJYYZfuFoWQlI6S by azonenberg@ioc.exchange
1 likes, 0 repeats
@ireneista @mhoye exactly I've just stopped giving mouser my business over this. You go out of my way to not get my business, I'll honor your wishes
(DIR) Post #B4MWcIJ2okSXOYFgcy by dascandy@infosec.exchange
0 likes, 0 repeats
@azonenberg @mhoye I have ~15 url segments that put you into everything-403 for a while. Seems to work.
(DIR) Post #B4NsPRASx2BdGQTRJ2 by corbet@social.kernel.org
0 likes, 0 repeats
@mhoye @azonenberg That part is true. I would never ban an address just for a 404 (though we do track such things in other ways). But if somebody is going for, say, /wp-anything, that's not a typo, that is seeing if a random doorknob is unlocked. Not the sort of reader we are writing for.
(DIR) Post #B4NsPRMsCu6xsuHLe4 by azonenberg@ioc.exchange
0 likes, 0 repeats
@corbet @mhoye yeah exactly what i'm getting at... there's a huge difference between "truncated url to an article" or "mistyped image URL" and looking for /wp-admin on my static HTML site.That said, it's a static site you can look for wordpress endpoints all day nothing will talk back to you :p