It's a lot harder for them to come from your IPs than it is for them to simply send the `User-Agent`

It's a lot harder for them to come from your IPs than it is for them to simply send the

User-Agent

User-Agent

User-Agent

User-Agent request header, but IPs aren't fool-proof either - they might be from shared infra, a stale list means IPs no-longer under your control are still whitelisted, etc

kianOP•2/21/24, 10:52 PM

A mixture of both is best, but IPs are better than UAs generally since they require the ability to send traffic from that IP.

kianOP•2/21/24, 10:53 PM

If that secret got out, it's not useful to anyone if your customers also only allowed your IPs.

kianOP•2/21/24, 10:53 PM

Is the chance of that secret getting out likely? Probably not.

Kkian It's a lot harder for them to come from your IPs than it is for them to simply s...

SK•2/21/24, 10:53 PM

yep - always a risk of the secret being leaked. But it's easier for me since I use a lot of shared ips (aws lambda, fly.io, cloudflare workers, etc)

SK•2/21/24, 10:53 PM

just wanted to make sure I'm not missing something super obvious that voids this idea haha

SK•2/21/24, 10:53 PM

thanks!

Original message was deleted

DarkDeviL•2/21/24, 10:56 PM

2a01:4f9:2b:1b6e::/64
2a01:4f8:10b:3d1b::/64
2a01:4f8:231:2ac9::/64
2a01:4f8:251:53df::/64
2a01:4f8:261:1254::/64
2a01:4f8:261:1257::/64
2a01:4f8:261:1262::/64
2a01:4f8:261:1280::/64
2a01:4f8:261:1296::/64
2a01:4f8:261:129f::/64
2a01:4f8:c17:ef62::/64
2a01:4f8:2200:346e::/64
2a01:4f8:c010:9ef1::/64
2400:8901::/64
2400:8902::/64
2400:8907::/64
2600:3c00::/64
2600:3c02::/64
2a01:7e00::/64

2a01:4f9:2b:1b6e::/64
2a01:4f8:10b:3d1b::/64
2a01:4f8:231:2ac9::/64
2a01:4f8:251:53df::/64
2a01:4f8:261:1254::/64
2a01:4f8:261:1257::/64
2a01:4f8:261:1262::/64
2a01:4f8:261:1280::/64
2a01:4f8:261:1296::/64
2a01:4f8:261:129f::/64
2a01:4f8:c17:ef62::/64
2a01:4f8:2200:346e::/64
2a01:4f8:c010:9ef1::/64
2400:8901::/64
2400:8902::/64
2400:8907::/64
2600:3c00::/64
2600:3c02::/64
2a01:7e00::/64

DarkDeviL•2/21/24, 11:00 PM

But the good question is, do you actually want to blindly add the subnets to your whitelist?

At least for those six ones:

2400:8901::/64
2400:8902::/64
2400:8907::/64
2600:3c00::/64
2600:3c02::/64
2a01:7e00::/64

2400:8901::/64
2400:8902::/64
2400:8907::/64
2600:3c00::/64
2600:3c02::/64
2a01:7e00::/64

These are all Linode SLAAC ranges, where each VM will get one individual /128 IPv6 address per default.

Alone adding them as as a Skip rule would make all Linode customers be able to access your site, WITHOUT your defence being active.

DarkDeviL•2/21/24, 11:01 PM

But that's where you're ending, by sanitizing them to /64.

Original message was deleted

DarkDeviL•2/21/24, 11:13 PM

You're welcome, - just remember the "fine print" in the following message.

AAA whats your question?

�

𝔜𝔞𝔫𝔤[matt]•2/21/24, 11:14 PM

Who would you recommend for hosting ?

�𝔜𝔞𝔫𝔤[matt]Who would you recommend for hosting ?

AA•2/21/24, 11:19 PM

depends on whats being hosted. I use cloudflare for lots of stuff, and have some servers on vultr

Original message was deleted

DarkDeviL•2/21/24, 11:20 PM

It's everything from https://uptime.betterstack.com/ips.txt, but without duplicates:

2400:8901::f03c:93ff:feb1:9809
2400:8901::f03c:93ff:feb1:9886

2400:8901::f03c:93ff:feb1:9809
2400:8901::f03c:93ff:feb1:9886

sanitized to /64 will both become:

2400:8901::/64

2400:8901::/64

DarkDeviL•2/21/24, 11:21 PM

2400:8907::/642400:8907::/64 would for example be there three times without deduplication.

Original message was deleted

DarkDeviL•2/21/24, 11:42 PM

I'd say anything from instant to the upper limit of Cache-Control here, assuming you aren't manually purging?

Original message was deleted

DarkDeviL•2/21/24, 11:43 PM

They didn't, they added each individual IPv6 addresses they had one by one, and some of them just managed to be within the exact same /64 subnet.

AAA depends on whats being hosted. I use cloudflare for lots of stuff, and have som...

�

𝔜𝔞𝔫𝔤[matt]•2/22/24, 12:01 AM

It would be some Roblox files for sale and commission orders

�𝔜𝔞𝔫𝔤[matt]It would be some Roblox files for sale and commission orders

AA•2/22/24, 12:03 AM

Unless permission is needed you can just use wasabi

AA•2/22/24, 12:03 AM

Or google drive

AAA Unless permission is needed you can just use wasabi

�

𝔜𝔞𝔫𝔤[matt]•2/22/24, 12:03 AM

What do u mean permission ?

�𝔜𝔞𝔫𝔤[matt]What do u mean permission ?

AA•2/22/24, 12:03 AM

If you need username/passwords

AAA If you need username/passwords

�

𝔜𝔞𝔫𝔤[matt]•2/22/24, 12:04 AM

I would for people to order stuff ? And developers to keep track orders

�𝔜𝔞𝔫𝔤[matt]I would for people to order stuff ? And developers to keep track orders

AA•2/22/24, 12:05 AM

I suspect you're in the wrong discord

Original message was deleted

DarkDeviL•2/22/24, 12:05 AM

Based on a quick glance, it looks like the full list, excluding the six mentioned spaces.

Whether you need the six spaces or not, depends on conditions like e.g. how they are scanning your website, from where, ... and so on.

DarkDeviL•2/22/24, 12:06 AM

Not having them could obviously cause issues where they are unable to test your site, if the test they run come from one of these spaces.

AAA I suspect you're in the wrong discord

�

𝔜𝔞𝔫𝔤[matt]•2/22/24, 12:06 AM

Need a web host for sale website and staff to keep track of there commissions

�𝔜𝔞𝔫𝔤[matt]Need a web host for sale website and staff to keep track of there commissions

AA•2/22/24, 12:07 AM

You'd need to ask the developers for the hosting requirements

Original message was deleted

DarkDeviL•2/22/24, 12:08 AM

Together with your communication (re. "I'll ask them"), you might want to pass on to them that they should contact Linode Support for a "dedicated" subnet, and update their IP lists accordingly after that, and then re-configure their network to use the dedicated subnet accordingly.

AAA You'd need to ask the developers for the hosting requirements

�

𝔜𝔞𝔫𝔤[matt]•2/22/24, 12:13 AM

What would u recommend

eldar08.•2/22/24, 1:30 AM

Hi, is it possible to upload a react site to Cloudflare without github?

Eeldar08.Hi, is it possible to upload a react site to Cloudflare without github?

Isaac McFadyen•2/22/24, 1:34 AM

Yup. You can use Direct Uploads: https://developers.cloudflare.com/pages/get-started/direct-upload/

IIsaac McFadyen Yup. You can use Direct Uploads: https://developers.cloudflare.com/pages/get-sta...

eldar08.•2/22/24, 1:38 AM

Thanks, i did a react build and uploaded the react build via the direct upload "drag and drop". I now see the actual html in the browser, instead of the site...

IIsaac McFadyen Yup. You can use Direct Uploads: https://developers.cloudflare.com/pages/get-sta...

eldar08.•2/22/24, 1:43 AM

Have you been able to do a successful direct upload for a react app?

Isaac McFadyen•2/22/24, 1:45 AM

Are you using Firefox?

Isaac McFadyen•2/22/24, 1:45 AM

If so, try another browser. Sometimes there's a bug with uploading direct with Firefox.

eldar08.•2/22/24, 1:59 AM

I am using Firefox, I'll try with chrome.

IIsaac McFadyen Are you using Firefox?

eldar08.•2/22/24, 2:07 AM

Tried with firefox and still the same issue, just see the raw html content of the index.html file.

Original message was deleted

Hello, I’m Allie!•2/22/24, 7:20 AM

That’s what I meant. BFM is pretty good at stopping bots, but, if you need any customization, your only recourse basically is to disable it and use WAF rules, or pay for SBFM.

Hello, I’m Allie!•2/22/24, 7:20 AM

Though in this case, if they whitelist observatory internally, that should fix the problem

Asnan Digixvalley•2/22/24, 11:00 AM

Hi, I need assistance with video streams. I am uploading a video through an API, but the thumbnail's color appears brighter than the actual video. Can someone help me correct this issue?

Original message was deleted

Chaika•2/22/24, 2:07 PM

Cloudflare has Email Routing and you could have it drop/not forward all mail but the activity log only goes back 24 hours, and only has sender/to, not contents

Chaika•2/22/24, 2:08 PM

Chaika•2/22/24, 2:08 PM

you could throw together your own stuff using Email Workers + R2 or something, but that'd be custom, nothing out of the box

David•2/22/24, 9:22 PM

An intreating finding: if you create an application on zero trust and add yourself as the approver,
then try to log in as a regular user with the approving email address, but it won't let you
It might be a bug
if I'm hello@org.com
The approver's email address is hello@org.com. Should this be automaticity equal to true?

eldar08.•2/23/24, 2:20 AM

Created a new domain on Cloudflare and uploaded a react app, but it says mysite.pages.dev instead of the actual mysite.com that i registered. How do i change or update the dev domain?

Eeldar08.Created a new domain on Cloudflare and uploaded a react app, but it says mysite...

Cyb3r-Jak3•2/23/24, 2:21 AM

You would add a custom domain of what you wanted. https://developers.cloudflare.com/pages/configuration/custom-domains/

CCyb3r-Jak3 You would add a custom domain of what you wanted. https://developers.cloudflare....

eldar08.•2/23/24, 2:31 AM

Thanks, does the site then have both the mypage.pages.dev and the custom domain?

Eeldar08.Thanks, does the site then have both the mypage.pages.dev and the custom domain?

Cyb3r-Jak3•2/23/24, 2:32 AM

Yes but you can make a redirect rule so anyone who visits mypage.pages.dev will get redirected to the custom domain

CCyb3r-Jak3 Yes but you can make a redirect rule so anyone who visits mypage.pages.dev will ...

eldar08.•2/23/24, 4:15 AM

It seems to work, website.com works, but my www.mywebsite.com does not work.

Eeldar08.It seems to work, website.com works, but my www.mywebsite.com does not work.

DarkDeviL•2/23/24, 4:18 AM

Did you add the custom domain both with and without

www

www

It's a lot harder for them to come from your IPs than it is for them to simply send the `User-Agent`

Similar Threads

Similar Threads

Similar Threads