Should I Block ICMP?

You are absolutely correct, but also, I am already having to clamp MTU for most business customers anyway, for a hundred reasons.

The issue is that sysadmins make this the ISP's issue anyway. They wont do any kind of investigation but simply yell at the telco. Telcos are ready willing and able to clamp. Its as natural as breathing at this point.

The only thing that gets me is when the some small business refuses to enable ICMP for troubleshooting when they raise a complaint. You have to come to the table at least that far.

the problem is ICMP can be abused for attacks like ICMP flood, ICMP smurf, because src.ip can be easily spoofed.

its very easy and cheap to saturate a link with flood traffic, but fixing this issue requires large investments in big expensive firewalls that can block these stupid attacks

Inbound echo request and echo reply are almost always blocked in my experience.

I bought a TP Link router to run in AP mode for WiFi 7. It has none of those antennae sticking out. It does have a little grid of LEDs on the front that I have set to the UwU face option though...

My newest router doesn't have any of that shit and works just as well, with at least as much range, as the one it replaced, which had six(!) of those insectoid antenna things.

I wouldn't be surprised if the damn antennas are just empty. They don't seem to serve any purpose.

I don't understand. Did you RTFA? This isn't a person asking whether they should block ICMP, it's a webpage designed to answer that question. Unless you're just ranting about your poor experience on HN under my comment, in which case carry on, I couldn't care less.

You people jest, but I once worked under a CISO that started an initiative to close all ports on production systems.

Yes, including 80 and 443.

He was purely a GRC monkey that had absolutely zero technical knowledge, he just knew how to check boxes. It took way too long for me to explain to him that closing those ports would take our SaaS down entirely, and I was absolutely appalled that I had to have that discussion and started questioning how the hell this guy became a CISO.

I've heard some people argue that CISOs don't need to be technical, but I wholeheartedly disagree and can't fathom how anybody could think that someone who manages something should be able to get away with not having any knowledge in the field they manage. Like, I get that the IC track and the management track are completely different skillsets, but once you get to that level, you should have both sets of skills. I wouldn't want a CTO that doesn't know how to code, and I'd be terrified of a CFO that doesn't know accounting.

In all seriousness, there is fan control software where you can request a speed of 0 when temperature is in a particular range.

Only if you leave the spacebar heating config set to off

Yes if the machine is operating in a vacuum.

Fair enough. For me personally it's not that big of a concern. I just remember from a previous network monitoring gig that using ICMP had a few problems with rate limiting. But that wasn't my cheap router at stake. It's probably just something that stuck with me and not that relevant in my context anymore.

Indeed. What I meant was that it's cheaper to drop than to generate a reply. But you are right, and I also mentioned in the other reply, that my router wouldn't stand a chance dropping or replying to a DDoS anyway, so probably this concern is not relevant in the home router context.

There's a YouTube domain that's somehow a load-bearing part of Google's OAuth login flow.

Thank you!

> The explanation I've seen before is that it doesn't really matter for websites that don't _want_ anything from you. No credentials, no login forms, no text entry fields.

Still worth creating a bit of a shield between you and the site to make it just hat much harder for anybody in the middle to inject anything / change anything.

Back before Lets Encrypt made it inexcusable to not have https, it was a common-ish prank to MITM all the HTTP traffic you could see and do something harmless like rotate images 180 degrees.

Without TLS, sometimes still referred to as SSL, a webite's content can be modified by anyone controlling the network path. This includes ISPs and WiFi operators.

Sure, your website may have unimportant stuff on it that nobody relies on, but do you want visitors to see ads in your content that you didn't put there?

> Maybe there are edge cases associated with this?

Plenty. There are a lot of information-only websites where you might want to keep your visit to yourself.

To give an obvious example: some parts of the United States are trying very hard to make abortion impossible. The state government could mandate that ISPs MitM your traffic, and alert the police when you visit a website giving you information about the legal abortion clinics in a neighboring state. Guess you'll be getting a home visit...

The same is going to apply with looking up info on LGBT subjects, civil rights, Tiananmen Square, a religion not explicitly allowed by the state, whether Eurasia has always been at war with Oceania, and so on. Heck, even a seemingly innocent website visit could theoretically come back to haunt you years later. Just some bored scrolling on Wikipedia? Nope, you were planning a crime - why else were you reading pages about chemical warfare during WW I? That neighbor who died due to mixing bleach and ammonia was obviously murdered by you.

If it's unencrypted, you should assume it's being logged by someone nefarious. Are you still okay with it?

Without TLS, people (service providers and intermediaries) can tell what pages I'm reading on your site. They can make the kind of inferences from these that get people convicted at trial.

TLS is more important on sites that are just serving information. It's easy to reconstruct your train of thought as you click around.

Librarians have fought (and lost) to defend our privacy to read.

https://www.ala.org/advocacy/intfreedom/privacyconfidentiali...

In addition to what everyone else has said, having everything be encrypted means encryption isn't "special", there's no metadata that indicates that the communication contains secret data due to encryption. If people don't encrypt non-sensitive traffic, then sensitive traffic stands out. So there's a sort of civic duty element to enabling TLS (or using encrypted messaging, etc.).

The website might not be designed to have credentials or login forms, but now you have allowed attackers to place fake login forms on your website. And given the prevalence of password reuse for the general population, attackers can easily harvest real passwords this way.

Not to mention injected ads which used to be very common in the late 2000s.

I used to think that, but at this point the Internet is sufficiently hostile that it's everyone's responsibility to encrypt everything all the time to reduce the utility to bad actors to zero.

It's a little bit like using Tor for some of your ordinary browsing (which I do) so that spy agencies can't infer everyone using Tor is doing something wrong.

Remember the C-I-A triad of security.

I consider the integrity of messages to-and-from the web to be very important.

Many of us lived through days when ISPs or some other greedy middleman injected ads into unsecured web pages. They played DNS tricks too.

Imagine if you had an app download that could be maliciously modified in-flight.

Furthermore, a certificate can guarantee you’re not connected to an imposter. What if the TFA link was redirected to “abevigoda.com”? Catastrophe!