whitelist mtgox

[jaybny]

can we just generate a list of all funded registered IPs.. so we can at least trade until this ddos is figured out?

assuming you have list of all valid ips.. would this work and stop the ddos? if so.. why not do it?

[Nefario]

because some/most users have a dynamic ip?

[jaybny]

because some/most users have a dynamic ip?

implementation detail... many ways around this.

back to the basic question.. assuming you have everyones ip.. will it work?

[xf2_org]

Some of the other services have "IP security" options, where you whitelist a set of IP or range of IP addresses associated with your account.  Per-person, this serves to ensure that someone from another country or computer is less likely to access your account.

Site-wide, it could be used as an anti-DDoS whitelist.

[TTBit]

pay 0.01 btc to get on the whitelist.

[casascius]

pay 0.01 btc to get on the whitelist.

+1  (0.01 * 100)

[TTBit]

pay 0.01 btc to get on the whitelist.

+1  (0.01 * 100)

I'll pay 1.00 btc provided I get my 1.00 back after I don't hit the servers 10,000 times in 24 hrs.

[marcus_of_augustus]

pay 0.01 btc to get on the whitelist.

+1  (0.01 * 100)

I'll pay 1.00 btc provided I get my 1.00 back after I don't hit the servers 10,000 times in 24 hrs.

Not a bad idea. Put up a bond to be a trusted IP.

[jkminkov]

because some/most users have a dynamic ip?

even dynamic ip are given by limited pools, which can be figured out...

[martinR]

What if you only accept IP address running bitcoin clients?

[jaybny]

ddos bump

[MagicalTux]

ddos bump

ddos ended.

We are setting up a layer7 firewall in front of mtgox to block those attacks~

[BCEmporium]

FW for layer 7 attacks sounds good, but due to the nature of those attacks I didn't think it would be possible.

Does that do what? Limit POST headers to Y connections - I see a problem here, as the attack is distributed they would have different IP sources? Closes slow POST? But that would be just a connection issue, anyway there're no big data uploads to Mt.Gox, posts are resumable to the login/register and bid/ask/withdraw forms...

[ribuck]

How about: send 0.1 BTC to MtGox for your IP address to be whitelisted for an hour. All whitelist payments would be deducted from your MtGox exchange fees, so this would not cost genuine traders anything.

[BCEmporium]

How about: send 0.1 BTC to MtGox for your IP address to be whitelisted for an hour. All whitelist payments would be deducted from your MtGox exchange fees, so this would not cost genuine traders anything.

And you would bury BTC and condemn it to the bottom of the underground, as most people take Mt. Gox as the "standard price" for BTC... so most of people is actually consulting not trading, not all BTC users are speculators or exchangers.

Whitelists are generally impracticable except for small access groups...

Unless MagicalTux splits Mt. Gox in two, one for trading other for consulting.

[ribuck]

...so most of people is actually consulting not trading...

That's no big deal. A few well-known mirrors (e.g. www.bitcoinwatch.com ) can get themselves whitelisted and can proxy the MtGox pricing information for everyone else. Or they can put it into a form that's hard to DDOS (such as Usenet NNTP).