On 2026-10-01 19:28, Benny Pedersen via mailop wrote:
John Levine via mailop skrev den 2026-10-01 21:24:
Starting this morning my submission server has been under attack
by hosts trying guess passwords. While I have been seeing this
forever, it always used to be a trickle. Now it's a flood that
is in effect a DDoS.
welcome to the internet :)
you mean welcome to the AInternet on steroAIds?
it would be more easy to KYC then fight with bots of all kinds
absolutely! time to invert the GENERAL RULE: instead of traffic is
trusted until proven otherwise; traffic is untrusted until proven otherwise.
here i just open ASN where i have my KYC
In my little law office, I do not have many KYC, but they are all
covered by one simple solution: all services, including submission, are
behind Wireguard. Wireguard does not respond unless the client
identifies itself with the appropriate encryption key, so my threat
scenario is limited to lost/compromized encryption keys.
Only ports/services that are intended for the general public (e.g. port
25 where my server is the destination) are exposed to the internet.
It works surprisingly well and surprisingly easy. I am now at an
airport between flights and I don't even know if I connected via the
airport's WiFi or via an international eSIM. it just works. and issuing
Wireguard credentials can be automated. at scale when needed (I have
not looked into Tailscale, but I have friends users that love it).
Yuv
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
