6

At a hotel currently. My habit on these crappy unencrypted wifi networks is to VPN to home, but the VPN timed out and a request was sent to SF in the clear. I was greeted by a concerning message:

We're sorry...

This IP is only allowed to access our API.

To protect our users, we can't process requests from this IP address.

If you believe you have reached this page in error, contact us.

  1. How's that happen? Shady hotel wifi is shady, but does that mean there's been active abuse from this IP? And if there has been abuse, why are they still allowed to use the API?
  2. Since my session cookie was sent in the clear through a known abusive network, just to confirm: after logging out from that session, that cookie is immediately useless, right?
  3. And, since my session cookie was sent in the clear through a known abusive network, can I take this opportunity to wonder aloud what the status is on setting up SSL?

2 Answers 2

Reset to default
5

API Only:
We limit AWS IPs to our API only. This is because historically we had a lot of abuse from AWS and it last time I checked AWS doesn't have a static IP only block -- therefore it is easy for AWS users to morph IPs.

Cookie Snatching:
In theory it is possible for someone to snatch your cookie and impersonate you. As far as I know this has never happened, and we could reverse any damage they did.

SSL:
There is a lot of work around SSL for us. As of now, we don't have a set date for full SSL support, or if it is even something we will work towards.

When it comes to one IP per site, we would be okay with a SAN cert (multidomain cert), but because of the way wildcard certs work we would probably need to change the naming meta scheme so we could just have *.stackexchange.com wildcard cert.

3
  • Hah, good call. I hadn't done an ownership lookup on the IP last night, but you're right, it's an AWS IP that the hotel proxies through. Strange setup.
    – Shane Madden
    Commented Apr 28, 2012 at 16:14
  • 1
    @ShaneMadden what's a delightfully INSANE arrangement... I would like to speak to their netadmin about why they chose this setup...
    – voretaq7 Mod
    Commented Apr 28, 2012 at 21:21
  • @voretaq7 Looks like their setup is outsourced - wi-figuys.com
    – Shane Madden
    Commented Apr 29, 2012 at 2:22
6

That message usually only shows up from Amazon instances; someone must have been really bad.

I can really only answer number one I'm afraid, based on similar answers I've seen on meta.so over the years:

  1. Generally, yeah. Someone was probably a guest at the hotel, or they had a conference or something, and someone posted a bunch of spam, or hit the rate limiter once too often. The API is read only and very light, so it has much less of an impact on the infrastructure (plus my guess is that the API has its own dedicated servers). The good news is, you can still access the site content via great apps such as Six to Eight, StackStrace, or my personal favourite, Column 80.

On a similar note, my two top requests are:

  1. SSL
  2. IPv6

I know that these are both difficult and can be expensive tasks for a site of this size. Especially as SSL still requires one IP per site (yes yes, TLS, but backwards compatibility is the goal for these guys).

1
  • I disagree with the assertion that backward-compatible SSL requires one IP per site. Why on Earth couldn't StackExchange use a UCC certificate, especially when some CAs allow unlimited domains and unlimited reissues to change the list of domains?
    – Skyhawk
    Commented May 6, 2012 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .