Hacker News

points by cube00 2 days ago | 0 comments

I initially thought this was a good idea too until another comment pointed out you'll lose most business or personal customers in offices because they connect through VPN gateways running on those cloud services (especially Azure)

[–] hypfer 2 days ago

True but the question is if that matters.

I would argue that more often than not it might not. Really depends on the specifics though.

A lot of stuff on the web actually isn't really relevant for all audiences everywhere I'd say. It just happened to be accessible by all, because academics back in the day dreamt of a better open world that didn't really manifest :(

[–] gverrilla 2 days ago

> day dreamt of a better open world that didn't really manifest :(

it is open and better indeed. open and better for capital - the true, living, flesh-eating god.

[–] semiquaver 2 days ago

This is a website about starting businesses.

Let me tell you, at the business I work at, some of our customers work at a company that uses a commercial VDI service for all workstations couldn’t access our service because the VDI egress was in GCP and we had an AWS WAF rule banning datacenter IPs.

Obviously, we removed the rule because it was doing nothing useful but plenty of harm. Real bots come from residential IPs.

[–] bigfishrunning 2 days ago

> This is a website about starting businesses.

It's really not, unless the only qualifier for that is "hosted by a VC incubator". Most of the people here are here to argue about AI or Crypto or whatever, or read announcements from Nvidia and Google. I would bet less then 1% are starting businesses.

[–] hypfer 2 days ago

Hm I mean HN _also_ is that? But not exclusively.

And even if we run with that assumption, one might still be fine. It's a trade-off, but, depending on the target audience, a few lost sales might be worth savings in other aspects.

[–] wtch98 2 days ago

If you control the connecting device why not use MTLS?

[–] semiquaver 2 days ago

Who said we control the connecting device? This is a website. Websites are usually pretty arms-length things, and that’s the case with us. They’re our customers but we can’t install certificates on their computers and enforce mTLS. Can you do that with any of your customers?

[–] anonreplier 2 days ago

Can use cloudflare turnstile or similar instead

[–] trollbridge 2 days ago

Someone accessing a VPN that's in an Azure IP range is going to have a difficult time using half of the Internet.

[–] wtch98 2 days ago

All my business traffic comes from either our own AS, or from ZScaler's AS

Do many companies really use azure etc rather than dedicated services like zscaler?

[–] turpentine 2 days ago

reddit has been banning reddit accounts of people who use public cloud services as a vpn i.e. while travelling or in cafes, without recourse. Reddit's answer was afaik "don't do that, and create a new account."

[–] bearjaws 2 days ago

I would sure hope they split tunnel their VPN so all traffic isn't going through the VPN...

[–] cube00 2 days ago

Some companies don't split because they want all internet traffic to go through their internal MITM proxies to enforce acceptable internet use and data loss policies.

[–] 80fj0348i 2 days ago

Those had to switch over to endpoint agents installed on work devices directly due to TLS 1.3 preventing MITM for domains which you do not control.

[–] cube00 1 day ago

> Those had to switch over to endpoint agents

No they didn't. https://news.ycombinator.com/item?id=32337698

[–] jack_pp 2 days ago

i can't access reddit through nordvpn