Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Howto: Block Amazon and any site using Amazon Web Services (bigboy.us)
113 points by dzuc on July 15, 2019 | hide | past | favorite | 81 comments


Reminds me of about three years ago, a buddy who does Cybersecurity for a very large military base was tasked with blocking AWS from their network due to porn.

He found it quite humorous, warned them of the consequences, got everything in writing(including his warnings), and executed his orders.

The base commander was not amused and the blocks were removed in about 12 hours. Unfortunately, the responsible party never suffered more than egg on their face for the stupidity.

They tried to shift blame to my buddy, but he had dotted his i's and crossed his t's. He did get a nice one-on-one with the Base Commander, where he was able to lay everything out.


Mmmkay. Have fun with that.

The attempt is also incomplete. I suspect this would miss ranges advertised through AWS's BYOIP (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoi...) option. It would definitely miss ranges advertised through companies' own datacenters and serviced in the backend by AWS.


33.5 million IP addresses is no small drop in the bucket though!


This doesn't block any site using AWS, only sites which are fronted by a server hosted within AWS.


I've toyed with the idea of setting up a no-FAANG VPN that implements these restrictions based on the ip networks advertised by the relevant ASNs. This would provide more complete coverage, and be useful as a testing tool, allowing you to verify that your own web properties still function without assets being loaded from a global active adversary.


It still doesn't actually block everything on those clouds. I can go get my own ASN, run my own edge server (or use a small CDN company not on your list) and use whatever I want on the back end for database, queue, backup, storage, compute, etc. All you'll know my IP is where the edge node is.


A VPN would still be effective at suppressing the tracking effects of all the "like buttons" while also revealing issues such as jquery being loaded off a CDN that also directly hosts content for 40% of the web.

For users wanting to thwart pervasive CDNs from receiving packets every time they visit almost any site on the web, it's matters less if a service they visit is using an amazon resource on the back end; as long as all services aren't using the same database backend, this puts e.g. AWS back in the position of only having a little of your consumer/browsing information instead of nearly all of it.


Someone didn't get an offer!


It still wouldn’t stop an application where some back end or data store is using AWS.


i would be willing to throw up to $50 for this


Please ping me if you ever get this set up.


That actually is a great idea.


There is a large community of people here in the US who block every company that does bad things.

Yes I'm talking about the Amish. But even in Amish society, there is politics and people who do Bad Things. Fortunately there are plenty of uninhabited mountaintops left that one can go and live on to maintain a clean conscience. But if we do that, then aren't we turning our backs on the world by not helping it? So now we'd need to come back to civilization and live amongst the unwashed masses once more.

There's no way to live a perfectly good and blameless life.


I find the initiative interesting, at least to realise how much of our daily browsing is hosted on AWS. I will give a go for sure!


Wouldn't it be easier to just turn off wifi and unplug the ethernet cable?


ding ding ding


> Counter-intuitively, AWS makes it very easy to do this! They publish and continuously update a list of IP ranges

It's not like any legitimate company could keep their IP address ranges private (other than by using seemingly unrelated shell companies) :)


I have found their list to be out-dated. I have to use bgp lookup sites to fill in the blanks. There are many ranges and small blocks they leave out that are not hosted in their datacenter directly.


Wouldn't blocking stuff using AWS block like, a significant chunk of the internet?


Yes


As an experiment, you could always put their ranges into your IDP / IDP / firewalls and just get summary data for how many packets / flows / bytes are transferred to/from AWS. (Rather than outright blocking)


I'd rather do this with Cloudflare. Amazon may be naughty but CF is just evil: trying to normalize a MITM-as-a-service protection-racket as a business model is bad for everyone involved.


And to get around this, simply route all your traffic through Cloudflare...


I mean I get the idea and all, but considering half the internet runs on AWS is this even feasible? Your day-to-day internet use would be crippled. Wouldn't it be better to spend the effort on writing letters to politicians or better yet campaigning yourself? (I'm assuming this is being posted because of the prime day walkouts today)


Indeed, there is nothing inherently wrong with AWS.

On the broader topic, what's wrong with people spending money on things they want? We live in a free country. If you have money, and want to buy junk with it, more power to you. It's your money. Do whatever you want with it. As far as vices are concerned, I would rather someone derived satisfaction from binge shopping than the alternatives (gambling, alcoholism, drugs, etc. etc.), since those have far more deleterious effects on society.


"what's wrong with people spending money on things they want?"

It depends on what they're buying. Many people would consider unethical the buying of children or child pornography, for instance. Bans on ivory, whaling, and trading in endangered species have gained ground in recent years.

Some arguments for what's wrong with those are that the former exploit people who are unable to defend themselves or even realize they're being exploited, while the latter cost the lives of sentient creatures and reduce biodiversity by causing extinctions. Now, whether you find any of those arguments persuasive depends on your own values. Some people see nothing wrong with exploitation or species extinction. It's really difficult to argue against them. Either you share certain fundamental values with the rest of us or you don't.

Philosophers study such ethical issues in nauseating detail, but I've yet to see how any of their arguments would be persuasive to someone who doesn't already share their core values.


No one's protesting binge shopping, it's all about how Amazon treats its warehouse workers (spoiler: horribly). The first link of the article says

> in solidarity with striking workers in several fulfillment centers in Spain


This is clearly meant to be more of a statement than a practical means. And yes, to effect change, advocacy surely must be much more effective.


I imagine the guys building AWS are treated pretty well, compared to their warehouse guys.


I wonder about the low level labor in data centers. Swapping disks and servers. I imagine they have a lot of the same tracked-time-pressure that retail pickers do? But I've never read about it one way or the other either.


This tutorial's of limited use to 30% of users, who have IPv6.


Half the internet would be unusable, lol.


Another of 2-3 stories about the Amazon strike deleted from the front page of Hacker news, it's hard to not be conspiratorial about this.


Do you realize how many companies run on AWS?


loll, good luck.


Oh boy, another one of the daily anti-FAANG posts. Amazon is evil and should be boycotted - usually coming from people who shop at WalMart and invest in companies like BP (i.e. my in-laws).

Good luck blocking AWS - and whatever percentage of the internet running on it.


The second sentence of the post clarifies that this is motivated by a one-day boycott in solidarity with Spanish workers striking for improved labor conditions--not by the belief that "Amazon is evil and should be boycotted." Either you didn't care to read up to that point or you're being intentionally obtuse.


Why not both!?


>usually coming from people who shop at WalMart and invest in companies like BP

What weird mental gymnastics are you trying to pull here? You know someone who hates Amazon and invests in Walmart/BP? So what? That doesn't mean there isn't a legitimate reason to hate Amazon.

"ugh, another one of the daily anti-violent crimes posts. Rape is evil and should be boycotted - usually coming from people who jaywalk and overcook their steaks."


They know someone who hates Amazon but shops at Wal-Mart and invests in BP, and is projecting all of that only everyone who has a negative view of Amazon.


> usually coming from people who shop at WalMart and invest in companies like BP (i.e. my in-laws)

If one takes a moral stand, must one then take every moral stand? I avoid using Google products because I think they're an unethical company, but arguably Apple is too. Am I obligated to just not use a smartphone?


When you're boycotting company A for doing bad thing X, but then using the services of company B for doing bad thing X, then that's hypocritical. If company B were doing different bad thing Y, then that's a different story.


It's not hypocritical. It's called "doing your bit"

Just because you can't save the world doesn't mean you can't start somewhere.


Changing your service provider for bad thing X is not “doing your bit”


>Am I obligated to just not use a smartphone?

I've met people who would argue "yes." Not sure that I agree with them, though.


Somewhat north of 70% of internet traffic passes through AWS servers at this point.


note previous post from this user:

> Disclaimer: I’m own about $500K in my portfolio in Amazon.


Yeah and I posted that openly. They’re actually the smallest of the FAANGs in my portfolio. I’m invested heavily in tech, banking, energy, and retail, including WalMart.

It’s hilarious and sad that my post caused you enough grief to dig up content from my post history as if that makes any of my points less valid.


Your point were so absurd that I (correctly) assumed that there was some bias driving it. :)


I would think efforts like this are less about completeness and more about creating a media event around the fact that ICE uses AWS to do harm to people.


ICE uses AWS to help take into custody people who have deportation orders. Can anyone explain why this is even remotely controversial? What is the alternative, open borders? no deportation ever?


The idea behind these actions is to pressure ICE into abiding by international human rights laws in its handling of detained immigrant children. To me, that seems like a very reasonable thing-to-care-about.


By going after the supply chain instead of the actual offenders? That does smell a bit armchair-activisty, to be honest.


Boycotting IBM may have saved lives at Nazi concentration camps if it was attempted... (IBM assisted Nazis in processing big data (of their time) during most of WW2)


But would it? When the war started, IBM was already established in Germany, and upon the US placing trade ban, the German branch essentially split out and worked independently, to be reintegrated into the mothership after the hostilities have ceased.


I have read all the comments below yours and as an immigrant in an Africa country I wonder why no one says anything about why we want to be immigrants in the first place. I have noticed this debate tends to be about Europe, US and Australia and it seems the world has given up on holding dictators to task. I know it is hard but surely as mostly IT people on HN we know you have to fix the root cause. For the record I think it is healthy to have both pro immigrant and also listen to concerns of those against immigrants.


Open borders, and no deportation ever, is a perfectly viable alternative.


There are approximately 500 million that want to come. It would be interesting to see how we would solve the housing needs while making their immigration economically viable for both them and the country as it exists today.


let's say 350 million people have the means + desire to move to the US over the course of a year after the borders open. i think that's low, but whatever.

how do you propose that the "delicate" infrastructure of the US can handle a clean doubling of population over the course of 1 year?


> viable

Not at all viable when you consider the cost of requisite social services to support such an initiative, which is one of the myriad reasons why no country has ever considered the option.


Its not that simple: https://www.nytimes.com/2018/07/03/world/europe/germany-poli...

Germany's refugee crisis is a good example of the pros and cons.


As a person who came to America legally, as an Immigrant, I seriously do not want this. How is this at all fair to those of us who had to work so hard and wait so long to get in?


> How is this at all fair to those of us who had to work so hard and wait so long to get in?

How is it unfair?


Being in the country and using its services isn't free. It's unfair because low (or no) income immigrants are a burden on everyone in the country.

The unfairness is that the bar for participation is being significantly lowered to the point where it risks the social safety nets for everyone. It's unfair to both native citizens and naturalized ones.


Instead of punching down on the literally the most vulnerable people in our society, why don't you direct energy at all the wealth being accumulated at the top? That situation is much more harmful for our social safety net.


It reminds me of hazing rituals at fraternities - you can't get rid of this bad thing, how would that be fair to us who had to go through it?


I also came to America legally, and that was the second time I legally emigrated from one country to another. As an "experienced immigrant", I've lost count of how many times I've come upon the astonishingly selfish attitude your comment espouses.

Make no mistake, I'm also against completely open borders without deportation, for a variety of reasons. "Fuck you, got mine" is not one of those reasons.


Seeking asylum in America IS legal. What's happened with the Trump admin is they've essentially made traditional routes for seeking asylum nonviable, so people cross the border, and if they get apprehended then instead of being released and assigned a court date like they used to, they're being held indefinitely in concentration camps.


How exactly will entitlements be funded in that scenario?


About half the country disagrees with you. I guess that means we should do it to poke them in the eye.


Why do people always make the"legality" argument. Just because something is legal, doesn't mean something is right. The Holocaust was quite legal, at the time.

Putting people in concentration camps and letting them die there (ICE) should not be legal. This does not even touch on whether deportations should be.


Congress has put ICE and CBP in a pretty impossible situation, they have refused to extend funding for months (since February at least) to fund further border enforcement to stop illegal border crossings, while simultaneously refusing to pass any legislation to further fund the detention centers.

Your implication that they must stop patrolling the border lest they become literally Hitler, is patently absurd and an affront to people who suffered through the Holocaust.


I merely said that legality does not imply that no human rights violations are occurring.

Also I'm talking about deportations (and the associated camps, whatever you want to call them) is a separate issue from border control, in my opinion.


Yes, can anyone explain why concentration camps are even remotely controversial?


Would you please stop posting in the flamewar style and please not use HN for ideological battle? Those things are destructive of what we're trying to do in this community, and your comments have been noticeably more inflammatory than the others I've seen in this thread. You've also done it recently elsewhere.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the spirit of this site to heart when posting here, we'd appreciate it.


We could start by shunning AWS content when their $200k+ salaried employees are posting their latest announcements on HN while their unsalaried, not-employed coworkers in the warehouses are sprinting to and from a piss break trying not to be fired.


Any of the warehouse workers has or had the chance to obtain the skills of an AWS employee... Or are you advocating communism?


I'm not entirely sure what you're arguing. Are you saying it's ok to treat nonskilled workers badly because they have the opportunity to gain skills?


I think boycotting is pretty much the opposite of communism.

Also, Just because someone does not have in demand skills does not mean that they should be subjected to poor treatment.


Because the only two possibilities are worker abuse or communism?


Communism would be pretty good, yes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: