68

While reading about question ban, I found this comment by Jeff Atwood, explaining that users are banned by IP address so that they cannot circumvent the ban by creating a new account.

I don't know about the rest of the world, but having a stably assigned public IP address is rather uncommon in Europe. Not only the IP address changes whenever one restarts the modem (and sometimes without restarting it), most users are also hidden behind NATs.

This brings us to the real issues:

  1. One can trivially circumvent the ban by restarting his/her modem
  2. Blocking a NAT public IP address will potentially affect thousands of users. Maybe not thousands of Stack Overflow users, but still..

As such, not only the IP address ban might be ineffective, it could also be harmful to other users. Furthermore, the upcoming transition to IPv6 might decrease the likelihood of having a stably assigned IP address even further.

Is Jeff's comment still valid in 2014? If yes, should Stack Overflow adopt other, more effective, countermeasures? What, if any? I admit I couldn't come up with a reliable solution.

15
  • 28
    How would IPv6 reduce the ability to get a stably-assigned IP address? The whole point of IPv6 is to provide enough IP addresses so that every device on the planet can have a unique one, rather than having to share one behind a NAT. Jul 28, 2014 at 20:37
  • 29
    @RobertHarvey not everyone welcomes the "unique" part. In fact, IPv6 will eliminate NATs, but address allocation is likely to remain dynamic in many contexts. More addresses to choose from (even in ISP subnets), less likely to be assigned the same twice. This is not certain, though, in fact I said that it might decrease said probability :) Jul 28, 2014 at 20:50
  • 10
    @RobertHarvey many ISPs that used to supply semi-static IP addresses (typically long term DHCP leases in practice) no longer do that with IPv6, going for short term DHCP leases instead. So more people end up with rapidly changing addresses than before.
    – jwenting
    Jul 29, 2014 at 7:08
  • 3
    @RobertHarvey: There are also ipv6 privacy extensions meaning that every now and then you get a new ipv6 address, even if you still use the subnet assigned to you by your isp (plus isps changing that subnet every 24 hours seems still common in some areas)
    – PlasmaHH
    Jul 29, 2014 at 14:53
  • 2
    "is rather uncommon in Europe" for my part of europe it is really not uncommon...
    – PeeHaa
    Jul 29, 2014 at 19:14
  • 10
    What about schools / universities / dorms etc where hundreds of academics / student programmers could be affected? Jul 29, 2014 at 19:19
  • 2
    People who carry laptops with them will get different IPs for each new hot spot they connect to.
    – PM 77-1
    Jul 29, 2014 at 19:31
  • 13
    Heh...the "upcoming transition to IPv6" has been in progress for well over a decade. I'll believe it when i see it.
    – cHao
    Jul 29, 2014 at 20:11
  • 1
    @jwenting: That's ... unfortunate -.- Jul 29, 2014 at 21:35
  • 3
    @cHao: It's starting to take off a little in the infrastructure world. Slow in the West still since closed networks don't tend to, y'know, care, but pretty much all telecom PTP traffic in Japan is now IPv6, for example. Jul 29, 2014 at 21:35
  • 1
    @cHao I just attended a talk last night where the guy said IPv6 was a problem for the "Internet Of Things" because handling IPv6 requires more battery power.
    – ajb
    Jul 29, 2014 at 23:58
  • 1
    @ajb -- really off a tangent here, but as far as I can tell the comment were about converting bluetooth to use IPv6...
    – Soren
    Jul 30, 2014 at 0:40
  • 1
    What's stopping people from using proxies? or am i confused?
    – James
    Jul 30, 2014 at 1:30
  • 1
    @cHao: Maybe the IPv6 transition has been going slowly because so many tech people are saying "I'll believe it when I see it," rather than working to support it. Everyone waiting for everyone else to go first. Jul 31, 2014 at 1:01
  • 1
    @CraigMcQueen: And maybe it's because that's just what happens when you try a grand redesign, but toss out backwards compatibility. Same reason XHTML 2 was DOA. Same reason Perl 6, PHP 6, and Interchange 6 are all jokes. Unfortunately, all those happened after IPv6, so it couldn't learn from their boneheadedness. (OK, maybe not all -- Perl 6 is over a decade old too, and is nearly as popular.)
    – cHao
    Jul 31, 2014 at 1:56

4 Answers 4

50

Post blocks do not automatically enforce a full-out block on the IP address. There are some IP addresses that are fully blocked from posting things here, but those are IPs which consistently provided low-quality crap content.

A quote from Shog9:

There are per-user and per-IP bans. I'll not go into detail about how they differ, but... Normally, your co-workers won't have anything to worry about if you get your user banned - although if everyone from an IP is doing poorly, that's probably not gonna end well.

At the base, when a user encounters a post block, it only applies to their account. Other users who might share their IP address are completely unaffected.

However, Stack Exchange did implement a new anti-recidivism system that will severely rate-limit new accounts which are created in an attempt to circumvent this post block. This system was specifically created because of the problem they were having with users just ditching accounts for new ones. All it does is limit the account to one question per week until they can prove that they are contributing positively to the site.

8
  • 5
    Low-rep users are subject to a per-IP address question rate limit; 1 question per 90 minutes. This is not dependent on a question ban, however.
    – Martijn Pieters Mod
    Jul 28, 2014 at 21:10
  • 1
    Wait, @MartijnPieters, is the 90min rate limit both per-account (the low-rep part) and per-IP? What is the point of combining the two? Just asking :) Jul 28, 2014 at 21:23
  • 2
    It is per IP but it is ignored once you have reached enough rep. See meta.stackoverflow.com/q/259941/100297
    – Martijn Pieters Mod
    Jul 28, 2014 at 21:24
  • 4
    So I can still post from a "low-rep-banned" IP address if I login to an account with enough rep, right? Thanks @animuson, this makes more sense. I still wonder how they can detect accounts created to circumvent the block, but I understand that SO developers might not want to share the details. Jul 28, 2014 at 21:30
  • 1
    "until they can prove that they are contributing positively to the site" And that proof is evaluated automatically by some kind of heuristic? Or is the user stuck waiting for some sort of manual action/review?
    – aroth
    Jul 29, 2014 at 7:11
  • 1
    @StefanoSanfilippo accounts created on the ip or even ip range from which a blocked account last posted are probably suspect. And of course accounts with very similar names. Say your account StefanFilippo gets blocked, and someone creates StefanoSanfilippo from the same domain, that might raise some automated eyebrows.
    – jwenting
    Jul 29, 2014 at 7:11
  • 1
    @aroth It uses some of the same algorithms as the question block. A few positively scored questions and/or answers would probably lift it fairly quick.
    – animuson StaffMod
    Jul 29, 2014 at 7:13
  • 1
    @animuson - Related: is it possible to be banned on one site (for example, Super User) and not banned on other sites (like Stack Overflow or TeX Stack Exchange)?
    – jww
    Jul 30, 2014 at 1:20
9

There is one very important exception in the IP bans Stack Exchange uses, and that is that they generally only apply to anonymous and very low rep users. Once you have a certain amount of reputation (very low three-digits as far as I know), these blocks on an IP base don't affect you anymore.

There is a certain amount of collateral damage due to these blocks, but they are necessary because of the extremely low amount of effort needed to create another account.

4

What if someone has a non-static IP? Someone else then could easily become banned because the non-static IP has changed.

Also, it would be crazily easy to bypass it with a VPN. To bypass a question ban I got 3 years ago (When I was 11), I created this account about a few months ago. If I had discovered that was banned too, then I would have just used a VPN (and made a new account) to bypass it.

Also, what if my father was using the same IP (Which he does)? Then he would become banned too. This would be even more of an issue for offices or workplaces if someone accidentally asks a couple of bad questions.

In other words, it is an all round illogical idea.

3

Browser fingerprinting provides lots of additional means of identifying a user, other than by IP address. It's not perfect, but it might be surprising to realize what an application can do to uniquely fingerprint a client, without using cookies.

1
  • 3
    Of course, like IP address, cookie information, and so many other techniques, it can inadvertently result in problems including false positives, false negatives, and can be subverted by a suitable motivated malicious user.
    – Servy
    Jul 30, 2014 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .