Support

Hi Dave,

Well, it's been asked again, but it's not very practical. That would require one site to act as a "master server" and all other sites to act as "slave servers". Then, every time a page would load, the slave servers would have to query the master server if that's an allowed request. Not very practical; it would basically flood the master server and cause sites on the slave servers to become very slow. Why not just "sync" the blacklists? Trust me, bad idea. Any delay in sync could mean that someone who shouldn't be blacklisted is.

And it only gets more complicated the more you think about it :)

Hi Dave,

There are actually two blacklists in Admin Tools. The first is that which you manage manually. The other is the one which is automatically managed, depending on the settings of the automatic IP blocking. The former can be set up to sync, the latter not really.

Syncing implies that we need to do server-to-server communication. This will happen in the clear, over plain HTTP. It's conceivable that a clever hacker can launch a man-in-the-middle attack -or compromise one of the sites- and figure out how the communication takes place. Then he can simply blacklist everybody, including you, and ask for ransom. Or he could blacklist you while he's hacking your site. So syncing is potentially dangerous and I'd like to steer clear from it.

Another issue is that you might blacklist an IP which was simply raising false positives. What if that IP belongs to a client who want to demo your sites to? You want him to be removed from the blacklist a.s.a.p. This means that we'd have to support manual syncing as well.

How do you automate syncing? You can do that with a plugin which runs every few minutes, as long as there is adequate traffic. Experience shows that this is a BAD idea, as it slows down the traffic on your site when it runs, and it can wreck havoc anytime (trust me, you don't want to know just how many ways something like that may cause trouble). The other approach is using a CRON job, but experience shows that the vast majority of people either don't have access to it or can't follow the step by step instructions to schedule a CRON job - mostly because even though the instructions are step by step, they still require you to know a few advanced server administration bits to get PHP scripts to launch reliably through a CRON job.

I told you, the more you look at it, the less convenient it becomes :)

Well, it was a good suggestion, it's just the practicality of it that's not looking good. In any case, I'm here to think for you what makes more sense and develop what does make sense. If you were all doing this kind of in promptu feature analysis, I'd be out of business, right? :D

Thank you for your kind words!