Hi to all, i noticed that only few blacklists coming to crowdsec.
Usually there are only 60 to 100 IP in the blacklists and often a lot of them are repeated through the different lists… it is normal? why there are so few IP?
Hi @ansem90,
Indeed, we are a little bit cautious about sharing all the IPs to avoid poisoning.
We are working on new consensus algorithm to improve the shared blacklists and increase the number of IPs we share with the community.
It will be available soon (within few weeks).
Thanks for your understanding.
1 Like
Hello @he2ss,
I’ve decided to try crowdsec and I’m seeing only a 100 IPs (IPv4 only) for the scenario ssh-bf. I’m not sure whether it is worth it to be connected to the CAPI for only a handful of addresses. Is this going to change?
A related questions, is there an option for config.yaml to disable CAPI?
Hi @thorgrin,
Is this going to change?
Yes, As I said, we’re working on new pipeline that will avoid lot of poisoning and we’ll make it available soon (it will share lot of IPs).
A related questions, is there an option for config.yaml to disable CAPI?
Yes you can, you need to comment or remove online_client section in the config file.
1 Like