Why do you think this is any easier than just scraping urls off the internet

I'm always surprised by the mindset of the person you're replying to.

I learned a few years ago from some DEFCON video[0] that someone had figured out a way to do a (basic) port scan of the whole internet in ~1 day (or something like that).

Thing is... it really shouldn't have been that surprising. Although network latency isn't getting that much better year by year (c = c), the amount of data you can process in bulk, correlate, etc. is ever-increasing.

[0] At least, I think that was the conference.

In fact, there's a tool that claims to scan the internet in 6 minutes: https://github.com/robertdavidgraham/masscan

To be fair anything that is sending like this is probably getting you network blocks:

"This program spews out packets very fast. On Windows, or from VMs, it can do 300,000 packets/second. On Linux (no virtualization) it'll do 1.6 million packets-per-second. That's fast enough to melt most networks."

That's probably the DEFCON talk the parent poster is talking about:

Massscanning the Internet - Defcon 22 (2014)

https://www.youtube.com/watch?v=UOWexFaRylM

Yes, thank you, I think that was the one. Only missed by an order of magnitude or so.

Port scanning is a real and established thing that anyone who is even thinking of security has known about normally for decades, but port scans don't tell everyone what your whole stack consists of. Maybe you'd like to share why sharing your stack with everyone is a good idea? I'd really like to know. Thank you.

Do you think that fingerprinting is quantitatively different from port scanning? My main point was just that a port scan can immediately identify the 0.1% (or whatever) of the Internet that you're interested in and then try more "invasive" probing.

(I should add that I forgot to mention that IpV6 does make the whole "PortScan the Internet" business a tad more complicated, so that's than argument against me.)

Wait until you hear about shodan...

I've used Shodan. But seriously, please give me a list of real resources if you think you're up to the task.

We don't store anyones IP address and the results are only in memory cached.

It's not you, but the implicit idea of trust. How are three people I know nothing about going to give me better results than a known name? Best of luck establishing yourselves though.

Alternatively, secure your stack and don’t have it hacked later.

Those self-managing their machines and sites could doubt if a break change or update would cause downtime, LXD/Docker could simplify on that and reduce the risk to only containers.

Part of securing your stack is not sharing with everyone exactly what you have, or do you not study security at all?

Don't shoot the messenger.

Or...interrogate the messenger when he tells you something that not even he is supposed to know.