Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious attack on Wikipedia – what we know and what we’re doing

wikimediafoundation.org

Post reply on HN
Print view View original

101–110 of 320 posts

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#101

Post by zajio1am »

throwamay1241 wrote: post #38
Nextgrid wrote: post #25

Earlier quoted context omitted.

Part of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many…

Can't wait to tell Gran she's legally liable for a DDoS because her unsecured IOT washing machine best buy sold her caused the internet to cave in ;)

Is liable? AFAIK strict liability only applies in specific cases, in general cases negligence applies. The claimant would have to prove that there was a breach of duty and a reasonable person would have done something to prevent the damage.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#102

Post by owenmarshall »

betaby wrote: post #86
jolmg wrote: post #41

Earlier quoted context omitted.

You can't expect everyone, kids and elderly included, to be able to identify when their machine is running a rootkit from the result of exploiting a 0-day, for example. People also have a very limited view on what's happening on their phones, too. What if the rights to the source and distribution of a free closed-source app is purchased by someone that's going to modify it to include all users in their botnet? It's n…

You can't expect everyone to be able to identify when their car is not running as expected. Wait, you can and you must under the law. Also there are liabilities.

Brakes squeal when they are wearing down. If I put a penny in the tread of my tires and see Abe Lincoln’s head I know they are bald. If my head lamps go out I’ll notice; if it’s a brake light I get a red indicator lamp on my dash that says I have a problem.

Let’s talk about liability when home routers make a revving engine sound when they push too many packets per second, or start playing a “buckle up” warning chime every 6 seconds if they see packets heading to a C2 server.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#103

Post by hombre_fatal »

Nextgrid wrote: post #25
Theboda wrote: post #20

Apparently this group is behind it. Also attacked WoW and twitch servers.. https://twitter.com/ukdrillas

Part of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many…

I don't see why you'd come up with something that so misaligns the interests of everyone except lawyers.

Instead, imagine the DDoS landscape if we had to pay a small price for bandwidth. There would be a natural disincentive to having a toaster saturating your bandwidth as part of a botnet because it would quickly show up on your bill. And something as simple as shipping an IoT product or Rasberry Pi with bad default username/password might suffer bad reviews like "1/5 stars, this product immediately raised my internet bill."

I know it's not perfect and most of us have a bad taste in our mouth from paying out the wazoo when bandwidth is priced per Gb, but it can be a fair system if priced well that fights against our botnet reality where we basically have zero insight when our networked devices our compromised.

I can also imagine better tooling provided by our ISPs in this world where they help us track down and itemize our bandwidth costs. "Honey, why is SmartToaster89 costing us $24 in network fees?"

It's impressive how poorly our current system equips everyone except malicious actors. How many ISPs don't even filter spoofed outbound packets?

It's hard to complain about everyone centralizing around Cloudflare with the state of cheap DDoS muscle.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#104

Post by bshep »

pronoiac wrote: post #90
voltagex_ wrote: post #49

Earlier quoted context omitted.

From a cursory glance at the site and source code, it's really hard to see who/what is involved with building an archive. There's automated builds set up for the Pi image itself.

Agreed. I can see that other Wikipedia languages are crawled - https://wiki.kiwix.org/wiki/Content_in_all_languages shows dozens of updates this week - but the best leads I have involve poking around the openZIM Github org, https://github.com/openzim . There might be a running "zimfarm" somewhere?

Looks like you are right, you may be able to join the farm to help ( i have not tested as I am away from my computer at the moment )

https://github.com/openzim/zimfarm/blob/master/worker/README...

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#105

Post by mpfundstein »

ollybritton wrote: post #92
jedieaston wrote: post #12

Remember: there are BitTorrent links that the Wikimedia Foundation gives out of SQL dumps of Wikipedia and the other projects. You can have a copy in case this happens in your country: https://en.wikipedia.org/wiki/Wikipedia:Database_download#Wh... Also, the Kiwix project has a hotspot project that allows you to host ZIM files (dumps of Wikipedia and other CC licensed content, like TED talks and StackOverflow) on a R…

There's also a read-only IPFS mirror of Wikipedia in English: https://ipfs.io/ipfs/QmXoypizjW3WknFiJnKLwHCnL72vedxjQkDDP1m...

I love ipfs. Can this actually be ddos’d as well?

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#106

Post by mpfundstein »

aldoushuxley001 wrote: post #67
ethelward wrote: post #58

Earlier quoted context omitted.

They can be used by blackhats selling e.g. DDoD-netbots to prove the “quality of the merchandise”.

I definitely get the feeling that’s what they’re going for. They mentioned they’re just testing out a new botnet made from IoT devices.

Where did you read this? I am curious...

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#107

Post by inimino »

braythwayt wrote: post #50
chillydawg wrote: post #47

Earlier quoted context omitted.

It's because they're just serving a big site, not running the world's most sophisticated surveillance and ad serving machine. Serving giant websites isn't all that hard if you're just spewing out SQL queries into html templates. It all scales in all directions with a properly thought through architecture.

Please be careful of logical tautologies: "It all scales in all directions with a properly thought through architecture" sounds dangerously like, "Programming isn't that hard if you just do it right."

> Programming isn't that hard if you just do it right.

That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right. Obviously that's not productive feedback without actually helping them be better, but it's far from a tautology.

For anyone wondering, a tautology is a statement that is logically true by construction, rather than contingently true because of the way the world is. For example, "Programming isn't that hard if it's easy" would be a tautology. Constructing a counterexample by changing programming to something else shows that this was not a tautology to begin with: "Sending a man to the moon isn't that hard if you just do it right," which is obviously false, because even if you do it right that's objectively difficult.

Programming is hard, but we make it much harder than it has to be by doing it spectacularly wrong in many ways, both individually and collectively.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#108

Post by lukejduncan »

jacekm wrote: post #84

On a side note, I was surprised to learn, that Wikipedia does not have a proper status page. status.wikimedia.org redirects to grafana dashboard and it too was down yesterday.

I wouldn’t expect a site to have a publicly available status page or anything like public grafana boards. Isn’t that what HTTP error codes are for?

Can you share examples of where this is common?

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#109

Post by master-litty »

hombre_fatal wrote: post #103
Nextgrid wrote: post #25

Earlier quoted context omitted.

Part of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many…

I don't see why you'd come up with something that so misaligns the interests of everyone except lawyers. Instead, imagine the DDoS landscape if we had to pay a small price for bandwidth. There would be a natural disincentive to having a toaster saturating your bandwidth as part of a botnet because it would quickly show up on your bill. And something as simple as shipping an IoT product or Rasberry Pi with bad default…

I don't see why you'd come up with something that so misaligns the interests of everyone except Comcast :)

We don't need to be priced by the bandwidth, we just need better accessibility to metering. Something my mother could look at and say "huh, the toaster's sent 8gb of data today..."

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#110

Post by adventured »

atdt wrote: post #85
breck wrote: post #72

Earlier quoted context omitted.

> I worked there for four years and I miss it every day. Sorry but now I'm curious, why did you leave?

Wikipedia has a huge impact in people's lives, particularly in non-English languages, and there's so much work to do, and so much of it feels urgent and necessary. I really responded to that, and I wasn't careful, and burnt myself out. (This was not the fault of the org; Wikimedia is largely a do-ocracy, and if you're intent on working through the small hours of the night, there is very little anyone can do to stop y…

What kind of role were you in at Wikimedia if you don't mind answering?
Post reply on HN