Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious attack on Wikipedia – what we know and what we’re doing

wikimediafoundation.org

Post reply on HN
Print view View original

121–130 of 320 posts

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#121

Post by betaby »

jolmg wrote: post #116
betaby wrote: post #86

Earlier quoted context omitted.

You can't expect everyone to be able to identify when their car is not running as expected. Wait, you can and you must under the law. Also there are liabilities.

Very much not the same thing. Your car can't interact with the cars of others without physical contact, and when it does interact, via a crash or otherwise, it would be very obvious to anyone. Even if you were constantly watching the traffic of your phone and other devices, you'll probably miss malicious packets that are sent among the thousands of packets each device sends per minute. It's also not as obvious to rec…

I'm liable if my car spontaneously catches fire while parked. Car is just an analogy.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#122

Post by [deleted] »

betaby wrote: post #121
jolmg wrote: post #116

Earlier quoted context omitted.

Very much not the same thing. Your car can't interact with the cars of others without physical contact, and when it does interact, via a crash or otherwise, it would be very obvious to anyone. Even if you were constantly watching the traffic of your phone and other devices, you'll probably miss malicious packets that are sent among the thousands of packets each device sends per minute. It's also not as obvious to rec…

I'm liable if my car spontaneously catches fire while parked. Car is just an analogy.

[deleted]

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#123

Post by braythwayt »

inimino wrote: post #107
braythwayt wrote: post #50

Earlier quoted context omitted.

Please be careful of logical tautologies: "It all scales in all directions with a properly thought through architecture" sounds dangerously like, "Programming isn't that hard if you just do it right."

> Programming isn't that hard if you just do it right. That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right. Obviously that's not productive feedback without actually helping them be better, but it's far from a tautology. For anyone wondering, a tautology i…

I think that you are speaking of a logical tautology, while I am speaking of a linguistic tautology. If I am correct about this, we are both right.

A logical tautology is, "A statement that is true by necessity or by virtue of its logical form."

A linguistic tautology is, "A phrase or expression in which the same thing is said twice in different words."

In formal debating, for example, you can call someone out for either type of tautology.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#124

Post by aldoushuxley001 »

mpfundstein wrote: post #106
aldoushuxley001 wrote: post #67

Earlier quoted context omitted.

I definitely get the feeling that’s what they’re going for. They mentioned they’re just testing out a new botnet made from IoT devices.

Where did you read this? I am curious...

From the attacker's twitter account, just read through his/her twitter replies (though it sounds like it's actually a group of them).

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#125

Post by alexeldeib »

smitop wrote: post #118
mpfundstein wrote: post #105

Earlier quoted context omitted.

I love ipfs. Can this actually be ddos’d as well?

The ipfs.io is just a web-based way to access IPFS, called a gateway. There are a bunch of different gateways. In addition, you can run an IPFS node locally, and then as long as just one node holds the content you're looking for you are looking for you're good. There are also browser extensions to re-write gateway URIs to localhost URIs.

Does this actually answer the question? If there's a node online that means I can reach the content, but would it help with DDOS? Not so sure.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#126

Post by [deleted] »

dangxiaopin wrote: post #120
judge2020 wrote: post #6

Someone claimed the attack on twitter with some details (DDoS) - and proved it later by stopping the attack for x minutes then restarting it at a specific time. https://twitter.com/fs0c131y/status/1170093562878472194?s=20 - the attacker also went on to DDoS the twitch ingest servers (not twitch.tv itself) knocking some big streamers offline.

It looks like a volumetric attack from this tweet. Wikipedia needs to use Verisign BGP mitigation. They create GRE tunnels to your routers and are capable of handling 2Tbps. During an attack, you make a BGP announcement and the traffic goes via Verisign scrubbing/tunnels. No application changes are required, no Matthew Prince selectively and benevolently enforcing CF neutrality. It's used by large banks.

[deleted]

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#127

Post by eloff »

Iv wrote: post #69
bollockitis wrote: post #44

Earlier quoted context omitted.

Do these kinds of attacks usually have a motive?

I am pretty certain that when China used the Great Firewall to attack github, this was a test of their capabilities.

Source?

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#128

Post by owenmarshall »

betaby wrote: post #119
owenmarshall wrote: post #102

Earlier quoted context omitted.

Brakes squeal when they are wearing down. If I put a penny in the tread of my tires and see Abe Lincoln’s head I know they are bald. If my head lamps go out I’ll notice; if it’s a brake light I get a red indicator lamp on my dash that says I have a problem. Let’s talk about liability when home routers make a revving engine sound when they push too many packets per second, or start playing a “buckle up” warning chime…

I'm liable if water/sewage breaks in my condo and there won't be any 'squeal'. Analogies work but are not equal. My point is that there should be liability for the malfunctioning internet equipment, definitely so for businesses.

Maybe. Or maybe liability exists for outside parties in that case: the plumber who was drunk when they put the pipes in, the architect who designed the wall in such a way to force a ton of joints in one weak spot, the building inspector who signed off on it... heck, maybe the water company is causing a water hammer to form because their pumps are busted.

Now if my home owners insurance finds that I flooded the downstairs condo because I fell asleep with the bath running, you bet I’ll pay.

But no matter what, either of your examples have a robust regulatory structure around them in terms of licensing and inspections. That is why liability works - without those structures you can’t say “you fucked up, therefore you pay”.

I’m all for adding liability into the system but if we do we must do it in a way that spreads the burden to the right places (IoT manufacturers, negligent ISPs) and doesn’t push it straight to the consumer.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#129

Post by jolmg »

betaby wrote: post #121
jolmg wrote: post #116

Earlier quoted context omitted.

Very much not the same thing. Your car can't interact with the cars of others without physical contact, and when it does interact, via a crash or otherwise, it would be very obvious to anyone. Even if you were constantly watching the traffic of your phone and other devices, you'll probably miss malicious packets that are sent among the thousands of packets each device sends per minute. It's also not as obvious to rec…

I'm liable if my car spontaneously catches fire while parked. Car is just an analogy.

What I'm saying is that it's very simple to inspect a car and make sure it's not going to spontaneously catch fire while parked. You can get a reliable answer in a day from a mechanic.

You can't get a reliable answer on whether a computing device is programmed to send malicious packets. There's too much code, most is compiled, there's too many ways to hide it. You can probably gather the smartest people in the world and leave them to die of old age before they can arrive at a reliable answer.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#130

Post by gruez »

dangxiaopin wrote: post #120
judge2020 wrote: post #6

Someone claimed the attack on twitter with some details (DDoS) - and proved it later by stopping the attack for x minutes then restarting it at a specific time. https://twitter.com/fs0c131y/status/1170093562878472194?s=20 - the attacker also went on to DDoS the twitch ingest servers (not twitch.tv itself) knocking some big streamers offline.

It looks like a volumetric attack from this tweet. Wikipedia needs to use Verisign BGP mitigation. They create GRE tunnels to your routers and are capable of handling 2Tbps. During an attack, you make a BGP announcement and the traffic goes via Verisign scrubbing/tunnels. No application changes are required, no Matthew Prince selectively and benevolently enforcing CF neutrality. It's used by large banks.

>no Matthew Prince selectively and benevolently enforcing CF neutrality.

What's the logic behind this? It's still a single point of failure and relying on a corporation. If the daily stormer or 8chan tried to use them, they would probably kicked off as well.

Post reply on HN