Live data from Hacker News

Malicious attack on Wikipedia – what we know and what we’re doing

wikimediafoundation.org

131–140 of 320 posts

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#131

Someone claimed the attack on twitter with some details (DDoS) - and proved it later by stopping the attack for x minutes then restarting it at a specific time. https://twitter.com/fs0c131y/status/1170093562878472194?s=20 - the attacker also went on to DDoS the twitch ingest servers (not twitch.tv itself) knocking some big streamers offline.

It looks like a volumetric attack from this tweet. Wikipedia needs to use Verisign BGP mitigation. They create GRE tunnels to your routers and are capable of handling 2Tbps. During an attack, you make a BGP announcement and the traffic goes via Verisign scrubbing/tunnels. No application changes are required, no Matthew Prince selectively and benevolently enforcing CF neutrality. It's used by large banks.

What's with the username? Are you trying to equate dang to Deng Xiaopin?

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#132
post #119

Earlier quoted context omitted.

I'm liable if water/sewage breaks in my condo and there won't be any 'squeal'. Analogies work but are not equal. My point is that there should be liability for the malfunctioning internet equipment, definitely so for businesses.

Maybe. Or maybe liability exists for outside parties in that case: the plumber who was drunk when they put the pipes in, the architect who designed the wall in such a way to force a ton of joints in one weak spot, the building inspector who signed off on it... heck, maybe the water company is causing a water hammer to form because their pumps are busted. Now if my home owners insurance finds that I flooded the downst…

So same should be with IoT? Programmer 'who was drunk when they put the' code should be liable.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#133
post #129
post #121

Earlier quoted context omitted.

I'm liable if my car spontaneously catches fire while parked. Car is just an analogy.

What I'm saying is that it's very simple to inspect a car and make sure it's not going to spontaneously catch fire while parked. You can get a reliable answer in a day from a mechanic. You can't get a reliable answer on whether a computing device is programmed to send malicious packets. There's too much code, most is compiled, there's too many ways to hide it. You can probably gather the smartest people in the world…

We are in the area of probability in both cases. Oftentimes is obvious if PC/device is infected. Sometimes is really hard to find out, https://en.wikipedia.org/wiki/Stuxnet

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#134
post #118

Earlier quoted context omitted.

The ipfs.io is just a web-based way to access IPFS, called a gateway. There are a bunch of different gateways. In addition, you can run an IPFS node locally, and then as long as just one node holds the content you're looking for you are looking for you're good. There are also browser extensions to re-write gateway URIs to localhost URIs.

Does this actually answer the question? If there's a node online that means I can reach the content, but would it help with DDOS? Not so sure.

Ipfs rarely stores 100% of content on one node.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#135
post #118

Earlier quoted context omitted.

The ipfs.io is just a web-based way to access IPFS, called a gateway. There are a bunch of different gateways. In addition, you can run an IPFS node locally, and then as long as just one node holds the content you're looking for you are looking for you're good. There are also browser extensions to re-write gateway URIs to localhost URIs.

Does this actually answer the question? If there's a node online that means I can reach the content, but would it help with DDOS? Not so sure.

A popular IPFS file might be available on thousands of nodes similar to how popular torrents have thousands of seeders. DDoS attack against thousands of servers across multiple countries and networks would be nearly impossible to perform.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#136
post #132

Earlier quoted context omitted.

Maybe. Or maybe liability exists for outside parties in that case: the plumber who was drunk when they put the pipes in, the architect who designed the wall in such a way to force a ton of joints in one weak spot, the building inspector who signed off on it... heck, maybe the water company is causing a water hammer to form because their pumps are busted. Now if my home owners insurance finds that I flooded the downst…

So same should be with IoT? Programmer 'who was drunk when they put the' code should be liable.

>> I’m all for adding liability into the system but if we do we must do it in a way that spreads the burden to the right places (IoT manufacturers, negligent ISPs) and doesn’t push it straight to the consumer.

Now, having said that, when the limb of my tree knocks the power line off my house I have to pay to fix it, but the electric company is on the hook to send someone to turn the line off so my electrician can work on it.

ISPs have to be in the liability chain too: if one of their customers is talking to a C&C server and participating in a DDoS they have to switch off the customer until repairs can be made.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#137

Just want to mention, WMF has a very small but elite team of engineers. Amazed they maintain an Alexa top 5 site with many orders of magnitude less engineering staff than Facebook or Reddit. I think they must count ~100 engineers? I can't imagine what such a small team must be going through with a major DDOS - wish them well in their efforts!

It's because they're just serving a big site, not running the world's most sophisticated surveillance and ad serving machine. Serving giant websites isn't all that hard if you're just spewing out SQL queries into html templates. It all scales in all directions with a properly thought through architecture.

> Serving giant websites isn't all that hard if you're just spewing out SQL queries into html templates. It all scales in all directions with a properly thought through architecture.

No.

1. Your comment makes it sound like Wikipedia is just, or mostly, serving read-only content, which is far from true. Yes, static read-only content is significantly easier to serve than dynamic, editable one, but Wikipedia is the latter.

2. Claiming it's easy to build something at this scale is "isn't all that hard" just makes me think you've never done anything similar. It reminds me of devs saying they could re-build MS Office over a weekend. It's just ignorant of the software's actual complexity.

I'm not associated with Wikimedia in any way, but have worked on large-scale software projects before, and things are quite different from, say, websites only serving 100k monthly active users.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#138
post #130

Earlier quoted context omitted.

It looks like a volumetric attack from this tweet. Wikipedia needs to use Verisign BGP mitigation. They create GRE tunnels to your routers and are capable of handling 2Tbps. During an attack, you make a BGP announcement and the traffic goes via Verisign scrubbing/tunnels. No application changes are required, no Matthew Prince selectively and benevolently enforcing CF neutrality. It's used by large banks.

>no Matthew Prince selectively and benevolently enforcing CF neutrality. What's the logic behind this? It's still a single point of failure and relying on a corporation. If the daily stormer or 8chan tried to use them, they would probably kicked off as well.

If you are not a political undesirable, it does help, though. I think Wikipedia is fine in this regard, not something to shun of for a big corp.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#139
post #138
post #130

Earlier quoted context omitted.

>no Matthew Prince selectively and benevolently enforcing CF neutrality. What's the logic behind this? It's still a single point of failure and relying on a corporation. If the daily stormer or 8chan tried to use them, they would probably kicked off as well.

If you are not a political undesirable, it does help, though. I think Wikipedia is fine in this regard, not something to shun of for a big corp.

There's always something "undesirable" for someone in a big crowdsourced website.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#140

Earlier quoted context omitted.

> Programming isn't that hard if you just do it right. That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right. Obviously that's not productive feedback without actually helping them be better, but it's far from a tautology. For anyone wondering, a tautology i…

I think that you are speaking of a logical tautology, while I am speaking of a linguistic tautology. If I am correct about this, we are both right. A logical tautology is, "A statement that is true by necessity or by virtue of its logical form." A linguistic tautology is, "A phrase or expression in which the same thing is said twice in different words." In formal debating, for example, you can call someone out for ei…

Because we express logical statements in English, these two kinds of tautologies overlap. (If we were using a formal language we could express tautologies like !(A && !A) without using English.)

If you say "All bachelors are unmarried", this is true both because of the meaning of the words, and because of the logical structure implied by the words.

In either case, if you state a tautology, you state something which is true in all possible worlds, given the definitions of the words, at least. Someone can then call you out for stating a tautology, which is to state something that is vacuously true, that is, you've made a statement about the nature of reasoning itself, in any possible world, but you haven't said anything at all about the world we're actually in. So you're wasting your breath even though what you say is unassailably true.

(Note that in mathematics, the tautologies are precisely the theorems with their premises or axioms! So this is by no means always useless.)

The problem with calling out tautologies in common life, however, is that the danger of identifying a false tautology is very high. When someone says "Either X happened, or it didn't." you may be tempted to say "tautology!" but in fact they are probably making some kind of oblique point or highlighting a flaw in someone else's argument, etc. In other words, tautologies may be vacuous as statements about the world within a logical framework, but as speech acts in the real world, they always come with a motivation and that can usually be expressed in a non-tautologous way. For example, "A or not A" can be expanded charitably to "A or not A, and this is relevant to the topic at hand", which is not a tautology anymore.

In this case, if you do something right, it's not extra hard, which is kind of a tautology. But there's a point in saying it, which is that it doesn't have to be that hard... if you do it right. And that's not true of everything or in every possible world, hence not a vacuous statement.

Post reply on HN