Apparently this group is behind it. Also attacked WoW and twitch servers.. https://twitter.com/ukdrillas
How can it be that a single group can take down Wikipedia? The internet is broken.
Malicious attack on Wikipedia – what we know and what we’re doing
191–200 of 320 posts
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#192Just want to mention, WMF has a very small but elite team of engineers. Amazed they maintain an Alexa top 5 site with many orders of magnitude less engineering staff than Facebook or Reddit. I think they must count ~100 engineers? I can't imagine what such a small team must be going through with a major DDOS - wish them well in their efforts!
> I think they must count ~100 engineers? https://wikimediafoundation.org/role/staff-contractors/ has the names of 379 employees. I believe (perhaps astonishingly) that is all - engineers and non-engineers combined. Their engineers spread across departments, but judging by the 141 instances of the string 'engineer' in that page, I'd be surprised if the number exceeds 200.
Speaking as someone listed on that page, and having attended all-hands meetings, yeah, we're not huge.
Though it is worth bearing in mind that everything's open source, and there's a hefty community component. So there's a more vaguely specified number of people who might provide patches, and individual wikis are mainly run by volunteers.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#193Earlier quoted context omitted.
No offense taken, I don’t work on the product side of things there. Also, with the caveat that I don’t know enough about the implementation details of the product at Reddit: I’d argue that Reddit’s workload is more write heavy that Wikipedia’s workload, which makes caching and scaling a bit harder for Reddit, relatively speaking.
That could be true, but do you have some numbers? Wikimedia wikis are in the order of a few hundreds edits per minute, around a thousand and sometimes more. https://tools.wmflabs.org/wmcounter/ https://wikipulse.herokuapp.com/
To add the Reddit figures to the discussion. There are something like ~2,100-2,200 comments posted to Reddit per minute on average across a year at this point (around or slightly over three million comments per day). That's not the peak minute figure of course, which is no doubt several times higher.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#194Earlier quoted context omitted.
Please be careful of logical tautologies: "It all scales in all directions with a properly thought through architecture" sounds dangerously like, "Programming isn't that hard if you just do it right."
> Programming isn't that hard if you just do it right. That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right. Obviously that's not productive feedback without actually helping them be better, but it's far from a tautology. For anyone wondering, a tautology i…
[deleted]
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#195Earlier quoted context omitted.
We are in the area of probability in both cases. Oftentimes is obvious if PC/device is infected. Sometimes is really hard to find out, https://en.wikipedia.org/wiki/Stuxnet
The question is whether you feel good enough about that probability to be held liable if the malicious code was hidden good enough. Also, some cases might be obvious on Windows PCs, but I don't think that's necessarily the case with phones. Take note that websites can also send malicious packets. When you load a webpage, the code is downloaded and immediately executed. Are you OK with being held liable for visiting a…
I feel like you try very hard to establish a strawman. No one expects 100% perfection. Establishing and following industry standards is a good first step.
Like no unencrypted local passwords. Individual default passwords for every individual device. Not using outdated version, especially once vulnerabilities are known. Including an update mechanism and providing updates for at least X years.
And yes, trained specialists will be able to work through such checklists for many commonly used software, just like your car mechanic.
And by the way, no one expects your car mechanic to [a] be perfect (you really never heard a story of a car breaking again just after leaving the shop?) or [b] be able to handle any kind of vehicle unknown to him.
The goal of rules like that is to punish the worst tier, thereby raising the bar. But this will probably be more hard to implement in the US with their everyone-sues-everyone mindset. Reminds me a lot of the great GDPR scare but now imo quite reasonable actual cases happening.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#196Apparently this group is behind it. Also attacked WoW and twitch servers.. https://twitter.com/ukdrillas
Part of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many…
> Part of the liability should be shared with the people owning the compromised machines
You’re voluntarily signing up to get fined when someone hacks the computer in your house, because you connected it to the internet, right?
> Currently there is no penalty for manufacturing insecure hardware
I’m glad you see some validity in the counter-points, but doubling down on this idea of punishing manufacturers for things people do with their hardware seems misguided at best.
You can’t prove any hardware is secure, if there were such penalties there would be no hardware, this is a total and complete non-starter. Moreover, there are lots of other bad things you can do with hardware, this would open the door to holding manufacturers accountable for everything. Do you think Intel or Dell will accept fines for every successfully hack into machines they made?
This isn’t unlike suggesting that ISPs should be held liable for people doing illegal things on the internet, or suggesting that it should be illegal to pay ransoms. It’s hurting the wrong people, and failing to punish the people doing wrong.
> this situation is a consequence of that
That’s a purely subjective opinion that ignores multiple causes, and ignores the single most direct cause: people who wish to do bad things. It would be just as valid to blame this on a failure of the education system & social civics as to blame hardware manufacturers. Maybe we should fine teachers who have students that later do bad things?
> We have regulations that (mostly successfully) prevent companies from selling hardware that blows up and destroys your house, why can’t we have the same for networked hardware?
First, the analogy is bad because there are zero good uses for consumer bombs in houses, while there are plenty of non-harmful uses for IoT devices.
Second, because there is a market for simple hardware that can be deployed inside of secure networks, and doesn’t require a team of security experts to run. Secure hardware is more expensive to produce than simply-connected hardware.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#197Earlier quoted context omitted.
Wasn't Instagram famous for having a very small team of engineers responsible for the availability of the entire platform before Facebook acquired them?
Not sure how big ig was on acquisition, but I always remember that story being about WhatsApp with only 35 engineers
Business Insider ran a story about them at the point of acquisition.
April 9, 2012 "Instagram was acquired by Facebook today for $1 billion in cash and stock. It only has 13 employees and a handful of investors. ... Meet 11 of the lucky employees and 9 investors behind Instagram. ... Two other employees were hired during South by Southwest last month and their information wasn't available for this story. "
https://www.businessinsider.com/instagram-employees-and-inve...
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#198Earlier quoted context omitted.
There’s lots of dirty politics on WP. Not sure about other countries, but Russian government is very involved in whitewashing it’s activities.
How interesting. Could you post some evidence? Thanks!
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#199Earlier quoted context omitted.
That could be true, but do you have some numbers? Wikimedia wikis are in the order of a few hundreds edits per minute, around a thousand and sometimes more. https://tools.wmflabs.org/wmcounter/ https://wikipulse.herokuapp.com/
To add the Reddit figures to the discussion. There are something like ~2,100-2,200 comments posted to Reddit per minute on average across a year at this point (around or slightly over three million comments per day). That's not the peak minute figure of course, which is no doubt several times higher.
So it's actually comparable I'd say, in terms of frequency. In terms of how much "writing" this actually means, it varies: an edit to a large article, even if it's just a comma, requires several seconds of parsing to produce the wikitext, a lot of events propagated in various places etc.
Re: Malicious attack on Wikipedia – what we know and what we’re doing
#200Earlier quoted context omitted.
I love ipfs. Can this actually be ddos’d as well?
The ipfs.io is just a web-based way to access IPFS, called a gateway. There are a bunch of different gateways. In addition, you can run an IPFS node locally, and then as long as just one node holds the content you're looking for you are looking for you're good. There are also browser extensions to re-write gateway URIs to localhost URIs.
So there is no central place like bittorent tracker which if down the network does not works?
Or is it like DHT which does not need central tracker?