Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious attack on Wikipedia – what we know and what we’re doing

wikimediafoundation.org

Post reply on HN
Print view View original

281–290 of 320 posts

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#281

Post by z3t4 »

journalctl wrote: post #263
z3t4 wrote: post #217

Earlier quoted context omitted.

The core parts of Office could be done on a weekend, but in order to get the same complexity and incompatibility it would take several "codemonkeys" several years to achieve.

Silly Microsoft wasted hundreds of people and decades of time. Why didn’t you tell them?

Software projects are usually 90% done in 1% of total time taken. And if you just solve the problem with duct tape eg. a shell script, like piping stdin to a file, or contenteditable=true in HTML, you would have a very basic word program, and if you take that route you will probably have the essential features done over a weekend. But going from that to a full Office clone would take years. The real challenge in development though is to solve real problems, eg not make solutions looking for a problem, and not implement new features ( implementing only features that solve real problems).

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#282

Post by majewsky »

rhizome wrote: post #252
majewsky wrote: post #167

Earlier quoted context omitted.

Because "physical safety regulations" is something that the majority understands, so it's hard to argue against that in public. With digital security, most people lack the mental models to follow the discussion, so it's really easy for lobbyists to tell them flatout lies about how those damn dems are out to take their smart lightbulbs away from them.

Ha ha, "most people." They're so stupid, right?! Not like we, the ones who know what's really going on and how things actually work.

I explicitly formulated very carefully that this is not an issue of "people are dumb", but an issue of lack of understanding. I wish I could downvote your strawman.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#283

Post by [deleted] »

dangxiaopin wrote: post #223
OBLIQUE_PILLAR wrote: post #188

Earlier quoted context omitted.

You appear to be extremely mad Cloudflare stopped proxying a website that encouraged large gun massacres.

The originalcontent was posted on IG. 8ch took the reposts down when it became known that it was connected to the real shooting. Watch the video with the 8ch founder explaining (unless YouTube took it down too). Matt was preparing for the IPO.

[deleted]

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#284

Post by wwright »

the8472 wrote: post #279
wwright wrote: post #237

Earlier quoted context omitted.

I didn’t say it wasn’t political, but it’s not just undesirable for immediate political reasons — it’s undesirable for nearly universally-agreed moral and ethical reasons. So implying it’s only inconvenient for politics is, in my opinion, misleading.

The political tends to encompass or at least subsume the moral and ethical aspects, as I tried to allude to with the realpolitik aspect. But again, this is just a tangent. The core argument is that it is best not to rely on providers that have the freedom to make political/moral decisions who they deal with because that freedom makes them susceptible to moral denial of service attacks. You are one moral outrage away…

I can see that mentality, but what I’m saying is that, personally, if I become a Nazi, I think I should be deplatformed.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#285

Post by SahAssar »

acdha wrote: post #241
SahAssar wrote: post #225

Earlier quoted context omitted.

> What’s wrong with having an upstream provider for caching close to the user and other features when you’re not under attack? The problem is that you are basically mitm:ed all the time.

That’s not what MITM means. I get that you don’t like Cloudflare but voluntary use of a CDN isn’t a MITM any more than, say, Amazon is a MITM because you host on EC2.

Cloudflare is in between the client and the server, decrypting, rewriting and (if set up right) re-encrypting the request/response. It masquerades as the server by presenting a proper certificate for the domain even though it is not the entity that is actually controlling the domain.

That to me sounds very much like MITM, although it is not a MITM attack since the entity controlling the domain opted into it, so basically it is voluntary MITM.

Using a VPS like EC2 is a different story since the decryption happens within the layer that you control. Of course you need to make sure that you choose a vendor for that layer that you trust, but on EC2 the traffic that amazon sees is encrypted with keys they don't have and decrypted with keys stored on a layer that I control. Amazon could read out the memory of my EC2 to get the keys but their business depends on not doing so, so in this case either I have a vendor that always will decrypt and read traffic (Cloudflare), or a vendor whose business depends on hypothetically being able to but not doing it. There is a clear difference to me.

That is the same for most CDN's (including CloudFront and all the other major offerings), so I'm not trying to single out Cloudflare.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#286

Post by master-litty »

johncolanduoni wrote: post #248
master-litty wrote: post #109

Earlier quoted context omitted.

I don't see why you'd come up with something that so misaligns the interests of everyone except Comcast :) We don't need to be priced by the bandwidth, we just need better accessibility to metering. Something my mother could look at and say "huh, the toaster's sent 8gb of data today..."

If you’re not charged for it and it’s not enough for you to feel reduced performance on your other devices, why would you even both looking?

It would consume more electricity, though let's assume by a marginal amount.

I suspect many people are uncomfortable holding a compromised device like that. The unpredictability of a toaster helping to take down Wikipedia is wild and potentially seen as a sign of chaos, especially for less technical users.

Who knows what else this crazy toaster will do next? Will it do the same thing again?

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#287

Post by lucifirius »

Operyl wrote: post #256
o-__-o wrote: post #242

Earlier quoted context omitted.

By your statement then reddit was complicit with the Russian trolls during election season because the bitcoin trolls who evolved into trump trolls were not punished in the slightest (I have a list of 300+ usernames that are still active today)

Reddit is actively moderated by both paid Admins (site wide rules) and volunteer Mods (per subreddit rules). So no, I disagree.

the chans are also actively moderated, and the chans remove CP and did remove other content after events happen

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#288

Post by snazz »

SahAssar wrote: post #285
acdha wrote: post #241

Earlier quoted context omitted.

That’s not what MITM means. I get that you don’t like Cloudflare but voluntary use of a CDN isn’t a MITM any more than, say, Amazon is a MITM because you host on EC2.

Cloudflare is in between the client and the server, decrypting, rewriting and (if set up right) re-encrypting the request/response. It masquerades as the server by presenting a proper certificate for the domain even though it is not the entity that is actually controlling the domain. That to me sounds very much like MITM, although it is not a MITM attack since the entity controlling the domain opted into it, so basic…

Cloudflare’s business also depends on not messing with your traffic, right? It would certainly be easier for them to get your users’ content than for Amazon to do the same, but I think you still have to accept that risk with either. “Hypothetically being able to but not doing it” isn’t a whole lot of confidence if I were hosting some kind of shady website.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#289

Post by cramforce »

SahAssar wrote: post #285
acdha wrote: post #241

Earlier quoted context omitted.

That’s not what MITM means. I get that you don’t like Cloudflare but voluntary use of a CDN isn’t a MITM any more than, say, Amazon is a MITM because you host on EC2.

Cloudflare is in between the client and the server, decrypting, rewriting and (if set up right) re-encrypting the request/response. It masquerades as the server by presenting a proper certificate for the domain even though it is not the entity that is actually controlling the domain. That to me sounds very much like MITM, although it is not a MITM attack since the entity controlling the domain opted into it, so basic…

The MITM can be avoided by using Signed Exchanges. https://developers.google.com/web/updates/2018/11/signed-exc...

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#290

Post by palerdot »

jopsen wrote: post #275
dangxiaopin wrote: post #120

Earlier quoted context omitted.

It looks like a volumetric attack from this tweet. Wikipedia needs to use Verisign BGP mitigation. They create GRE tunnels to your routers and are capable of handling 2Tbps. During an attack, you make a BGP announcement and the traffic goes via Verisign scrubbing/tunnels. No application changes are required, no Matthew Prince selectively and benevolently enforcing CF neutrality. It's used by large banks.

> no Matthew Prince selectively and benevolently enforcing CF neutrality. Is this a slippery slope argument. Because there is a world in difference from discontinuing a few extremists customers, to discontinuing service for something akin to Wikipedia. I'm not sure every slight compromise of principals is a slippery slope. It seems to me that CF generally aims at being neutral.

The argument made here is there is a chance (however minute) that the same can happen to something like Wikipedia because of some misplaced sense of morality, like say - we don't agree with wikipedia edits and editing process which we see if offending certain sections of X population. It does not matter how right their reason is. The fact that providers like cloud flare are in such position to take a moral high stance is not right ...
Post reply on HN