Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

Post reply on HN
Print view View original

361–370 of 648 posts

Re: Internet Archive: Security breach alert

#361

Post by Timber-6539 »

aucisson_masque wrote: post #129
999900000999 wrote: post #93

A pulled an old friends website down from Internet Archive. He's moved on the next stage, but I was glad I was able to put his site back up. It'll be a shame if IA goes down permanently, but we need a decentralized solution anyway. Having a single mega organization in charge of our collective heritage isn't a good idea.

It's called torrent protocol and it doesn't work, no one wants to spend money and bandwidth hosting a god forsaken movie or book that only a handful of people care about.

If the whole world has bandwidth available for TikTok, it can make the same available for sharing torrent files.

Re: Internet Archive: Security breach alert

#363

Post by fortyseven »

hunter2_ wrote: post #358
Springtime wrote: post #355

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

> should email addresses be private?

I dunno. Should your personal phone number be private? Or your home address? Would you be okay if I knew it and shared it with a stranger? Or would you rather be asked permission to share it first?

Seems pretty cut and dry to me. Yeah, there's going to be someone out there (there always is) who doesn't care, but I'd wager the majority would be pretty ticked off if you gave those pieces of information out to a rando on the street.

Re: Internet Archive: Security breach alert

#364

Post by makach »

hunter2_ wrote: post #358
Springtime wrote: post #355

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

Pr definition the email address is considered as private information and should be protected accordingly.

Re: Internet Archive: Security breach alert

#365

Post by Banditoz »

adfm wrote: post #98
Aachen wrote: post #64

Earlier quoted context omitted.

> Software Engineer, Archiving & Data Services (Remote) [...] Preliminary duties of the role will primarily focus on developing Archive-It That is. Paying over 100k at the lower end of the range for 3y experience as software engineer

Not even in the 10th % for the area per https://www.levels.fyi/heatmap/

It says it's remote though, so doesn't seem too bad?

Re: Internet Archive: Security breach alert

#366

Post by echoangle »

phantomathkg wrote: post #362
buildsjets wrote: post #341

Earlier quoted context omitted.

Not the author but yes, I do. It’s trivially easy so why not?

Curious, how trivially easy is that?

Some providers allow you to use Alias emails (I think google redirects mail to ia+mymail@gmail.com to mymail@gmail.com), and if you use your own domain, you can just use a catchall redirect and enter a random address (ia@mydomain.com which goes to catchall@mydomain.com).

Re: Internet Archive: Security breach alert

#367

Post by emidoots »

hunter2_ wrote: post #358
Springtime wrote: post #355

Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

There is software which is intended to e.g. locate the GitHub profiles of people working at companies, then scrape all public repositories they've contributed to for their email address and the emails of their coworkers - to enable targeted advertising to those individuals. Very common in enterprise sales.

With ChatGPT, this can be extended to create emails that look very personal - as if someone has followed all of your work and is genuinely interested in what you are up to - with extremely low effort. And people are already doing this, I already get emails like this today.

Should emails be private? I don't know - I personally consider them to be public because I know for a fact mine will eventually be public whether I like it or not. But I am aware AI is out their slurping up every public communication I've ever had, and is likely trying to manipulate me in various ways already today.

Re: Internet Archive: Security breach alert

#368

Post by drsim »

phantomathkg wrote: post #362
buildsjets wrote: post #341

Earlier quoted context omitted.

Not the author but yes, I do. It’s trivially easy so why not?

Curious, how trivially easy is that?

Many providers support plus addresses like bob+servicename@example.com. Servicename can be anything and doesn’t require any setup.

Re: Internet Archive: Security breach alert

#369

Post by amszmidt »

fortyseven wrote: post #363
hunter2_ wrote: post #358

Earlier quoted context omitted.

This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…

> should email addresses be private? I dunno. Should your personal phone number be private? Or your home address? Would you be okay if I knew it and shared it with a stranger? Or would you rather be asked permission to share it first? Seems pretty cut and dry to me. Yeah, there's going to be someone out there (there always is) who doesn't care, but I'd wager the majority would be pretty ticked off if you gave those p…

There are plenty of countries where all that is public information, back in the day there even used to be a phone book with .. name, phone number, and address. And many countries have this now in digital form.

Re: Internet Archive: Security breach alert

#370

Post by TheDong »

phantomathkg wrote: post #362
buildsjets wrote: post #341

Earlier quoted context omitted.

Not the author but yes, I do. It’s trivially easy so why not?

Curious, how trivially easy is that?

It's quite trivial.

1. Buy a domain. About $10/year for a .com

2. Buy a /24 ipv4 block with good reputation (maybe like $10k)

3. Get a rack in a nearby datacenter, rack up a BGP-capable router and your servers for redundancy to run email. Takes about $30k initial setup costs if you buy all new, and about $5k initial setup costs if you cut corners and buy used. It'll be $2k/mo after that, so less than the cost of 1 $100 avocado toast per day, quite affordable.

4. Setup your mailserver of choice, such as dovecot + postfix. Enable either a catch-all address, or use recipient_delimiters. The former means "anything@domain.com" works, and the latter means "user-anything@domain.com" works (assuming your recipiient_delimiters are '-'). I recommend using a real catchall.

5. Setup your spam setup, this is the hardest part. I have no guidance here.

6. Point your DNS over, setup SPF and DKIM records, test, and off you go! This should all take about 1 to 3 days if you know what you're doing.

7. Find out that some email will go to spam anyway because you're not using one of the big 4 email providers, but it can't be helped, and anyway no one uses email anymore.

And after that, for less than $30k/year, you have email with catchall or subadressing support. Nice and easy.

You can also pay Fastmail for email and use their "catchall" feature https://www.fastmail.help/hc/en-us/articles/1500000277942-Ca...

Or Google Apps also has a catchall feature.

Then, after you do this, you can simply give internet archive the email address "internet-archive@mydomain.com", or generate a random string. If you forget the email you used, you can search your email history for the first email they sent you, and check the To field.

Post reply on HN