Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

181–190 of 648 posts

Re: Internet Archive: Security breach alert

#181
post #87
post #65

Earlier quoted context omitted.

50 PB * $0.014/GB = $0.7M. $0.014/GB is from[1], bare drive cost without chassis, power, or redundancy. 1: https://www.backblaze.com/blog/hard-drive-cost-per-gigabyte/

How long does an average hard drive last? You'd have to spend that 700k every that many years (plus the extra bits you mentioned). Quite an operation actually

For archival, if you use tape, it comes out cheaper (~225k) and ought to last longer (~30 years).

Re: Internet Archive: Security breach alert

#182

Some people on this planet add such negative value. What does this clown hope to gain, apart from costing us all an incredibly useful shared resource?

What if the clown is actually someone hired by one of the many enemies that IA made during the years?

Re: Internet Archive: Security breach alert

#183

Earlier quoted context omitted.

Oh no! I didn't know their IPFS initiative didn't pan out. What happened to it? I am surprised how hard it is to google. I remember interviewing for a role on that team at the archive to help move it to filecoin. Was so happy to hear that the effort was underway to decentralize their datastore. We need this more than ever.

There are people still working on trying to make it happen but it's just a collosal amount of data and filesystems are notoriously hard, so it's very slow going. From my own personal experience doing distributed archiving with no relation to Archive.org, Filecoin/IPFS's UX isn't quite there yet. They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of you…

> They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of your stuff so you end up double-storing data or you have to give into everything being stored as inscrutable binary blobs.

I don't understand this part. What data would you have to give them? Why can't it just live next to your stuff on your OS' filesystem?

Re: Internet Archive: Security breach alert

#184

Some people on this planet add such negative value. What does this clown hope to gain, apart from costing us all an incredibly useful shared resource?

What if the clown is actually someone hired by one of the many enemies that IA made during the years?

He or she is still a clown. What difference does it make who hired him or her? At an individual level one can always disagree to do things that only destroy value.

Re: Internet Archive: Security breach alert

#185
post #140

A few minutes ago (22:48 UTC), I got three emails from HIBP about accounts of mine breached on the Internet Archive. Troy is quick! And I'm surprised the author of that alert() actually had the data as well as followed through Bit of a shame the emails contain an ad for a password manager, saying there's two easy steps to become more secure: Step 1: use our password manager (fair enough), "Step 2: Enable 2 factor aut…

I was going to disagree with you (and I sort of do about password managers and storing 2FA in them, but I also unlock my password manager with a yubikey). But, doesn't a DB compromise mean that the attacker would have the TOTP seed as well? It can only increase your account security elsewhere, but also not re-using password prevents the IA leak from hurting you elsewhere as well?

> I was going to disagree with you (and I sort of do about password managers and storing 2FA in them

Note I'm quoting HIBP's advice from the email they've sent me! I'm absolutely not recommending to store one's 2FA secrets in the same place as the password!

Even if one uses 2FA for the password manager, it stops proving "something you have" in addition to something you know and you're one unlock away from malware vacuuming it all up. The point of 2FA is to be on a separate device you need to have on hand

Of course, the same logic goes for a password manager in the first place, but password reuse is a big enough problem that (for most people's threat model) it seems to be a net positive. 2FA tokens don't have that reuse issue

Re: Internet Archive: Security breach alert

#186
post #87

Earlier quoted context omitted.

How long does an average hard drive last? You'd have to spend that 700k every that many years (plus the extra bits you mentioned). Quite an operation actually

> How long does an average hard drive last? This is a great question, and a state of the art kind of thing. HDDs are sold with a lifetime drive read/write amount and power cycle warranty, along with usually some environmental operating envelope. read/write relates to the quality/space of the platter, power cycle is usually the actuator & read/write head being reseated/wearing out. Environment is the same as all other…

There's also the fact that hard drive capacities keep increasing and increasing significantly faster that the power required, and sooner or later for very long term storage it'd become cheaper to migrate all your data from those 5 year old 4TB drives to more modern 16TB ones. That's assuming you want hot access to the data and don't plan on spinning them down as soon as you've written to them, like you'd do for a cold backup of the whole IA.

I remember for a long time (I'm talking 20-ish years back here), every hard drive I bought had double or more the capacity of every drive I'd ever bought previously combined. My first ever 40MB (yes, megabyte) drive got upgraded to an 80MB one, that got updated to a 250MB one, then a 750MB, and then a whopping 2GB drive (how would I _ever_ fill that up???) - and so on. That's slowed down some, but I'm currently starting to think about upgrading my 8TB drives (Raid1 pair) with 20TB drives when the prices start to drop a bit more.

Re: Internet Archive: Security breach alert

#187

Earlier quoted context omitted.

What if the clown is actually someone hired by one of the many enemies that IA made during the years?

He or she is still a clown. What difference does it make who hired him or her? At an individual level one can always disagree to do things that only destroy value.

> He or she is still a clown. What difference does it make who hired him or her?

We completely agree about the perpetrator. My point was if that is the case, it would implicate that IA enemies were going beyond lawsuits.

Re: Internet Archive: Security breach alert

#188
post #173

Earlier quoted context omitted.

How do they get a hold of all these leaks so fast?

Voluntary sharing, since afaik they don't pay the criminals to get the data. Either the criminals share it directly (fat chance, usually), or someone else bought it and shared it either publicly, privately with HIBP, or privately with someone who then reported it to HIBP How this specific instance unfolded, time will have to tell. The leak may have occurred in 2020 for all we know at this point

There is a strange dynamic between the threat actors who conduct these breaches and researchers.

When not used for extortion and for "status" in the hacking community, they share them with researchers (commonly HIBP) to warn people about a site's security and so that site is forced to fix things.

Definitely a strange dynamic.

Re: Internet Archive: Security breach alert

#189
post #183

Earlier quoted context omitted.

There are people still working on trying to make it happen but it's just a collosal amount of data and filesystems are notoriously hard, so it's very slow going. From my own personal experience doing distributed archiving with no relation to Archive.org, Filecoin/IPFS's UX isn't quite there yet. They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of you…

> They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of your stuff so you end up double-storing data or you have to give into everything being stored as inscrutable binary blobs. I don't understand this part. What data would you have to give them? Why can't it just live next to your stuff on your OS' filesystem?

They're saying that the client software (the servers that speak the IPFS protocols) has to load the files to be served into their own local storage database, it can't just keep a "metadata file" and read the existing files off disk. Presumably somebody could write a client that spoke the IPFS protocol and did this, or fork the main Go or JS one, but until someone does that they're stuck with the software that's already been written

Re: Internet Archive: Security breach alert

#190
post #87

Earlier quoted context omitted.

How long does an average hard drive last? You'd have to spend that 700k every that many years (plus the extra bits you mentioned). Quite an operation actually

I actually find that fairly tame. For a point of comparison, Wikipedia gets ~$150M in revenue a year, an "asset rise" (I presume this is what non-profits call profit?) of ~$15M a year, and is sitting on about a quarter billion in the bank. Not that they want to, but I think Wikipedia could fund this using their current donations if they wanted. Hell, I almost wonder if one of the big storage providers would do it for…

You're right, I guess it is tame and achievable so far as organisations go. I was imagining trying to get some friends together to have a decent percentage of the IA backed up, but that seems out of reach based on this napkin math. Not that that is necessarily demotivating, but it's going to depend on a lot of people intuitively seeing the value and keeping up their share
Post reply on HN