The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines • Hacker News Board

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#21

Post by TillE » Sun, Sep 21, 2014, 4:41 PM UTC

fooyc wrote: post #16

drsintoma wrote: post #10

Earlier quoted context omitted.

They are more expensive, but they are usually easy and immediate to acquire. Which makes provisioning much more efficient in case of fluctuating traffic. And overall sysadmins will have less tendency to over-provision, meaning getting more and beefier machines than it's needed "to be safe".

Nothing prevents you from using bare dedicated servers for your usual traffic, and VMs for anything else.

This is clearly the ideal setup for most use cases, and I'm somewhat puzzled as to why it's not more common. I guess using only virtual servers is a tiny bit simpler, so companies will just eat the extra cost.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#22

Post by TheLoneWolfling » Sun, Sep 21, 2014, 4:45 PM UTC

aianus wrote: post #18

TheLoneWolfling wrote: post #13

Earlier quoted context omitted.

It depends on what you mean by that. The only way to prevent a codebase from being seen by an adversary with physical access when the server is on is to not have the sensitive data on the server in the first place. Encryption (with the decryption key being gotten at boot from, say, a particular .onion address) would work against backups, but won't protect against an adversary with admin access to the server when the…

This would be a cool application for some kind of homomorphic encryption. Server gets encrypted search request and matches it against an encrypted index and returns the encrypted results.

Homomorphic encryption isn't fast enough... yet. But it's getting faster!

It will be amazing if/when we get to the point where you can have a virtual server where you know that the person with physical access to the server cannot access your data.

Even if it is two orders of magnitude slower than raw hardware that's still fast enough for some things. (For example, being able to have a username+password -> personal info database safely run on someone else's hardware.) And once it takes off there probably will start to be hardware support/accelerators for it - like vector intrinsics and AES instructions currently.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#23

Post by verroq » Sun, Sep 21, 2014, 4:54 PM UTC

Why can't people find where their servers? I understand they have their own IP allocation, thus they can use BGP tricks. But don't they need a sympathetic ISP or similar to help them get the routes in?

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#24

Post by waxjar » Sun, Sep 21, 2014, 5:06 PM UTC

TomAnthony wrote: post #7

If the load balancer is the weak point that would be first to be discovered, then I imagine they must have some mechanism to stop it leaving evidence that leads to the other machines if it were to get raided (it isn't on their hardware, so they can't prevent the files being backed up). Is there a way the codebase could be entirely encrypted and not even accessible to the cloud provider (with some 'boot password' need…

I remember reading their load-balancer shuts itself off after 2 minutes if something strange happens. The whole thing is run from memory, so no traces will be left.

I don't know how accurate this is, though.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#25

Post by drsintoma » Sun, Sep 21, 2014, 5:18 PM UTC

fooyc wrote: post #16

drsintoma wrote: post #10

Earlier quoted context omitted.

They are more expensive, but they are usually easy and immediate to acquire. Which makes provisioning much more efficient in case of fluctuating traffic. And overall sysadmins will have less tendency to over-provision, meaning getting more and beefier machines than it's needed "to be safe".

Nothing prevents you from using bare dedicated servers for your usual traffic, and VMs for anything else.

In an ideal world yes. Or if your software works already seamlessly cross-datacenter. But in the real world is rare that your hosting provider is good at both VMs and metal. At least that's the biggest problem I've always encountered, specially with budget providers.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#26

Post by tacotime » Sun, Sep 21, 2014, 5:25 PM UTC

droopyEyelids wrote: post #19

fooyc wrote: post #9

" This saved costs, guaranteed better uptime, and made the site more portable and thus harder to take down " Probably not true for " This saved costs ". From what i've seen, virtual machines usually cost more than twice the price of renting the equivalent "real" machine monthly. They could have used dedicated servers; there are more dedicated server providers than VM providers, thus achieving the same goal, less expe…

I think TPB specifically might save money: 1) Hardware seizure expenses vs LEOs duplicating the hdd of a virt. 2) TPB needs to locate in disparate jurisdictions to take advantages of different legal situations. That would involve a ton of shipping costs, probably more lost hardware, and paying for remote hands 3) They had been paying a premium for 'bulletproof' hosting.

For real, their dedicated hosting costs are most likely not going to be at all comparable to the ones most people commonly get quoted. Hosting costs go up when your host runs out of a former Cold War bunker.

http://en.wikipedia.org/wiki/CyberBunker

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#27

Post by tacotime » Sun, Sep 21, 2014, 5:45 PM UTC

waxjar wrote: post #24

TomAnthony wrote: post #7

If the load balancer is the weak point that would be first to be discovered, then I imagine they must have some mechanism to stop it leaving evidence that leads to the other machines if it were to get raided (it isn't on their hardware, so they can't prevent the files being backed up). Is there a way the codebase could be entirely encrypted and not even accessible to the cloud provider (with some 'boot password' need…

I remember reading their load-balancer shuts itself off after 2 minutes if something strange happens. The whole thing is run from memory, so no traces will be left. I don't know how accurate this is, though.

I wonder how long until our nation's SWAT teams are equipped with ram rippers and cans of liquid nitrogen.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#28

Post by tacotime » Sun, Sep 21, 2014, 5:51 PM UTC

TheLoneWolfling wrote: post #20

the_mitsuhiko wrote: post #17

Earlier quoted context omitted.

A NAT does not stop you if you do it right. Console games have been hosting servers through NATs for the last decade.

As I said: it gets "fun", especially if you want to do it without a third server to set up the connection. Still doable, just "fun".

I would speculate that the massive advertising revenue generated by the 'bay probably renders any such 'fun' factor trivial.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#29

Post by fooyc » Sun, Sep 21, 2014, 5:56 PM UTC

droopyEyelids wrote: post #19

fooyc wrote: post #9

" This saved costs, guaranteed better uptime, and made the site more portable and thus harder to take down " Probably not true for " This saved costs ". From what i've seen, virtual machines usually cost more than twice the price of renting the equivalent "real" machine monthly. They could have used dedicated servers; there are more dedicated server providers than VM providers, thus achieving the same goal, less expe…

I think TPB specifically might save money: 1) Hardware seizure expenses vs LEOs duplicating the hdd of a virt. 2) TPB needs to locate in disparate jurisdictions to take advantages of different legal situations. That would involve a ton of shipping costs, probably more lost hardware, and paying for remote hands 3) They had been paying a premium for 'bulletproof' hosting.

Renting a dedicated server doesn't involve any of this.

There are dedicated server providers in every part of the world, including MPAA-proof countries.

Re: The Pirate Bay Runs on 21 “Raid-Proof” Virtual Machines

#30

Post by larrys » Sun, Sep 21, 2014, 5:57 PM UTC

allegory wrote: post #4

crazy1van wrote: post #3

Earlier quoted context omitted.

They may "have no clue" but it seems like that's only because they don't care and haven't looked. I don't see anything in the article that would prevent the providers from figuring this out unless I'm missing something.

If someone is paying the bill, do they really care?

"If someone is paying the bill, do they really care?"

So you could cross reference names of the people raided with payment information of the VPS providers (usual suspects or top "n" providers let's say). Of course that could be hidden as well.

Other issue is how does anyone know this isn't misinformation anyway and that the VPS providers don't play a role or not as much of a role as is indicated. Just because someone is writing this or because they said it?

What advantage does it have for anyone (like this) to reveal anything about how they are situated security wise if not to lead people off the beaten track even given some possible marketing advantage?