Live data from Hacker News

Malicious attack on Wikipedia – what we know and what we’re doing

wikimediafoundation.org

211–220 of 320 posts

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#211
post #208

Earlier quoted context omitted.

> That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right But this boils down to If you build systems using a high level of skill and foresight, it's easy to do . This is of course not a tautology, but a contradiction. I agree that inexperienced developers can…

> If you build systems using a high level of skill and foresight, it's easy to do. The point being made here is not necessarily a flippant 'git gud'. Instead, it is a statement that problems are tractable, and that getting some things right up-front can have good pay-offs down the road. In other words, don't give up and try to figure out what is good and bad practice.

Yes, "don't give up" is the main thrust. However, if an individual exists in an environment where bad practice is rewarded and good practice is scorned, the advice needs to go beyond individual practice. We need to not give up on the environment, and that in turn requires hope that a better environment is possible and within our reach, as an individual, a team, and a discipline/craft/practice. This is a hard problem.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#212

Earlier quoted context omitted.

Any serious mitigation solution must be BGP based, not proxy. Besides its technical merits and convenience, it also minimizes the risk of a benevolent controller (e.g. Matthew Prince of Cloudflare) ruining your company, because it becomes your upstream provider only during the attacks. Otherwise the GRE tunnels are not in use. The IP addresses are still yours always. We used Verisign for mitigation of a 44Gbps volume…

You appear to be extremely mad Cloudflare stopped proxying a website that encouraged large gun massacres.

Alternately: The fact that Prince was super okay with hosting those websites until the moment it made him look bad

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#213
post #187

Earlier quoted context omitted.

OTOH, shouldn't it be easier to scale Reddit horizontally by sharding the subreddits into separate DBs?

Certainly not trivially - the subreddits are not wholly independent entities. User accounts are shared between them, for instance, and every post a user makes is (searchably) linked to their account, regardless of which subreddit they posted it in. Users can also send each other private messages, and this does not take place in the context of any particular subreddit.

Not to mention that a huge portion of reddit traffic goes to aggregation pages like users' frontpages, /r/all, and too a lesser extent multireddits.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#214

Earlier quoted context omitted.

You appear to be extremely mad Cloudflare stopped proxying a website that encouraged large gun massacres.

How did 8chan "encourage" large gun massacres exactly? By allowing users to post content?

By not moderating content largely, it was no secret what the site was letting go.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#215

Just want to mention, WMF has a very small but elite team of engineers. Amazed they maintain an Alexa top 5 site with many orders of magnitude less engineering staff than Facebook or Reddit. I think they must count ~100 engineers? I can't imagine what such a small team must be going through with a major DDOS - wish them well in their efforts!

[deleted]

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#216
post #20

Apparently this group is behind it. Also attacked WoW and twitch servers.. https://twitter.com/ukdrillas

Part of the liability should be shared with the people owning the compromised machines these crazies are using for their attacks, otherwise attacks like these will never stop as long as enough free “ammunition” is being left around by incompetent people who can’t be bothered to secure & monitor their systems properly. Edit: in reply to some of the (valid) counter-arguments, I'd like to say that there are indeed many…

This stands out to me as a problem that mandatory liability insurance would be well suited to. Make everyone liable for damages to people and organizations harmed by illegal use of their unsecured computers. Then everyone who has an internet-connected device has to purchase liability insurance. They would be able to choose between expensive policies that impose no surveillance or restrictions, or purchase cheap policies that require running surveillance software, or submitting to regular security audits. Most individual consumers would probably end up with cheap policies that just require them to use devices that receive timely security updates from vetted manufacturers and run behind typical home internet firewall rules.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#217
post #146

Earlier quoted context omitted.

> Serving giant websites isn't all that hard if you're just spewing out SQL queries into html templates. It all scales in all directions with a properly thought through architecture. No. 1. Your comment makes it sound like Wikipedia is just, or mostly, serving read-only content, which is far from true. Yes, static read-only content is significantly easier to serve than dynamic, editable one, but Wikipedia is the latt…

I've never heard anyone in my life say they could rebuild MS office in a weekend. What, in your opinion, would be the work needed to go from a 100k monthly active user site to a wikipedia scale site - that would be comparable to rebuilding MS office?

The core parts of Office could be done on a weekend, but in order to get the same complexity and incompatibility it would take several "codemonkeys" several years to achieve.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#218
post #160

Earlier quoted context omitted.

Wikipedia is blocked in China. It's politically undesirable for 1/8 of the human population...

I think undesirable here describes something like white nationalists. They have a problem getting web hosting.

CloudFlare has strategic business partnership with Baidu [1]. They are very likely to cooperate with the chinese government to implement the great chinese firewall.

Additionally, helping to block Wikipedia because China says so is much easier to excuse than blocking 4chan - they would just be complying with local regulations after all.

[1] https://www.cloudflare.com/press-releases/2015/cloudflare-an...

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#219

Earlier quoted context omitted.

> Programming isn't that hard if you just do it right. That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right. Obviously that's not productive feedback without actually helping them be better, but it's far from a tautology. For anyone wondering, a tautology i…

> That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right But this boils down to If you build systems using a high level of skill and foresight, it's easy to do . This is of course not a tautology, but a contradiction. I agree that inexperienced developers can…

> But this boils down to If you build systems using a high level of skill and foresight, it's easy to do.

Yes.

> This is of course not a tautology, but a contradiction.

It's not quite a contradiction! If you bill $1 for changing the bolt, and $9,999 for knowing which bolt to replace, this shows that the work is easy, but the experience required to make the work easy is not easy. If the master can draw it in seven strokes, but you don't see the seventy thousand strokes they did before, it looks easy, and in fact it is easy, for the master but not for the novice.

> I agree that inexperienced developers can, as it were, 'make life hard for themselves', but that's (trivially) due to their inexperience. I don't think there's a silver bullet for inexperience.

That's right. However, we can also make life hard for each other, and there are some solutions for that that are better than doing nothing.

> Over-engineering is bad, as is under-engineering. Fuzzy principles like 'YAGNI' can't be applied without skilled discernment, which means experience.

Yes. This is why we have code reviews, design reviews, pair programming, and so on, but these aren't silver bullets either and there is no silver bullet, but if these things lead to increased awareness of why and not just what and how, then we can accelerate the process of acquiring that discernment. As Dijkstra said, if it goes to the grave with you and you didn't pass it on, you didn't really do your job as a senior engineer (paraphrasing).

>> Programming is hard, but we make it much harder than it has to be by doing it spectacularly wrong in many ways, both individually and collectively.

> I think I agree with this, but it depends on specifics. What sorts of things are you thinking of?

Using the wrong tool for the job. Using too many tools for the job. Using tools that do not afford mastery, because they are too complex for anything built on top of them to be comprehensible.

This is all quite abstract. A specific example: we (the JavaScript community) had a good thing in that JS was a small, human-scale, useful and commercially valuable language with applications beyond its initial environment on the web. We got excited and built the npm package archive, and filled it up, and now we have unmaintainable, incomprehensible piles of trash piled upon trash that can't possibly be used as a foundation for anything reliable, performant, or maintainable. This is unfortunate. What's even more unfortunate is that this piled-up-trash approach still has momentum, still lets people get useful work done, and still has some value to the community. So we keep using it, and even keep piling more on. It takes considerable effort to step back from all this, take a collective mulligan, and start over with a principle of taking things away to make things better, rather than adding more hacks to hide existing hacks.

This is one example of many, but I mention this one because I was there when JS was simpler and better and I watched as we made it markedly worse. I would have recommended JS as a first language to beginners when node.js and npm were new, and I did, but I cannot now recommend them in good faith, because they have become antagonistic to quality and to mastery of the craft.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#220
post #147
post #142

Earlier quoted context omitted.

The question is whether you feel good enough about that probability to be held liable if the malicious code was hidden good enough. Also, some cases might be obvious on Windows PCs, but I don't think that's necessarily the case with phones. Take note that websites can also send malicious packets. When you load a webpage, the code is downloaded and immediately executed. Are you OK with being held liable for visiting a…

Liability boundary is an important question. There is no simple answer. Couple of years back owner of the abandoned building was declared liable of the death of the kid who entered to the fenced building despite all the signs no trespassing and so on. Neither your example nor mine negates that there should liability for various voluntarily and involuntarily acts, own or third party.

> Couple of years back owner of the abandoned building was declared liable of the death of the kid who entered to the fenced building despite all the signs no trespassing and so on.

Honestly, that doesn't sound right. I hope I'm misjudging because of lack of details.

Post reply on HN