Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

washingtonpost.com

Post reply on HN
Print view View original

211–220 of 257 posts

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#211

Post by trulyme »

rswail wrote: post #205
vxNsr wrote: post #183

Earlier quoted context omitted.

Because ipv6 is hard and NAT works well enough.

IPv6 on an internal network is trivial. It is supported by both Windows and MacOS (and Linux) out of the box. If your ISP doesn't provide it, get one that does. They should allocate you a /56 by default per connection, if not something larger like a /48 if you have multiple locations. Subnet the /48 for each connection, subnet each /56 into /64 subnets. reserve one of the /56's for site-to-site if needed. Done.

Ipv6 is like python3. A worthy upgrade, but tried to do too much in a single coup and broke backwards compatibility. If they simply added two top octets, saying that 0.0.... was the old ipv4, everyone would have used it ages ago. Instead they made other improvements which led to complex standard and worse adoption.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#212

Post by kijin »

Aperocky wrote: post #180
sterlind wrote: post #109

Earlier quoted context omitted.

but if they're not filtering BGP announcements for those ranges (however unlikely), and the GFW isn't blocking traffic out to those addresses (even more unlikely), and the internal metrics were high (super unlikely), I guess it'd slurp out all the traffic? maybe this was a weird smash-and-grab.

You'd be surprised, but GFW is a blacklist not a whitelist, as such the blocked domains and/or IPs are a very small subset of all public addresses out there.

Even with a blacklist, a large and contiguous range like 11.0.0.0/8 won't be particularly difficult to block or reroute.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#213

Post by Dylan16807 »

woleium wrote: post #93
xxpor wrote: post #69

Earlier quoted context omitted.

If they're not actually using the whole /8 (highly likely), you can setup a 1:1 NAT. basically from network b, if you want to talk to network a, you find out the address in 11/8 that corresponds to the 10/8 address and vice versa. You can use split horizon dns to make it mostly transparent. Every networking problem in the world can be solved with more NAT or more encapsulation :)

what you call 1:1 NAT is just called NAT by cisco, the stuff most folks think NAT is is actually NAT+PAT (like what you run on your home router with a single public IP)

Mostly, but NAT without PAT doesn't have to be 1:1. You could put 100 hosts behind 20 IP addresses without ever changing a port.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#214

Post by prox »

A_non_e-moose wrote: post #159
MathCodeLove wrote: post #156

Earlier quoted context omitted.

What does that statement have to do with the comment you're responding to? Yes cops should kill fewer people, but as the person to whom you replied mentioned, police violence is far from the most serious issue facing the US currently. Let's get outraged at the obesity epidemic, let's revolt against black on black violence in the inner cities, let's "defund" platforms which encourage division and turmoil. Even my comm…

See John Cleese on Extremism https://m.youtube.com/watch?v=HLNhPMQnWu4 The "you're either with us or against us" mentality leads to the eradication of moderates and further extremism. A healthy society needs balance. How can we counteract this?

- Cutting down on high noise / low effort social media - Reflection on whether the article you just read made you feel good or you learned something, find on the ground experts in fields. - Debating with your “enemy” in a Socratic Way - A true intolerant likes wrestling in the mud and stay there.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#215

Post by tiernano »

icedchai wrote: post #140
tiernano wrote: post #110

when digging though some of the IPs, i came across 22.0.0.0/8, which if you look at the DNS tab of bgp.he.net ( https://bgp.he.net/net/22.0.0.0/8#_dns ) shows a LOT of people are "using" those IPs... which means a LOT of people wont be happy that their sites, email, dns, etc, are now essentially being blackholed... for me (I run AS204994), the traffic hits Frankfurt (i peer with HE there) goes over their network thou…

If they're using them for internal networks, they'll (probably) work just like they did before. It's likely many folks are using these as like private RFC-1918 addresses.

If they are private, which they could be, I wonder why they are showing up in public on there... Also, ripe.net has ripe stats... Checked a few of the ranges and seen people other than the dod and these lads announcing the range...

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#216

Post by withinboredom »

ARandomerDude wrote: post #164
dwarfsandstuff wrote: post #134

Earlier quoted context omitted.

A random cat's death got to be top secret? Oh gawd...

Things are often classified because of how we know the cat died, not because the cat was special. Suppose you've recruited a foreign intelligence officer to work for you and he happens to mention the cat dying during a debriefing. You can't just declassify the unimportant bits because enough of them will tell you who said it. It's the same problem as FAANG collecting mountains of "anonymous" metrics. Pretty soon, you…

I think everyone knows we are in Afghanistan and the cat was a stray on our base. But you’re right. Maybe the fact that Nothing Happened was what was classified, not the cat? Who knows.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#217

Post by Flocular »

dwarfsandstuff wrote: post #138
leesalminen wrote: post #122

Earlier quoted context omitted.

Ha! “Unmarked white van” is the WiFi name at my local dog daycare. I got a good laugh.

My wifi is called nsa_net

Yeah, sharing SSIDs isnt such a great idea. Check out https://wigle.net ... Obviously multiple people around the world use this one, but it narrows it down for dedicated people

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#218

Post by rnhmjoj »

vxNsr wrote: post #183
kenniskrag wrote: post #127

Earlier quoted context omitted.

why?

Because ipv6 is hard and NAT works well enough.

> NAT works well enough

Yeah, it works well enough until it doesn't: I love when VoIP calls have one-way audio or when I have to map ports because the traversal method used by this P2P app is not working. When run at the ISP level it's even more fun: remember when wikipedia blocked the whole Qatar?

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#219

Post by sk1ppy »

VLM wrote: post #44
Denvercoder9 wrote: post #23

Earlier quoted context omitted.

Two things that come to mind are running out of private address space (a /8 isn't that large), or wanting address space that doesn't clash with other private networks (e.g. to ensure a VPN doesn't overlap with home networks). There's probably more reasons.

> running out of private address space Classic merger "solution". Company A uses 10/8 Company B uses 10/8, company A buys company B and orders new subsidiary B to renumber into 11/8 "All you have to do is change every first octet to 11"

Merger after merger after merger followed by a massive adoption of public cloud (using Direct Connect/Express Route for hybrid connectivity) has led at least two very large FinServs I worked for adopting CGNAT (100.64/10) for parts of their internal networks.

In both cases RFC1918 was used throughout their global network and while not fully used, had become highly fragmented over time.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#220

Post by beckman466 »

frogpelt wrote: post #129
ufmace wrote: post #94

Earlier quoted context omitted.

That isn't really how it works anymore. It's possible (and standard) to push any political agenda without ever stating an opinion directly. It's all about which specific facts you choose to report and which you choose to ignore. It's very easy to select and report only facts that make group A look good, or only facts that make them look bad. In that way, 2 news sources can give people the opposite opinion without any…

And furthermore, public sentiment (and therefore elections) are decided by what the main sources of media determine is the most important news. Example: Cops have shot a thousand people a year for several years in a row (maybe a decade). About 300 of those each year have been black, which is a disproportionate amount by some measures. However, it is nowhere near the biggest problem in our country even for black peopl…

> because the media has chosen to report on that problem near constantly since Colin Kaepernick took a knee, it has dominated the public consciousness and therefore influences thousands of people to loot, burn, protest, riot and thousands more to develop opinions and attitudes that create more and more division in our country.

No, systemic racism caused by capitalism is the root cause of that.

The capitalist media is but one contributing factor of this.

The root cause for this rioting is hundreds of years of systemic oppression: redlining (now digital redlining in the digital age), racist banking policies (for a detailed analysis see ‘The Color of Money: Black Banks and the Racial Wealth Gap‘ and ‘How The Other Side Banks‘, both by law Professor Mehrsa Baradaran), the school to prison pipeline, the CIA and Reagan’s ‘war on drugs‘ that flooded inner cities with crack in the 1980’s causing the crack cocaine epidemic (journalist Gary Webb exposed this), the CIA also systemically murdered the leaders of socialist black liberation movements (Martin Luther King, Malcolm X, Fred Hampton, etc.), and more (these are only a few examples that I can think of right now).

Wage slavery of course exploits and oppresses all of the working class (the 99% of us who don’t own capitalist property: technology in the form of trade secrets, patent claims, etc. (the means of production)). Yet black and brown people (both in the global north and the global south) have especially had a harder time simply because of the color of their skin.

Post reply on HN