When internal hostnames are leaked to the clown • Hacker News Board

Re: When internal hostnames are leaked to the clown

#261

Post by superkuh » Fri, Feb 06, 2026, 9:18 PM UTC

DANmode wrote: post #241

superkuh wrote: post #237

Earlier quoted context omitted.

I opened it on an old computer with an old linux distro with an old browser because old linux distros have reliable and working accessibility features like screen readers and good non-gpu text to speech and advanced keyboard/mouse sharing. Modern linux distros do not. Don't worry, I have javascript execution/etc turned off by default on that machine.

Glad I asked - first time running into a screen reader using Linux user in the wild! What distro/reader? Thanks

Ubuntu 10.04 (custom 3.x kernel, custom 1.7.x xorg) + Orca + Festival 1.96 with nitech HTS voices.

Re: When internal hostnames are leaked to the clown

#262

Post by simoncion » Fri, Feb 06, 2026, 9:29 PM UTC

Nextgrid wrote: post #260

simoncion wrote: post #216

Earlier quoted context omitted.

> ...any network hiccup or dropped connection will leave the filesystem in an unclean state. Given that the docs claim that this is an implementation of an official NVMe thing, I'd be very surprised if it had absolutely no facility for recovering from intermittent network failure. "The network is unreliable" [0] is axiom #1 for anyone who's building something that needs to go over a network. If what you report is tru…

NVME only provides block IO. An interruption of the connection is equivalent to forcibly unplugging a hard drive. If the filesystem you put on top supports that and is able to recover from that, you're fine. But most filesystems do not optimize for that happening anywhere near as frequently as it would if you were using this as a regular file sharing protocol over unreliable networks.

> NVME only provides block IO.

Sure. NVMe provides block IO carried over a variety of transports. The one we're talking about is TCP.

> An interruption of the connection is equivalent to forcibly unplugging a hard drive.

Remember that I said in my footnote:

  "Your disks get turbofucked if the network ever so much as burps" is unacceptable for something you expect people to actually use for real.

A glance at the spec reveals that TCP was chosen to provide reliable, in-order transmission of NVMe payloads. TCP is quite able to recover from intermittent transport errors. You might consider reading the first paragraph of sections 2 and 3.3, as well as sections 3.4, 3.5, and the first handful of paragraphs of section 3.5.1 of the relevant spec. [0]

If you're truly seeing disk corruption whenever the network so much as burps, then it sounds like the SystemD guys fucked something up.

[0] https://nvmexpress.org/wp-content/uploads/NVM-Express-TCP-Tr...>

Re: When internal hostnames are leaked to the clown

#263

Post by icedchai » Sat, Feb 07, 2026, 12:32 AM UTC

xp84 wrote: post #226

ryandrake wrote: post #184

Earlier quoted context omitted.

It certainly feels that way here in 2026. It seems like I'm spending so much time "verifying" and "authenticating" and clicking somewhere so that the service can send me a code in E-mail. And more and more services are getting super aggressive. Biometrics, 2FA, uploading government ID, uploading face scans... Good grief! I can imagine being in info-sec is a rough life. When you get breached, they're blamed. So they s…

The way so-called ‘2fa’ has been implemented on 90% of the things I interact with as a consumer is an absolute farce. Control of a SIM is nearly 100% of the time sufficient to get absolute control of any account, and showing a $50 fake ID to a teenager at a cell phone store has probably a 99% success rate. Only sites for nerds, plus Google and Microsoft, support TOTP or passkeys. Everywhere else uses the sms BS for 2…

Don't forget about password reset policies. At one place with a dedicated "security theater" team, I have to change my password every 90 days, so I just add the year and month to a base password. Password!2602 it is!

Re: When internal hostnames are leaked to the clown

#264

Post by 1vuio0pswjnm7 » Sat, Feb 07, 2026, 10:56 AM UTC

1vuio0pswjnm7 wrote: post #218

b1temy wrote: post #15

Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private netw…

I remember the term "clown computing" to describe "cloud computing" from IRC earlier than 2016 I use a localhost TLS forward proxy for all TCP and HTTP over the LAN There is no access to remote DNS, only local DNS. I use stored DNS data periodically gathered in bulk from various sources. As such, HTTP and other traffic over TCP that use hostnames cannot reach hosts on the internet unless I allow it in local DNS or th…

Another habit I follow is to set the gateway of (a) computers I cannot trust, i.e., ones running corporate OS I cannot control, to (b) a computer that I believe I can control running UNIX-like OS that I compiled from source

I run tcpdump on (b)

(b) is the only computer with direct access to the internet

The only time I have seen a sentry.io DNS request is from (a)

Re: When internal hostnames are leaked to the clown

#265

Post by spondyl » Sun, Feb 08, 2026, 4:28 AM UTC

n0w wrote: post #46

spondyl wrote: post #23

Earlier quoted context omitted.

My first thought was perhaps they're trying to fetch a favicon for rendering against the traces in the UI?

They're likely trying to retrieve source maps

Oh true, that would make a lot more sense!