Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious attack on Wikipedia – what we know and what we’re doing

wikimediafoundation.org

Post reply on HN
Print view View original

311–320 of 320 posts

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#311

Post by keymone »

toxik wrote: post #307
d0mine wrote: post #271

Earlier quoted context omitted.

if something is repeated a lot, it doesn't make it true. Though it does make it more believable to common folk according to Goebbels https://www.azquotes.com/author/5626-Joseph_Goebbels

Russian fake news is widespread and easy to find. How can this be controversial, and even downvoted on HN of all places? Russian military shot down a plane full of politicians over Ukraine, and boldly lied about it in the international press. This is just one of literally hundreds of such instances. Russia has been caught numerous times trying to sway elections across the world. How on earth is “Russia whitewashes it…

plane full of civilians you mean? plane full of politicians crashed over russian territory in 2010.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#312

Post by marvin-83 »

nl wrote: post #309
marvin-83 wrote: post #305

Earlier quoted context omitted.

you're not really engaging with his point. Effectively banning 8chan by removing network protection does not just restrict extremists; it restricts anyone who used that forum. Ultimately, such matters should be prosecuted by courts. It is inappropriate for organisations like cloudflare to leverage their position within essential network infrastructure to start editorialising what passes through their network.

It is inappropriate for organisations like cloudflare to leverage their position within essential network infrastructure to start editorialising what passes through their network. No, I think it's entirely appropriate. "Don't troll" and methods for dealing with trolls has been a thing all sites have done since the internet was invented. I don't see any difference here at all.

the difference is their position in the stack.

Cloudflare blocking people that abuse the network is legitimate (e.g. spam, denial-of-service), just like it is legitimate for forum admins to block people that abuse the forum (trolling, explicit posts).

But cloudflare, or any other network infrastructure provider, shouldn't be determining permissible content for websites because they are not hosts/administrators for that content.

It is like a postal service reading your letters and then saying "we don't like what is being said, so you can't send letters anymore." They can and should stop people sending dangerous materials by post, but they should not be determining permissible content of letters.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#313

Post by nl »

marvin-83 wrote: post #312
nl wrote: post #309

Earlier quoted context omitted.

It is inappropriate for organisations like cloudflare to leverage their position within essential network infrastructure to start editorialising what passes through their network. No, I think it's entirely appropriate. "Don't troll" and methods for dealing with trolls has been a thing all sites have done since the internet was invented. I don't see any difference here at all.

the difference is their position in the stack. Cloudflare blocking people that abuse the network is legitimate (e.g. spam, denial-of-service), just like it is legitimate for forum admins to block people that abuse the forum (trolling, explicit posts). But cloudflare, or any other network infrastructure provider, shouldn't be determining permissible content for websites because they are not hosts/administrators for th…

See, I think 8-chan itself is a troll, and it is entirely reasonable to deal with it by refusing to provide service.

It is like a postal service reading your letters and then saying "we don't like what is being said, so you can't send letters anymore." They can and should stop people sending dangerous materials by post, but they should not be determining permissible content of letters.

No it's not. It's like FedEx declining to deliver for a company which continues to cause it problems, or refusing to service Amazon[1]. Or like Visa refusing to service businesses which have lots of charge-backs.

[1] https://www.nytimes.com/2019/06/07/business/fedex-amazon-exp...

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#314

Post by ryacko »

nl wrote: post #313
marvin-83 wrote: post #312

Earlier quoted context omitted.

the difference is their position in the stack. Cloudflare blocking people that abuse the network is legitimate (e.g. spam, denial-of-service), just like it is legitimate for forum admins to block people that abuse the forum (trolling, explicit posts). But cloudflare, or any other network infrastructure provider, shouldn't be determining permissible content for websites because they are not hosts/administrators for th…

See, I think 8-chan itself is a troll, and it is entirely reasonable to deal with it by refusing to provide service. It is like a postal service reading your letters and then saying "we don't like what is being said, so you can't send letters anymore." They can and should stop people sending dangerous materials by post, but they should not be determining permissible content of letters. No it's not. It's like FedEx de…

Actually, it is illegal to mail obscene materials or crime inciting matter through the postal service.

https://www.law.cornell.edu/uscode/text/18/1461

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#315

Post by marvin-83 »

ryacko wrote: post #314
nl wrote: post #313

Earlier quoted context omitted.

See, I think 8-chan itself is a troll, and it is entirely reasonable to deal with it by refusing to provide service. It is like a postal service reading your letters and then saying "we don't like what is being said, so you can't send letters anymore." They can and should stop people sending dangerous materials by post, but they should not be determining permissible content of letters. No it's not. It's like FedEx de…

Actually, it is illegal to mail obscene materials or crime inciting matter through the postal service. https://www.law.cornell.edu/uscode/text/18/1461

yes, but these are investigated and prosecuted by police, public prosecution services, and courts; not by couriers discontinuing their services.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#316

Post by marvin-83 »

nl wrote: post #313
marvin-83 wrote: post #312

Earlier quoted context omitted.

the difference is their position in the stack. Cloudflare blocking people that abuse the network is legitimate (e.g. spam, denial-of-service), just like it is legitimate for forum admins to block people that abuse the forum (trolling, explicit posts). But cloudflare, or any other network infrastructure provider, shouldn't be determining permissible content for websites because they are not hosts/administrators for th…

See, I think 8-chan itself is a troll, and it is entirely reasonable to deal with it by refusing to provide service. It is like a postal service reading your letters and then saying "we don't like what is being said, so you can't send letters anymore." They can and should stop people sending dangerous materials by post, but they should not be determining permissible content of letters. No it's not. It's like FedEx de…

if 8chan was cut off because they were subject to extensive network attacks and cloudflare did not see any profit or value in serving them then I am ok with that. I just don't think that's the reason.

I expect that a different site with the same contract and payment terms, subject to the same attacks would have continued to be protected. maybe I'm wrong but it looked like a political decision, not a business decision.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#317

Post by kfrzcode »

mises wrote: post #100
kfrzcode wrote: post #91

Earlier quoted context omitted.

Nothing stopping you from capturing packets at the router or using tcpdump on your phone. Not convenient but theoretically possible.

Gee, lemme just call up my grandma and teach her how to set up kismet and snort. Seriously though, this is like holding some one liable if his car is stolen and used as a get-away car in a crime. It's also not really possible to get a shell on most of these devices with serious effort, so apart from turning one off, I'm not sure how any one is supposed to mitigate this. They're too locked down to do any kind of disin…

I didn't say it was easy or a solution to the problem. I was adding an additional point of context to a discussion in order to clarify the parent comment, which was insinuating impossibility of said action.

It's not easy, but it's not impossible. I could envision a software based solution that approaches simplicity in installation.

What I'm not arguing, is that someone should be held liable for their devices being used in a botnet.

I believe the manufacturers and retailers have the liability. But I am definitely not a lawyer.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#318

Post by cramforce »

SahAssar wrote: post #297
cramforce wrote: post #289

Earlier quoted context omitted.

The MITM can be avoided by using Signed Exchanges. https://developers.google.com/web/updates/2018/11/signed-exc...

That only works for static content, right?

No, they can be created on the fly. That basically makes it a TLS signing Oracle.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#319

Post by MaxBarraclough »

inimino wrote: post #219
MaxBarraclough wrote: post #203

Earlier quoted context omitted.

> That's not a tautology. In fact, it's actually worth pointing out, especially to junior engineers who get frustrated by how hard everything is, that it actually doesn't need to be that hard if you, well, do it right But this boils down to If you build systems using a high level of skill and foresight, it's easy to do . This is of course not a tautology, but a contradiction. I agree that inexperienced developers can…

> But this boils down to If you build systems using a high level of skill and foresight, it's easy to do. Yes. > This is of course not a tautology, but a contradiction. It's not quite a contradiction! If you bill $1 for changing the bolt, and $9,999 for knowing which bolt to replace, this shows that the work is easy, but the experience required to make the work easy is not easy. If the master can draw it in seven str…

> If you bill $1 for changing the bolt, and $9,999 for knowing which bolt to replace, this shows that the work is easy, but the experience required to make the work easy is not easy. If the master can draw it in seven strokes, but you don't see the seventy thousand strokes they did before, it looks easy, and in fact it is easy, for the master but not for the novice.

If it takes years to be able to do it well, it's not easy.

> So we keep using it, and even keep piling more on. It takes considerable effort to step back from all this, take a collective mulligan, and start over with a principle of taking things away to make things better, rather than adding more hacks to hide existing hacks.

True, but it can be done. The community moved away from Bower, for instance.

Re: Malicious attack on Wikipedia – what we know and what we’re doing

#320

Post by inimino »

MaxBarraclough wrote: post #319
inimino wrote: post #219

Earlier quoted context omitted.

> But this boils down to If you build systems using a high level of skill and foresight, it's easy to do. Yes. > This is of course not a tautology, but a contradiction. It's not quite a contradiction! If you bill $1 for changing the bolt, and $9,999 for knowing which bolt to replace, this shows that the work is easy, but the experience required to make the work easy is not easy. If the master can draw it in seven str…

> If you bill $1 for changing the bolt, and $9,999 for knowing which bolt to replace, this shows that the work is easy, but the experience required to make the work easy is not easy. If the master can draw it in seven strokes, but you don't see the seventy thousand strokes they did before, it looks easy, and in fact it is easy, for the master but not for the novice. If it takes years to be able to do it well, it's no…

Watch the master attack an intermediate problem. They "make it look easy" because it is easy for them because they have been doing it for so many years they have forgotten that it was ever not easy. This is the real curse of knowledge.

> Bower

Yes, finally! In another 40 years most of the trash we're creating now will also be gone, probably replaced by more unless we find some discipline.

Post reply on HN