Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

321–330 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#321
post #252
post #8

I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.

Isn't that what net neutrality is all about?

That's the joke

Re: AT&T updates firmware to block access to 1.1.1.1

#322

Earlier quoted context omitted.

So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.

"Never attribute to malice that which is adequately explained by stupidity"

Hanlon's razor is dangerous. "Playing stupid" and its adult cousin "plausible deniability" trivially exploit the razor under adversarial conditions.

That said, we agree on the probable cause of this particular issue.

Re: AT&T updates firmware to block access to 1.1.1.1

#323

Earlier quoted context omitted.

So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.

They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.

Except that it wasn't classified as a private IP address. They should've use something like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.

The 1.0.0.0/8 range was owned by IANA from _1981_ up until 2010, when it was transfered to APNIC. (The 2.0.0.0/8 range was also owned by IANA until 2010, thentransfered to RIPE NCC).

If you want to get technical, use of the space could be construed as theft.

As for the continuity issue, it was stated that it was an old device, so they have no responsibility to continue supporting it, and considering the age of the device in question, it may not be able to connect to the existing network.

Re: AT&T updates firmware to block access to 1.1.1.1

#324
post #118

Earlier quoted context omitted.

https://blog.cloudflare.com/dns-resolver-1-1-1-1/ > For IPv6, we have chosen 2606:4700:4700::1111 and 2606:4700:4700::1001 for our service. It’s not as easy to get cool IPv6 addresses; however, we’ve picked an address that only uses digits. For me up in Canada, ping 1.1.1.1 works. But ping6 2606:4700:4700::1111 ping6 2606:4700:4700::1001 shows "connect: Network is unreachable". Am I using ping6 wrong? We also need to…

> Am I using ping6 wrong? I'm pretty sure the other end has to be running `pingd` to get a response from ping. Some do, some don't. I might be wrong but that's always been my understanding.

You are definitely wrong. No daemons have to be running, ping operates using standard ICMP echo messages that are a part of any complete IP stack. Any meaningful OS will respond to pings unless prevented from receiving them by a firewall. It wouldn't surprise me to find that some embedded implementations skip that part for size reasons, but even in that category most devices I have available to me still respond. It's a basic network connectivity diagnostic tool.

What is unfortunately common though is people blocking ICMP at their firewall, either at the host level itself or further upstream. Sometimes they just block echo requests, but often they block ICMP entirely which breaks things in very weird ways from time to time.

Blocking ICMP in any way is generally to be considered harmful. It's not 1997 anymore, the "ping of death" is not a thing on any OS you should actually be connecting to the internet.

Re: AT&T updates firmware to block access to 1.1.1.1

#325

Earlier quoted context omitted.

So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.

They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.

> They used an IP that was originally reserved for what reserved IP's are used for.

I'm eagerly awaiting your evidence for this statement, which to my knowledge is entirely incorrect.

So far's I know, existing uses of 1.1.1.1 have almost universally been illegitimate (e.g. captive portals, internal-ish services, …)

Re: AT&T updates firmware to block access to 1.1.1.1

#326
post #8

I wonder if anyone has considered some sort of legislation whereby internet service providers are not allowed to block or disrupt service to certain parts of the internet in order to promote their own business model.

Then take your business elsewhere. There are options.

Re: AT&T updates firmware to block access to 1.1.1.1

#327

Earlier quoted context omitted.

They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.

It was not ever a reserved IP address in the proper sense. They should have used something from RFC1918.

Any sane gateway would block any access to anything from RFC1918, and using a private IP address for a public service is a bad idea in general.

Re: AT&T updates firmware to block access to 1.1.1.1

#328

Earlier quoted context omitted.

It was not ever a reserved IP address in the proper sense. They should have used something from RFC1918.

Any sane gateway would block any access to anything from RFC1918, and using a private IP address for a public service is a bad idea in general.

Fair enough, if it was traversing public (non-ATT) networks without a tunnel.

Re: AT&T updates firmware to block access to 1.1.1.1

#329

Earlier quoted context omitted.

What kind of demented person uses 1.1.1.1, a routable public address since 2010, for internal addresses. What's wrong with 10.0.0.0/8 or 192.168/16?

I'm gonna guess they valued the aesthetics over the problems / conditions.

10.10.10.10?

Re: AT&T updates firmware to block access to 1.1.1.1

#330

Earlier quoted context omitted.

It's either malicious or a major fuck up. Either way it's worth shouting about.

It's the latter. Here is the CEO of Cloudflare tweeting about it: https://twitter.com/eastdakota/status/991718955021623296 D

Where do you see that this was a mistake? That tweet thread doesn't have anything definitive on it.
Post reply on HN