Live data from Hacker News

Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

washingtonpost.com

41–50 of 257 posts

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#41
post #35

This is a complete side point, but what does this sentence mean? > Created in 2015, the DDS operates a Silicon Valley-like office within the Pentagon.

Open office plan, ping pong and bean bag chairs. Slogans on the walls. Sit stand desks. Lots of h1b workers. Have you never silicon valley’d?

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#42
post #35

This is a complete side point, but what does this sentence mean? > Created in 2015, the DDS operates a Silicon Valley-like office within the Pentagon.

DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs for a 2 year tour of duty fixing pressing issues in DoD tech via pretty broad authority to sidestep

A) the usual senior military slow-roll* in the way of these fixes

B) the sh**y govt contractors who made the tech and usually get paid to fix their own bad tech.

DDS Hires a lot of motivated engineers who would be in civil service but for the $180k -> $90k paycuts and fear of bureaucratic hell. It is run by one of the ~founders of opentable who, post opentable riches, was flying on 9/11/01, decided to join the Chicago PD as a result, did west Chicago homicide until the PD discovered his past, he then stood up Chicago’s data-based policing technical approaches, and eventually the Obama admin heads about him asked him to take over DDS (iirc, +/- details there).

Cool stuff and I’d work for them in a second, probably need another few years in private sector though.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#43
post #14

Earlier quoted context omitted.

Ohh, I think I see. So instead of (or in addition to) creating internal subnets inside 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, they set up subsets inside DoD's 11.0.0.0/8 etc., and it worked out because there were no external BGP announcements for those ranges. But now that there are, if they did not explicitly configure their border gateways to route those ranges inside their networks, the traffic may now lea…

Maybe DoD is trying to catch security flaws caused by traffic intended for their own internal networks accidentally reaching the public internet? Advertising those IPs publicly and logging all traffic could be a good way of detecting such bugs in DoD systems.

It also explains the lack of public commentary.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#44
post #16

Earlier quoted context omitted.

Why would you do that though when there are perfectly fine internal address ranges available?

Two things that come to mind are running out of private address space (a /8 isn't that large), or wanting address space that doesn't clash with other private networks (e.g. to ensure a VPN doesn't overlap with home networks). There's probably more reasons.

> running out of private address space

Classic merger "solution".

Company A uses 10/8 Company B uses 10/8, company A buys company B and orders new subsidiary B to renumber into 11/8 "All you have to do is change every first octet to 11"

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#45
post #36

Earlier quoted context omitted.

Thanks a lot, Appreciate. It is not I don't want to pay the washingtonpost.com. I just don't have time to read them.

I've tried subscribing to a few news sources, including WaPo, but I can't handle the political agendas (right, left, or any of it). I've had better luck with subscription based aggregators, but nothing exciting enough to want to plug one in particular. Always looking for new options to try.

Yeah all the news sources my parents sub’d to in the early 00s and I sort of figured I’d sub to as well once ready are aggravatingly narrative driven. I’m not sure if I never noticed that, or if it’s a new media approach, but I don’t need “baseball + narrative injection” articles in my life. I’m actually fairly bummed out about this, I go to Reuters now.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#46
post #7

"several Chinese companies use network numbering systems that resemble the U.S. military’s IP addresses in their internal systems" I don't think I've heard of this before. What does it mean? Does China operate a disconnected BGP network? Or do they have some modified protocol, or what?

Lots of less clueful network operators worldwide have used the DoD /8 IP blocks internally, under the impression that they'll never show up in the global v4 routing table, essentially for the same purposes that people would use the 10/8 RFC1918 blocks.

Some of those less-cluefull operators include Juniper and Azure[1], Cisco[2][3], and probably many other companies. When Cloudflare put its 1.1.1.1 DNS server into use, it started receiving huge amounts of packets destined to unroutable addresses because the 1.0.0.0/8 space was (mostly?) unused.

If you configure your routers correctly, none of these IP addresses should resolve, anyway. If something in your network is intentionally dialing the department of defence, you probably have some kind of problem at hand. In theory this might become a huge problem, but in practice it probably won't.

[1]: https://www.juniper.net/documentation/en_US/vmx/information-...

[2]: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2017/pdf...

[3]: https://security.stackexchange.com/questions/157682/why-does...

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#47
post #35

This is a complete side point, but what does this sentence mean? > Created in 2015, the DDS operates a Silicon Valley-like office within the Pentagon.

More money, I assume. The government does not want to raise all programmers’ pay, so instead of adjusting the pay schedules that apply to everyone, they make a special group that the normal pay schedules don’t apply to.

I wonder if it came about because how much of a dumpster fire the first version of healthcare.gov was for the premier of the Affordable Care Act. That probably embarrassed a lot of people.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#48
post #35

This is a complete side point, but what does this sentence mean? > Created in 2015, the DDS operates a Silicon Valley-like office within the Pentagon.

DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs for a 2 year tour of duty fixing pressing issues in DoD tech via pretty broad authority to sidestep A) the usual senior military slow-roll* in the way of these fixes B) the sh**y govt contractors who made the tech and usually get paid to fix their own bad tech. DDS Hires a lot of motivated engineers who would be in civil service…

I don't know Brett super well so I can't speak to the rest of his background, but it's not correct that the Obama admin asked him to take over DDS.

DDS's founding head was Chris Lynch, who served in that role until the middle of the Trump administration, when he left government service and that's when Brett got the job.

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#49
post #35

This is a complete side point, but what does this sentence mean? > Created in 2015, the DDS operates a Silicon Valley-like office within the Pentagon.

DDS hires professional engineers at a special paygrade pegged to their civilian pay stubs for a 2 year tour of duty fixing pressing issues in DoD tech via pretty broad authority to sidestep A) the usual senior military slow-roll* in the way of these fixes B) the sh**y govt contractors who made the tech and usually get paid to fix their own bad tech. DDS Hires a lot of motivated engineers who would be in civil service…

This is quite interesting — glad I asked!

Re: Millions of the Pentagon’s dormant IP addresses sprang to life on January 20

#50
post #44

Earlier quoted context omitted.

Two things that come to mind are running out of private address space (a /8 isn't that large), or wanting address space that doesn't clash with other private networks (e.g. to ensure a VPN doesn't overlap with home networks). There's probably more reasons.

> running out of private address space Classic merger "solution". Company A uses 10/8 Company B uses 10/8, company A buys company B and orders new subsidiary B to renumber into 11/8 "All you have to do is change every first octet to 11"

or, you know, use NAT to do so :)
Post reply on HN