Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet Archive: Security breach alert

theverge.com

Post reply on HN
Print view View original

601–610 of 648 posts

Re: Internet Archive: Security breach alert

#601

Post by fwip »

max-throat wrote: post #560
999900000999 wrote: post #93

A pulled an old friends website down from Internet Archive. He's moved on the next stage, but I was glad I was able to put his site back up. It'll be a shame if IA goes down permanently, but we need a decentralized solution anyway. Having a single mega organization in charge of our collective heritage isn't a good idea.

This is why BitTorrent and other P2P solutions were invented, but alas: A. The RIAA, MPAA, and ESA have given these technologies a terrible reputation. B. Nobody likes to seed. Some kind of seeding-based crypto would have been a great incentive if cryptocurrency wasn't also demonized by now.

Part of the reason people don't/didn't like seeding is that many residential lines are so terribly asymmetric. If you had 100down/5up, seeding your torrent at a useful speed was often enough to degrade your connection into unusability.

Re: Internet Archive: Security breach alert

#602

Post by mkl »

markgoho wrote: post #562
mkl wrote: post #385

Earlier quoted context omitted.

Yes, without exception. I want to know who is leaking/selling my address, and usually stop doing business with those who do. It also makes filtering really easy. People sometimes have strange reactions when I verbally give them an email address with their company name in it, especially when I'm a new customer. All you need is a domain and an email provider that allows catch-all addresses, both of which are easy and c…

is each address truly unique or are you doing something like username+archive@gmail.com, username+facebook@gmail.com, etc.

It's a separate address that can have its own mailbox if need be, but unless you want to keep meticulous records on the go, and refer to them constantly, some sort of pattern is required.

Re: Internet Archive: Security breach alert

#603

Post by meindnoch »

acaiblue44 wrote: post #307
codemac wrote: post #170

Earlier quoted context omitted.

> How long does an average hard drive last? This is a great question, and a state of the art kind of thing. HDDs are sold with a lifetime drive read/write amount and power cycle warranty, along with usually some environmental operating envelope. read/write relates to the quality/space of the platter, power cycle is usually the actuator & read/write head being reseated/wearing out. Environment is the same as all other…

I'm a new user, is this a good time to plug my project that hopes to put 200 GB on a piece of paper? https://sourceforge.net/u/acaiblue44/blog/2024/09/gigapaper0...

What the fuck am I reading?

Re: Internet Archive: Security breach alert

#604

Post by [deleted] »

seanvelasco wrote: post #577
aa-jv wrote: post #501

Earlier quoted context omitted.

There is a lot of embarassing pro-Zionist material archived on IA, but scrubbed elsewhere from the Internet: https://www.google.com/search?client=safari&rls=en&q=zionist... So just to play devils advocate, since Zionism is being critically received all across the Internet - it is more likely that IA was attacked in order to censor those materials, and then a sockpuppet was created to shift the blame to pro-palestinia…

i hate how Zionism has become a bad word, like it's some world domination conspiracy theory. as a Zionist myself, it's not at all likely that IA was attacked to take down Zionist-related material as these material are neither embarrassing nor damaging to Israel. on the contrary, I would like for them to stay up and be archived for all eternity. what is more likely is that these pro-Palestinian hacktivists are once mo…

[deleted]

Re: Internet Archive: Security breach alert

#605

Post by klibertp »

acaiblue44 wrote: post #571
mdaniel wrote: post #539

Earlier quoted context omitted.

> I learned that I can't use file i/o in a function outside the main, which is an unspoken rule that no tutorial elucidated. is for sure not true, that would be crazypants

I tried for 6 weeks. Eventually, it just stops functioning. The same program and arguments spits out "segmentation fault" 33% of the time I run it, with the other 67% working perfectly. The only way I could explain it was that it was in a function outside the main, because when I put the exact same code in the main, compiled and ran, it worked. I have no other explanation. At some point, having too many nested loops…

Why would you try to do this in C of all languages? It's one of the worst choices, especially for a self-learner and a beginner like you. Consider: choosing another language could, on its own, 100% eliminate any possibility of getting a segfault! With just that, you'd be spared from having to produce an abomination of many thousands of loc inside a single function, which is never (unless you're Donald Knuth) a good programing practice.

Re: Internet Archive: Security breach alert

#606

Post by everforward »

Aachen wrote: post #190
everforward wrote: post #153

Earlier quoted context omitted.

I actually find that fairly tame. For a point of comparison, Wikipedia gets ~$150M in revenue a year, an "asset rise" (I presume this is what non-profits call profit?) of ~$15M a year, and is sitting on about a quarter billion in the bank. Not that they want to, but I think Wikipedia could fund this using their current donations if they wanted. Hell, I almost wonder if one of the big storage providers would do it for…

You're right, I guess it is tame and achievable so far as organisations go. I was imagining trying to get some friends together to have a decent percentage of the IA backed up, but that seems out of reach based on this napkin math. Not that that is necessarily demotivating, but it's going to depend on a lot of people intuitively seeing the value and keeping up their share

Yeah, as a sort of pet project I don’t think backing up the whole thing is possible.

You might be able to back up a significant portion of the unique data in IA if you limited it to text files. I think they probably have the highest information to file size ratio.

It’s also probably the most likely to already be back up, though. Interesting issue; you might also get somewhere by cutting the 50TB up into 10GB torrents (or 100GB or whatever, something reasonable for a consumer hard drive) and maybe adding a script that checks the torrent swarm stats to recommend a torrent to download.

Something where I run it, tell it I want to let it use 600GB, and it hands me torrent files for the least seeded 600GB. Maybe a super basic web UI so people can see how well backed up it is?

Unsure if people would sign on or not; I probably would. I’ve got 10 or so TB of NFS I’m not using I could chuck at it. I would guess there are other data hoarders out there who would do the same, but only if it were somewhat easy. I’m probably not going to volunteer to do an hour of rtorrent cleanup a week to make sure I’m backing up the right things.

Re: Internet Archive: Security breach alert

#607

Post by Jach »

bjourne wrote: post #464
EasyMark wrote: post #381

They use bcrypt and I always use a really long password so I’m not gonna freak out over this one for once.

Are bcrypt password hashes difficult to crack? I signed up for IA over 10 years ago with a much weaker password than those I use today.

Besides being slow, there's also an implicit salt, so rainbow tables to quickly check every account for "password" don't exist. Still, if you just used a simple dictionary word present in e.g. /usr/share/dict/words (my system has 234,937 entries), you don't have as much time. I have a Ryzen 9 5900X, 12 cores; using a random Go implementation of bcrypt I found with default work factor of 10 and going through that dictionary with 24 threads, it takes my machine about 18 minutes to get through every entry. A thousand years if I wanted to go through 31 million accounts and each one was a worst-case at-the-end value. But there are quite a few more than a thousand of my CPU or better out there, some surely part of botnets which routinely number in the thousands of devices, and probably faster bcrypt implementations. Earlier this year, the FBI dismantled a botnet with 19 million infected devices globally and over 600,000 US IP addresses. Surely some of those were weak IoT devices, but still, there's a lot of compute available to bad actors such that you shouldn't necessarily rely on bcrypt et al. to protect a very weak password. (They are rather good at protecting normally weak and mid passwords, though, and there's opportunity cost for all that compute.)

Re: Internet Archive: Security breach alert

#608

Post by Jach »

nicce wrote: post #507
bjourne wrote: post #464

Earlier quoted context omitted.

Are bcrypt password hashes difficult to crack? I signed up for IA over 10 years ago with a much weaker password than those I use today.

If you don't reuse that password anymore, does it matter tho. Some services might use older hashing for older passwords without updating the hash algorithm. But I don't know what is the case here. brypt passwords are very slow to crack.

I would hope that a system competent enough to migrate to bcrypt would also be competent enough to rehash the entire database as well. Logins check bcrypt(oldHash(pw)); if it matters they can be updated to bcrypt(pw). Of course, "Hope is not a strategy".

Re: Internet Archive: Security breach alert

#609

Post by numpad0 »

acaiblue44 wrote: post #571
mdaniel wrote: post #539

Earlier quoted context omitted.

> I learned that I can't use file i/o in a function outside the main, which is an unspoken rule that no tutorial elucidated. is for sure not true, that would be crazypants

I tried for 6 weeks. Eventually, it just stops functioning. The same program and arguments spits out "segmentation fault" 33% of the time I run it, with the other 67% working perfectly. The only way I could explain it was that it was in a function outside the main, because when I put the exact same code in the main, compiled and ran, it worked. I have no other explanation. At some point, having too many nested loops…

Python is slower but easier, and less likely to segfault out of blue! You don't even have to have a main() loop. If you just have an idea worth demoing quick, I'd recommend switching to Python 3.

Re: Internet Archive: Security breach alert

#610

Post by firen777 »

Considering the hacker's motive: https://x.com/Sn_darkmeta/status/1844358501952618976

Is it safe to assume the hacker want to erase the evidence?

Forcing the service offline also means they want to prevent people from archiving evidence in the next how-ever-long hours. Combining with the spoken language they used in that video, are they planning some online disinformation campaign?

----

Edit: some more info about this group: https://old.reddit.com/r/technology/comments/1g0kupb/hacktiv...

----

This group claims to be pro palestinian and it's entirely based on Russia.

[https://therecord.media/middle-east-financial-institution-6-...

>SN\_BLACKMETA has operated its Telegram channel since November 2023, boasting of DDoS incidents and cyberattacks on infrastructure in Israel, the Palestinian Territories and elsewhere. While all of the group’s messages focus on the Palestinian Territories and perceived opponents to Palestine, many of its posts are written in Russian.

>The group’s account on X also shows that it was created by someone in Staraya, a town in Novgorod Oblast, Russia. The account’s initial language was also set to Russian.

>The researchers added that analysis of timestamps and activity patterns showed possible evidence that the actors within the group are operating in a timezone “close to Moscow Standard Time (MSK, UTC+3) or other Middle Eastern or Eastern European time zones (UTC+2 to UTC+4).”

~~Attacks include pro palestine sites and groups, so~~ take that "pro palestine" with a grain of salt.

EDIT: edited for clarity on what is actually in the article and not in outside anonymous sources. If you want to read more, [there's a clearer report on one of their attacks and their usual targets.](https://www.radware.com/security/threat-advisories-and-attac...)

Post reply on HN