6 ms·

Are DDoS attacks really a problem for journalists getting out information to the public, or are they more so just a problem for journalists who want to distribu

by runeks 10y ago

Are DDoS attacks really a problem for journalists getting out information to the public, or are they more so just a problem for journalists who want to distribute content via their own website? Wanting to run a website is reasonable, as it enables journalists to make money on ads as well, but does the inability to run your own website truly hamper free speech? This seems more like an architecture problem to me, not with regards to the Internet, but with regards to how articles are distributed: by contacting a server who responds with the article. If I really wanted to get some information out, I would upload it to: Google Drive, Dropbox, Amazon S3 and any other free/cheap hosting service I know, and spread the links out on Twitter, Facebook, HN, Reddit, etc. Would it really be possible for any attacker to take down all these services, thus preventing the information from getting out? Or is this more about distributing articles via a web app?

wmf 10y ago
To be protected against DDoS it sounds like you need to be hosted by Google, CloudFlare, or Akamai. Yet these companies are so influential and critical to the Internet that journalists need to feel that they are free to criticize them. AFAIK Google Drive, Dropbox, Amazon S3 etc. will drop you in a second with a "we're not getting paid enough to deal with this" error message if you bring a DDoS down on them.
- pjscott 10y ago
  CloudFlare is saying all the right things in this relevant blog post: https://blog.cloudflare.com/cloudflare-and-free-speech/ https://blog.cloudflare.com/cloudflare-and-free-speech/ I'm fairly optimistic that they mean it -- and that if they don't, playing censor would be way more trouble for them than it could ever be worth.
- eastdakota 10y ago
  This is such an important point. And it is exactly why, when we launched Project Galileo, CloudFlare's initiative to protect politically or artistically important work online, we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it, for free and no questions asked. https://www.cloudflare.com/galileo/ https://www.cloudflare.com/galileo/ We offered to protect Brian's site under Galileo for free. Had he taken us up on our offer, which remains open, I would hope he would continue to be as critical of CloudFlare as he always has been. And I hope we've established some credibility in not abusing the position of trust we occupy. For instance, when we protected Spamhaus from a large DDoS attack years ago we specifically made it clear we'd never ask them to treat us any differently than any other organization they monitor. And we haven't. And, to this day, Spamhaus remains one of our biggest critics. And they remain a CloudFlare customer. Here's a talk I gave last year at Blackhat about the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers: https://youtu.be/V-Pj0lrr168 https://youtu.be/V-Pj0lrr168 It's something we worry about all the time and I'm glad more people are beginning to discuss the risks it poses.
  - fdsaaf 10y ago
    Does Project Galileo cover political expression you consider problematic though? It's easy to support free speech with which you agree. The real test is whether you support it when it's reprehensible
    - thaumasiotes 10y ago
      This is kind of an oblivious response to > we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it which is in the first paragraph of the comment you're "responding" to.
    - eastdakota 10y ago
      Yes. There are lots of things that I personally believe are incredibly abhorrent that use our network. I'm not proud of them, but I am proud that we don't censor them.
      - kyledrake 10y ago
        It seems to me that a vast majority of the for-profit DDoS attack sites (https://www.google.com/#q=ddos+booter https://www.google.com/#q=ddos+booter) use Cloudflare to protect the component of their operations that take the payments to attack people like Brian Krebs, including the one he wrote about that triggered this entire thing (http://krebsonsecurity.com/tag/cloudflare/ http://krebsonsecurity.com/tag/cloudflare/). Forget "state sponsored actors", people executing these attacks are just as likely teenagers with a spare $20 that can use these DDoS attack services to execute a serious DDoS attack in minutes, just for the hell of it. The point Brian is trying to make in this article is that DDoS attackers have become the true censors of the web. By protecting their ability to profit from DDoS attacks, are you protecting their "free speech rights", or are you instead protecting the real censors of consequence here? I know you take action on malware and phishing attacks being propagated from your service. A lot of us out here in the NOC world struggling to keep the internet running (and now starting to fail at it) would really appreciate it if you added "DDoS attack sites" to that list.
- thaumasiotes 10y ago
  Judging by the earlier HN commentary, Krebs was hosted by Akamai.
- bcook 10y ago
  Is it common for the hosting company to know which client is being targetted by the DDoS?
ohthehugemanate 10y ago
The decentralized nature of the web is critical to it's power for free speech. The whole point is that you shouldn't have to be dependent on a handful of media giants in order to publish.
- runeks 10y ago
  I'm not saying free speech isn't important, I'm only saying that perhaps it's not reasonable to expect that distributing information, that is highly damaging to certain parties, can be done free of charge. The web exponentially decreases the cost of distributing information, but can we reasonably expect it to be zero, always, for any type of information? Historically, free speech has meant that you can say whatever you want without fear of violence. It has never been synonymous with the right to have your opinions made available to everyone, free of charge. I think free speech is immensely important, which is why I think it we shouldn't confuse it with the ability to cheaply serve damaging information from a website with 100% uptime.
  - AnthonyMouse 10y ago
    The only way to make it not-free in a way that isn't censorship is to make it equally not-free for all information. Otherwise it's a content-based restriction, i.e. censorship. > Historically, free speech has meant that you can say whatever you want without fear of violence. That is untrue. For example, the government can't tax Democratic magazines and not Republican magazines (or vice versa).
CaptSpify 10y ago
This is really where I think p2p things like torrents can be a big help. There are obvious drawbacks such as verifying your getting the original version, for example. But if we give up the idea that the creator's website should be the gateway to that information, we have the methods to work around ddos attacks.
- runeks 10y ago
  A torrent with one million public keys of the most prominent journalists wouldn't be big (32 MB if we use Ed25519), and would allow them to host their content from torrents with few seeders, without fear of being over-crowded by malicious nodes with wrong data. Of course, we'd have to make sure that this particular public key-torrent is not taken over either, but it's a lot easier to secure a single torrent than to secure the torrents containing all articles of all journalists. krebsonsecurity.com basically works as Brian Krebs' public key: any information you get from that domain via HTTPS is considered signed by Brian Krebs. But it constitutes a fairly crude PKI system, where the public key is tied to a domain that simultaneously has the job of distributing the signed information. The solution requires a separation of public key and information distribution: information must not be tied to a location, and the location of the public key should differ from that of the signed information. All in all, I would say that (D)DoS is a problem of the transport protocol, not of the internet. Distributing information of high negative value to certain parties requires a different protocol than serving cat pictures does, which is why the BitTorrent protocol appeared in the first place: to counter the takedown of information (copyrighted content) whose publication is deemed of negative value to certain parties (copyright holders).
  - mynameislegion 10y ago
    krebsonsecurity.com doesn't use Brian Krebs' public key, it uses Google's public key (and before that, Akamai).

by runeks 10y ago

wmf 10y ago

To be protected against DDoS it sounds like you need to be hosted by Google, CloudFlare, or Akamai. Yet these companies are so influential and critical to the Internet that journalists need to feel that they are free to criticize them. AFAIK Google Drive, Dropbox, Amazon S3 etc. will drop you in a second with a "we're not getting paid enough to deal with this" error message if you bring a DDoS down on them.

pjscott 10y ago
CloudFlare is saying all the right things in this relevant blog post: https://blog.cloudflare.com/cloudflare-and-free-speech/ https://blog.cloudflare.com/cloudflare-and-free-speech/ I'm fairly optimistic that they mean it -- and that if they don't, playing censor would be way more trouble for them than it could ever be worth.
eastdakota 10y ago
This is such an important point. And it is exactly why, when we launched Project Galileo, CloudFlare's initiative to protect politically or artistically important work online, we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it, for free and no questions asked. https://www.cloudflare.com/galileo/ https://www.cloudflare.com/galileo/ We offered to protect Brian's site under Galileo for free. Had he taken us up on our offer, which remains open, I would hope he would continue to be as critical of CloudFlare as he always has been. And I hope we've established some credibility in not abusing the position of trust we occupy. For instance, when we protected Spamhaus from a large DDoS attack years ago we specifically made it clear we'd never ask them to treat us any differently than any other organization they monitor. And we haven't. And, to this day, Spamhaus remains one of our biggest critics. And they remain a CloudFlare customer. Here's a talk I gave last year at Blackhat about the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers: https://youtu.be/V-Pj0lrr168 https://youtu.be/V-Pj0lrr168 It's something we worry about all the time and I'm glad more people are beginning to discuss the risks it poses.
- fdsaaf 10y ago
  Does Project Galileo cover political expression you consider problematic though? It's easy to support free speech with which you agree. The real test is whether you support it when it's reprehensible
  - thaumasiotes 10y ago
    This is kind of an oblivious response to > we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it which is in the first paragraph of the comment you're "responding" to.
  - eastdakota 10y ago
    Yes. There are lots of things that I personally believe are incredibly abhorrent that use our network. I'm not proud of them, but I am proud that we don't censor them.
    - kyledrake 10y ago
      It seems to me that a vast majority of the for-profit DDoS attack sites (https://www.google.com/#q=ddos+booter https://www.google.com/#q=ddos+booter) use Cloudflare to protect the component of their operations that take the payments to attack people like Brian Krebs, including the one he wrote about that triggered this entire thing (http://krebsonsecurity.com/tag/cloudflare/ http://krebsonsecurity.com/tag/cloudflare/). Forget "state sponsored actors", people executing these attacks are just as likely teenagers with a spare $20 that can use these DDoS attack services to execute a serious DDoS attack in minutes, just for the hell of it. The point Brian is trying to make in this article is that DDoS attackers have become the true censors of the web. By protecting their ability to profit from DDoS attacks, are you protecting their "free speech rights", or are you instead protecting the real censors of consequence here? I know you take action on malware and phishing attacks being propagated from your service. A lot of us out here in the NOC world struggling to keep the internet running (and now starting to fail at it) would really appreciate it if you added "DDoS attack sites" to that list.
thaumasiotes 10y ago
Judging by the earlier HN commentary, Krebs was hosted by Akamai.
bcook 10y ago
Is it common for the hosting company to know which client is being targetted by the DDoS?

ohthehugemanate 10y ago

The decentralized nature of the web is critical to it's power for free speech. The whole point is that you shouldn't have to be dependent on a handful of media giants in order to publish.

runeks 10y ago
I'm not saying free speech isn't important, I'm only saying that perhaps it's not reasonable to expect that distributing information, that is highly damaging to certain parties, can be done free of charge. The web exponentially decreases the cost of distributing information, but can we reasonably expect it to be zero, always, for any type of information? Historically, free speech has meant that you can say whatever you want without fear of violence. It has never been synonymous with the right to have your opinions made available to everyone, free of charge. I think free speech is immensely important, which is why I think it we shouldn't confuse it with the ability to cheaply serve damaging information from a website with 100% uptime.
- AnthonyMouse 10y ago
  The only way to make it not-free in a way that isn't censorship is to make it equally not-free for all information. Otherwise it's a content-based restriction, i.e. censorship. > Historically, free speech has meant that you can say whatever you want without fear of violence. That is untrue. For example, the government can't tax Democratic magazines and not Republican magazines (or vice versa).

CaptSpify 10y ago

This is really where I think p2p things like torrents can be a big help. There are obvious drawbacks such as verifying your getting the original version, for example. But if we give up the idea that the creator's website should be the gateway to that information, we have the methods to work around ddos attacks.

runeks 10y ago
A torrent with one million public keys of the most prominent journalists wouldn't be big (32 MB if we use Ed25519), and would allow them to host their content from torrents with few seeders, without fear of being over-crowded by malicious nodes with wrong data. Of course, we'd have to make sure that this particular public key-torrent is not taken over either, but it's a lot easier to secure a single torrent than to secure the torrents containing all articles of all journalists. krebsonsecurity.com basically works as Brian Krebs' public key: any information you get from that domain via HTTPS is considered signed by Brian Krebs. But it constitutes a fairly crude PKI system, where the public key is tied to a domain that simultaneously has the job of distributing the signed information. The solution requires a separation of public key and information distribution: information must not be tied to a location, and the location of the public key should differ from that of the signed information. All in all, I would say that (D)DoS is a problem of the transport protocol, not of the internet. Distributing information of high negative value to certain parties requires a different protocol than serving cat pictures does, which is why the BitTorrent protocol appeared in the first place: to counter the takedown of information (copyrighted content) whose publication is deemed of negative value to certain parties (copyright holders).
- mynameislegion 10y ago
  krebsonsecurity.com doesn't use Brian Krebs' public key, it uses Google's public key (and before that, Akamai).