22 ms·
Project Shield
- Fuzzwah 10y agoLink to the actual project's page: https://projectshield.withgoogle.com/public/ https://projectshield.withgoogle.com/public/
- Fuzzwah 10y agoPost from Brian Krebs about Google using Shield to get Krebs on Security back up and running: https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...
- willvarfar 10y agoI follow your link https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c... and I get this: 503 Service Temporarily Unavailable shield So it seems to be running shield, but at least part of the attacks are still getting through? :( Would be very nice to know what kind of attacks Shield doesn't shield against etc.
- the_duke 10y agoWorks fine for me.
- deleted 10y ago[deleted]
- headmelted 10y agoCompletely down from here too. I may need to retract my comments about Akamai. Apparently 680gbps (or whatever it's at now) is the total amount of traffic the busiest site on the internet can be hosed with before the internet itself poops the bed. So, you know, we did learn something from this whole saga.
- headmelted 10y agoUpdate: Back up now.
- nolok 10y agoOVH got hit by a bigger than 1Tbps attack this week
- headmelted 10y agoDid they? I saw them report a cannon with 1.5tbps capacity (based on multiple sources), wasn't clear they were getting hit by that load though (it looked like 991gbps from what I could gather, which still I didn't know of and is mind-blowing!)
- Something1234 10y agoDo you have source and is it possible you know what's so magical about that number?
- deleted 10y ago[deleted]
- lostsock 10y ago"It may take another 24h for my site to come up everywhere. meantime, you could try flushing your DNS cache https://www.whatsmydns.net/flush-dns.html https://www.whatsmydns.net/flush-dns.html " https://twitter.com/briankrebs/status/780018241401974784?lang=en https://twitter.com/briankrebs/status/780018241401974784?lan... I flushed my DNS and it didn't work, then I just hardcoded 130.211.45.45 krebsonsecurity.com in my hosts file and it is working fine.
- wernerb 10y agoI guess this is where KrebsOnSecurity went to when moving to google cloud? [0] [0] https://news.ycombinator.com/item?id=12574428 https://news.ycombinator.com/item?id=12574428
- yalogin 10y agoIs this a competitor to cloudflare?
- willvarfar 10y ago> Project Shield is a free service that uses Google technology to protect news sites and free expression from DDoS attacks on the web. So CloudFlare is a service you pay for, and they seem to be hosting every despicable backwater of the internet so presumably they take no stance of the 'goodness' of the site they protect. Whereas Shield is a free service, but only extended to those who Google deem righteous enough to protect? I think there's room for both. There could also be room for Google extending it to a paying service, although I'd be surprised if Google would take the brand risk of extending their protection to porn sites etc irregardless of fees. And of course every time Google stand up and protect sites like KrebsOnSecurity for free, the tech world loves them that little bit more and its a massive PR opportunity miss for CloudFlare. Of course, every time Google stand up and protect sites like KrebsOnSecurity for free, its a massive PR loss for Akamai who wouldn't/couldn't.
- Usu 10y agoOnly to CloudFlare Project Galileo: https://www.cloudflare.com/galileo/ https://www.cloudflare.com/galileo/
- jpalomaki 10y agoOf course I'm not blaming Google or Cloudflare, but it is kind of sad that larger and larger part of the Internet is moving behind their networks. I don't think this kind of centralization is good for the Internet.
- willvarfar 10y agoThe ease at which sites can be DDOSed to oblivion is "why we can't have nice things"? :(
- drinchev 10y agoI don't think this is some sort of centralization. In the end you always end up with some sort of a cable or router between you and the website that you want to visit. And these companies provide you with protection of that cable / router. This opens more doors than the ones that it closes. And sure, you can just detach from CloudFlare and own your traffic, but overall the benefits of using their service are more than the downsides.
- forthefuture 10y agoPretty sure way more sites are centralized on AWS behind a GUI so unintuitive companies pay Amazon to do it for them.
- cleeus 10y agoIt's the feudalism age of the internet. Everyone needs a lord for protection.
- travisty 10y agoI'd bed that this would only function properly if the controversial story didn't involve Alphabet or it's sub entities.
- frozenport 10y agoThis is going to play into the hands of authoritarian regimes like China and Russia. They will simply block Google.
- contingencies 10y agoCouldn't agree more; no idea who is downvoting you, this is the most insightful comment here. Also, it's fucking hypocritical claiming to support 'net neutrality' while hand-picking sites to receive support of a massive private-fiber global conglomerate with very strong senior management political affiliations. Engineers with ethics at google should start a rebellion.
- Dylan16807 10y agoChina and Russia don't generally censor via DDOS. A reverse proxy that connects from the internet to the internet does not need to be neutral. Free hosting does not need to be neutral. Net neutrality is about packets getting between an end user and the core of the internet fairly. This service is in a different area entirely.
- contingencies 10y agoStraw man about DDoS, nobody asserted that here. As far as private fiber, global search traffic, cached pages, maps, mail and advertising goes, Google already is the core of the internet.
- ztl8702 10y agoIndeed, China is probably the place that needs this kind of "shield" the most. But Google is already blocked there. Ideally, we should use some kind of P2P network against censorship, but such networks aren't mature enough. BUT, if you consider the other way: China's attack on western sites, then this "shield" is valuable. I remember no long ago China uses GFW to inject malicious code in some analytics javascript. Then all of a sudden millions of internet users started ddosing Github. It was probably because someone put something Chinese gov didn't like on Github. Github for some reason is not banned in China , but China was using this kind of ddos to force Github to take down the pages it didn't like.
- deleted 10y ago[deleted]
- jimmytidey 10y agoRather than seeking a technical solution, I wonder if there is a social one. If Google promised to upweight DDOSed articles in their (news) rankings in perpetuity, that's a strong incentive not to DDOS. It also makes sense that material one person is spending resource trying to suppress is extremely likely to be interesting to others, so it's not necessarily a bad experience for someone using the Google news. Obviously, in the short term it's also useful if they can link to a cached copy that is still working. A systemic Streisand effect.
- Iv 10y ago> If Google promised to upweight DDOSed articles in their (news) rankings in perpetuity, that's a strong incentive not to DDOS. That would actually be a strong incentive to DDOS yourself!
- enraged_camel 10y agoYeah, SEO "experts" would jump on that!
- jimmytidey 10y agoThat's true. Although institutions deal with that kind of moral hazard in insurance all the time, so perhaps similar mechanisms could be applied here. Perhaps sites uprated for having been DDOSed could be marked as such. We already have to make many decisions about the trustworthiness of news sources, so maybe it's just another factor. I can also see why Google would just like to make DDOSing very hard and make the whole problem go away, rather than the mechanism I'm proposing. That said, I think there's something gratifying about using an attacker's willingness and ability to commit resource to removing information as a signal about the value of that information. Judo chop!
- TeMPOraL 10y ago> Perhaps sites uprated for having been DDOSed could be marked as such. We already have to make many decisions about the trustworthiness of news sources, so maybe it's just another factor. Then I'll DDoS your already highly-ranked site just to trigger the "untrustworthy" mark for it in the results. The problem with going social is the infinite capability of humans to game things like that. I strongly sympathize with the desire to "make the whole problem go away" instead.
- Iv 10y ago"Safer from attacks on free speech" Good. Host a mirror of wikileaks and let's talk.
- biot 10y agoIs this something Wikileaks requested but Google turned them down? I'm wondering if there's some context to your comment or if you're just being dismissive.
- Iv 10y agoI am just being dismissive. I just tend to be triggered by comments like "Most of the world lives in countries that censor the internet" that assume that USA does not do that. Wikileaks is the most blatant example, but sci-hub and Pirate Bay are other examples of US influences censoring the net.
- allistar 10y agoThis isn't going to defend content that threatens the "national security", age of consent, and copyright laws of the States. So isn't it just a declaration that Google wants to be the imperialist content police of the internet, spun under a more benevolent-seeming light?
- tamana 10y agoJigsaw is run by a veteran of the US State Department
- bipbopbipbop 10y agoJared Cohen, former advisor to Condoleezza Rice and later Hillary Clinton.
- crottypeter 10y agoOff topic - ish But this site is broken at even modest levels of zoom. Content hanging off the left of the window and no scroll bar :-(
- xemdetia 10y agoHeck even at 100% on my 1080p monitor it reads 'make people in the afer?' After zooming out to 67% I have a chance. It actual content it is kind of irksome that they have 'End repressive censorship' followed by 3 items that generally are considered censorship at some level.
- dessant 10y agoThat's part of the design, click on Close in the upper-left corner then use the site menu to see it in action.
- Mao_Zedang 10y agoI wonder what the Google Shield team thinks of YouTube heroes.
- themihai 10y ago> We’ve met news organizations around the world who suffer crippling digital attacks when they publish something controversial. Good...except Google doesn't protect you from such attacks once the US gov deems it illegal. We need a safe, anonymous protocol not the network of X corporation.
- CraftThatBlock 10y agoSo... Tor?
- ryanlol 10y agoThe botnet attacking Krebs could in all likelihood take down the entire Tor network.
- rtkwe 10y agoThe advertised bandwidth for the whole network is much lower than the 600+GBps that's attacking Kerbs it's a little under 200 GBps. https://metrics.torproject.org/bandwidth.html https://metrics.torproject.org/bandwidth.html
- sandworm101 10y agoTor has too many friends. I dislike the trend of Tor being used to control botnets, but the upside is that an entire underworld now sees tor as an asset. Any non-state attacking Tor would make some very interesting enemies.
- NetStrikeForce 10y agoKudos to both Krebs and Google for their courage. I have profound admiration for Brian's work and Google's technology. I didn't know about Project Shield and I think it's an interesting initiative. However, for some reason it leaves me a bit unease (not as much as the idea of being taken down by a 650Gbps DDoS at will!) - not sure what it is, but we might be moving towards an Internet where only the "approved" would have "free" speech. I really hope ISP naming and shaming takes over, so we can make DDoS a little bit more difficult.
- mtbcoder 10y ago> I really hope ISP naming and shaming takes over, so we can make DDoS a little bit more difficult. I think naming and shaming would have little impact and whatever impact it did have would be short lived. Consumers tend to have short attention spans and zero long term memory. Take the banking/finance industry for example, were egregious, predatory and at times criminal tactics are par for the course. Banking institutions are named and shamed all the time, yet the Bank of Americas, Wells Fargos and Goldman Sachs of the world still exist.
- TeMPOraL 10y agoFrom what I hear about the US, many people there don't even have any alternative ISP to change to... Also changing a service provider often can be a huge inconvenience for one. For instance, if I were to learn today that my ISP makes DDoS very easy and doesn't care about the issue, I'd have a choice between one or two random small providers I don't know, and two big telecom operators that are already on my "do no ISP-related business with" list due to their annoying telemarketing.
- Bartweiss 10y agoIt's also fairly standard to suffer 1-2 weeks of outages when changing ISP's, which is somewhere between unwelcome and prohibitive for a lot of people. Worse, even places with "competitive" markets often have only one provider giving decent speeds - 1-5 Mbps maximum is not a realistic option for a lot of uses.
- meira 10y agoGreat, now the political status quo are even more under Google protection. What is the selection criteria? To receive money from some of americans NGOs? Hold yourselves, more Arab Springs are coming.
- meira 10y agoWould Google protects the webapp they created (and gave to Al Jazeera) to support the creation of Islamic State?
- whorleater 10y ago>"I’ve been toying with the idea of forming a 501(c)3 non-profit organization — ‘The Center for the Defense of Internet Journalism’, if you will — to assist Internet journalists with obtaining the kind of protection they may need when they become the targets of attacks like the one that hit my site." Now this is an interesting proposal. A 501(c)3 would need to be unbiased, and also require a large amount of starting capital. On the other hand, a non-profit that strives to protect internet free speech is pretty alluring. I wonder if something like this could be in the next YC fund.
- dominotw 10y ago>We’ve met news organizations around the world who suffer crippling digital attacks when they publish something controversial or that questions powerful institutions. What are some of the recent examples of this?
- john_reel 10y agoIt might not be exactly what you’re looking for, but there was the recent attack on Brian Krebs.
- tloble 10y ago> 'Disrupt online radicalization and propaganda' Well, it's cute that they only mention ISIS, but the same exact means can and are being used to suppress political dissent and unpopular opinion, while google is the master of spreading consumer propaganda and spying on people. > 'End repressive censorship' The commercialization of news is the best form of censorship. You don't need to censor much when the vast majority of news is meaningless bullshit stuffed with ads and promotions, and is already controlled by organizations like Google. > 'Crime and corruption thrive in the absence of transparency. As long as criminal organizations and corrupt institutions can operate without scrutiny, they will continue to use modern tools to conceal their behavior. But injustice and corruption — from atrocities on the battlefield to money laundering to organized crime — leave behind information that can be used to understand these challenges and work to stop them.' Google is one of these organizations that operate without scrutiny and transparency alongside organizations such as the NSA. If you think Google will help you with anonymity, free speech, or 'unfiltered' news, you are retarded.
- kevinSuttle 10y agoYou had me nodding in agreement until the very last word. Don't ruin it.
- tloble 10y agoThat's the spirit! Report me for maximum effect. Stupid cunt.
- sctb 10y agoWe've banned this account.
- rudolf0 10y agoThat's the part I took least issue with. >while google is the master of spreading consumer propaganda and spying on people. Equating automated behavioral analysis or ad targeting with willful communications-spying, like NSA does, is retarded. Yes, Google has been guilty of many invasive tactics and holds too much power right now, but claims that they're doing that to "suppress dissent and unpopular opinion" or "spread propaganda" will need a lot of evidence. >The commercialization of news is the best form of censorship. You don't need to censor much when the vast majority of news is meaningless bullshit stuffed with ads and promotions, and is already controlled by organizations like Google. How is this Google's fault in any way? Google owns a lot of those ad networks, but beyond that they're not responsible for news quality. >Google is one of these organizations that operate without scrutiny and transparency alongside organizations such as the NSA. Aka every other private corporation in the US? You really seem to be grasping at straws trying to make them out to be as bad as intelligence agencies. >If you think Google will help you with anonymity, free speech, or 'unfiltered' news, you are retarded. They're dedicating their network resources to preventing independent news websites from being censored by oppressive governments or DDoS'd by hostile entities, pro bono, and it appears to be working quite well. You've cited no specific examples of them doing the opposite, while there are many examples of them doing as they say. I am no Google fanboy. I hate advertising and ad networks and think (or at least hope) they'll mostly die within a decade or two. I use ad blockers on all my devices and have never put a single ad on any website I've operated due to the ethical concerns. But come on.
- Kenji 10y agoSo, does that mean Google (and thus the American State) MitM your website traffic to protect free speech? I am thrilled! I am so happy that at least large corporations that cooperate with the ever-more pervasive surveillance state care about our privacy. /s That's how you defeat HTTPS.
- rudolf0 10y agoIt does mean Google is MitMing you, but this is a service they're providing to organizations that are already at serious risk of DDoS or have been DDoS'd. Like Krebs' site, which was just hit with a 600+ Gbps DDoS. Plus, I mean, Google Analytics and various Google-owned ads are already present on tons of HTTPS sites. That's enough to nullify HTTPS due to the XSS potential. How are you getting Google = American State, though?
- Kenji 10y agoThere is barely a company that visits the white house more than Google. I wouldn't be surprised if the American state has direct access right into Google's data center - it wouldn't be the first company whose server building included a government surveillance room.
- shade23 10y agoWhat would be interesting if they handover this project to an organization like the ICIJ to oversee and run while they merely take care of the infrastructure.This sort of setup can work.Provided Google provides a transparent organisation which handles the daily workings. I do not have any issues if a any X corporation provides such opportunities.The kind of attack that Krebs faced, there is absolutely no possible scenario where a non-profit could cater to. Every organization has a bunch of people who support the open web.This could be their voice from within Google. PS: I am not from google or a fan boy.Just that never judge a book by its cover.Let this unfurl before we pass the judgement.
- delinka 10y ago> 'Disrupt online radicalization and propaganda' > 'End repressive censorship' These are at odds. One person's (politician's? corporation's?) "propaganda" is another's "Declaration of Independence." How will can you possibly tell the difference?
- fail2fail2ban 10y agoThe navigation column on the left is clipped in Chrome and the monochrome theme is hard to read.
- zerognowl 10y agoBy nature, a personal (clearnet) domain is a single point of failure, because forever and always attackers know where the site is hosted. This is how DNS works unfortunately and it's very broken. No such problem exists with TOR hidden services, so krebs could have his own .ONION and it would prove very tricky to uncover the servers and boot them offline. Another mitigation (and there are many DDOS mitigations I'm leaving out here) is duplicating the content at several different locations, which already have their DDOS mitigations in place. So if you really want to be heard, hit Google Plus, Blogger, Twitter, Pastebin, etc. Just copy and paste your message all over the Internet, and it can prove nearly impossible to censor. Bonus points for multiple 'backup TLDs' so you could have: krebsonsecurity.org krebsonsecurity.net krebsonsecurity.io krebsonsecurity.biz You only use these in special circumstances like sharing a blogpost with your friend via email. More bonus points for mirroring static posts with Varnish cache on multiple sub-domains like wwa.krebsonsecurity.org wwb.krebsonsecurity.org ww3.krebsonsecurity.org Even more bonus points for putting resources on CoralCDN: http://www.coralcdn.org/ http://www.coralcdn.org/