12 ms·

It's the feudalism age of the internet. Everyone needs a lord for protection.

by cleeus 10y ago

afsina 10y ago
Better than nation states.
- Tepix 10y ago
  Only sometimes.
- nl 10y ago
  That's interesting, in the context of a quote from the KerbsOnSecurity piece which prompted this post: John Gilmore, an American entrepreneur and civil libertarian, once famously quipped that “the Internet interprets censorship as damage and routes around it.” This notion undoubtedly rings true for those who see national governments as the principal threats to free speech. However, events of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach.[1] and also: But as my friend and mentor Roland Dobbins at Arbor Networks eloquently put it, “When it comes to DDoS attacks, nation-states are just another player.” [1] https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...
  - afsina 10y ago
    At the end, if nation states are helpless on preventing this, and only being part of the problem, I say this - our benevolent feodal overlords - is the preferable solution.
    - kyledrake 10y ago
      That's what the "benevolent feudal overlords" want everyone to think. From all the defeatist DDoS comments I'd say they're doing a good job at it. As Brian Krebs, myself and numerous other people have pointed out, Cloudflare could end almost all of the DDoS-for-hire attacks in an hour if they actually wanted to https://news.ycombinator.com/item?id=12577289 https://news.ycombinator.com/item?id=12577289
      - rudolf0 10y ago
        Sadly, not really true. * Cloudflare has a growing number of competitors, like Incapsula. * These services only protect the front-end of the booter websites. These are barebones CRUD apps for managing accounts and typing the IPs you want DDoS'd. It'd be pretty easy to throw that template up on any other server or domain. Most of that whole workflow could be replaced by IRC, Slack, Discord, Skype along with Bitcoin or similar payment methods. As proof, booter sites do still regularly get DDoS'd (usually by exposing their origin server IP or otherwise fucking up configuration) and breached (often exposing the entire user DB and source code) yet pop back up within a few days and still retain most of their customer base. * They could just move everything to a Tor hidden service, or the equivalent to I2P. It's the botnet and/or list of IPs and URLs (scripts and shells on compromised servers they planted or paid for access to) that serves the foundation of booter services. If that remains untouched, then the booter can stick around indefinitely. Cloudflare's CEO reiterates the same points here: https://news.ycombinator.com/item?id=12577690 https://news.ycombinator.com/item?id=12577690 As for whether they have a moral obligation to stop reverse proxying these sites... I think he makes a pretty good argument for why they should be considered a common carrier. They do forward all abuse reports to the respective hosting providers.
      - nl 10y ago
        Yeah, that's pretty simplistic. There's no evidence at all that somehow removing DDOS protection for the payment part of blackmailers web presence will somehow make them go away. Sure, chase down how they do payment. But ultimately a web front end isn't the thing that makes the payment happen.
        kyledrake 10y ago
        > But ultimately a web front end isn't the thing that makes the payment happen. The "brochure" argument makes 100% sense to me for something like the distributed web, but not for a dynamic web application. Brochures just sit there and look at you. Brochures don't take payments and process callbacks, and send commands to attack.
      - mtourne 10y ago
        Interestingly, you link into a thread where you yourself agree that it would be harder than it sounds.
- arviewer 10y ago
  Depends on where you live and who you love.
MichaelMoser123 10y ago
>It's the feudalism age of the internet. Everyone needs a lord for protection. i think Schneier likes this analogy, he has used it before: https://www.schneier.com/blog/archives/2012/12/feudal_sec.html https://www.schneier.com/blog/archives/2012/12/feudal_sec.ht... He then calls for the state and the law to protect us from our overlords; now that was all written before Snowden (the presnowdonian period) Still nice that google does this hosting + ddos protection work; they could have chosen not to do it.
rudolf0 10y ago
The problem is that governments services and organized police and military are effectives solution to many of the problems faced in medieval times. It's fairly easy to evade attribution, let alone apprehension, if you're a ne'er-do-weller with a broadband connection. You have no option left but to hide inside rich people's castles.

It's the feudalism age of the internet. Everyone needs a lord for protection.

by cleeus 10y ago

It's the feudalism age of the internet. Everyone needs a lord for protection.

afsina 10y ago

Better than nation states.

Tepix 10y ago
Only sometimes.
nl 10y ago
That's interesting, in the context of a quote from the KerbsOnSecurity piece which prompted this post: John Gilmore, an American entrepreneur and civil libertarian, once famously quipped that “the Internet interprets censorship as damage and routes around it.” This notion undoubtedly rings true for those who see national governments as the principal threats to free speech. However, events of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach.[1] and also: But as my friend and mentor Roland Dobbins at Arbor Networks eloquently put it, “When it comes to DDoS attacks, nation-states are just another player.” [1] https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...
- afsina 10y ago
  At the end, if nation states are helpless on preventing this, and only being part of the problem, I say this - our benevolent feodal overlords - is the preferable solution.
  - kyledrake 10y ago
    That's what the "benevolent feudal overlords" want everyone to think. From all the defeatist DDoS comments I'd say they're doing a good job at it. As Brian Krebs, myself and numerous other people have pointed out, Cloudflare could end almost all of the DDoS-for-hire attacks in an hour if they actually wanted to https://news.ycombinator.com/item?id=12577289 https://news.ycombinator.com/item?id=12577289
    - rudolf0 10y ago
      Sadly, not really true. * Cloudflare has a growing number of competitors, like Incapsula. * These services only protect the front-end of the booter websites. These are barebones CRUD apps for managing accounts and typing the IPs you want DDoS'd. It'd be pretty easy to throw that template up on any other server or domain. Most of that whole workflow could be replaced by IRC, Slack, Discord, Skype along with Bitcoin or similar payment methods. As proof, booter sites do still regularly get DDoS'd (usually by exposing their origin server IP or otherwise fucking up configuration) and breached (often exposing the entire user DB and source code) yet pop back up within a few days and still retain most of their customer base. * They could just move everything to a Tor hidden service, or the equivalent to I2P. It's the botnet and/or list of IPs and URLs (scripts and shells on compromised servers they planted or paid for access to) that serves the foundation of booter services. If that remains untouched, then the booter can stick around indefinitely. Cloudflare's CEO reiterates the same points here: https://news.ycombinator.com/item?id=12577690 https://news.ycombinator.com/item?id=12577690 As for whether they have a moral obligation to stop reverse proxying these sites... I think he makes a pretty good argument for why they should be considered a common carrier. They do forward all abuse reports to the respective hosting providers.
    - nl 10y ago
      Yeah, that's pretty simplistic. There's no evidence at all that somehow removing DDOS protection for the payment part of blackmailers web presence will somehow make them go away. Sure, chase down how they do payment. But ultimately a web front end isn't the thing that makes the payment happen.
      - kyledrake 10y ago
        > But ultimately a web front end isn't the thing that makes the payment happen. The "brochure" argument makes 100% sense to me for something like the distributed web, but not for a dynamic web application. Brochures just sit there and look at you. Brochures don't take payments and process callbacks, and send commands to attack.
    - mtourne 10y ago
      Interestingly, you link into a thread where you yourself agree that it would be harder than it sounds.
arviewer 10y ago
Depends on where you live and who you love.

MichaelMoser123 10y ago

>It's the feudalism age of the internet. Everyone needs a lord for protection. i think Schneier likes this analogy, he has used it before: https://www.schneier.com/blog/archives/2012/12/feudal_sec.html https://www.schneier.com/blog/archives/2012/12/feudal_sec.ht... He then calls for the state and the law to protect us from our overlords; now that was all written before Snowden (the presnowdonian period) Still nice that google does this hosting + ddos protection work; they could have chosen not to do it.

rudolf0 10y ago

The problem is that governments services and organized police and military are effectives solution to many of the problems faced in medieval times. It's fairly easy to evade attribution, let alone apprehension, if you're a ne'er-do-weller with a broadband connection. You have no option left but to hide inside rich people's castles.