5 ms·

"To be brief: Apple's infrastructure is massive. They own the entire 17.0.0.0/8 IP range, which includes 25,000 web servers with 10,000 of them under apple.com,

"To be brief: Apple's infrastructure is massive. They own the entire 17.0.0.0/8 IP range, which includes 25,000 web servers with 10,000 of them under apple.com, another 7,000 unique domains, and to top it all off, their own TLD (dot apple)." Wow. I would think it's just impossible to secure all that, and that's not even everything.

lukeramsden 6y ago
7,000 unique domains seems insane, what could they possibly need all of those for? Unless that includes subdomains, I guess.
- blakesterz 6y ago
  7,000 does seem REALLY high, but I can imagine them needing the TLD for every possible spelling of Apple. Maybe applesucks as well. appl3, 8ppl3 and so on. Anything close to apple. Same goes for icloud, and I anything else. I guess you get to 1k pretty quick just covering typo squatters. They must have a team of people just to manage domain names!
  - ficklepickle 6y ago
    It's probably semi-random domain names. Like "auth-8e3fe.icloud.apple.com" type stuff.
- remram 6y ago
  That's probably right. A quick internet search shows up domains like applecoronavirus.com and similar, as well as this court case [1] where they acquired a bunch of ipod related names. I suspect they are only parking those names after recovering them or buying them preemptively. Domain names are cheap, so why not. I don't think that's any argument for the possession of the /8 though. I remember Google had ownership of duck.com until recently, so they probably participate in the wholesale acquisition of random domains as well [2]. [1]: https://techcrunch.com/2010/01/07/apple-domain-names/ https://techcrunch.com/2010/01/07/apple-domain-names/ [2]: https://www.theverge.com/2018/12/12/18137369/duckduckgo-duck-com-google-acquisition https://www.theverge.com/2018/12/12/18137369/duckduckgo-duck...
  - laurent92 6y ago
    All parked domains could lead to the same IP. A single web server could distinguish which domain it’s contacted for, using the HTTP headers for example, and serve different content (probably all 301-redirects, but to relevant other websites of Apple).
    - remram 6y ago
      In this case it looks like a lot of them don't have A records at all.
- deleted 6y ago
  [deleted]
nuker 6y ago
> I would think it's just impossible to secure all that You can make sure your village have no spies, you cannot ensure the same for a city. I bet every large enough network is compromised to some degree.
- dopylitty 6y ago
  This is the truth. I've worked in large organizations and it really is impossible organizationally to be fully secure. People come and go. Responsibilities change. The comparison of the city is a really good one.
  - deleted 6y ago
    [deleted]
yread 6y ago
Why do they need 17.0.0.0/8 (16,777,216 addresses) if they only have 25000 webservers? #eattheIPrich edit: fixed the number of addresses
- mrweasel 6y ago
  You can use those IPs for something other than webservers. But yeah, that a bit much for one company. I'll give hosting providers a pass on owning a million IPs, because they're for the lending out to customers.
- gruturo 6y ago
  a /8 is actually 16M addresses, not 1M.
- ta8347 6y ago
  They probably don't, but there are weirder cases. Ford was allocated 17.0.0.0/8, Prudential 48.0.0.0/8, USPS 56.0.0.0/8
- iruoy 6y ago
  This [0] is a really interesting page. Companies that have an entire /8 block are AT&T, Apple, Ford, Cogent, Prudential Financial, USP and Comcast. For some reason the US Department of Defense has 13 /8 blocks. All others belong to regional internet registries (AFRINIC, ARIN, APNIC, LACNIC, RIPE NNC). I really don't know why anyone other than the registries needs/deserves/got /8 blocks. [0]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
  - khalilravanna 6y ago
    Wow Prudential and Ford (if USP is supposed to be UPS, that too) are the odd ducks. At least the others have the internet as a core competency. My guess as to the answer of “why” is power and leverage. It’s the same as nations claiming physical land. “Maybe we’ll need it, maybe we won’t. But either way, now it’s ours to decide.” Writing that out, do they own those? Can someone take those back?
rswail 6y ago
It's interesting that by owning and using that Class A block, Apple are making it easier to scan for their infrastructure. Moving that to IPv6 and releasing the Class A would help them avoid the preliminary scanning that was performed. There's also something to be said about migrating internal DNS to a subdomain of apple.com that is only visible internally. Not solutions to security, but making things harder to scan makes it harder to find the vulnerabilities.

lukeramsden 6y ago

7,000 unique domains seems insane, what could they possibly need all of those for? Unless that includes subdomains, I guess.

blakesterz 6y ago
7,000 does seem REALLY high, but I can imagine them needing the TLD for every possible spelling of Apple. Maybe applesucks as well. appl3, 8ppl3 and so on. Anything close to apple. Same goes for icloud, and I anything else. I guess you get to 1k pretty quick just covering typo squatters. They must have a team of people just to manage domain names!
- ficklepickle 6y ago
  It's probably semi-random domain names. Like "auth-8e3fe.icloud.apple.com" type stuff.
remram 6y ago
That's probably right. A quick internet search shows up domains like applecoronavirus.com and similar, as well as this court case [1] where they acquired a bunch of ipod related names. I suspect they are only parking those names after recovering them or buying them preemptively. Domain names are cheap, so why not. I don't think that's any argument for the possession of the /8 though. I remember Google had ownership of duck.com until recently, so they probably participate in the wholesale acquisition of random domains as well [2]. [1]: https://techcrunch.com/2010/01/07/apple-domain-names/ https://techcrunch.com/2010/01/07/apple-domain-names/ [2]: https://www.theverge.com/2018/12/12/18137369/duckduckgo-duck-com-google-acquisition https://www.theverge.com/2018/12/12/18137369/duckduckgo-duck...
- laurent92 6y ago
  All parked domains could lead to the same IP. A single web server could distinguish which domain it’s contacted for, using the HTTP headers for example, and serve different content (probably all 301-redirects, but to relevant other websites of Apple).
  - remram 6y ago
    In this case it looks like a lot of them don't have A records at all.
deleted 6y ago
[deleted]

nuker 6y ago

> I would think it's just impossible to secure all that You can make sure your village have no spies, you cannot ensure the same for a city. I bet every large enough network is compromised to some degree.

dopylitty 6y ago
This is the truth. I've worked in large organizations and it really is impossible organizationally to be fully secure. People come and go. Responsibilities change. The comparison of the city is a really good one.
- deleted 6y ago
  [deleted]

yread 6y ago

Why do they need 17.0.0.0/8 (16,777,216 addresses) if they only have 25000 webservers? #eattheIPrich edit: fixed the number of addresses

mrweasel 6y ago
You can use those IPs for something other than webservers. But yeah, that a bit much for one company. I'll give hosting providers a pass on owning a million IPs, because they're for the lending out to customers.
gruturo 6y ago
a /8 is actually 16M addresses, not 1M.
ta8347 6y ago
They probably don't, but there are weirder cases. Ford was allocated 17.0.0.0/8, Prudential 48.0.0.0/8, USPS 56.0.0.0/8
iruoy 6y ago
This [0] is a really interesting page. Companies that have an entire /8 block are AT&T, Apple, Ford, Cogent, Prudential Financial, USP and Comcast. For some reason the US Department of Defense has 13 /8 blocks. All others belong to regional internet registries (AFRINIC, ARIN, APNIC, LACNIC, RIPE NNC). I really don't know why anyone other than the registries needs/deserves/got /8 blocks. [0]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...
- khalilravanna 6y ago
  Wow Prudential and Ford (if USP is supposed to be UPS, that too) are the odd ducks. At least the others have the internet as a core competency. My guess as to the answer of “why” is power and leverage. It’s the same as nations claiming physical land. “Maybe we’ll need it, maybe we won’t. But either way, now it’s ours to decide.” Writing that out, do they own those? Can someone take those back?

rswail 6y ago

It's interesting that by owning and using that Class A block, Apple are making it easier to scan for their infrastructure. Moving that to IPv6 and releasing the Class A would help them avoid the preliminary scanning that was performed. There's also something to be said about migrating internal DNS to a subdomain of apple.com that is only visible internally. Not solutions to security, but making things harder to scan makes it harder to find the vulnerabilities.