3 ms·

You're right that the single peer is a concern. Maybe they have others that are hidden for now, like you said? I don't think they need more than a few IP addre

by Meekro 6y ago

You're right that the single peer is a concern. Maybe they have others that are hidden for now, like you said? I don't think they need more than a few IP addresses since most of their hardware could sit on a private network with only a single load balancer visible from the Internet. Also, a small ASN doesn't really need IPv6 compatibility to function, and won't for many years to come. Since they're still using Cloudflare, it looks like multiple layers of defense. When Cloudflare eventually bans them, people will realize that it was only pointing to their own ASN and no one knows which datacenter it's in. The single peer with HE doesn't actually mean they're in an HE datacenter.

kkielhofner 6y ago
Disclaimer: I haven't worked with IP transit in five years so this could very well be dated. A single peer and a single IPv4 /24 (to me, at least) kind of tells the story of "Hey this might come in handy, costs a couple hundred dollars, and is just a couple of applications to fill out. Might as well." as opposed to something that's actually running in production. While there is more autonomy with your own ASN and the resulting infrastructure there's also the obvious and required information leakage that comes as a result. Compared to being able to hide everything behind billions of essentially ephemeral addresses inside of a Cloudflare, AWS, etc at best (worst?) they've got a maximum of 256 easily discovered static IP addresses that Anonymous or any other DDoSer can readily point their bots at to obliterate. I'm not familiar with DDoS mitigation equipment or products that HE has in place but I doubt they'd be able to as smoothly or economically absorb some of the large targeted attacks we've seen pointed at Google, AWS, Cloudflare, etc. If Gab does decide to start multi-homing they would then need to coordinate DDoS mitigation across multiple providers and/or utilize some of the products from companies that specialize in layer 3+ DDoS scrubbing and clean return. This is all because anyone can just go grab all of their current IPs from the latest route announcement and bury them in anything from layer 3 to 7. It gets very complicated and very expensive very quickly compared to how fast, cheap, and easy hiding your HTTPS stuff behind a CDN is. That's why everyone just does that. If they're using their own ASN which transit providers they have and which datacenters they're in doesn't matter - all of their routes would be publicly announced and any reasonably competent attacker would configure their tool to pull the most recent route announcements from any number of looking glasses and update the bots. The internet will do what it does and happily route the legitimate and illegitimate traffic to any number of providers and datacenters worldwide. At their (apparent) size and scale using their own IPs and their own ASN (both under their own corporate name) completely defeats the purpose of using a CDN, load balancer, DDoS mitigation service, etc and just doesn't make any sense. To your point: on the modern Internet if you're banned from Cloudflare, Amazon, Google, and Azure (maybe a few others) even IF you can get hosted somehow/somewhere your next concern is going to be a DDoS. From what I know anyone large enough to handle a modern day DDoS probably won't do business with you either -or- will happily forward you a massive (six figures, easily) per-incident invoice and then probably give you the boot anyway. I don't have any personal experience hosting controversial web properties but there are some HUGE technical, social, and political differences between The Pirate Bay and Gab, Parler, etc that the article fails to address. EDIT: Above I describe receiving a per-attack invoice with DDoS mitigation companies. That's not actually how it works. I could get into it further but those costs are a rough ballpark.
toast0 6y ago
Ideally, for redundancy, you'd run in more than one datacenter. That's hard to do with only one /24; most networks won't take BGP advertisements more specific than /24, so you can't easily run half your ips at each DC. Maybe HE allows it for transit customers, but it makes the routing messier. They could be doing anycast, but that's pretty sophisticated. They could also only advertise the /24 from one DC at a time, but that's error prone. Or maybe advertise from both and forward to the live DC over a private link/VPN. I do see in Octoberish, they were peering with a second network, and they have second network in their IRR records. Could just be so they can use one of the DDoS filter companies that advertises your netblock, and sends you clean traffic. Can't do that (easily) if you get IPs from your transit provider and it's not a service they support.
- treesknees 6y ago
  You can still have redundancy. Basically active + backup config, where the other datacenter takes over and announces the /24 if the active goes down. They could certainly be utilizing "oob" IP connectivity to coordinate failover instead of using their own IP space.

by Meekro 6y ago

kkielhofner 6y ago

Disclaimer: I haven't worked with IP transit in five years so this could very well be dated. A single peer and a single IPv4 /24 (to me, at least) kind of tells the story of "Hey this might come in handy, costs a couple hundred dollars, and is just a couple of applications to fill out. Might as well." as opposed to something that's actually running in production. While there is more autonomy with your own ASN and the resulting infrastructure there's also the obvious and required information leakage that comes as a result. Compared to being able to hide everything behind billions of essentially ephemeral addresses inside of a Cloudflare, AWS, etc at best (worst?) they've got a maximum of 256 easily discovered static IP addresses that Anonymous or any other DDoSer can readily point their bots at to obliterate. I'm not familiar with DDoS mitigation equipment or products that HE has in place but I doubt they'd be able to as smoothly or economically absorb some of the large targeted attacks we've seen pointed at Google, AWS, Cloudflare, etc. If Gab does decide to start multi-homing they would then need to coordinate DDoS mitigation across multiple providers and/or utilize some of the products from companies that specialize in layer 3+ DDoS scrubbing and clean return. This is all because anyone can just go grab all of their current IPs from the latest route announcement and bury them in anything from layer 3 to 7. It gets very complicated and very expensive very quickly compared to how fast, cheap, and easy hiding your HTTPS stuff behind a CDN is. That's why everyone just does that. If they're using their own ASN which transit providers they have and which datacenters they're in doesn't matter - all of their routes would be publicly announced and any reasonably competent attacker would configure their tool to pull the most recent route announcements from any number of looking glasses and update the bots. The internet will do what it does and happily route the legitimate and illegitimate traffic to any number of providers and datacenters worldwide. At their (apparent) size and scale using their own IPs and their own ASN (both under their own corporate name) completely defeats the purpose of using a CDN, load balancer, DDoS mitigation service, etc and just doesn't make any sense. To your point: on the modern Internet if you're banned from Cloudflare, Amazon, Google, and Azure (maybe a few others) even IF you can get hosted somehow/somewhere your next concern is going to be a DDoS. From what I know anyone large enough to handle a modern day DDoS probably won't do business with you either -or- will happily forward you a massive (six figures, easily) per-incident invoice and then probably give you the boot anyway. I don't have any personal experience hosting controversial web properties but there are some HUGE technical, social, and political differences between The Pirate Bay and Gab, Parler, etc that the article fails to address. EDIT: Above I describe receiving a per-attack invoice with DDoS mitigation companies. That's not actually how it works. I could get into it further but those costs are a rough ballpark.

toast0 6y ago

Ideally, for redundancy, you'd run in more than one datacenter. That's hard to do with only one /24; most networks won't take BGP advertisements more specific than /24, so you can't easily run half your ips at each DC. Maybe HE allows it for transit customers, but it makes the routing messier. They could be doing anycast, but that's pretty sophisticated. They could also only advertise the /24 from one DC at a time, but that's error prone. Or maybe advertise from both and forward to the live DC over a private link/VPN. I do see in Octoberish, they were peering with a second network, and they have second network in their IRR records. Could just be so they can use one of the DDoS filter companies that advertises your netblock, and sends you clean traffic. Can't do that (easily) if you get IPs from your transit provider and it's not a service they support.

treesknees 6y ago
You can still have redundancy. Basically active + backup config, where the other datacenter takes over and announces the /24 if the active goes down. They could certainly be utilizing "oob" IP connectivity to coordinate failover instead of using their own IP space.