7 ms·
Pentagon retakes control of IP addresses it moved in last minutes of presidency
- cpncrunch 5y agohttps://archive.is/Y16Bg https://archive.is/Y16Bg
- jvdvegt 5y agoDoes anyone know why I can't reach archive.is anymore from The Netherlands these days?
- CameronNemo 5y agoAre you using Cloudflare DNS? https://jarv.is/notes/cloudflare-dns-archive-is-blocked/ https://jarv.is/notes/cloudflare-dns-archive-is-blocked/
- kevincox 5y agoI have Cloudflare with fallback to Google and I need to refresh a few times to make it fallback and work. This spat is kinda ridiculous.
- true_religion 5y agoI’m not really understanding the crux of it. Even if archive.is doesn’t get your location via DNS, won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request?
- cyounkins 5y agoYes, the receiving webserver will get the IP with the HTTP GET, but it's mostly too late to be useful for serving users from a server with minimal latency. The EDNS client subnet feature reveals the clients subnet (but not entire IP) to the nameserver that answers the DNS query, which is then cached by Cloudflare/Google. This allows the nameserver to do geolocation at the DNS stage and direct the end user to a server with minimal latency. Without EDNS client subnet, you could get the IP for an archive.is frontend in a different continent and have a slow site experience. While the frontend server will get your IP, it's too late to do much about it under normal circumstances. An HTTP redirect would cost time, and you'd have to have different domains for each data center/region which is one thing you can avoid with the client subnet feature to start with.
- CameronNemo 5y agoFrankly they (archive.is) wouldn't have this issue if they used BGP anycast. DNS was never designed to facilitate regional load balancing.
- NickNameNick 5y agoI thought anycast wasn't reliable for TCP sessions? You can serve UDP services (eg DNS) by anycast, but if you hosted a tcp service, there's no guarantee the same server would receive consecutive packets from the tcp stream
- CameronNemo 5y agoIt is rarely an issue in practice. There are workarounds to minimize connection resets. Using ECMP hashing on routers and a tiered load balancing topology are important. https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalancer https://vincent.bernat.ch/en/blog/2018-multi-tier-loadbalanc... https://blog.cloudflare.com/high-availability-load-balancers-with-maglev/ https://blog.cloudflare.com/high-availability-load-balancers... https://engineering.linkedin.com/network-performance/tcp-over-ip-anycast-pipe-dream-or-reality https://engineering.linkedin.com/network-performance/tcp-ove...
- sterlind 5y agoSeems like LinkedIn had to do some finessing and still couldn't go with global anycast. How do CDNs work without controlling DNS resolution by source subnet?
- CameronNemo 5y agoPresumably a CDN has better and more direct peerings with ISPs than LinkedIn, or admittedly archive.is.
- diroussel 5y agoCloudflare uses any cast, and they deal with it by making every external node able to handle every public IP that they have. If packets in a TCP stream end up going to different nodes, then they deal with that in their infrastructure.
- dngray 5y ago> won’t they get it anyways immediately one millisecond later when you issue an HTTP GET request? Not if you're using a VPN in addition to Cloudflare servers.
- true_religion 5y agoTrue. In that case, why wouldn’t you send all traffic via the VPN including your DNS?
- lugged 5y agoIs this a Mac thing? You're not meant to use DNS fallback for different providers.
- gumby 5y agoI can't see what a Mac has to do with this at all. Also I can't imagine why you might think that "You're not meant to use DNS fallback for different providers." That was precisely the point it was originally designed for. The whole point of multiple resolvers is to have diversity of risk. If both your resolvers are from the same organization there's a higher chance that whatever took one out took the other out as well.
- dngray 5y agoIt's not Cloudflare's fault. In any case in order to maintain privacy I use https://dnscrypt.info https://dnscrypt.info it has an anonymized DNS option https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-D... I then just use unbound and forward that to DNSCrypt on my router. https://wiki.archlinux.org/title/DNSCrypt#Unbound https://wiki.archlinux.org/title/DNSCrypt#Unbound
- stingraycharles 5y agoOh man this explains so many issues I have had with archive.is, I couldn’t pinpoint the problem. Thanks for sharing this, things finally make sense now.
- anothernewdude 5y agoI'm surprised Cloudflare don't provide security by obfuscating EDNS info.
- entropicgravity 5y agoI can't reach it from Canada either right now.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- platz 5y agodid someone roll a nat 20 in shadowrun
- alasdair_ 5y agoDoesn’t shadowrun only use d6 for all rolls?
- nickthemagicman 5y agoWhy does the federal government STILL have control over 6% of the internet IP's? Edit: added the word still. I know the history but that was like 20 years or more ago. Why did they still have so much IP space?
- Retric 5y agoBecause they paid to create it initially and have yet to sell their address space. There are some great stories early on that break down to: “Why are all these civilians on our network?”
- swarnie 5y agoBecause they can. Who's going to take it off them?
- mc32 5y agoNo because it was first come first served in addition to having sprouted from a government program. Universities who got on the bandwagon first also tended to have multiple class B addresses.
- icedchai 5y agoI know several individuals who have /24's ("class C") blocks, including myself. I always regret not going for the class B. It would've just taken a couple of emails back in 1993.
- zamadatix 5y agoThe first place I was a network admin at they had a /16. I didn't deal with private IPs until I left that company in 2015. Even the printers were on a public IP.
- deleted 5y ago[deleted]
- pbronez 5y agoDefense Digital Service is pretty solid. I’m not worried about this.
- kjaftaedi 5y agoYou don't wonder at all why they needed a private company?
- BrianOnHN 5y agoCover story. As in the DDS is the cover story for how easy it is to do a money grab in the US gov.
- 2OEH8eoCRo0 5y agoDo you have a source for that claim?
- dillondoyle 5y agoFor tech & engineering specifically, sometimes used to get above the govt salary caps. But standard industrial complex profit maker makes sense too lol
- throwaway192874 5y agoHaving talked with a guy basically trying to recruit for it at the aerospace village at Defcon one year, I can say that working for the government without really working for them (e.g. not wearing suits) was a big part of how he sold it. That you're still a civilian and things like that, but get to work on cool stuff like hacking aircrafts
- Lammy 5y agoI figured they just like it that way for the deniability, e.g. https://en.wikipedia.org/wiki/Southern_Air_Transport https://en.wikipedia.org/wiki/Southern_Air_Transport
- 5y ago
- twirlock 5y agoLinking to paywalls should not be allowed. Obvious example of our intelligentsia thinking it's magically special in all domains of life, and now that Reddit has spread to every last corner of the internet, we just accept it.
- programmarchy 5y agoCould this be related to the SolarWinds hack? Maybe the Pentagon was monitoring traffic to surveil vulnerable corporate infrastructure.
- resoluteteeth 5y agoCould you explain how this would work?
- programmarchy 5y agoNot exactly but here’s some quotes from an article earlier this year [1]: > Goldstein described the project as one of the Defense Department's "many efforts focused on continually improving our cyber posture and defense in response to advanced persistent threats. We are partnering throughout DoD to ensure potential vulnerabilities are mitigated." > Expanding on his [Madory] point that the Defense Department may want to "scare off any would-be squatters," he wrote that "there is a vast world of fraudulent BGP routing out there. As I've documented over the years, various types of bad actors use unrouted address space to bypass blocklists in order to send spam and other types of malicious traffic." > On the Defense Department's goal of collecting "background Internet traffic for threat intelligence," Madory noted that "there is a lot of background noise that can be scooped up when announcing large ranges of IPv4 address space." [1] https://arstechnica.com/information-technology/2021/04/pentagon-explains-odd-transfer-of-175-million-ip-addresses-to-obscure-company/ https://arstechnica.com/information-technology/2021/04/penta...
- mfer 5y agoI wonder if that company was a shell company setup by a 3 letter agency
- ceejayoz 5y agoThat seems like a fairly dumb idea. The point of a CIA shell company is to hide the link to the government, isn't it?
- GenerocUsername 5y agoAnd here we are uncertain. what's your point again?
- bwj982 5y agoUnder what circumstances can internal traffic leak to external addresses in 11.0.0.0/8? I’d have thought it wouldn’t have been routed via a gateway if the traffic is local.
- 0x0000000 5y agoRouting decisions are made via route tables, which may include routes learned from different means: connected routes ("I have an interface in this network"), static routes, and routes learned from routing protocols (BGP, OSPF, et al). While any given routing protocol has it's own cost metric for selecting the best path, if a router has multiple routes to a network, learned from different means, there must be a way to select which route to install in the route table. This can be tuned, but often goes in order of connected, static, external BGP, followed by internal BGP and other interior gateway protocols. So, yeah if you learn a route from eBGP, you very well may take that path out of your own AS out to the global Internet, as opposed to internally where you are (incorrectly) using someone else's public space. (Edit: network here includes a prefix length, where more specific prefixes are chosen over less specific ones. In the case, the public announcement is 11.0.0.0/8. If you were using this space internally, you would presumably have more specific routes than a /8)
- EMM_386 5y agoIs it possible this is cronyism? Wasn't the US Government looking to sell these unused addresses to bring money in? What if this secretive shell company is just something run by a great campaign donor or someone close to the administration who planned on a good cut of these profits? It makes me very curious who is really behind this storefront in Plantation, FL.
- rbanffy 5y agoI'm willing to bet some money that, whoever they are, they play golf at Mar-a-Lago.
- sieabahlpark 5y agoThese type of comments belong on reddit
- wmf 5y agoThe value of these addresses is peanuts to the DOD... although it would be a fortune if it made its way into someone's pocket.
- IAmEveryone 5y agoThis would be my bet, as well. The company being registered in Florida also supports it, even if it’s not definitive. People get thrown off by it being the Pentagon and come up with all these James-Bond-level theories. But DoD just happens to be the owner for historic reason.
- sennight 5y ago> The company being registered in Florida also supports it, even if it’s not definitive. Supports which baseless claim, that the orange Florida man paid kickbacks with ipv4 space? With a Florida registered foreign LLC pointing back to Delaware? Seriously?
- lvs 5y agoI don't really understand the premise of the article. There's no need to change control of an ip space in a registry to assign it to some piece of network hardware. The ownership change seems to serve no purpose under the offered explanation that its purpose was bulk collection.
- betwixthewires 5y agoI was reading a thread on this site about the program and there was speculation that since these IPs are mothballed, lots of people use the address range for internal networks, particularly in China, and potentially this experiment was to get lots of networks worldwide to accidentally leak internal network traffic to the pentagon. Who knows what this thing was, but that sounds like something a government would do.
- TwoNineFive 5y agoNetwork engineer here with more than a decade of BGP peering experience on a T1 ISP: This theory is stupid for a variety of reasons. Doesn't even make sense if you understand how peering and routing actually works on the internet. This is Q-anon/ivermectin type conspiracy crap that only gets traction amongst the gullible.
- Doxin 5y agoPerhaps you'd care to explain why it's such a silly assumption?
- hacker_newz 5y agoGot a link? I've never heard of network engineers using an IP range because it's "mothballed".
- betwixthewires 5y agoIt was a thread on this site early this year where that was part of the discussion. I don't have one, and I'm not even saying it is true, just that I found that angle interesting.