6 ms·

One minor philosophical question. If you are using AWS PrivateLink because your VPC is not connected to the internet are you really squatting anything? You are

One minor philosophical question. If you are using AWS PrivateLink because your VPC is not connected to the internet are you really squatting anything? You are just aren't using the public internet. This means that you own the entire address space and can decide what you want to do with it. Of course it still may make sense to stick to ranges you own in case you need to peer your VPC with someone else, but I don't see much difference between using some random batch of IPs that you don't "own" on the public internet vs any block reserved for internal use. Either can conflict with someone that you want to merge with.

quickthrower2 5y ago
Yes I didn’t understand this as squatting and made me question if I understood the post. As it is a topic I admit to not being too deeply knowledgeable about.
- kevincox 5y ago
  I think in general the author's definition of squatting is reasonable. I see it to mean "living on land you don't own" or more directly "using IP addresses that you don't own". My point is about fully private networks that aren't connected to the internet. I would argue that in this case you do own all of the addresses, even if someone else owns them on the public internet.
  - quickthrower2 5y ago
    Thanks. I have a question then. If you squat as per this definition, can you divert internet traffic designated foe the real IP address to your server? Or does it only divert it for computers on your network?
    - kevincox 5y ago
      The author is only talking about private networks. This does however occasionally happen on the public internet (or when a government turns their country into a private network and does this maliciously). The most common source is "BGP Leaks" which is a fun search.
      - erik_seaberg 5y ago
        My favorite example is when a Turkish ISP accidentally declared themselves to be the best route to anywhere, and the whole Internet simply took their word for it. https://web.archive.org/web/20080228131639/http://www.renesys.com/blog/2005/12/internetwide_nearcatastrophela.shtml https://web.archive.org/web/20080228131639/http://www.renesy...
  - iqanq 5y ago
    That's like saying if I create a 3D model of my neighbour's car and drive it around the streets of a videogame I am "squatting my neighbour's car" or "using a car I don't own".
thedougd 5y ago
That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks. They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a public service in that IP space, the company/network using it as private IPs would not be able to access the public service. The author is trying to understand how prevalent this is, and to what extent of trouble an owner of these IP spaces would have if they decided to host a public service.
- kevincox 5y ago
  I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote: > This is useful since it can remove the need for some servers to have any outbound internet access at all. My point is that if you are not connected to the public internet at all I don't see why you should be expected to follow the rules of the public internet (who owns what). You can use whatever rules you want for your own private network.
  - benjojo12 5y ago
    For what it's worth, I've these endpoints in use for VPCs that still had internet access. Meaning that if you attempted to read the "real" internet address you put your VPC subnet on, they would be unreachable. It's hard/impossible to figure out if the VPC in question has been setup this way. But I agree that it would be likely that most of these VPC with the endpoints on don't have internet access. However if we assume (dangerously I suppose) that the VPC subnet distribution is similar to other VPCs without private link, we can imagine how many other VPCs are squatting on space that do have internet access! (Assuming any of this makes sense)
    - kevincox 5y ago
      For sure, I'd bet that most of the examples you found were still connected to the internet. I don't think the findings are any less valid I just thought it was an interesting observation that if you are in fact disconnected from the internet there isn't really any reason you should follow the public internet's rules.
hotpotamus 5y ago
I believe the networking term is "bogon". Basically you're using space in a way that isn't intended. Mostly I've seen it as people trying to use RFC1918 space on public networks probably because of misconfigurations and most routers/FWs will ignore these. This is sort of the inverse.
- Godel_unicode 5y ago
  Not really, bogon is generally used for either unallocated space or "Martian" packets (packets with a source in private space). This space is unannounced, but not unallocated, therefore it doesn't show up on the bogon list. Here's the team cymru bogon list, for instance: https://team-cymru.com/community-services/bogon-reference/bogon-dotted-decimal/ https://team-cymru.com/community-services/bogon-reference/bo...

quickthrower2 5y ago

Yes I didn’t understand this as squatting and made me question if I understood the post. As it is a topic I admit to not being too deeply knowledgeable about.

kevincox 5y ago
I think in general the author's definition of squatting is reasonable. I see it to mean "living on land you don't own" or more directly "using IP addresses that you don't own". My point is about fully private networks that aren't connected to the internet. I would argue that in this case you do own all of the addresses, even if someone else owns them on the public internet.
- quickthrower2 5y ago
  Thanks. I have a question then. If you squat as per this definition, can you divert internet traffic designated foe the real IP address to your server? Or does it only divert it for computers on your network?
  - kevincox 5y ago
    The author is only talking about private networks. This does however occasionally happen on the public internet (or when a government turns their country into a private network and does this maliciously). The most common source is "BGP Leaks" which is a fun search.
    - erik_seaberg 5y ago
      My favorite example is when a Turkish ISP accidentally declared themselves to be the best route to anywhere, and the whole Internet simply took their word for it. https://web.archive.org/web/20080228131639/http://www.renesys.com/blog/2005/12/internetwide_nearcatastrophela.shtml https://web.archive.org/web/20080228131639/http://www.renesy...
- iqanq 5y ago
  That's like saying if I create a 3D model of my neighbour's car and drive it around the streets of a videogame I am "squatting my neighbour's car" or "using a car I don't own".

thedougd 5y ago

That's not really what the author was getting at. The VPC endpoints just provide a way (via TLS certificate authority logs) for the author to discover DNS addresses that they can then use to check for queries and determine what IP addresses are being used in private networks. They found a number of AWS users that are treating publicly routable IP space as their own private IP space. If someone were to ever offer a public service in that IP space, the company/network using it as private IPs would not be able to access the public service. The author is trying to understand how prevalent this is, and to what extent of trouble an owner of these IP spaces would have if they decided to host a public service.

kevincox 5y ago
I agree with you in general. If you do expect to be able to connect to the public internet and map an endpoint over a public address you are aiming a gun at your foot. However the point I was trying to make was about this quote: > This is useful since it can remove the need for some servers to have any outbound internet access at all. My point is that if you are not connected to the public internet at all I don't see why you should be expected to follow the rules of the public internet (who owns what). You can use whatever rules you want for your own private network.
- benjojo12 5y ago
  For what it's worth, I've these endpoints in use for VPCs that still had internet access. Meaning that if you attempted to read the "real" internet address you put your VPC subnet on, they would be unreachable. It's hard/impossible to figure out if the VPC in question has been setup this way. But I agree that it would be likely that most of these VPC with the endpoints on don't have internet access. However if we assume (dangerously I suppose) that the VPC subnet distribution is similar to other VPCs without private link, we can imagine how many other VPCs are squatting on space that do have internet access! (Assuming any of this makes sense)
  - kevincox 5y ago
    For sure, I'd bet that most of the examples you found were still connected to the internet. I don't think the findings are any less valid I just thought it was an interesting observation that if you are in fact disconnected from the internet there isn't really any reason you should follow the public internet's rules.

hotpotamus 5y ago

I believe the networking term is "bogon". Basically you're using space in a way that isn't intended. Mostly I've seen it as people trying to use RFC1918 space on public networks probably because of misconfigurations and most routers/FWs will ignore these. This is sort of the inverse.

Godel_unicode 5y ago
Not really, bogon is generally used for either unallocated space or "Martian" packets (packets with a source in private space). This space is unannounced, but not unallocated, therefore it doesn't show up on the bogon list. Here's the team cymru bogon list, for instance: https://team-cymru.com/community-services/bogon-reference/bogon-dotted-decimal/ https://team-cymru.com/community-services/bogon-reference/bo...