5 ms·

Sounds interesting! Can someone explain a bit in simple terms what happened here and why it's noteworthy? Thanks :)

meltyness 3y ago
Presumably whichever government is trying to identify users accessing the service, or prevent the spread of information or something.
dilyevsky 3y ago
The way routing works on the internet very simply is a network (like an ISP or connectivity provider) will announce IP prefix and "the origin" - where to send packets matching the prefix. This mechanism is also frequently used by national ISPs to block specific destinations (like Telegram nodes) - they will announce Telegram IP prefixes to be sent to them and then will just toss the packets or try to snoop on sessions. This is known as the "BGP hijack". These announcement typically only intended for downstream providers (regional Iraqi ISPs in this case) but sometimes "leak" upstream - erroneously announced to the open internet which sometimes cause outages for the whole world. This is what famously happened with YouTube when Pakistan tried to do the same thing in 2008. In this case the routes "leaked" upstream again like what happened before but seems like outage was mostly prevented by something called RPKI which is basically a technology to attest who really owns which prefix.
- explaininjs 3y ago
  Is this directly at odds with the whole “the internet interprets censorship as damage and routes around it” motif?
  - dilyevsky 3y ago
    The internet doesn't interpret anything - it's a just a bunch of networks and technologies to pass packets around with some level of redundancy (originally to withstand nuclear strikes on the comms centers).
    - explaininjs 3y ago
      It’s a metaphor.
      - dilyevsky 3y ago
        Ok sure but if router rules say “send these packets over there” that’s where they will go (to die). There are no way to “interpret” if the packets are going to the right destination for downstream devices which are totally oblivious to this process if that makes sense
        salawat 3y ago
        What you are homing in on is the problem of trust. And yes. It is a problem. If your upstream does skulduggerous things, you can't "route around it" from the standpoint of being an endpoint. Your packets will go where your ISP says they go. Unless... You take a bit of the routing decision out of their hands, which takes a bit of footwork on your part. For instance, setting up a VPN to a network zone unpolluted by the faulty prefix announcement, which is basically going to be any non downstream of the hostile ISP provider. Once you're out of that routing zone, normal network visibility is restored. Odds are even a national scale backbone provider is not going to be able to effectively block traffic that's routing out to a proxy, so all the the ISP has really done is made life more difficult for people unaware of how to set up such an arrangement. Which now that you know about this, it is your duty to spread the knowledge of how to do so far and wide. If someone wants to block it, then that's all the justification needed for frustrating those efforts.
        dilyevsky 3y ago
        VPN traffic is trivially blocked at the ISP level which has been proven by china, russia and others. So no you can't really prevent mass censorship with technology.
        Forbo 3y ago
        And trivially circumvented, which has been proven by Tor. https://support.torproject.org/censorship/connecting-from-china/ https://support.torproject.org/censorship/connecting-from-ch...
  - WJW 3y ago
    TBH, that is a quote from several decades ago that hasn't kept up with modern censoring technology. When Gilmore originally coined it he was embroiled in a legal dispute with his ISP, I doubt he had BGP hijacks by national governments in mind.
  - segfaultbuserr 3y ago
    The original comment was a remark on Usenet newsgroup message filtering. Usenet had a degree of decentralization, a single news server couldn't control the entire network. If the message is filtered at a particular path by a server, at least some other nodes would still receive their own copies via an alternative path, which may then propagate the messages further downstream. Today's highly-centralized server-client Web architecture does not have this property. Some P2P protocols are closer to the spirit of this quote. Conclusion: architecture of "the Net" matters a lot (the original quote didn't use the term "Internet").
  - Groxx 3y ago
    Seeing as how the entire internet doesn't still block youtube: no. It routed around it. The quote has nothing to do with automatically and invisibly routing around censorship, e.g. a techno-system that somehow always works to oppose censorship. It's just that people will reconnect stuff eventually, bypassing any block somehow. At worst there are always sneakernets.
- ehsankia 3y ago
  If this node has been known to publish unreliable routes in the past, wouldn't any upstream nodes just put some preventative rules to ignore it / blocklist it? Or is that not feasible?
  - dilyevsky 3y ago
    Yes before RPKI especially and still now this technique is commonly used but not even every T1 (backbone) network had done that correctly in the past, hence outages.
    - hnarn 3y ago
      By T1 I assume you mean “Tier 1”, not to be confused with https://en.wikipedia.org/wiki/T-carrier https://en.wikipedia.org/wiki/T-carrier
      - dilyevsky 3y ago
        heh yeah tier 1 provider, not t1 line. Blast from the past - I still remember people bragging about their 1.5Mbps T1 connections.
        phara0h 3y ago
        Ah I used to be so jealous of people with their T1 connections while I was stuck on a 56k dial up connection trying to play Unreal Tournament '99. Good times.
deleted 3y ago
[deleted]

Presumably whichever government is trying to identify users accessing the service, or prevent the spread of information or something.

dilyevsky 3y ago

The way routing works on the internet very simply is a network (like an ISP or connectivity provider) will announce IP prefix and "the origin" - where to send packets matching the prefix. This mechanism is also frequently used by national ISPs to block specific destinations (like Telegram nodes) - they will announce Telegram IP prefixes to be sent to them and then will just toss the packets or try to snoop on sessions. This is known as the "BGP hijack". These announcement typically only intended for downstream providers (regional Iraqi ISPs in this case) but sometimes "leak" upstream - erroneously announced to the open internet which sometimes cause outages for the whole world. This is what famously happened with YouTube when Pakistan tried to do the same thing in 2008. In this case the routes "leaked" upstream again like what happened before but seems like outage was mostly prevented by something called RPKI which is basically a technology to attest who really owns which prefix.

explaininjs 3y ago
Is this directly at odds with the whole “the internet interprets censorship as damage and routes around it” motif?
- dilyevsky 3y ago
  The internet doesn't interpret anything - it's a just a bunch of networks and technologies to pass packets around with some level of redundancy (originally to withstand nuclear strikes on the comms centers).
  - explaininjs 3y ago
    It’s a metaphor.
    - dilyevsky 3y ago
      Ok sure but if router rules say “send these packets over there” that’s where they will go (to die). There are no way to “interpret” if the packets are going to the right destination for downstream devices which are totally oblivious to this process if that makes sense
      - salawat 3y ago
        What you are homing in on is the problem of trust. And yes. It is a problem. If your upstream does skulduggerous things, you can't "route around it" from the standpoint of being an endpoint. Your packets will go where your ISP says they go. Unless... You take a bit of the routing decision out of their hands, which takes a bit of footwork on your part. For instance, setting up a VPN to a network zone unpolluted by the faulty prefix announcement, which is basically going to be any non downstream of the hostile ISP provider. Once you're out of that routing zone, normal network visibility is restored. Odds are even a national scale backbone provider is not going to be able to effectively block traffic that's routing out to a proxy, so all the the ISP has really done is made life more difficult for people unaware of how to set up such an arrangement. Which now that you know about this, it is your duty to spread the knowledge of how to do so far and wide. If someone wants to block it, then that's all the justification needed for frustrating those efforts.
        dilyevsky 3y ago
        VPN traffic is trivially blocked at the ISP level which has been proven by china, russia and others. So no you can't really prevent mass censorship with technology.
        Forbo 3y ago
        And trivially circumvented, which has been proven by Tor. https://support.torproject.org/censorship/connecting-from-china/ https://support.torproject.org/censorship/connecting-from-ch...
- WJW 3y ago
  TBH, that is a quote from several decades ago that hasn't kept up with modern censoring technology. When Gilmore originally coined it he was embroiled in a legal dispute with his ISP, I doubt he had BGP hijacks by national governments in mind.
- segfaultbuserr 3y ago
  The original comment was a remark on Usenet newsgroup message filtering. Usenet had a degree of decentralization, a single news server couldn't control the entire network. If the message is filtered at a particular path by a server, at least some other nodes would still receive their own copies via an alternative path, which may then propagate the messages further downstream. Today's highly-centralized server-client Web architecture does not have this property. Some P2P protocols are closer to the spirit of this quote. Conclusion: architecture of "the Net" matters a lot (the original quote didn't use the term "Internet").
- Groxx 3y ago
  Seeing as how the entire internet doesn't still block youtube: no. It routed around it. The quote has nothing to do with automatically and invisibly routing around censorship, e.g. a techno-system that somehow always works to oppose censorship. It's just that people will reconnect stuff eventually, bypassing any block somehow. At worst there are always sneakernets.
ehsankia 3y ago
If this node has been known to publish unreliable routes in the past, wouldn't any upstream nodes just put some preventative rules to ignore it / blocklist it? Or is that not feasible?
- dilyevsky 3y ago
  Yes before RPKI especially and still now this technique is commonly used but not even every T1 (backbone) network had done that correctly in the past, hence outages.
  - hnarn 3y ago
    By T1 I assume you mean “Tier 1”, not to be confused with https://en.wikipedia.org/wiki/T-carrier https://en.wikipedia.org/wiki/T-carrier
    - dilyevsky 3y ago
      heh yeah tier 1 provider, not t1 line. Blast from the past - I still remember people bragging about their 1.5Mbps T1 connections.
      - phara0h 3y ago
        Ah I used to be so jealous of people with their T1 connections while I was stuck on a 56k dial up connection trying to play Unreal Tournament '99. Good times.

deleted 3y ago

[deleted]