10 ms·
The British Library URL has been offline due to cyberattack for 10 days
- The-Old-Hacker 3y agoBroken link. Should be https://www.bl.uk https://www.bl.uk.
- sph 3y agoYeah the mod has edited the title and added another slash (https://www.bl.uk// https://www.bl.uk//) which now shows a blank page.
- willhackett 3y agoIs there anything we can do to help?
- trevyn 3y ago[flagged]
- donbox 3y agoOh well, that is sad. Toronto Public Library's online services are still down since at least a month.
- pards 3y agoThe Toronto Public Library got hit with ransomware, but they obviously can't afford to pay. It's awful. TPL is one of the best library networks in North America, providing a vast array of valuable services to the people of Toronto. It should be considered an essential service given how many underprivileged people depend on its services.
- 5040 3y ago>vast array of valuable services I'd argue that this is how libraries get into this mess. Instead of specializing, they adopt a scattershot approach to services, many of which aren't even related to taking care of library materials. Flashy pet projects get prioritized while less interesting things like books or computer systems languish.
- mschuster91 3y agoAgree with you. It's a truly sad state that libraries have become the de-facto "last option" for so many people, ranging from Internet access for those too poor to afford a basic phone data plan over food [1] and showers [2] to first aid for drug users [3]. Out of all of that, only the first should be provided by a library - the rest should be a core function of any civilized government to provide in dedicated, actually properly equipped facilities. Librarians are not social workers, and they shouldn't have to be forced into that role that they've never been adequately trained nor equipped for. And libraries shouldn't be places where those in need of their actual services are afraid to go to, because they don't want to get harassed by homeless and drug users. And yet, I shudder even thinking about how the situation would look like if the many librarians and other adjacent staff would not have stepped up to the multiple crises of completely dysfunctional local governments and widespread poverty. [1] https://www.governing.com/now/public-libraries-step-up-to-help-as-food-insecurity-rises https://www.governing.com/now/public-libraries-step-up-to-he... [2] https://www.slocounty.ca.gov/Departments/Library/Library-News/San-Luis-Obispo-Library-Partnering-with-Shower-the.aspx https://www.slocounty.ca.gov/Departments/Library/Library-New... [3] https://www.cbsnews.com/news/libraries-becoming-popular-places-for-drug-users-to-shoot-up-heroin/ https://www.cbsnews.com/news/libraries-becoming-popular-plac...
- that_guy_iain 3y agoLooks like they got hacked and just shut down their web system while they rebuild a secure env/system.
- unwind 3y agoMeta: the URL is not offline, the (web) service associated with it is. The title would be better with "URL" deleted, in my opinion. I hope they resolve the attack issues, that's of courses incredibly crappy and I feel sorry for them. :(
- wahnfrieden 3y agoThat’s what a url being offline means and is understood to mean The store is closed vs that store location is closed. Same thing
- WendyTheWillow 3y agoColloquially perhaps, but it is wrong from a technological perspective, and IMO that matters.
- phyzome 3y agoThe URL https://www.bl.uk/ https://www.bl.uk/ is working fine, but the site is busted.
- Retr0id 3y agoIt returns a resource but I wouldn't say it's working.
- ldarby 3y agoI found it confusing - if a URL is "offline", I'd expect some kind of error message like connection refused or no such domain. The URL here is not "offline", it's the BL that's offline, and the BL isn't a URL.
- Retr0id 3y agoIf it displayed the Cloudflare 502 Bad Gateway error page, would you consider the URL to be offline? There's no Cloudflare here, but I see it as conceptually the same thing.
- jamesholden 3y agoMan if only people had access to a large online free global library.
- throwup238 3y agoYou could call it the “genesis library” or GenLib for short
- xnyan 3y agoWow, libraries general! We can call it libgen for short.
- reedjosh 3y agoI love you guys!
- tivert 3y agoWouldn't help. You might as well say people could use Wikipedia and Wikibooks. A big reason people go to libraries like the British Library is for collections of rare books an manuscripts (https://www.publicbooks.org/how-to-lose-a-library/ https://www.publicbooks.org/how-to-lose-a-library/), which you're not going to find on some pirate site that scraped the (relatively) low-hanging fruit of digitally-distributed academic papers and ebooks. You might as well say "Man if only people would spend the billions of dollars to digitize every scrap of archival paper in the world, and put it online for free."
- xnyan 3y ago>A big reason people go to libraries like the British Library is for collections of rare books an manuscripts I love rare books and have donated to my library specifically to restore rare books in need. The vast majority of patrons would never notice them missing or care if they did. >Wouldn't help...You might as well say... So, a huge collection of books available for free won't help library patrons, and the main reason why because I can't also use it to view Chekhov's handwritten notebooks or the Leningrad codex? Ok.
- blexx 3y agoThe www.bl.uk website currently reads: > Temporary holding page > Our website is currently unavailable > Last updated: 5pm on Friday, 8 December 2023. > We're experiencing a major technology outage following a cyber-attack affecting our website, online systems and services, and some onsite services. However, our buildings are still open as usual. We anticipate restoring more services in the next few weeks, but disruption to certain services is now expected to persist for several months. > Last week the attackers released some of our data onto the dark web including some personal user information. We've contacted our users to alert them to this incident and to offer advice from the National Cyber Security Centre (NCSC) on how to protect themselves, including updating their passwords on other systems. > Because our systems are still unavailable, you can't change the password for our services. However, if you use the same password for non-British Library services, we recommend that you change it as a precaution. > NCSC provides guidance on staying secure online, including how to create a strong password, and specific guidance for individuals who may have been impacted by a data breach. > Analysing the data is likely to take several months. Should we find specific information has been compromised, we will alert anyone affected as soon as we can. We are continuing to collaborate with the Metropolitan Police and professional cybersecurity advisors, and are receiving support from the NCSC. > We're really sorry for the ongoing disruption to our systems and services and we'll provide further updates when we can. > What is currently available? > The Library's buildings are open, but some services are limited, including access to collection items. We're regularly updating our blog with the latest information on what's currently available online and onsite so please check this before you visit. > If you have purchased tickets for our exhibition, Fantasy: Realms of Imagination, you can still use them. Exhibition tickets can also be booked via See Tickets. Our free exhibition, Malorie Blackman: The Power of Stories, is open and no booking is required. > All upcoming public events are going ahead as planned and you can find more information on our events blog update. We're continuing to welcome schools and families too, as well as adult learners to our courses. > Business & IP Centre (BIPC) in St Pancras is open to support businesses as usual but digital services onsite are unavailable. You can also join BIPC events and webinars and access one-to-one support. Read our BIPC blog update to find out what help and advice we can offer during this time. > Contacting us > While our systems are offline, you can contact us by emailing customer@bl.uk We'll do our best to answer your queries but please bear with us. This inbox is reviewed between 08.30 to 16.30 Monday to Friday. We're experiencing a high volume of enquiries so it may take us some time to respond. We'll get back to you as quickly as we can. > Thank you for your patience and understanding.
- ta1243 3y agoIts been out since October https://www.theguardian.com/books/2023/oct/31/british-library-suffering-major-technology-outage-after-cyber-attack https://www.theguardian.com/books/2023/oct/31/british-librar... And affecting far more than their public website - including everything from personnel records to payments to authors https://www.thetimes.co.uk/article/7f2b670a-f52a-4f88-b6d4-d7ba51d1fb94?shareToken=9454bdb8d4413517266ca5f87346a78d https://www.thetimes.co.uk/article/7f2b670a-f52a-4f88-b6d4-d...
- asicsp 3y agoAnd multiple discussions here too (https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=false&query=british%20library&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal...): * https://news.ycombinator.com/item?id=38356768 https://news.ycombinator.com/item?id=38356768 * https://news.ycombinator.com/item?id=38430831 https://news.ycombinator.com/item?id=38430831
- wrycoder 3y agoExtensive input from the BPL blog 15Dec: https://blogs.bl.uk/living-knowledge/2023/12/knowledge-under-attack.html https://blogs.bl.uk/living-knowledge/2023/12/knowledge-under... Edit: They were legally forbidden to pay the £600,000 ransom.
- 8372049 3y ago> They were legally forbidden to pay the £600,000 ransom. That should have been the case for all ransoms everywhere.
- Obscurity4340 3y agoY do you think thats NOT the case? Is it a Chernobyl type situation or is there something else I'm missing (lack of technical literacy or refusal to hire appropos consultantz in the public interest?)
- 3y ago
- btrettel 3y agoRelated: How to Lose a Library - https://news.ycombinator.com/item?id=38657830 https://news.ycombinator.com/item?id=38657830 - Dec 2023 (21 comments)
- maxehmookau 3y agoThe heritage, museum and library sectors in the UK are badly paid, even for technology and IT staff. Frankly, I suspect that the British Library is reaping the result of decades of underfunding and under-preparing for such an eventuality despite quite clearly being a target.
- flumpcakes 3y agoIT workers had a £4k uplift to every band compared to all other staff in the heritage sector from my experience, and that was specifically because you can get more money working elsewhere. They're paid "normal" salaries, if look at salary distributions of the UK as a whole. IT/technology is just abnormally overpaid as a whole. I'm not saying it shouldn't be, just that it is.
- maxehmookau 3y agoI don't doubt you, but it clearly wasn't enough of an investment in cybersecurity for the UK's flagship, national library to be knocked offline for months with no end in sight. This is less about the pay of any individual working there, but a culture of underinvestment which the UK public sector has been undergoing for the past 15 years.
- zerkten 3y ago>> culture of underinvestment which the UK public sector has been undergoing for the past 15 years. It's going on for much longer than that. It's hard to think of a time when there was investment. It's also hard to think of a time when the individuals and teams who could have prevented this would be given the respect that they deserve. This is a problem in the UK that extends beyond the UK public sector because a lot of the management in large organisations has some cultural similarities.
- okeuro49 3y ago> IT/technology is just abnormally overpaid as a whole. In the UK, IT/technology is arguably underpaid, compared to the value it generates. Just remember the TSB IT meltdown last year. (https://www.theguardian.com/business/2022/dec/20/tsb-bank-fined-it-meltdown-fca https://www.theguardian.com/business/2022/dec/20/tsb-bank-fi...) The average salary for a solicitor is ~£70,000 https://www.checkasalary.co.uk/salaries/solicitor https://www.checkasalary.co.uk/salaries/solicitor The average salary for IT is ~£50,000 https://www.checkasalary.co.uk/salaries/information-technology-it https://www.checkasalary.co.uk/salaries/information-technolo... For a software engineer ~£60,000. https://www.checkasalary.co.uk/salaries/software-engineer https://www.checkasalary.co.uk/salaries/software-engineer
- Hi_hacker_here 3y ago[flagged]
- bro_thats_crazy 3y ago[flagged]
- mdcurran 3y agoI visit the British Library often. It's a great place to work if no meetings are on your schedule that day. The library has been noticeably quieter the past few weeks. Perhaps it's the time of year, but many individuals use the library for researching family histories or accessing esoteric items in the catalogue. I hope this is resolved soon. Public libraries are a really wonderful utility.
- huytersd 3y agoI love libraries. The only other quiet public place I can think of is churches and working your remote job from churches is frowned upon. Now that I mention it, churches should totally host remote working spots.
- Moru 3y agoSpeaking of Churches, the Swedish Church [1] is currently also down for similar reasons. [1] https://www.svt.se/nyheter/lokalt/dalarna/svenska-kyrkan-bekraftar-it-attacken-ar-ett-utpressningsforsok--ebdldt https://www.svt.se/nyheter/lokalt/dalarna/svenska-kyrkan-bek...
- donohoe 3y agoThe URL for this post is incorrect and has a double-slash. It should be: https://www.bl.uk/ https://www.bl.uk/ and not: https://www.bl.uk// https://www.bl.uk//
- seagullriffic 3y agoCan anyone explain why this happens? Why would they pay ransomware hackers when they would obviously have backups. Sucks to have data compromised, but presumably it's not lost. And what part of the system was designed to bad practices that this was able to happen? Aren't there lots of UK white-hats who would freely lend their services to help improve the library's infrastructure? Presumably excluding attacks of this sort isn't arcane or impossible, because other major companies and orgs manage it. Is it secret knowledge, or something? Surely there's a SOP to just not have this happen.
- Pxtl 3y agoI assume they lost something that's timely, like a transactional DB, where the "backup" would mean accepting the loss of some important transactions.
- amelius 3y agoMaybe the attackers encrypted the data, and those encrypted files were backed up, maybe even overwriting older backups?
- gurchik 3y ago> Why would they pay ransomware hackers when they would obviously have backups. Sucks to have data compromised, but presumably it's not lost. It's been more than a month. I think if it was this easy, they would be online by now. They said on their blog they will only begin to restore some functionality in January. A business could consider paying the random to avoid two months of downtime. Although in this case they didn't have the option to pay it.
- DharmaPolice 3y agoI wouldn't necessarily assume they do have backups. At least, not recent backups of 100% of their content/systems.
- dazc 3y agoThey have back-ups but they are mostly not digital back-ups.
- adulau 3y agoThe ransomware group posted some evidences -> https://www.ransomlook.io/screenshots/rhysida/British%20Library.png https://www.ransomlook.io/screenshots/rhysida/British%20Libr... and the ransomware group details -> https://www.ransomlook.io/group/rhysida https://www.ransomlook.io/group/rhysida
- rthkljlkrj 3y agoIsn't it ironic that a library of all places completely melts down when you damage their computers? It's not like a hospital for example who could reasonably argue "of course if you manage my systems my business melts down, it's not like managing paper records is part of my core expertise, I'm busy with other things".
- dotnet00 3y agoThe other way to look at it is that a library can afford the trouble, as no one is likely to be at immediate risk of death if their computers go down. A hospital has no choice but to be more resilient, since many other emergencies they would be most needed in (eg natural disasters) can also involve loss of access to computer systems.
- rthkljlkrj 3y agoOf course, I wasn't making an argument that we should make hospitals more fragile...
- hardlianotion 3y agoMeanwhile, the Ministry of Justice proposes a destructive digitisation of its archive of a couple of centuries worth of wills. https://twitter.com/MoJGovUK/status/1735642204809351595 https://twitter.com/MoJGovUK/status/1735642204809351595
- firtoz 3y agoDecentralised storage could be pretty cool for this, no?
- Sirizarry 3y agoNot if it’s destructive. Not entirely sure what the procedure is to digitize them but if the original is lost in the process, no amount of digital decentralization will help that and there are plenty of good arguments against relying on digital storage solutions for long term data storage. They’re just not long term enough (yet)
- space_fountain 3y agoIdk, it's likely very expensive to maintain the physical copies. It's easy to say that the government should just do everything, but spending money to maintain an archive that probably is very rarely used isn't a good use of limited money. Digital copies aren't always infinitely durable, but they can be copied exactly which is something that can't be done with paper and honestly I'd guess more durable than a paper archive with a the same amount of money being spent
- jart 3y agoIn order to make digital data durable, you have to store it on cassette tape. This has the same issue as physical stuff in the sense that you have to wait for it to be recalled before you can access its data, which is why tape is normally only used for backup. So they'd have to have two digital copies, paying twice the price, one for prod and one for backup. At this point when it comes to managing that, we've already exceeded the ops competencies of most tech industry teams, let alone a homeless shelter. They're really much better off just leaving the wills as they are.
- dogweather 3y agoAre attacks like this—ransomware—always aimed at Windows-based systems? Is that the common denominator? I've noticed that most Internet attacks are Windows-based but somehow "Microsoft" or "Windows" never makes it into the news copy. I've wondered if MS has a massive marketing/legal outreach to make sure that doesn't happen. And to make it sound like "this can happen anywhere", and "no computer is 100% attack-proof".
- adolph 3y agoNetcraft indicates Linux or unknown previous to the incident for www and bl.uk: https://sitereport.netcraft.com/?url=http://www.bl.uk https://sitereport.netcraft.com/?url=http://www.bl.uk Hosting History Netblock owner IP address OS Web server Last seen Microsoft Corporation One Microsoft Way Redmond WA US 98052 13.107.213.64 Linux unknown 26-Nov-2023 Microsoft Corporation One Microsoft Way Redmond WA US 98052 13.107.246.64 Linux unknown 25-Nov-2023 British Library 194.66.233.215 Linux unknown 20-Jul-2023 British Library 194.66.233.215 Linux nginx 15-May-2019 British Library 194.66.233.215 unknown nginx 5-Jul-2016 British Library 194.66.233.215 Linux nginx 4-Jul-2016 British Library 194.66.233.215 unknown nginx 26-Jun-2016 British Library 194.66.233.215 Linux nginx 21-Jun-2016 British Library 194.66.233.215 unknown nginx 17-Jun-2016 British Library 194.66.233.215 Linux Apache 17-Jan-2016
- Moru 3y agoDoes not have to be what they are running their servers on.
- adolph 3y agoVery true. This website[0] by a library consultant says the library system was “Aleph 500.” The product documentation[1] says it is an Oracle on RHEL. Other components also indicate Unix flavors. 0. https://librarytechnology.org/library/3413 https://librarytechnology.org/library/3413 1. https://knowledge.exlibrisgroup.com/Aleph/Product_Documentation/001_Version_24 https://knowledge.exlibrisgroup.com/Aleph/Product_Documentat...
- 3y ago
- emmender2 3y agoattack the incentives... have dedicated govt agencies going after the crypto money trail, and disrupt the theives. this happened in the pipeline hack. otherwise, the thieves will continue thieving with nothing to stop them. thats why we have the police and other such agencies in the real world. when thieves go after the commons (libraries/hospitals) - we the public taxpayers have every incentive to demand action of our govt as there is nobody else who can help here. why are the british taxpayers not demanding action ?
- toyg 3y agoDemanding from whom? The current government could not cook an egg.
- javajosh 3y agoWith enough study and preparation, and enough funding, I bet the current government could, in fact, cook an egg.
- eviks 3y agoThey could break an egg with that level of commitment, cooking it is another thing altogether
- tonyedgecombe 3y agoI have some doubt that the current prime minister has ever cooked an egg.
- toyg 3y agoThe most likely outcome is, in fact, that they would pay £60m to a company (which happens to be run by well-connected friends of the Prime Minister), for them to cook an egg - just to discover 6 months later that such company never owned a pan and never cooked anything.
- eviks 3y ago
- ciwolsey 3y agoIt's working for me.