4 ms·

Internet Archive Services are "temporarily offline"

104 points by pushedx 2y ago

jlund-molfese 2y ago
Likely related to https://www.theverge.com/2024/10/14/24269741/internet-archive-online-read-only-data-breach-outage https://www.theverge.com/2024/10/14/24269741/internet-archiv...
ChrisArchitect 2y ago
Re: https://news.ycombinator.com/item?id=41836677 https://news.ycombinator.com/item?id=41836677
keepamovin 2y ago
how vulnerable is IA to some malicious actor who wanted to rewrite history or run an 'information cleansing' operation? - take offline - purge 'problematic' archives - return to service is that impossible? are there redundancies to make this very hard?
- cookiengineer 2y ago
  Don't give the SVR any ideas, man. The problem that multi generational projects like this always have is tech debt. Any library/dependency chosen by the previous generation might be unmaintained for decades until it falls through the cracks and someone notices it. Heretrix, for example, was written in a very old "Java way" to do it. They have also lots of services that were built in the PHP4 age, with globals by default and stuff like that. Always keep in mind that whatever you choose, it's a bet, essentially. Over time you'll realize that different language ecosystems have different aligned or misaligned goals to your project. Don't choose libraries because of hype, choose them because of maintainability.
  - keepamovin 2y ago
    Hah! As if they need ideas. But that's not the point, how possible is it? Re your comprehensive edit, I totally am on board with that tech choice idea. It's a bet, avoid the fads, pick stuff that's robust (or at least a fit for your possible futures)
    - cookiengineer 2y ago
      I'd say we have to differentiate between human error as an attack surface and software bugs / vulnerabilities as an attack surface here. Software-wise I wouldn't know where to start, honestly, because the internet archive as a project is so vast [1] that it's hard to get an architectural overview of how the pieces are glued together. Unifying the tech stack seems to have been no concern at all in its development... But from a pentesting perspective I'd try to find vulnerabilities in the perl based services first, then Java, then PHP, then NPM and so on... because older projects tend to have a higher likeliness of being unmaintained or using outdated libraries. [1] (~242 public repositories) https://github.com/orgs/internetarchive/repositories https://github.com/orgs/internetarchive/repositories
  - Apocryphon 2y ago
    I dunno about the state actor hypothesis, but if there is, it all sounds like Charles Stross's description of future cold war in Halting State: > "And that's the twentieth-century model, what they used to call an electronic Pearl Habour. Things have moved on since then. Footnotes inserted in government reports feeding into World Trade Organization negotiating positions. Nothing we'd notice at first, nothing that would be obvious for a couple of years. You don't want to halt the state in its tracks, you simply want to divert it into a sliding of your choice." Who knows what will appear after the archives are restored?
    - keepamovin 2y ago
      Heh, yeah. It was probably "the Entity". An AI that subtly nudged human affairs as the opening salvo of its Big Plan. Masquerading as hapless hackers of course hahaha! :)
- deleted 2y ago
  [deleted]
- emmelaich 2y ago
  I hope that Google (for instance) has an occasional snapshot of everything tucked away somewhere on a tape in Norway or somewhere. Like the seed bank.
- bubblesnort 2y ago
  - openly speculate the tactic to preemptively address concerns
  - keepamovin 2y ago
    Exactly! Red-team the situation to identify weaknesses, build defenses and devise overall strategy! :)
- g-b-r 2y ago
  Yeah, last time I checked they weren't doing any timestaping. They definitely should.
userbinator 2y ago
This incident brings up a good point: Who archives the archives?
- JKCalhoun 2y ago
  r/DataHoarder (or r/archiveteam ?) Personally, I have archived a few of the magazine collections.
  - notpushkin 2y ago
    https://archiveteam.org/index.php/IA.BAK https://archiveteam.org/index.php/IA.BAK
    - chambers 2y ago
      > The INTERNETARCHIVE.BAK experiment has come to a close a number of years ago. > Much was learned in the process, and many thanks are given to the dozens of people who donated time, space and coding efforts to make the system work as long as it did. A number of useful facts and observations came from the project. > The Internet Archive continues to explore methods and code to decentralize the collection, to have a mirror running in various ways - these include IPFS, FileCoin, and others. The INTERNETARCHIVE.BAK project also added general mirroring and tracking code to a number of projects that are still in use. IA called this their Postmortem, but it sounds... intentionally opaque. Also, I'm not sure if this website is affiliated with archive.org, since they say at the bottom of their homepage: > Archive Team is in no way affiliated with the fine folks at ARCHIVE.ORG Archive Team can always be reached by e-mail at archiveteam@archiveteam.org or by IRC at the channel #archiveteam (on hackint).
      - notpushkin 2y ago
        Yeah, it’s a completely [1] separate team (they do run a bunch of archiving projects that end up in the IA / Wayback Machine though). Just wanted to share – it’s sad there isn’t much more info though apart from some code; maybe worth looking into IRC logs? [1]: On paper, at least; the founder, Jason Scott, seems pretty involved with the IA as well, and I’m not really sure how much the teams intersect.
Apocryphon 2y ago
The timing of Google getting rid of the Google Cache couldn't be even worse with these ongoing DDOS attacks on and necessary hardening of the Internet Archive. Wonder what kind of twisty narrative one could posit about why this is happening?
conormarcellus 2y ago
internet archive
jaredb3 2y ago
Fix the Internet Archive to be back online.
timonoko 2y ago
What we really need right now is "black hole" of information. A place where you can push stuff, but retrieving is impossible until that time when ironclad legitimation can be automated. Insane that only examples of me myself ever doing anything is in printed copies from 1970's. In National Archives where some aunties still believe that Internet is just a passing fad.

104 points by pushedx 2y ago

Likely related to https://www.theverge.com/2024/10/14/24269741/internet-archive-online-read-only-data-breach-outage https://www.theverge.com/2024/10/14/24269741/internet-archiv...

ChrisArchitect 2y ago

Re: https://news.ycombinator.com/item?id=41836677 https://news.ycombinator.com/item?id=41836677

keepamovin 2y ago

how vulnerable is IA to some malicious actor who wanted to rewrite history or run an 'information cleansing' operation? - take offline - purge 'problematic' archives - return to service is that impossible? are there redundancies to make this very hard?

cookiengineer 2y ago
Don't give the SVR any ideas, man. The problem that multi generational projects like this always have is tech debt. Any library/dependency chosen by the previous generation might be unmaintained for decades until it falls through the cracks and someone notices it. Heretrix, for example, was written in a very old "Java way" to do it. They have also lots of services that were built in the PHP4 age, with globals by default and stuff like that. Always keep in mind that whatever you choose, it's a bet, essentially. Over time you'll realize that different language ecosystems have different aligned or misaligned goals to your project. Don't choose libraries because of hype, choose them because of maintainability.
- keepamovin 2y ago
  Hah! As if they need ideas. But that's not the point, how possible is it? Re your comprehensive edit, I totally am on board with that tech choice idea. It's a bet, avoid the fads, pick stuff that's robust (or at least a fit for your possible futures)
  - cookiengineer 2y ago
    I'd say we have to differentiate between human error as an attack surface and software bugs / vulnerabilities as an attack surface here. Software-wise I wouldn't know where to start, honestly, because the internet archive as a project is so vast [1] that it's hard to get an architectural overview of how the pieces are glued together. Unifying the tech stack seems to have been no concern at all in its development... But from a pentesting perspective I'd try to find vulnerabilities in the perl based services first, then Java, then PHP, then NPM and so on... because older projects tend to have a higher likeliness of being unmaintained or using outdated libraries. [1] (~242 public repositories) https://github.com/orgs/internetarchive/repositories https://github.com/orgs/internetarchive/repositories
- Apocryphon 2y ago
  I dunno about the state actor hypothesis, but if there is, it all sounds like Charles Stross's description of future cold war in Halting State: > "And that's the twentieth-century model, what they used to call an electronic Pearl Habour. Things have moved on since then. Footnotes inserted in government reports feeding into World Trade Organization negotiating positions. Nothing we'd notice at first, nothing that would be obvious for a couple of years. You don't want to halt the state in its tracks, you simply want to divert it into a sliding of your choice." Who knows what will appear after the archives are restored?
  - keepamovin 2y ago
    Heh, yeah. It was probably "the Entity". An AI that subtly nudged human affairs as the opening salvo of its Big Plan. Masquerading as hapless hackers of course hahaha! :)
deleted 2y ago
[deleted]
emmelaich 2y ago
I hope that Google (for instance) has an occasional snapshot of everything tucked away somewhere on a tape in Norway or somewhere. Like the seed bank.
bubblesnort 2y ago
- openly speculate the tactic to preemptively address concerns
- keepamovin 2y ago
  Exactly! Red-team the situation to identify weaknesses, build defenses and devise overall strategy! :)
g-b-r 2y ago
Yeah, last time I checked they weren't doing any timestaping. They definitely should.

userbinator 2y ago

This incident brings up a good point: Who archives the archives?

JKCalhoun 2y ago
r/DataHoarder (or r/archiveteam ?) Personally, I have archived a few of the magazine collections.
- notpushkin 2y ago
  https://archiveteam.org/index.php/IA.BAK https://archiveteam.org/index.php/IA.BAK
  - chambers 2y ago
    > The INTERNETARCHIVE.BAK experiment has come to a close a number of years ago. > Much was learned in the process, and many thanks are given to the dozens of people who donated time, space and coding efforts to make the system work as long as it did. A number of useful facts and observations came from the project. > The Internet Archive continues to explore methods and code to decentralize the collection, to have a mirror running in various ways - these include IPFS, FileCoin, and others. The INTERNETARCHIVE.BAK project also added general mirroring and tracking code to a number of projects that are still in use. IA called this their Postmortem, but it sounds... intentionally opaque. Also, I'm not sure if this website is affiliated with archive.org, since they say at the bottom of their homepage: > Archive Team is in no way affiliated with the fine folks at ARCHIVE.ORG Archive Team can always be reached by e-mail at archiveteam@archiveteam.org or by IRC at the channel #archiveteam (on hackint).
    - notpushkin 2y ago
      Yeah, it’s a completely [1] separate team (they do run a bunch of archiving projects that end up in the IA / Wayback Machine though). Just wanted to share – it’s sad there isn’t much more info though apart from some code; maybe worth looking into IRC logs? [1]: On paper, at least; the founder, Jason Scott, seems pretty involved with the IA as well, and I’m not really sure how much the teams intersect.

Apocryphon 2y ago

The timing of Google getting rid of the Google Cache couldn't be even worse with these ongoing DDOS attacks on and necessary hardening of the Internet Archive. Wonder what kind of twisty narrative one could posit about why this is happening?

conormarcellus 2y ago

internet archive

jaredb3 2y ago

Fix the Internet Archive to be back online.

timonoko 2y ago

What we really need right now is "black hole" of information. A place where you can push stuff, but retrieving is impossible until that time when ironclad legitimation can be automated. Insane that only examples of me myself ever doing anything is in printed copies from 1970's. In National Archives where some aunties still believe that Internet is just a passing fad.