9 ms·

Does the Internet Route Around Damage? – Baltic Sea Cable Cuts

172 points by voytec 2y ago

7e 2y ago
[flagged]
- lcnPylGDnU4H9OF 2y ago
  That’s just a necessary hazard that comes with providing free analysis to the public.
  - lvturner 2y ago
    Also, let's just assume that a bad actor would have access to reasonably sized and geographically distributed botnet... they could easily run their own global connectivity tests to get a good picture of what the actual impact of their actions were.
    - ssl-3 2y ago
      We all have access to such a botnet. (And we should probably all participate in it, too.) https://atlas.ripe.net/ https://atlas.ripe.net/
      - RealStickman_ 2y ago
        That's cool, thanks for sharing. Guess I know what I have to set up next.
- Cthulhu_ 2y ago
  Is it any information the Russians (I presume you mean) don't have yet? It's naive to think they don't understand how the internet works, given they've been doing active cyber warfare for a long time now.
- exe34 2y ago
  to be fair, the Kremlin usually gets it before it reaches number 10 [0]. [0] https://youtu.be/1KjHYsDoLyw?si=ji8xCWnJoBS-FXbc https://youtu.be/1KjHYsDoLyw?si=ji8xCWnJoBS-FXbc
fsflover 2y ago
Related: https://news.ycombinator.com/item?id=42198635 https://news.ycombinator.com/item?id=42198635
- deleted 2y ago
  [deleted]
schoen 2y ago
By the way, the original adage from John Gilmore ("The Net interprets censorship as damage and routes around it") was referring to a behavior of Usenet rather than of the Internet. In particular, if articles didn't reach a node by one path, the node would still accept that they were missing (according to Usenet routing rules) and accept those articles from a different path. Thus, one could not prevent Usenet messages or newsgroups from reaching most of Usenet merely by deleting or not forwarding them on a single node. Another way of putting this is that the connectivity of Usenet was (in general though not everywhere) a web rather than a tree, and the Usenet software didn't assume that messages had to be forwarded along some particular path, if another path was available. As with Jon Postel's maxim (https://en.wikipedia.org/wiki/Robustness_principle https://en.wikipedia.org/wiki/Robustness_principle) people have also subsequently applied this to human behavior, not just the behavior of particular software. There were ultimately more technically sophisticated means of censorship available on Usenet that were somewhat more effective.
- UltraSane 2y ago
  It turns out that flooding your own lies is far more effective than trying to censor information.
  - labster 2y ago
    Yep. The internet is an infinite copy machine. All you have to do is copy the lies an order of magnitude more than the truth, and Bob’s your uncle (whether you’re related to Bob or not).
  - newsclues 2y ago
    The crime of polluting information to control it was perhaps the most unforgivable sin of our Information Age.
    - hn34381 2y ago
      Like with everything else, the internet didn't invent the crime, it just does it at scale. https://www.fayobserver.com/story/opinion/columns/2018/09/08/patrick-w-oneil-when-fake-news-hit-abraham-lincoln/10812226007/ https://www.fayobserver.com/story/opinion/columns/2018/09/08... "When fake news hit Abraham Lincoln"
chrismorgan 2y ago
I think it was late 2012 or early 2013 when I was in India (Hyderabad) at a time when an earthquake in the Mediterranean Sea cut I think it was SEA-WE-ME 3. The internet was terrible for the next two weeks, until the cable was repaired: almost half the internet flat-out didn’t work, including most USA hosts. I have no idea why communication between India and the USA, which should head east, was affected by a break to the west in the Mediterranean. I do know that local ISPs often have fairly dodgy peering arrangements. My workaround was to tunnel via my own VPS in Singapore, as I could connect to it and but I was using OpenVPN back then and performance was pretty terrible. (Now if I want such tunnelling I use WireGuard, and it’s much better.)
- toast0 2y ago
  We'd really need traceroutes (ideally bidirectional) from before, during, and after the break to diagnose your issues :P But, even if your traffic was going east, with the broken cable to the east, there might be a lot more traffic going east (or coming from the east), and that could cause a lot of breakage. For better or worse (mostly for worse), BGP doesn't propagate capacity of links, so it doesn't matter if there are alternate routes, if the overloaded route has the most desirable advertisement, it gets the traffic even if most of the packets are dropped into the sea.
  - ssl-3 2y ago
    > We'd really need traceroutes (ideally bidirectional) from before, during, and after the break to diagnose your issues :P You jest, but RIPE Atlas may have that data.
    - meileaben 2y ago
      we indeed collect that data, we didn't analyse it (yet)
- icegreentea2 2y ago
  I mean India to USA is almost exactly opposite sides. Great circle routes to the east coast of the USA go west from India, and to the west coast USA would be east. Even back in 2012, us-east was huge.
aaron695 2y ago
> The scarier part is that, while we don’t see capacity issues, we are blind on what would happen if another link would be severed, or worse, if many are severed An actual attack would be capacity based, but xx% of the internet is Netflix, Disney etc. you can DNS block these. Then unless it's a war zone like Yemen quickly fix it. News, Messager, websites, VoIP, Zoom (probably) should all work fine on minimal capacity. Just like we throw out a lot of food because we have redundancy, 4K streaming is our redundancy. It'd be interesting to see a write up by a non-insane person, so not HN users or cyber security 'experts' or military consultants. TikTok is a vital part of the Ukraine war for Ukraine for instance, but mostly the video gets out and then is organized for the external audience. 4K internet might not "Route Around Damage", 720p might?
- amelius 2y ago
  We'd need an Internet Protocol that would support the opposite of net-neutrality. Basically, only allowing important traffic and blocking or downgrading everything else.
  - somat 2y ago
    That was part of the original ip specification, it was modeled after army telecom patterns. where there are priority levels baked in. when the net starts to overload the lower priority traffic gets discarded first. https://www.rfc-editor.org/rfc/rfc791 https://www.rfc-editor.org/rfc/rfc791 calls it precedence Precedence 111 - Network Control 110 - Internetwork Control 101 - CRITIC/ECP 100 - Flash Override 011 - Flash 010 - Immediate 001 - Priority 000 - Routine https://en.wikipedia.org/wiki/Type_of_service https://en.wikipedia.org/wiki/Type_of_service The bits ended up being reassigned for service codes. mainly because nobody used them. I also suspect there would be problems with a priority system in a peer network like the internet. It works in a more managed network(like the army) where strict priority control can be enforced. but it would probably be an arms race when one peer starts setting their priority a notch higher so their messages start getting through better on a congested link.
niemandhier 2y ago
I have workloads on hetzner data centers in Finnland and Germany. Hetzner owns part of that cable, to connect those sites. Tracerout gives me a path like this spine5.cloud2.fsn1.hetzner.com -> core22.fsn1.hetzner.com -> core5.fra.hetzner.com -> core53.sto.hetzner.com -> core31.hel1.hetzner.com Which is worse than before, but still works for me.
- voytec 2y ago
  My route from Poland to dedi box leased from Hetzner in Finland currently goes through AS1299 / twelve99.net (Warsaw->Talinn->Helsinki) peering, and there's a slight increase in latency since the cable cut. On a normal day, it's Poland -> Hetzner in Germany -> Hetzner in Finland. I'm guessing that the situation hurts companies like Hetzner financially.
  - hulitu 2y ago
    > I'm guessing that the situation hurts companies like Hetzner financially. So maybe, in the end, is a Hetzner competitor who profits from those "cable cuts". /s Just follow the money.
    - FollowingTheDao 2y ago
      I think you have to follow the really big money. What if these cuts were meant to route traffic through a specific network to intecept data?
      - voytec 2y ago
        I like your thought pattern.
  - Hamuko 2y ago
    I assume they need to pony up to get the cable repaired (unless there's insurance against such thing) but I'm not sure if I see the cable connection itself being a huge financial hit. Submarine cables getting damaged is fairly normal, and from what I've read, it should be back up by the end of the month.
ikiris 2y ago
It routes around damage just fine. It doesn’t magically create extra capacity to handle cuts unless the capacity was built out already. Just in time capacity thinking has its downsides.
Havoc 2y ago
I was on jersey island when they lost 3 out of 4 cables. Didn’t notice a thing. Then again that place was wired up with all fibre infra like it’s nobody’s business even a decade ago so perhaps not surprising. Best residential internet I’ve ever personally seen.

172 points by voytec 2y ago

7e 2y ago

[flagged]

lcnPylGDnU4H9OF 2y ago
That’s just a necessary hazard that comes with providing free analysis to the public.
- lvturner 2y ago
  Also, let's just assume that a bad actor would have access to reasonably sized and geographically distributed botnet... they could easily run their own global connectivity tests to get a good picture of what the actual impact of their actions were.
  - ssl-3 2y ago
    We all have access to such a botnet. (And we should probably all participate in it, too.) https://atlas.ripe.net/ https://atlas.ripe.net/
    - RealStickman_ 2y ago
      That's cool, thanks for sharing. Guess I know what I have to set up next.
Cthulhu_ 2y ago
Is it any information the Russians (I presume you mean) don't have yet? It's naive to think they don't understand how the internet works, given they've been doing active cyber warfare for a long time now.
exe34 2y ago
to be fair, the Kremlin usually gets it before it reaches number 10 [0]. [0] https://youtu.be/1KjHYsDoLyw?si=ji8xCWnJoBS-FXbc https://youtu.be/1KjHYsDoLyw?si=ji8xCWnJoBS-FXbc

fsflover 2y ago

Related: https://news.ycombinator.com/item?id=42198635 https://news.ycombinator.com/item?id=42198635

deleted 2y ago
[deleted]

schoen 2y ago

By the way, the original adage from John Gilmore ("The Net interprets censorship as damage and routes around it") was referring to a behavior of Usenet rather than of the Internet. In particular, if articles didn't reach a node by one path, the node would still accept that they were missing (according to Usenet routing rules) and accept those articles from a different path. Thus, one could not prevent Usenet messages or newsgroups from reaching most of Usenet merely by deleting or not forwarding them on a single node. Another way of putting this is that the connectivity of Usenet was (in general though not everywhere) a web rather than a tree, and the Usenet software didn't assume that messages had to be forwarded along some particular path, if another path was available. As with Jon Postel's maxim (https://en.wikipedia.org/wiki/Robustness_principle https://en.wikipedia.org/wiki/Robustness_principle) people have also subsequently applied this to human behavior, not just the behavior of particular software. There were ultimately more technically sophisticated means of censorship available on Usenet that were somewhat more effective.

UltraSane 2y ago
It turns out that flooding your own lies is far more effective than trying to censor information.
- labster 2y ago
  Yep. The internet is an infinite copy machine. All you have to do is copy the lies an order of magnitude more than the truth, and Bob’s your uncle (whether you’re related to Bob or not).
- newsclues 2y ago
  The crime of polluting information to control it was perhaps the most unforgivable sin of our Information Age.
  - hn34381 2y ago
    Like with everything else, the internet didn't invent the crime, it just does it at scale. https://www.fayobserver.com/story/opinion/columns/2018/09/08/patrick-w-oneil-when-fake-news-hit-abraham-lincoln/10812226007/ https://www.fayobserver.com/story/opinion/columns/2018/09/08... "When fake news hit Abraham Lincoln"

chrismorgan 2y ago

I think it was late 2012 or early 2013 when I was in India (Hyderabad) at a time when an earthquake in the Mediterranean Sea cut I think it was SEA-WE-ME 3. The internet was terrible for the next two weeks, until the cable was repaired: almost half the internet flat-out didn’t work, including most USA hosts. I have no idea why communication between India and the USA, which should head east, was affected by a break to the west in the Mediterranean. I do know that local ISPs often have fairly dodgy peering arrangements. My workaround was to tunnel via my own VPS in Singapore, as I could connect to it and but I was using OpenVPN back then and performance was pretty terrible. (Now if I want such tunnelling I use WireGuard, and it’s much better.)

toast0 2y ago
We'd really need traceroutes (ideally bidirectional) from before, during, and after the break to diagnose your issues :P But, even if your traffic was going east, with the broken cable to the east, there might be a lot more traffic going east (or coming from the east), and that could cause a lot of breakage. For better or worse (mostly for worse), BGP doesn't propagate capacity of links, so it doesn't matter if there are alternate routes, if the overloaded route has the most desirable advertisement, it gets the traffic even if most of the packets are dropped into the sea.
- ssl-3 2y ago
  > We'd really need traceroutes (ideally bidirectional) from before, during, and after the break to diagnose your issues :P You jest, but RIPE Atlas may have that data.
  - meileaben 2y ago
    we indeed collect that data, we didn't analyse it (yet)
icegreentea2 2y ago
I mean India to USA is almost exactly opposite sides. Great circle routes to the east coast of the USA go west from India, and to the west coast USA would be east. Even back in 2012, us-east was huge.

aaron695 2y ago

> The scarier part is that, while we don’t see capacity issues, we are blind on what would happen if another link would be severed, or worse, if many are severed An actual attack would be capacity based, but xx% of the internet is Netflix, Disney etc. you can DNS block these. Then unless it's a war zone like Yemen quickly fix it. News, Messager, websites, VoIP, Zoom (probably) should all work fine on minimal capacity. Just like we throw out a lot of food because we have redundancy, 4K streaming is our redundancy. It'd be interesting to see a write up by a non-insane person, so not HN users or cyber security 'experts' or military consultants. TikTok is a vital part of the Ukraine war for Ukraine for instance, but mostly the video gets out and then is organized for the external audience. 4K internet might not "Route Around Damage", 720p might?

amelius 2y ago
We'd need an Internet Protocol that would support the opposite of net-neutrality. Basically, only allowing important traffic and blocking or downgrading everything else.
- somat 2y ago
  That was part of the original ip specification, it was modeled after army telecom patterns. where there are priority levels baked in. when the net starts to overload the lower priority traffic gets discarded first. https://www.rfc-editor.org/rfc/rfc791 https://www.rfc-editor.org/rfc/rfc791 calls it precedence Precedence 111 - Network Control 110 - Internetwork Control 101 - CRITIC/ECP 100 - Flash Override 011 - Flash 010 - Immediate 001 - Priority 000 - Routine https://en.wikipedia.org/wiki/Type_of_service https://en.wikipedia.org/wiki/Type_of_service The bits ended up being reassigned for service codes. mainly because nobody used them. I also suspect there would be problems with a priority system in a peer network like the internet. It works in a more managed network(like the army) where strict priority control can be enforced. but it would probably be an arms race when one peer starts setting their priority a notch higher so their messages start getting through better on a congested link.

niemandhier 2y ago

I have workloads on hetzner data centers in Finnland and Germany. Hetzner owns part of that cable, to connect those sites. Tracerout gives me a path like this spine5.cloud2.fsn1.hetzner.com -> core22.fsn1.hetzner.com -> core5.fra.hetzner.com -> core53.sto.hetzner.com -> core31.hel1.hetzner.com Which is worse than before, but still works for me.

voytec 2y ago
My route from Poland to dedi box leased from Hetzner in Finland currently goes through AS1299 / twelve99.net (Warsaw->Talinn->Helsinki) peering, and there's a slight increase in latency since the cable cut. On a normal day, it's Poland -> Hetzner in Germany -> Hetzner in Finland. I'm guessing that the situation hurts companies like Hetzner financially.
- hulitu 2y ago
  > I'm guessing that the situation hurts companies like Hetzner financially. So maybe, in the end, is a Hetzner competitor who profits from those "cable cuts". /s Just follow the money.
  - FollowingTheDao 2y ago
    I think you have to follow the really big money. What if these cuts were meant to route traffic through a specific network to intecept data?
    - voytec 2y ago
      I like your thought pattern.
- Hamuko 2y ago
  I assume they need to pony up to get the cable repaired (unless there's insurance against such thing) but I'm not sure if I see the cable connection itself being a huge financial hit. Submarine cables getting damaged is fairly normal, and from what I've read, it should be back up by the end of the month.

ikiris 2y ago

It routes around damage just fine. It doesn’t magically create extra capacity to handle cuts unless the capacity was built out already. Just in time capacity thinking has its downsides.

Havoc 2y ago

I was on jersey island when they lost 3 out of 4 cables. Didn’t notice a thing. Then again that place was wired up with all fibre infra like it’s nobody’s business even a decade ago so perhaps not surprising. Best residential internet I’ve ever personally seen.