11 ms·

Feedly gets hit by DDoS attack, refuses to give in to blackmail

219 points by chmars 12y ago

ksec 12y ago
Do people really get punished for it? I mean the actual ones behind those bot, not the innocent ones that had their computer hacked without knowing. If yes, how long does it normally take to get them? If At all? Weeks? Months? Years? These days DDoS seems far too easy, far too common.
- bliker 12y ago
  I quite liked this article about the issue. http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > The shocking thing about these DDoS-for-hire services is that — as I’ve reported in several previous stories — a majority of them are run by young kids who apparently can think of no better way to prove how cool and “leet” they are than by wantonly knocking Web sites offline and by launching hugely disruptive assaults. Case in point: My site appears to have been attacked this week by a 15-year-old boy from Illinois who calls himself “Mr. Booter Master” online.
  - ksec 12y ago
    From Wiki "For the time being there are no good technical means to counteract misuse of NTP servers" Sigh
    - ghshephard 12y ago
      Drop all port 123 packets that are heading to the DDOS'd server from anything but the authorized NTP server is a pretty good start.
      - mnw21cam 12y ago
        Where do you drop the packets? If your filter is inside your own network, and your bottleneck is your network connection to the outside world, then you're out of luck. If you can arrange with your upstream internet access provider for them to filter out junk before it hits the bottleneck, then great - but that involves cooperating with people, which may take some time.
        ghshephard 12y ago
        DDOS is always handled by the upstream by definition.
    - chrisBob 12y ago
      Is there a good reason for someone to want a high volume of NTP requests? How do the owners of these servers not share more of the blame for sending so much data at a web server? It should be straight forward to implement a protocol that each NTP server won't send data to the same ip more than once every 10 seconds regardless of the number of requests.
      - BCM43 12y ago
        It's already been fixed. Newer version of NTP don't reply with more data than it gets sent, so you can't use the server for amplification. It's servers that have not been updated that are issues.
    - kbar13 12y ago
      not entirely true. enabling source filtering in all networks will essentially kill off these UDP amplification attacks, because the attacker wouldn't be able to spoof your address as the source address.
- slashdotaccount 12y ago
  There will always be people who want to get some easy money and have the brains for that. Instead of playing the cat and mouse game we better take care that our networks are protected from, at least, small to mid-range DDoS attacks. The alternative is potential oppression from the governments - "you fear the bad guys, OK, then we will take some more freedoms from you and improve our surveillance to catch them".
  - davidw 12y ago
    There's no reason you can't punish criminals like this and still have a free, democratic, and open society.
    - jacquesm 12y ago
      Criminals work hard to re-invest their money in the upper world. Once they successfully do that punishing them can become very hard. Free, democratic and open societies are far more vulnerable to this than dictatorships, there you are either part of the 'in-group' or you're going to be hunted. An open society makes the assumption that people play by the rules and that those that do not will be caught and can be punished. But in reality that assumption does not hold true. Witness the extent to which the Mafia has been able to ruin your country. They've managed to infiltrate the highest echelons of politics, live like kings and in general are so far above the law that it's farcical. Punishment is for small time criminals. So yes, hackers, burglars, extortionists and so on stand some chance of being caught. But the big fish (in this case, the bosses of the hackers) will likely get away with it while some patsy does time.
      - davidw 12y ago
        Italy is the country where I live, but I'm not sure I'd call it "mine". If it were mine, I'd run it differently :-) I am not a citizen in any event. I think you're wrong in any event: the more open and well run a society is, the harder it is for mafias to really take root. That's why they are stronger in places like Italy than in, say, Sweden: http://en.wikipedia.org/wiki/The_Moral_Basis_of_a_Backward_Society http://en.wikipedia.org/wiki/The_Moral_Basis_of_a_Backward_S... And truth be told, there has been progress in the fight against the Mafia, just that it's a long slog, not something that's going to be fixed from one day to the next.
- modernerd 12y ago
  Yes, people get jailed for DDoS attacks, at least in the UK. For example, two attackers were jailed for 5 years in 2013 for an extortion attempt and DDoS attack against an online casino: http://www.cnmeonline.com/news/ddos-playground-bully-blackmailers-jailed-for-attack-on-uk-casino-firm/ http://www.cnmeonline.com/news/ddos-playground-bully-blackma...
  - jacquesm 12y ago
    Jailtime for extorting a casino sounds like a good deal.
- watty 12y ago
  Pairing blackmail + DDoS is a guaranteed way to get the big guns to investigate.
  - mhurron 12y ago
    Yes, but for the blackmail part, not the DDoS and then only if the perpetrators are in a country that cares to work with the laws of the victims country.
- malka 12y ago
  If all the ddos goes through a botnet, and the blackmail is done using Bitcoin, it could be really harsh for the authorities to find who is behind the attack.
- alandarev 12y ago
  Heavily depends on company's presence in media and how much pressure the owner puts into it. The reports I submitted with evidence of DDOS and traces to the blackmail'er through IC3 form[1], none were replied. On another side, as bliker mentioned, those are usually kids. Replying to them that you have submitted an official IC3 report usually stops them, and some were even asking to cancel the report. [1] - https://www.ic3.gov/complaint/default.aspx https://www.ic3.gov/complaint/default.aspx
- claudius 12y ago
  Why do you think someone is innocent if they let some third party use their computer without permission? For essentially all malware that makes your computer part of a larger botnet, you have to be extremely careless to let it get on your device, not dissimilar to leaving your car unlocked when it is subsequently stolen and used in a crime (or just misused by playing kids). The latter is illegal[0], why should the former be ok? [0] http://www.gesetze-im-internet.de/stvo_2013/__14.html http://www.gesetze-im-internet.de/stvo_2013/__14.html
  - gedrap 12y ago
    From our perspective - yes, that's pretty silly. But we are different, we are extremely far from the majority. For many many people, computer is just a box for writing stuff in MS Word and watching porn.
    - ksec 12y ago
      Tell dont not to open .exe file in Email. "What is .exe files?" Dont use IE "What is IE? Next time they click on it to get to the Internet" Can You please stoping using XP? "Why should I pay for upgrade when everything i do is working perfectly fine?" Honestly, there are people who dont know Shxt. And they dont want to know about it either. To them even basic computer usage is extremely complex. That is why Tablet, is getting the traction in Grandma and others who dont want anything but a Internet and Application capable Appliance.
      - TheCapn 12y ago
        How much do you know about your car's internal combustion engine and components? Your home electrical? Your home plumbing? Natural Gas? Lawn care? The pumps that fuel your car tank? Not everyone can be an expert in everything. Someone who makes their living perfecting one of those aspects might look at things you do and say "don't do that, you're damaging it" but to you its "who cares? I just need it to work and its been fine up until now!" Computers/software might be your thing but they're not Grandma's so don't push your agenda on someone just because they might have some ignorance you don't.
mwill 12y ago
I was just wondering why I couldn't hop on Feedly. I feel sort of bad that this is what makes me finally self host my RSS reader, since it's totally out of their control, but I've been planning on jumping ship for a while, it's just been low priority for me. Goread has been tempting me though, so I guess I'll check it out.
- madeofpalk 12y ago
  If you were a former Google Reader user, you might like Feedbin. I've been with them for the last year or however long and have been fairly happy.
  - thisishugo 12y ago
    I'll second support for Feedbin. The interface is clean and uncomplicated, it's so cheap that it really isn't worth my time to self-host, and it works with my RSS apps of choice.
  - dyslexicmonkey 12y ago
    How does this solve the problem of another DDoS against some other RSS reader? Are you going to suggest that if Feedbin gets attacked next, to hop to the next product?
    - RollAHardSix 12y ago
      Or he saw the other guy is open to trying different RSS readers and simply made a recommendation.
      - Macsenour 12y ago
        I'm moving TO Feedly since they've already had their attack. Next round would be the some other provider.
        cweiss 12y ago
dewey 12y ago
The original posting on their blog: http://blog.feedly.com/2014/06/11/denial-of-service-attack/ http://blog.feedly.com/2014/06/11/denial-of-service-attack/ > We are working in parallel with other victims of the same group and with law enforcement. Last.fm is also experiencing "network difficulties" for a few days now, I'm curious if they are also on the same group. [0] http://status.last.fm/ http://status.last.fm/
jackgavigan 12y ago
I wonder why they're not using Cloudflare.
- hueving 12y ago
  Cloud flare is a protection racket. Some people don't use them on principle. They are the vendor selling chastity belts to stop rape. It is in their best economic interest that these attacks continue. It's sad that to run a service now the expectation is to shovel money to another service to absorb UDP packets.
  - vdaniuk 12y ago
    It is a protection racket ONLY if they are aiding or doing the attacks. I don't see how protecting a company from DDoS attacks is a protection racket by itself, care to elaborate?
    - sgift 12y ago
      Isn't that an extortion racket when they force you to either buy their service or attack you?
    - nothxbro 12y ago
      From what I have read, Cloudflare takes considerable flack because they willingly provide services to the websites that let you buy and sell ddos-for-hire services. Also, I believe their defense is "we are a proxy, not the host, go elsewhere to complain". So, yes- They appear to allow these booters to exist and thrive in a world where they were unable to (at this level) before. * http://www.webhostingtalk.com/showthread.php?t=1235995 http://www.webhostingtalk.com/showthread.php?t=1235995 * http://www.organicweb.com.au/17240/internet/cloudflare-security-review/ http://www.organicweb.com.au/17240/internet/cloudflare-secur... * http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...
      - Dylan16807 12y ago
deleted 12y ago
[deleted]
coldcode 12y ago
I guess the demise of XP is still a long ways off. If there were no XP users remaining, could there still be enough hackable computers to create a large enough botnet?
- danielweber 12y ago
  Is that really a correlation? Have we seen a decrease in zombie counts as XP machines attrition out?
- xeroxmalf 12y ago
  Considering a lot of intrusions happen via the web browser / plugins installed in the web browser (flash/java come to mind right off the bat), I don't think XP being retired has anything to do with future botnet sizes.
  - aikah 12y ago
    it's a coktail,you cant only blame flash or java,the browser and the os running these stuff shares some responsibility.
    - Dylan16807 12y ago
      Exactly how is the OS supposed to stop an exploited browser from doing anything malicious? Even if you have strict access controls like SELinux, that won't stop a browser from participating in a DDOS attack and changing settings like cache or homepage to get reinfected next session. And if you don't have strict access controls, like 99% of desktops, the exploited browser can freely install all the user-mode malware it wants. So XP vs. not-XP is completely meaningless at this stage.
  - zuck9 12y ago
    Even if everything was up to date, you still can't make sure that you don't get infected. The common hobby for kids these days: finding and writing exploits
- frankus 12y ago
septerr 12y ago
When they said in their post that they were working to neutralize the attack, I started wondering how they are doing that. If anyone else is curious, this article - http://www.infosecisland.com/blogview/22518-How-to-Protect-against-Denial-of-Service-Attacks-Refresher.html http://www.infosecisland.com/blogview/22518-How-to-Protect-a... - briefly describes how DDoS are neutralized.
Sharphunter 12y ago
One of the problems is that the Android app is draining the battery whilst it can't connect to the Feedly servers.
frou_dh 12y ago
How's this blackmail? What secret are they threatening to reveal?
- lebarton 12y ago
  They are probably saying "Give me money or I am going to continue DDoSing your site."
- dan1234 12y ago
  It's not blackmail, just plain old extortion.
- rickyc091 12y ago
  Yep, from their blog. "2:04am PST – Criminals are attacking feedly with a distributed denial of service attack (DDoS). The attacker is trying to extort us money to make it stop. We refused to give in and are working with our network providers to mitigate the attack as best as we can." http://blog.feedly.com/2014/06/11/denial-of-service-attack/?utm_content=bufferf6540&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer http://blog.feedly.com/2014/06/11/denial-of-service-attack/?...
- jasallen 12y ago
  A quick google shows 'blackmail' definition can either be restrictive to secrets as you say or can encompass 'extortion' depending on the definition you use.
dailen 12y ago
Best thing they can do is offer a bounty :-D that seems to be extraordinarily effective
aliasnexus0 12y ago
I've been using Fever since Google Reader shutdown: http://feedafever.com/ http://feedafever.com/ I have put together install instructions here: http://thornelabs.net/2014/05/10/install-fever-rss-reader-on-fedora-rhel-or-centos-with-ssl-and-selinux.html http://thornelabs.net/2014/05/10/install-fever-rss-reader-on...
stevejyim 12y ago
yes.
NicoJuicy 12y ago
I posted it on HN a month ago, but it wasn't popular then: http://selfoss.aditu.de/ http://selfoss.aditu.de/ (yes, it's opensource)
n1ghtmare_ 12y ago
What kind of low life do you have to be to do this kind of crap ? Is this what "hackers" do these days ?
gkya 12y ago
I wonder why nearly every self-hosted alternative RSS-reader here is a web-app; isn't using a desktop-application desirable? Like Firefox, Thunderbird, Liferea[1], Akregator[2], and probably lots of OS X applications? [1] http://lzone.de/liferea/ http://lzone.de/liferea/ [2] http://www.kde.org/applications/internet/akregator/ http://www.kde.org/applications/internet/akregator/
- kingnight 12y ago
  So much of what you're reading in RSS-reader is web content, naturally you'd want to click through things in your existing browsing experience. At least that's how I view it. I'd like to use a desktop-app but find myself never opening running it and instead jumping to feedly/google-reader etc. I'd really like to have a desktop-app w/o web service that sync'ed to my phone which I also like to read rss on.
  - alxndr 12y ago
    Multiple devices is the main reason I rely on a web service.
    - mike-cardwell 12y ago
      That's why I read RSS via IMAP. All of my devices have an IMAP client on them. I have a script which downloads RSS feeds and sends an email to me for each item, which is then filtered into a News folder via a Sieve filter. I spend half my time in my email clients anyway so I may as well get my RSS fix in the same place.
      - alxndr 12y ago
        Interesting flow! Personally I'm beginning to hate email... sorta wish the actually-important stuff in my email were sent to my RSS reader...
  - gkya 12y ago
    My solution was (and still is) using Pocket[1] to read. I absolutely hate reading on laptop/desktop. I instead check out the feeds every so often using a desktop reader (elfeed nowadays, but seeking for sth. else as I'm no longer using Emacs), and save those I want to read to Pocket. This way I do not need an app that syncs my feeds on each device I have, but rather only Pocket on each of them. [1] http://getpocket.com/ http://getpocket.com/
kwestro 12y ago
It looks like they got hit by a second one today.

219 points by chmars 12y ago

ksec 12y ago

Do people really get punished for it? I mean the actual ones behind those bot, not the innocent ones that had their computer hacked without knowing. If yes, how long does it normally take to get them? If At all? Weeks? Months? Years? These days DDoS seems far too easy, far too common.

bliker 12y ago
I quite liked this article about the issue. http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > The shocking thing about these DDoS-for-hire services is that — as I’ve reported in several previous stories — a majority of them are run by young kids who apparently can think of no better way to prove how cool and “leet” they are than by wantonly knocking Web sites offline and by launching hugely disruptive assaults. Case in point: My site appears to have been attacked this week by a 15-year-old boy from Illinois who calls himself “Mr. Booter Master” online.
- ksec 12y ago
  From Wiki "For the time being there are no good technical means to counteract misuse of NTP servers" Sigh
  - ghshephard 12y ago
    Drop all port 123 packets that are heading to the DDOS'd server from anything but the authorized NTP server is a pretty good start.
    - mnw21cam 12y ago
      Where do you drop the packets? If your filter is inside your own network, and your bottleneck is your network connection to the outside world, then you're out of luck. If you can arrange with your upstream internet access provider for them to filter out junk before it hits the bottleneck, then great - but that involves cooperating with people, which may take some time.
      - ghshephard 12y ago
        DDOS is always handled by the upstream by definition.
  - chrisBob 12y ago
    Is there a good reason for someone to want a high volume of NTP requests? How do the owners of these servers not share more of the blame for sending so much data at a web server? It should be straight forward to implement a protocol that each NTP server won't send data to the same ip more than once every 10 seconds regardless of the number of requests.
    - BCM43 12y ago
      It's already been fixed. Newer version of NTP don't reply with more data than it gets sent, so you can't use the server for amplification. It's servers that have not been updated that are issues.
  - kbar13 12y ago
    not entirely true. enabling source filtering in all networks will essentially kill off these UDP amplification attacks, because the attacker wouldn't be able to spoof your address as the source address.
slashdotaccount 12y ago
There will always be people who want to get some easy money and have the brains for that. Instead of playing the cat and mouse game we better take care that our networks are protected from, at least, small to mid-range DDoS attacks. The alternative is potential oppression from the governments - "you fear the bad guys, OK, then we will take some more freedoms from you and improve our surveillance to catch them".
- davidw 12y ago
  There's no reason you can't punish criminals like this and still have a free, democratic, and open society.
  - jacquesm 12y ago
    Criminals work hard to re-invest their money in the upper world. Once they successfully do that punishing them can become very hard. Free, democratic and open societies are far more vulnerable to this than dictatorships, there you are either part of the 'in-group' or you're going to be hunted. An open society makes the assumption that people play by the rules and that those that do not will be caught and can be punished. But in reality that assumption does not hold true. Witness the extent to which the Mafia has been able to ruin your country. They've managed to infiltrate the highest echelons of politics, live like kings and in general are so far above the law that it's farcical. Punishment is for small time criminals. So yes, hackers, burglars, extortionists and so on stand some chance of being caught. But the big fish (in this case, the bosses of the hackers) will likely get away with it while some patsy does time.
    - davidw 12y ago
      Italy is the country where I live, but I'm not sure I'd call it "mine". If it were mine, I'd run it differently :-) I am not a citizen in any event. I think you're wrong in any event: the more open and well run a society is, the harder it is for mafias to really take root. That's why they are stronger in places like Italy than in, say, Sweden: http://en.wikipedia.org/wiki/The_Moral_Basis_of_a_Backward_Society http://en.wikipedia.org/wiki/The_Moral_Basis_of_a_Backward_S... And truth be told, there has been progress in the fight against the Mafia, just that it's a long slog, not something that's going to be fixed from one day to the next.
modernerd 12y ago
Yes, people get jailed for DDoS attacks, at least in the UK. For example, two attackers were jailed for 5 years in 2013 for an extortion attempt and DDoS attack against an online casino: http://www.cnmeonline.com/news/ddos-playground-bully-blackmailers-jailed-for-attack-on-uk-casino-firm/ http://www.cnmeonline.com/news/ddos-playground-bully-blackma...
- jacquesm 12y ago
  Jailtime for extorting a casino sounds like a good deal.
watty 12y ago
Pairing blackmail + DDoS is a guaranteed way to get the big guns to investigate.
- mhurron 12y ago
  Yes, but for the blackmail part, not the DDoS and then only if the perpetrators are in a country that cares to work with the laws of the victims country.
malka 12y ago
If all the ddos goes through a botnet, and the blackmail is done using Bitcoin, it could be really harsh for the authorities to find who is behind the attack.
alandarev 12y ago
Heavily depends on company's presence in media and how much pressure the owner puts into it. The reports I submitted with evidence of DDOS and traces to the blackmail'er through IC3 form[1], none were replied. On another side, as bliker mentioned, those are usually kids. Replying to them that you have submitted an official IC3 report usually stops them, and some were even asking to cancel the report. [1] - https://www.ic3.gov/complaint/default.aspx https://www.ic3.gov/complaint/default.aspx
claudius 12y ago
Why do you think someone is innocent if they let some third party use their computer without permission? For essentially all malware that makes your computer part of a larger botnet, you have to be extremely careless to let it get on your device, not dissimilar to leaving your car unlocked when it is subsequently stolen and used in a crime (or just misused by playing kids). The latter is illegal[0], why should the former be ok? [0] http://www.gesetze-im-internet.de/stvo_2013/__14.html http://www.gesetze-im-internet.de/stvo_2013/__14.html
- gedrap 12y ago
  From our perspective - yes, that's pretty silly. But we are different, we are extremely far from the majority. For many many people, computer is just a box for writing stuff in MS Word and watching porn.
  - ksec 12y ago
    Tell dont not to open .exe file in Email. "What is .exe files?" Dont use IE "What is IE? Next time they click on it to get to the Internet" Can You please stoping using XP? "Why should I pay for upgrade when everything i do is working perfectly fine?" Honestly, there are people who dont know Shxt. And they dont want to know about it either. To them even basic computer usage is extremely complex. That is why Tablet, is getting the traction in Grandma and others who dont want anything but a Internet and Application capable Appliance.
    - TheCapn 12y ago
      How much do you know about your car's internal combustion engine and components? Your home electrical? Your home plumbing? Natural Gas? Lawn care? The pumps that fuel your car tank? Not everyone can be an expert in everything. Someone who makes their living perfecting one of those aspects might look at things you do and say "don't do that, you're damaging it" but to you its "who cares? I just need it to work and its been fine up until now!" Computers/software might be your thing but they're not Grandma's so don't push your agenda on someone just because they might have some ignorance you don't.

mwill 12y ago

I was just wondering why I couldn't hop on Feedly. I feel sort of bad that this is what makes me finally self host my RSS reader, since it's totally out of their control, but I've been planning on jumping ship for a while, it's just been low priority for me. Goread has been tempting me though, so I guess I'll check it out.

madeofpalk 12y ago
If you were a former Google Reader user, you might like Feedbin. I've been with them for the last year or however long and have been fairly happy.
- thisishugo 12y ago
  I'll second support for Feedbin. The interface is clean and uncomplicated, it's so cheap that it really isn't worth my time to self-host, and it works with my RSS apps of choice.
- dyslexicmonkey 12y ago
  How does this solve the problem of another DDoS against some other RSS reader? Are you going to suggest that if Feedbin gets attacked next, to hop to the next product?
  - RollAHardSix 12y ago
    Or he saw the other guy is open to trying different RSS readers and simply made a recommendation.
    - Macsenour 12y ago
      I'm moving TO Feedly since they've already had their attack. Next round would be the some other provider.
      - cweiss 12y ago

dewey 12y ago

The original posting on their blog: http://blog.feedly.com/2014/06/11/denial-of-service-attack/ http://blog.feedly.com/2014/06/11/denial-of-service-attack/ > We are working in parallel with other victims of the same group and with law enforcement. Last.fm is also experiencing "network difficulties" for a few days now, I'm curious if they are also on the same group. [0] http://status.last.fm/ http://status.last.fm/

jackgavigan 12y ago

I wonder why they're not using Cloudflare.

hueving 12y ago
Cloud flare is a protection racket. Some people don't use them on principle. They are the vendor selling chastity belts to stop rape. It is in their best economic interest that these attacks continue. It's sad that to run a service now the expectation is to shovel money to another service to absorb UDP packets.
- vdaniuk 12y ago
  It is a protection racket ONLY if they are aiding or doing the attacks. I don't see how protecting a company from DDoS attacks is a protection racket by itself, care to elaborate?
  - sgift 12y ago
    Isn't that an extortion racket when they force you to either buy their service or attack you?
  - nothxbro 12y ago
    From what I have read, Cloudflare takes considerable flack because they willingly provide services to the websites that let you buy and sell ddos-for-hire services. Also, I believe their defense is "we are a proxy, not the host, go elsewhere to complain". So, yes- They appear to allow these booters to exist and thrive in a world where they were unable to (at this level) before. * http://www.webhostingtalk.com/showthread.php?t=1235995 http://www.webhostingtalk.com/showthread.php?t=1235995 * http://www.organicweb.com.au/17240/internet/cloudflare-security-review/ http://www.organicweb.com.au/17240/internet/cloudflare-secur... * http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...
    - Dylan16807 12y ago

deleted 12y ago

[deleted]

coldcode 12y ago

I guess the demise of XP is still a long ways off. If there were no XP users remaining, could there still be enough hackable computers to create a large enough botnet?

danielweber 12y ago
Is that really a correlation? Have we seen a decrease in zombie counts as XP machines attrition out?
xeroxmalf 12y ago
Considering a lot of intrusions happen via the web browser / plugins installed in the web browser (flash/java come to mind right off the bat), I don't think XP being retired has anything to do with future botnet sizes.
- aikah 12y ago
  it's a coktail,you cant only blame flash or java,the browser and the os running these stuff shares some responsibility.
  - Dylan16807 12y ago
    Exactly how is the OS supposed to stop an exploited browser from doing anything malicious? Even if you have strict access controls like SELinux, that won't stop a browser from participating in a DDOS attack and changing settings like cache or homepage to get reinfected next session. And if you don't have strict access controls, like 99% of desktops, the exploited browser can freely install all the user-mode malware it wants. So XP vs. not-XP is completely meaningless at this stage.
- zuck9 12y ago
  Even if everything was up to date, you still can't make sure that you don't get infected. The common hobby for kids these days: finding and writing exploits
frankus 12y ago

septerr 12y ago

When they said in their post that they were working to neutralize the attack, I started wondering how they are doing that. If anyone else is curious, this article - http://www.infosecisland.com/blogview/22518-How-to-Protect-against-Denial-of-Service-Attacks-Refresher.html http://www.infosecisland.com/blogview/22518-How-to-Protect-a... - briefly describes how DDoS are neutralized.

Sharphunter 12y ago

One of the problems is that the Android app is draining the battery whilst it can't connect to the Feedly servers.

frou_dh 12y ago

How's this blackmail? What secret are they threatening to reveal?

lebarton 12y ago
They are probably saying "Give me money or I am going to continue DDoSing your site."
dan1234 12y ago
It's not blackmail, just plain old extortion.
rickyc091 12y ago
Yep, from their blog. "2:04am PST – Criminals are attacking feedly with a distributed denial of service attack (DDoS). The attacker is trying to extort us money to make it stop. We refused to give in and are working with our network providers to mitigate the attack as best as we can." http://blog.feedly.com/2014/06/11/denial-of-service-attack/?utm_content=bufferf6540&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer http://blog.feedly.com/2014/06/11/denial-of-service-attack/?...
jasallen 12y ago
A quick google shows 'blackmail' definition can either be restrictive to secrets as you say or can encompass 'extortion' depending on the definition you use.

dailen 12y ago

Best thing they can do is offer a bounty :-D that seems to be extraordinarily effective

aliasnexus0 12y ago

I've been using Fever since Google Reader shutdown: http://feedafever.com/ http://feedafever.com/ I have put together install instructions here: http://thornelabs.net/2014/05/10/install-fever-rss-reader-on-fedora-rhel-or-centos-with-ssl-and-selinux.html http://thornelabs.net/2014/05/10/install-fever-rss-reader-on...

stevejyim 12y ago

yes.

NicoJuicy 12y ago

I posted it on HN a month ago, but it wasn't popular then: http://selfoss.aditu.de/ http://selfoss.aditu.de/ (yes, it's opensource)

n1ghtmare_ 12y ago

What kind of low life do you have to be to do this kind of crap ? Is this what "hackers" do these days ?

gkya 12y ago

I wonder why nearly every self-hosted alternative RSS-reader here is a web-app; isn't using a desktop-application desirable? Like Firefox, Thunderbird, Liferea[1], Akregator[2], and probably lots of OS X applications? [1] http://lzone.de/liferea/ http://lzone.de/liferea/ [2] http://www.kde.org/applications/internet/akregator/ http://www.kde.org/applications/internet/akregator/

kingnight 12y ago
So much of what you're reading in RSS-reader is web content, naturally you'd want to click through things in your existing browsing experience. At least that's how I view it. I'd like to use a desktop-app but find myself never opening running it and instead jumping to feedly/google-reader etc. I'd really like to have a desktop-app w/o web service that sync'ed to my phone which I also like to read rss on.
- alxndr 12y ago
  Multiple devices is the main reason I rely on a web service.
  - mike-cardwell 12y ago
    That's why I read RSS via IMAP. All of my devices have an IMAP client on them. I have a script which downloads RSS feeds and sends an email to me for each item, which is then filtered into a News folder via a Sieve filter. I spend half my time in my email clients anyway so I may as well get my RSS fix in the same place.
    - alxndr 12y ago
      Interesting flow! Personally I'm beginning to hate email... sorta wish the actually-important stuff in my email were sent to my RSS reader...
- gkya 12y ago
  My solution was (and still is) using Pocket[1] to read. I absolutely hate reading on laptop/desktop. I instead check out the feeds every so often using a desktop reader (elfeed nowadays, but seeking for sth. else as I'm no longer using Emacs), and save those I want to read to Pocket. This way I do not need an app that syncs my feeds on each device I have, but rather only Pocket on each of them. [1] http://getpocket.com/ http://getpocket.com/

kwestro 12y ago

It looks like they got hit by a second one today.