Ban the victims
Primary tabs
Submitted by vastleft on Sat, 12/04/2010 - 10:27am
Tags:
So, having your site attacked makes you unacceptably disruptive:
In a statement on its website, the free everydns.net service said that the "distributed denial of service" (DDOS) attacks by unknown hackers – who are trying to knock WikiLeaks off the net – meant that the leaks site was interfering with the service being provided to other users. That in turn meant that WikiLeaks had broken everydns.net's terms of service, and it cut the site off at 3am GMT on Friday (10PM EST Thursday).
Democratic Underground used this "reasoning" all the time (and probably still does). If hordes of Obama apologists attacked you — regardless of how fair or rational your post was — the mods locked the thread and shamed you for posting "flame bait."
All part of our culture of STFU.
- vastleft's blog
- Log in or register to post comments
Comments
You are wrong about the issue
VL,
I'm going to weigh in here because you're confusing a DDoS attack on a domain name server with the failure of an overloaded front-end web server. There is a difference between a domain name look-up and returning a web page request.
EveryDNS.net is a service (free to low-cost) that hosts domain name records on its domain name server. The role of this server is to provide a way for requests for a particular domain to be directed to the correct web server/IP where that web site resides. It itself is probably contracting its server space from one of the big providers.
A domain name server is not a single box in a commercial operation like this. It's a bank of servers that is built to handle a certain level of traffic plus an allowance for spikes. On the user side, your operating system maintains a local cache of the domain mappings to avoid having to hit the main DNS (this is done to make your browsing experience faster) and whatever DNS server the end user is pointed at, usually your ISP, will also maintain a cache of the domains its users are visiting, again, mostly to improve browsing performance. This interim caching behavior is part of what keep the DNS system from being overwhelmed by ordinary traffic.
In contrast, web servers host the actual sites and can vary in complexity from a pretty basic single Linux box with the sole copy of website X running on it to massively redundant farms with fail overs and clustering and much more complicated architecture than we want to get into here. When you're dealing with a free or low cost service, such as what most blogs use, the server infrastructure is not going to be resilient for the sake of a single web site. That's how relatively insignificant amounts of traffic, measured in thousands of users an hour, can crash a web site. There just isn't enough server oomph to answer the requests. If the pipe in and out isn't big enough, if the site is not mirrored and the servers load balanced, if the boxes themselves are low on RAM and disk space, if there are several high-traffic sites already crammed onto a weak box, if something spawns a run-away process that eats up memory, down it goes.
The firepower it takes to bring down a DNS bank is a whole 'nuther kettle of fish. These are by design systems that receive potentially millions of requests an hour and serve very small amounts of information. A DDoS that can do damage to a reputable DNS provider like EveryDNS.net is enormous. The size and scope of these attacks are magnitudes greater than a burst of traffic to a particular blog. These are things that, given enough size and time, can bring down the root name servers that allow the Internet to function.
EveryDNS.Net, by its own account, had a major business decision to make when it became the target for the DDoS. While they are a well regarded provider, they are not in the same league as Network Solutions or Go Daddy or even a major corporation that can host its own DNS. They would have not have been able to withstand a full on DDoS assault. Unlike an attack on the website, which would affect just that site and probably anyone else sharing hardware and where they could have isolated the site content or redirected traffic, this was an attack *on EveryDNS.Net itself* and affected all of their operations.
Wikileaks was not merely "disruptive" - it was taking down hundreds of thousands of other DNS records with it.
DDoS attacks like this come from bots specially configured to bypass DNS caches and hit their target directly. They take out everything in their path, not just the final target. There are bot networks that can be rented by the hour that are bigger than Google. China is notorious for using these kinds of attacks, as was documented in several of the documents that have been leaked.
The fault here is Assange's for not anticipating the ways in which his site would be attacked by the governments he is attacking, and putting together the kind of infrastructure that could stand up to that. So much for him being some kind of cyber-genius.)
Don't confuse simple traffic overload with DDoS on a domain name server. The first is personally aggravating. The second is one of those international dangers that you need a government to help defend against.
Anglachel
I would have said, on a less abstract level....
... that unfortunate as it is, the hosting service is more right than wrong. They're serving many clients they have service agreements with for a certain level of uptime, not just one. This case is no different than Corrente's original hosting agreement, where when I got 3000 (three thousand) hits on one post, that brought their server down, and they turned us off. So I went to the dedicated server we now have, which is more appropriate to our load. If we needed cartel-level security, I could get that too -- with the money to pay for it. If the Internet, or US hosting services, were a public utility, that wouldn't be needed, I imagine, but that's not the case.
On Anglachel's other statement:
see Assange's interview in the Guardian:
Now, you can argue this "worse is better" reasoning is perncious Jacobinism. What you can't argue, if you take the Guardian interview at face value, is that it wasn't "anticipated."
It's also not clear to me how any level of "infrastructure" could protect itself against whatever it is that the US government is doing or is going to do. Rather, whatever protection there is will have to take place at the level of social engineering, rather than technical. Which Assange may be trying to do. For example, one excellent way for an emerging data haven to market itself would be to host for him.
The Guardian interview is also interesting. For example, Assange doesn't present himself as a "cybergenius," but as a front man and an editor. So I don't know what the sourcing on "cyber-genius" is, but to me the only people who can use "cyber-"
without sounding like idiots or marketing weasels are William Gibson and Norbert Weiner.
As if they wouldn't have nixed WL for some other pretext
In any case, I'm still not impressed with the argument that a site under attack is a site that should be killed.
Kind of a "moral hazard," IMHO, like oh-so-nice people not wanting blacks in their neighborhood, not because they're racists mind you, but because they "just don't want any trouble." Somerby took such a position on defending "Ground Zero Mosque" critics -- that people were rational to eschew such "trouble," and I find that argument troubling.
First they came for the Muslim community centers, but I didn't speak up because I wasn't a Muslim.
Then, they came for the sites under denial-of-service attacks....
+1000!!
Amazing how troublesome and inconveniencing those freedom-fighters are/were.
Perhaps the larger argument isn't that a site under attack
should be killed, but the structure of the hosting environments. I don't pretend to understand how the environments work on the technical level, but I don't think it's reasonable to expect EveryDNS.Net to bear the burden of the attacks (whatever the source), esp. not if it causes it to lose other (and perhaps all) its business.
The harder question is, who should bear the burden? On an abstract level, if we think WikiLeaks is providing a valuable public service, and we acknowledge the critical importance the web has as one of the key distributors of information (a public good), then the costs should be borne by all of us -- ie, the government. On a practical level, that's just never going to happen for this type of information.
Somewhere the other day, I saw a blurb about how many, many people are contributing money to WikiLeaks from people who believe in its mission. Also that Assange had backup sites/options. That solves the immediate practical problem, but not the larger one.
Let's say someone had a lot of enemies
Maybe it's an outspoken black Jewish lesbian abortionist with a Muslim-sounding name, and it costs the police a great deal of money to protect that person. Is it fair that everyone has to pay for that police protection?
Should the hated person be fired, since rocks are regularly thrown into the windows of the workplace? Why should the innocent company be forced to bear the costs associated with continuing to employ someone with such expensive enemies? Other companies in that building sometimes have rocks thrown through their windows. Should the hated person be fired to protect their interests?
Should the protection and employment of the hated person be at the mercy of sufficient donations to cover the costs?
You're presuming that the source of the bandwidth spike is known
but it in fact it isn't.
From the outside it's known, because we read it in the papers (ha ha). From the inside of the hosting companies, things look very different.
For example, corporate assaults take place all the time, and there are well-known procedures to deal with them. These procedures are very expensive, as they should be.
So, from the hosting company's perspective, how are the two cases to be distinguished? The "good guys" spike from the "bad guys" spike? When there's collateral damage to bystanders either way?
If your argument is that the Internet should be organized as a public utility, instead of privately.... But that's not your argument.
Re: good guys/bad guys and known/unknown spike sources
From the original post/referenced article:
By your reasoning, if Corrente is driven off the net by its enemies, it's your own damn fault for not paying enough, and your DNS listing should be cut off for good, yes?
The frequent attacks that have periodically pushed Chris Floyd off the net are his fault, because he's not paying enough, and his DNS listing should be cut off for good, yes?
Unfortunately, yes, those are the harsh rules
If you want to argue for the internet as a public utility, the rules will change. But you're not making that argument.
I agree with you on the moral argument, assuming there's some way to distinguish good guys from bad guys (and get to the net damage when third parties are taken into account). But right now... It's spinning wheels. Justice doesn't enter in, and it's still not clear to me, from your posts, operationally how it could.
NOTE From my experience, the source of usage spikes is not always known. That's how a DDOS works. Parsing the ISP's statement, they're really just putting 2 + 2 together from the papers. But not every DDOS gets into the papers! So my question remains: How does the hosting service know? And if one can't separate the accounts who "deserve" to be protected from those who don't, how do you protect everyone and stay in business?
Of course it's fair
Regardless whether the focus of violence is black Jewish lesbian abortionist with a Muslim-sounding name or someone we all revile. I'm not sure of the point of your question. Perfect fairness would be if we could place all the costs on the perpetrators, of course, but that's not practical. For one thing, there are many crimes for which neither the victim nor society can ever be "made whole". And while it may not be ideal fairness for the public to bear the costs of crime, it's certainly more unfair for the victims to bear the whole burden.
One thing that distinguishes crimes from other kinds of legal wrongs is that they are actions which wrong not just the victims, but against society as a whole. Basic personal safety IS a public good. In an ideal world no "innocent" victim or entity would have to pay the costs of crimes, but where that's not possible we have to turn to the next most fair alternative.
As for the firing example, pretend that your outspoken black Jewish lesbian abortionist with a Muslim-sounding name works not for a nameless company, but for a heroic non-profit which valiantly battles for human rights across the globe, but now no longer can engage its basic mission because of the harassment. It's failing all the other victims of human rights violations. Who should bear those costs, the nonprofit or all of us? Would you really advocate making the nonprofit destroy its mission?
In the WikiLeaks example, the basic problem is not the service, it's the attackers. When you can't identify the violators, the solutions aren't going to be perfect. So what would you do, require them to keep WikiLeaks on at the cost of destroying their business?
The example of DU is not apposite in the this case, because there there are alternatives to punishing the "provocative" poster. The attackers are known, for one thing. For another, halfway decent moderation would redress many instances. Perhaps the site managers could have suspended posting until things calmed down. DU was motivated to shut you down because they didn't like hearing your premature correctness.