Hacker Newsnew | past | comments | ask | show | jobs | submit | homero's commentslogin

Related, non-causal event: BGP origin hijack of 1.1.1.0/24 exposed by withdrawal of routes from Cloudflare. This was not a cause of the service failure, but an unrelated issue that was suddenly visible as that prefix was withdrawn by Cloudflare.


I'm a bit uneducated here - why was the other 1.1.1.0/24 announcement previously suppressed? Did it just express a high enough cost that no one took it on compared to the CF announcement?


CF had their route covered by RPKI, which at a high level uses certs to formalize delegation of IP address space.

What caused this specific behavior is the dilemma of backwards comparability when it comes to BGP security. We area long ways off from all routes being covered by rpki, (just 56% of v4 routes according to https://rpki-monitor.antd.nist.gov/ROV ) so invalid routes tend to be treated as less preferred, not rejected by BGP speakers that support RPKI.


And because people highlighted it on social media at the time of the outage, many thought that the bogus route was the cause of the problem.


So someone just started advertising the prefix when it was up for grabs? That’s pretty funny


No they were already doing that, the global withdrawal of the legitimate route just exposed it.


How is there absolutely no further comment about that in their RCA? That seems like a pretty major thing...


It's funny all the modern fruit I see is bigger but dry and not sweet at all


You'll get a chargeback when the owner sees it


And if you get too many chargebacks your account gets closed


That's the connector. You're missing the fact that it uses the entirety of the rest of the window


So what? There's people who need remote support


This what

>According to iVerify, once activated, the application downloads a configuration file via an insecure connection, which can result in system-level code being executed. The configuration file is retrieved from a domain hosted by AWS over unsecured HTTP, which leaves the configuration and the device vulnerable to malicious code, spyware and data wiping.


https://xkcd.com/463/

The "unsecured HTTP" is about as relevant as lactose is for a butterfly.


The app isn't used by Verizon anymore.

How long will they keep the domain they used for that?


Huh? Are you really saying that downloading configuration files over HTTP is fine? (I’m really struggling to find a charitable interpretation)


Of course it is. If you want security, you should secure the files (i.e., signatures, public key, whatever), not the carrier pigeon used to send them.


I think their argument is it shouldn’t download any configuration via any connection.


No it's that HTTP means nothing


Of course it's fine. You sign the files


HTTP means nothing


[flagged]


>Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that".

https://news.ycombinator.com/newsguidelines.html


It's crazy if they weren't signing and verifying downloads


How is beer free? I never understood that


It makes more sense to state it as "Free as in free beer", as opposed to "Free as in free speech":

https://opensource.stackexchange.com/questions/620/what-is-t...


Free as in “free beer”. You don’t own the rights to the beer, you don’t have the ingredient list, but it costs no money


> You don’t own the rights to the beer, you don’t have the ingredient list

But beer's recipe is open source, anyone can brew their own. It's a really bad analogy, it should be free Coca-Cola or something.


The idea of "free beer" is if I'm giving away free beer at my establishment during an event, there are restrictions around that free beer. I'm not gonna fill up a tanker truck for you, I'm gonna kick you out if you start trying to resell it, I'm gonna cut you off it you've had too much, you can't get any if you're under age, etc, etc, etc.

It's free, but you can't do anything you want with it. Really it's free to drink on my terms - and that's certainly "free", but it's not "freedom" (as in free speech).


The recipe for soda is also open source - anybody can make their own carbonated soft drink. But I think if someone offered you "free soda" it would be pretty clear that they are offering you a specific soda whose recipe you almost certainly don't know, not the umbrella concept of "soda".


Coca-cola is a type of soda so... I think you're agreeing with me? Kind of hard to tell.


"Free soda" and "free beer" are analogous, if that helps.

Or, since it seems to need explaining, the point is that "beer" is not one thing with one recipe and if somebody offers you "free beer" it is pretty obviously a specific kind and batch of beer.


You hang out with me? You get free beer.


It's crazy to run any power through that. Only safe option are current transformers


Do you have any you would recommend? I'll love you for a link, and like you for a brand name. Not being a dick here, I'm genuinely looking for one that I don't have to lose sleep over installing.



Quality ones inspect the product and have a company that can be sued. Others change their name monthly.


Would be fun on Android


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: