About AI slurping all information. I bet one of the first ideas organisations that spy on population had when the recent AI boom happened was: How about we just train our AI on all the intercepted data and just ask it? Is John Smith a terrorist (for our definition of terrorist)? And the AI would reply: Yes he it, he searched on Google where to buy these ingredients that can be used to make explosives. So then they go and figure out some way to "legally" arrest the guy and obtain more private info. It looks like the guy was buying the stuff because he's got a plot of land to fertilise and an old car to paint. So they ask the AI again. You said John Smith is a terrorist! And the AI would answer. I'm really sorry, I'm doing my best and I'll endeavour to do better in future. After this the agents ask for another billion $ because clearly they need more VRAM.

Proton Mail and iCloud’s hide my e-mail feature allow users to have unlimited e-mail addresses. You can also get unlimited e-mail addresses by running your own e-mail server or using something like Office 365’s business e-mail (costs about $4 per month).

> One could create entirely separate accounts but it's high friction and IIRC the

> same phone number (now a requirement) can only be used for 2-3 accounts.

I've wondered about this. Every Android/ChromeOS device I've ever bought, I had a new Google account created for it (during setup, instead of using an existing account), and only a few actually had phone numbers (I don't generally use smartphones for telephony). Is "Google account" synonymous with "GMail account" these days?

I've had this idea for an experiment where I get such a device (without a simcard), and see how many times I can iterate the Initialize-Device-With-New-Google-Acct-PowerWash-Repeat cycle, and how many Gmail accounts I would have as a result.

I also have my own mailserver and I don't create new accounts, I have a wildcard filter that drops all emails that come to my domain in my inbox. This is of course only viable when you are the only person using the domain, but I just sign up with a new mail address every time I sign up, for example my hackernews account would be hackernews-acc@xx.com That way I have a clear differentiator for every domain.

Yes, but privacy suffers with this approach, because if one of emails ending in @domain.com is tied to your identity, all are.

None of that information is actually private though. Your home address and personal phone number are likely in the public record for any number of reasons, such as ownership records or court filings. Or maybe a Facebook post from 2009 that your mom made. Unless you're one of the 0.00001% of people who do things like rotate your phone number and address annually, it's out there somewhere.

But public vs private is a spectrum, not a binary true/false. My phone number is public because I get sales calls from various companies to it. It's annoying, but bearable. But there's a big gap between that and the New York Times putting my name, number and picture on the front page.

So your home address and phone number aren't private. But they're also not readily accessible unless someone is really dedicated to finding them, so they're not quite public either.

The missing part is the action part.

An email (or phone number, or address) is an identifier. Asking whether this identifier is public or private misses the important thing, which is the action that can be paird with the identifier.

So therefore, there's no universal answer to whether the identifier should be public or private. It's a case by case basis, when paired with an action.

For example, i don't want a shop to see me buying condoms, so shops shouldn't get my email address (or phone number).

There are plenty of countries where all that is public information, back in the day there even used to be a phone book with .. name, phone number, and address. And many countries have this now in digital form.

Interestingly, public U.S. state property records will just disclose where you live whether you like it or not. With as little as your name, a home address is trivial to find.

Phonebooks were a thing not so long ago...

The note currently displayed to my account disputes the claims made in the linked tweet (that the Internet Archive is run by the US government(???)), not the supposed motivation of the attackers.

That said, this just seems to me like the attackers are trying to come up with some justification after the fact to explain why they would go after something as universally beloved as the Internet Archive. Actual pro-Palestine activists are not happy, eg (strong language): https://x.com/Aldanmarki/status/1844155616199413969

The current community notes I see on these tweets just basically say: the Internet Archive is not part of the US government.

You should actually read what the notes say.

It may not even be that nefarious — perhaps they did the hack “for the lulz” then had pangs of conscience afterward and scrabbled around for a (false) excuse.

In any case, the IA was in some cases the only public host of important documents about Palestinian history, which are currently inaccessible, to say nothing about how important the Wayback Machine has been over the past year.

Alarm didn't go off - Russia.

Missed the bus - Russia.

Stubbed my toe - FFS why is it always Russia?

Not excusing it, Russia, China and Iran do make my honeypot's top ten list every month. But then again so do the US, UK and France....

This. Typically HIBP attribution includes the email of the "submitter". Various data aggregators will contact them and buy the stolen data. Everybody wins*.

* Exceptions apply.

Mine isn't, but I've created my account only a week ago, so maybe I've created the account after the breach.

EDIT: Should've read TFA more thoroughly, it says the breach happened before the 30th September. And I created my account around the 2nd October

Mine too.

Yes, without exception. I want to know who is leaking/selling my address, and usually stop doing business with those who do. It also makes filtering really easy. People sometimes have strange reactions when I verbally give them an email address with their company name in it, especially when I'm a new customer.

All you need is a domain and an email provider that allows catch-all addresses, both of which are easy and cheap.

Not the author but yes, I do. It’s trivially easy so why not?

Voluntary sharing, since afaik they don't pay the criminals to get the data. Either the criminals share it directly (fat chance, usually), or someone else bought it and shared it either publicly, privately with HIBP, or privately with someone who then reported it to HIBP

How this specific instance unfolded, time will have to tell. The leak may have occurred in 2020 for all we know at this point

I hadn't seen that one, I love it!

Anything would be better than the current system where you basically just have one source.

Independently ran mirrors all over the world, along with snapshots.

Have the occasional fork or two. Say your from a small town in Northern Illinois. If you have 2 TB of image archives from a defunct local newspaper, it might be good for photography forks even if it wouldn't make sense for the main archive.

People are pirating comic books and cookbooks from the 30s; there are a lot of people in this world, if something goes on the web and you tell everyone you put it there, it's pretty much preserved. It's only law enforcement that kills free availability of everything all the time online, for better or for worse.

With copyright, as individuals we get to trade all of the wonderful stuff already made (and long paid for) for the flood of minute-old shit and sludge inundating us online constantly. It's a bad trade. Maybe copyright should stop encouraging creativity; the answer to how "artists" would get paid post-copyright might be "who cares, quit if you want."

We already have Herman's Head, we don't need any more crap.

Yup. If browsers built in support for magnet links and (on desktop) defaulted to seeding with some capped bandwidth then a lot of centralized hosting platforms would become unnecessary.

“I went to the site to jerk off (to an adult scenario, to be clear) and noticed that it looked like it [the Muah.ai website] was put together pretty poorly,” the hacker told 404 Media. “It's basically a handful of open-source projects duct-taped together. I started poking around and found some vulnerabilities relatively quickly. At the start it was mostly just curiosity but I decided to contact you once I saw what was in the database.”

What a nice guy.

> Create a new email address for every service we sign up for?

Exactly that, yes! Various services like icloud or proton offer "hide-my-email" addresses, or you can use any email service and just leverage a dedicated email aliasing service like SimpleLogin (paid but cheaper).

This way your email addresses are always random, and since these are shared services, the fact that it's random doesn't identify you either. In proton's / simplelogin's case, you can even set the display name used and email first, so from the outside it's not going to appear as strange, or have any real limitations.

If you think about it, modern email services don't really allow for easily testing if an email address is valid or not, so pretty much the only way your email is ever found out is if you share it on. So never share it on. Always share an alias instead. With automated systems, you may even want to rotate it every so often, so that if there's a leak, you can identify not just who leaked, but also roughly when.

Fixed identifiers, like an email address, are terrible, as their lifetime is always significantly longer than whatever context they're being used in for.

Truly unique email addresses and passwords per service is the strongest approach, but there may be alternatives. For instance, Gmail allows address+tag@gmail.com, which will save you from the lowest hanging fruit (block the +tag when it’s compromised to prevent the laziest spam from reaching you). iCloud also allows automatically generating a new email address that forwards to your inbox for a new account when using iCloud Keychain (possibly when using other password managers too, but I haven’t tried).

Using unique email addresses makes phishing attempts extremely obvious…

(No, this official looking email from my bank is fake since it was sent to Grocery@my.domain …)

> Create a new email address for every service we sign up for?

Yes! Just get a domain and have every email it go to you. Mine is something like “@super-secure-no-viruses.email”

Password manager + unique password per site + 2FA for anything of value.

But was that code placed there by IA or by the malicious party?

It looks like it is running the service that was part of the supply chain attacker earlier this year. https://github.com/polyfillpolyfill/polyfill-service/issues/...

> How long does an average hard drive last?

This is a great question, and a state of the art kind of thing.

HDDs are sold with a lifetime drive read/write amount and power cycle warranty, along with usually some environmental operating envelope. read/write relates to the quality/space of the platter, power cycle is usually the actuator & read/write head being reseated/wearing out. Environment is the same as all other devices in a DC.

Most folks replace drives when they die (reads/writes stall or return garbage), or when the warranty runs out. Some will pay for a warranty exception, and some will just use the drive outside of warranty. Depending on how you use the drive, what environment it's in, etc changes how much you can push things.

I'd say anywhere from 4-8 years, depending on how it's used. In many cases it can be cheaper to have a worse environment for your fleet (thus using less power on hvac) and replace devices more frequently.

For archival, if you use tape, it comes out cheaper (~225k) and ought to last longer (~30 years).

I actually find that fairly tame. For a point of comparison, Wikipedia gets ~$150M in revenue a year, an "asset rise" (I presume this is what non-profits call profit?) of ~$15M a year, and is sitting on about a quarter billion in the bank.

Not that they want to, but I think Wikipedia could fund this using their current donations if they wanted. Hell, I almost wonder if one of the big storage providers would do it for free if they could do it in their staging environment so they get real traffic. It would be less good than real backups, but extra copies are still extra copies even if they're unreliable.

If this is a backup, you don't need it to be powered up and available 24x7.

So the question becomes more like "how long does an average hard drive last while powered down and still reliably be able to power back up and be read?".

I'm fairly sure that is a lot longer than the single digit years that'd be the probably answer to your question.

I wonder if there are useful guidelines for long term storage of powered down hard drives? My gut feel is the major failure modes would be electrolytic capacitor failure, bearings sticking as the lubrication ages, and obseleting of the interfaces. I wonder how hard it'd be to find hardware that'd read my Mac SCSI hard drives from 25 years ago?

For that purpose you might want to use magnetic tape like they use in long term archival services

They are cheaper per Gio, and last significantly longer

Backblaze keeps good stats. https://www.backblaze.com/cloud-storage/resources/hard-drive...

1.71% a year failure rate if you care for the hardware as much as they do.

> How long does an average hard drive last? You'd have to spend that 700k every that many years (plus the extra bits you mentioned). Quite an operation actually

You'd have to spend a lot more, because with that many drives, you need redundancy now.

Electricity, bandwidth, and generally running a business is not free. Also for these pay-as-you-go setups you'd need a considerable amount of free space available on demand. That said, it's not an especially cheap option. Hetzner has storage boxes for EUR 2.5/TB/mo (in fixed 5 and 10TB boxes though)

There are people still working on trying to make it happen but it's just a collosal amount of data and filesystems are notoriously hard, so it's very slow going.

From my own personal experience doing distributed archiving with no relation to Archive.org, Filecoin/IPFS's UX isn't quite there yet. They still don't let you serve data to the network from a normal filesystem, you have to let their system ingest all of your stuff so you end up double-storing data or you have to give into everything being stored as inscrutable binary blobs.

That's why I still haven't integrated ArchiveBox with IPFS/Filecoin/Storj, let my data live in a normal filesystem dammit!

I don't want Elon anywhere near Archive.org, please don't give him any ideas. There are plenty of other people in the world with money.

very likely compromised comms.

this was coordinated. several archive services hit around the same date. ddosecrets was the first to be hacked, as far as i can tell. span of one week.

here's list of suspects i guess https://en.m.wikipedia.org/wiki/List_of_material_published_b...

heh, if they went 100% "we're operating our service from international waters and won't be taking any DMCA requests" i would donate $1000 on the spot (anonymously, of course, but entirely serious).

What's "legitimate piracy"? As a reminder, the scheme was designed to work exactly like typical lending libraries. Publishers were unable to show any harm, and the only evidence available proved they actually benefited from better sales thanks to the Internet Archive. Authors were clearly benefited. https://www.techdirt.com/2024/09/05/second-circuit-says-libr...

But I agree, no need to put them on a pedestal. Nobody is perfect.

Yea, it is pretty harmless. I suppose someone might be interested in any books you currently have checked out, but beyond that there isn't much.

If you're a blackhat and you want to be annoying, you can use Stripe tokens to charge your target's customers. The target is the payee, so you won't make any money, but it'll add to the chaos.

https://news.ycombinator.com/item?id=41793081

The undertone was intended to be: that's an insane amount of money, something one with quadruple that amount of experience would maybe earn in a for-profit organisation, but I guess your reaction further proves it's different where you're from

It says it's remote though, so doesn't seem too bad?

> or at least say how confident they are in what they know

This I can very much underwrite. Error bars or rough confidence indicators are missing far too often, also from sites reporting on e.g. benchmark values of hardware they've been testing... such professional organisations yet such basic omissions

That's not easier, that's the same but with a worse scale fit.

If you need free, you need free.

But if you can pay, you want to pay a vendor whose scale is such that you mean something to them while still being mature enough to rely on.

This applies to pretty much everything, not just email.

With Google and Apple, you service needs are overhead and with Google in particular, your value is entirely in them being able to monitor as much as they legally can about your activity.

With Fastmail, Protonmail, etc, you are a customer already and they're invested in making you a bigger happy cuatomer in the future. They have staff that will service your support tickets, you represent profit on their books, and the services they offer you are generally designed for your scale more precisely.

It’s risky to let your online identity be controlled by a single large provider. Distribute out the services you use as much as possible. Use a different email provider from your domain registrar, and different from the providers of any other online account you have.

I'm not 100% sure that that gets you wildcard email addresses that all point to the same inbox, but if they support that, sure!

Would you elaborate why it’s a no-go for you? Just curious for my own sake

I recently started getting "targeted" bitcoin extortion emails that have your home address (or what they scraped from public records) and a picture of Google Street view, but they're all going to the email I used for a now-defunct online grocery

Just like how some people think GitHub is git.

There is no US, there are just a bunch of interest groups. Some interest group definitely wants IA down. I wouldn't be surprised this is a paid attack.

Just for completeness sake and my own opinion based on my own witnessing of history, every political party of every government of every country would love to see all the archives gone. It's easier to twist the truth if one can memory hole reports and make the original source go offline or pressure them to change their words. There will always be individuals that archive stories they find interesting, but many stories are uninteresting until people learn what more may have been left out at a later time as part of a much bigger story. That is when the archives become a treasure trove and big archives sites are the first that people turn to for the original reporting. As a generic example, many news sites will redact what they knew to be false after the vast majority saw their misinformation but they can't redact an archive of their twisted truth. The internet has made it a little harder to control a narrative. It was so much easier to control when it was just a few big newspaper publishers that owned the smaller ones and a few big cable companies that owned most of the smaller ones. They would all literally parrot the same lines.

Curious to see if they go after archive.is next.

People in other parts of the thread say it's Israel. (Which certainly is "aligned with US interests abroad", as the powerful see it anyway). I think it is ridiculous conspiracism, right now anything anyone doesn't like they think Israel is behind it.

The crazy rise of conspiracism in our society in general, combined with Israel really is doing some nasty stuff (but not controlling everything you don't like), combined with the latent antisemitism in most conspiracism.

And I say this as a strong supporter of and activist on Palestinian rights and liberation. Free Palestine. (But there is no reasonable reason to think Israel is behind an IA hack. Or the fact that your mail came late, or anything else except what they're actually doing which is bad enough. Call your senators and tell them to vote for Bernie's JRD resolutions).

If an attractive story takes precedence over fact, then we will repeat the story of a James Bond film. Maybe the one with that bikini scene, bikinis are attractive after all.

Yes. Not the hacker but as a hacker, that's what hibp refers to

Books. (Until they're vanished by publishers. https://www.techdirt.com/2024/06/20/500000-books-have-been-d... )

It sounds like it takes a lot of effort by intelligent people. Why would someone go to effort like that unless it was for something they believed was really important (I can't accept that it's just to show off your cronies / jelousy).

reasonable people disagree on whether some things are positive or negative value.

IA is one of the go-to examples for that. is it good to make every book ever written freely downloadable (as they were trying with their library project a while back), or is that bad? you and i might think the answer is obvious. we might even agree on it. but we would occupy a rather different world if even a supermajority agreed on that question, in either direction.

> He or she is still a clown. What difference does it make who hired him or her?

We completely agree about the perpetrator. My point was if that is the case, it would implicate that IA enemies were going beyond lawsuits.

I'm not sure that placing free long distance calls isn't harmful to the org whose infrastructure you're using for your own benefit, but 2600 (Hz) is a respected hacker magazine and phreaking and Cap'n crunch whistles are seen as cool

Hacking the Internet Archive and only placing an alert with a provocative message, I could see my teenage self do that. My judgment of the character is going to depend on what it turns out they've actually done

Of course, my grown up self (or late teen also, as I've done responsible disclosures back then as well) would rather have seen them do a coordinated vulnerability disclosure, but alas, I just meant to remark upon the "special place in hell" for not having a plan or motive bit

*Edit:* wait, I just saw in the article (I opened the thread before the link was changed) that this quote refers to a DDoS, not the alert() message that the thread was initially about

> the site was experiencing a DDoS attack, posting on Mastodon that “According to their twitter, they’re doing it just to do it.

That's indeed just destructive and not related to (hacker) curiosity...

Is it better to deface a website for ransom or to support a scam than it is to deface a website because you're bored?

The action is reprehensible either way, but if this is truly just an old-fashioned Anonymous attack with no ulterior motive beyond just being bad that's honestly kind of refreshing.

Imagine physically breaking into your local library for the lulz

For all I know, they've given the private data to an organisation dedicated to alerting people about breaches. If they fear that the data may also have been accessed by others, that's not a reprehensible thing to do by itself. Besides the DDoS apparently being from the same author (which seems odd because those ethics are incongruous), I don't know what else they've done so I don't know that it's in violation of what you linked

If god is the good guy and satan is the bad guy - why do bad people sent to hell? They would just chill with the devil laughing about all the DDoS they did for the lulz.

> nah. its politically motivated hacktivists that are pro Palestinian.

This is... the most obvious false flag I've ever seen