Freenode has very recently been under DDoS attack[1] and has been dealing with them for at least a year or more[2]. It seems likely that they're getting the same government treatment as Quakenet. Given that Freenode hosts channels for many open source projects, these attacks aren't just annoying bystanders, they're potentially affecting the progress of our technology.
"It seems very likely that they're getting the same government treatment as Quakenet" is not a conclusion that can be drawn from this blog post or the leak. My understanding based on what I read is that "Anon IRC" is on its own network and QuakeNet has nothing to do with anything except apparently relishing any opportunity to publish a political op-ed. IRC servers (and their users) have been DDOSed from the dawn of time by anyone and everyone.
To put it another way - when a body is found in the woods, you don't instantly jump to the conclusion that it must have been government drones because the government is using drones to kill people in Yemen.
Most DDoS attacks directed at IRC networks are not government related. IRC networks have a long and proud history of being one of the most DDoS-prone targets on the internet.
That's not at all a given. I distinctly recall, for instance, DALnet being the target of crippling DDoS attacks ~15 years ago. IRC servers are incredibly vulnerable in this particular regard.
Just exactly what purpose would the government be serving by DDoS'ing freenode? I would think if they wanted to spy on us they would want the servers up and running and everyone able to connect so they can monitor. Killing the servers just disconnects everyone and if they continue to do it people will find other places, likely more than 1.
>Given that Freenode hosts channels for many open source projects, these attacks aren't just annoying bystanders, they're potentially affecting the progress of our technology.
Some Minecraft servers I know have been getting DDoSed too. I wonder if they are using IRC for the chat backend, and if that is just getting his by these same things?
Elsewhere in this thread, blibble linked to a (nearly five-year-old) blog post on quakenet.org entitled "Trust is not transitive: or why IRC over SSL is pointless" [0].
The article presents arguments that I've heard over and over again in the months since the Snowden leaks began. The argument essentially boils down to "we can't achieve 100% security even with SSL, so SSL is useless" and is completely wrong. It also misses the point.
The argument in the blog post is that, paraphrasing, since Carol can be MITM'd without her knowledge, everything is compromised.
It shouldn't be necessary to utter the phrase "defense in depth" here on HN as I would hope that everyone here is familiar with it. As I commented just six days ago:
> I have locks on my doors but that doesn't mean I don't have a pistol next to my bed.
Let me say that I'm not familiar with QuakeNet. (For the last several years I've only hung out on Freenode and two private IRC networks -- and I use SSL when connecting to each of them.) Freenode, however, has "NickServ" and the two private networks I use have similar functionality.
At the very least, SSL protects my credentials from being "sniffed" when I authenticate to NickServ. Anyone else on IRC can verify that the user with the nickname "jlgaddis" is authenticated and is really me. Since sensitive information is sometimes discussed, that authentication as well as the encryption is critical. Without SSL, it would be much easier to sniff my credentials, authenticate to NickServ using them, and impersonate me on the networks, possibly gaining access to sensitive information that would otherwise not be possible.
IRC over SSL is not pointless. If QuakeNet can't understand that and implement basic security precautions, I don't think they have much room to complain about being attacked.
so we've had a solution to the credential sniffing for 10+ years: our services support AUTH via something very similar to CRAM-MD5.
with that out of the way: you've missed the main point, and that is that it's really really hard (I would use the word impossible but I'm not 100% certain) to secure multiuser chat.
the sheer number of places that could be compromised is so high, that offering a 'secure connection' (which users associate with actually secure online commerce) is dangerously misleading.
we understand the threat model very well, and we recommend that you shouldn't trust us to secure your communications, and suggest something like fish instead.
Trying to shut down IRC on the internet feels a bit like the government is running around attempting to cut telephone wires in the hopes it'll get enemy agents to stop communicating, when all it'll really do is annoy a bunch of innocent bystanders.
> Many of the charges being thrown at IRC users associated with the Anonymous movement are now clear to be identical to the actions of the agency itself.
The state not only has a monopoly on violence, but also apparently on hacktivism.
"We urge the British government to initiate an immediate and thorough public investigation..."
And now, for another caricature of British victim speak:
"Pardon me, Mr. Assailant, would you be a good chap and ask your right hand to stop beating me thus about the face? It's rather painful and I fear it might ruin my good humor."
Albeit unrelated, I wonder when Quakenet is going to realise that SSL for IRC, both server-to-server, but also client-to-server, is a must have in the year 2014, if you are truly care about your users privacy.
we believe it's better to not have it than to do it badly.
the other way to do it would be like freenode: do it quickly without understanding the risks... they used the same SSL cert for every ircd, then they got hacked, and with no PFS, all their past SSL'ed IRC is now effectively in the clear.
I think the government is behaving wrong when it doing the same thing as organized crime that is to run DDOS attacks in order to bring down servers. So when the government attacks platforms of free speech they have a problem with running against the core values of democracy.
Who would work for a government agency like the NSA or GCHQ? Anyone who is intelligent and well-minded must realize that these government agencies stomp on people's liberties in the name of security. I am sure that employees of these agencies come to work every day telling themselves that they are keeping the world safe. But their reassurances to themselves must sound hollow to themselves. I hope everyone working at these agencies realizes that. At least Edward Snowden did.
It saddens me to think that I once applied and actually wanted to work for GCHQ. Fortunately they told me to "come back when you've graduated" and that was enough time for me to come to my senses.
They wanted to stop AnonOps from enabling the planning and execution of Anonymous operations. They bragged that a month after "rolling thunder" that the same nicknames/operations weren't there anymore. It's hardly effective, mostly childish.
I wonder, why DDoS the IRC servers, if you can find out the IP addresses of the "offending" users via /WHOIS and then inject TCP FIN packets to disrupt their connections.
After all the NSA has the capability to do very deep going traffic manipulation as proven with Quantum Insert, so why not use it here?
QuakeNet makes it trivial for a user to hide their IP from other users on the network. If you are registered with Q (a network service) and set mode +x on yourself, you will now have the host username.users.quakenet.org.
/whois doesn't work if you are cloaking your hostname or just connect via tor/vpn or just some random place. Probably easier to just target the central node.
Even assuming there would have been a valid reason for law enforcement to disrupt the communications of those individuals, how could an intelligence agency be justified in doing so?
I don't really understand the point of bringing age into their argument ("overly eager teenagers"), but I tend to agree that DDoSing IRC servers is the lowest form of low. Let us idle in peace!
It is unlikely that "overly eager teenagers" are doing anything other than playing around or engaging in raw, unbacked braggadocio, as is especially the way of the male teenager. It is unlikely that targeting these users, shutting them down, or prosecuting and convicting them will do anything to enhance security, but it will cost the government money, incur an opportunity cost as these resources are wasted while more reasonable (if less sexy) things that might actually have a positive effect are left undone, and, oh, last and most assuredly least from the government's point of view, it may destroy young lives which were quite likely on a track to be otherwise quite productive, computer-savvy citizens. (How many people here can tell tales of early, somewhat-less-than-legal activities before they became productive members of the computer world?)
I've phrased it with "probably"s on purpose; every once in a while a teenager will manage to escalate to the "true threat" level. However I think it is likely such a teen will either A: tend to show up by other, more practical measures or B: slip through a crack regardless; it doesn't justify harassing relatively innocent and frankly naive users, for what is probably little more than the purpose of padding numbers to make your enforcement look good by going for cheap, easy targets, regardless of whether that's good for anybody else.
It's more of a play on 'juvenile behavior', as in, Anonymous DDOSes whoever they don't agree with under the pretense of 'FREEDOM!11ONE' or whatever. Speaking of low.
Is there any actual evidence that QuakeNet is being attacked by governments? Just because they did it in 2012 doesn't mean that's what's happening now.
No, nobody can easily know this - Quakenet's probably still the target of DDoS.
Aren't we getting to the point where we more or less must assume that these kind of things happens? I mean, taking into account all the news we have seen during the past, err, year :-)
Tor allows for rampant abuse and is problematic to prevent. Many IRC networks ban it due to this.
However, the solution is to make it so if you want to use Tor on an existing that you instead connect via a hidden service address, allowing the IRCd to mark you as a Tor user and then allow channels to stem abuse.
we actually don't, the only thing tor specific we do is set to their host to something along the lines of 11223344.tor.gateway.quakenet.org.
OTOH a lot of people do naughty things through tor (e.g. mass flooding) and get caught automatically by the network services, resulting in a large %age of tor hosts being banned for short periods.
Could we leverage a VPN tunnel over short band radio waves? This would allow us to detect a Man in the middle attack, as well as provide decentralized access. The speeds would be slow, and the network could be 'jammed' but it could work for medium distance messaging.
Server-Server and Servier-Client SSL is a thing for IRC. Of course if you operate one of the servers then you naturally see everything that goes through it. Any anybody in the same channel sees everything in that channel, since that is the point of IRC.
IRC clients typically also support DCC, though I am unaware of what the encryption options there are. There are are other forms of encrypted "IMing" however, if you want secure peer-to-peer text chat you should probably look outside what irssi has to offer.
I'm not really clear how you would encrypt an IRC network? Its very nature is one of wide dissemination.
You can use FiSH, but that's really mostly for one to one communication in which both parties are trusted. I suppose you could use it for group chat, but it would become harder and harder the more people that were added (what happens if you trust all of them, but two of them don't trust each other and so on). There are plenty of good options for encrypting real time communication.
Encrypting group chat is a much more challenging issue and one could argue it goes against the whole spirit of IRC.
It's sort of not readable on my desktop, the lines extend off the browser. In Firefox I View/PageStyle/NoStyle. Is anything like that implemented on mobile browsers?
I don't understand - is QuakeNet saying it has unique evidence that it specifically has been targeted by DoS attacks perpetrated by GCHQ, or are they guessing it's the GCHQ based on the report done by NBC?
Specifically, this line:
> as well as wholesale attacks on the IRC servers hosting the network.
It's pretty disingenuous to downplay attacks vs Anonymous as motivated by them "engaging in such topics with an opinion contrary to that of the intelligence agencies". No, that's not agencies go after Anon. Agencies go after anon because of the actual criminal activity.
>Agencies go after anon because of the actual criminal activity.
Where is the due process? There isn't any. Please tell me which actual crimes that some Anons have committed whose consequences are so critical that it justifies the abandonment of longstanding principles of fair governance, and military action to sabotage IRC operations in order to halt the occurrence of said crimes.
rcfox|12 years ago
[1] http://blog.freenode.net/2014/02/turbulence/
[2] http://blog.freenode.net/2013/05/the-good-the-bad-and-the-ug...
skwirl|12 years ago
To put it another way - when a body is found in the woods, you don't instantly jump to the conclusion that it must have been government drones because the government is using drones to kill people in Yemen.
meebi|12 years ago
doktrin|12 years ago
vidarh|12 years ago
rschmitty|12 years ago
coldtea|12 years ago
As if governments could care less...
tomrod|12 years ago
Angostura|12 years ago
jlgaddis|12 years ago
The article presents arguments that I've heard over and over again in the months since the Snowden leaks began. The argument essentially boils down to "we can't achieve 100% security even with SSL, so SSL is useless" and is completely wrong. It also misses the point.
The argument in the blog post is that, paraphrasing, since Carol can be MITM'd without her knowledge, everything is compromised.
It shouldn't be necessary to utter the phrase "defense in depth" here on HN as I would hope that everyone here is familiar with it. As I commented just six days ago:
> I have locks on my doors but that doesn't mean I don't have a pistol next to my bed.
Let me say that I'm not familiar with QuakeNet. (For the last several years I've only hung out on Freenode and two private IRC networks -- and I use SSL when connecting to each of them.) Freenode, however, has "NickServ" and the two private networks I use have similar functionality.
At the very least, SSL protects my credentials from being "sniffed" when I authenticate to NickServ. Anyone else on IRC can verify that the user with the nickname "jlgaddis" is authenticated and is really me. Since sensitive information is sometimes discussed, that authentication as well as the encryption is critical. Without SSL, it would be much easier to sniff my credentials, authenticate to NickServ using them, and impersonate me on the networks, possibly gaining access to sensitive information that would otherwise not be possible.
IRC over SSL is not pointless. If QuakeNet can't understand that and implement basic security precautions, I don't think they have much room to complain about being attacked.
[0]: https://www.quakenet.org/articles/99-trust-is-not-transitive...
blibble|12 years ago
with that out of the way: you've missed the main point, and that is that it's really really hard (I would use the word impossible but I'm not 100% certain) to secure multiuser chat.
the sheer number of places that could be compromised is so high, that offering a 'secure connection' (which users associate with actually secure online commerce) is dangerously misleading.
we understand the threat model very well, and we recommend that you shouldn't trust us to secure your communications, and suggest something like fish instead.
valarauca1|12 years ago
dan1234|12 years ago
Bot-net owners can be disrupted if they can't access the channels their compromised machines are connecting to.
Istof|12 years ago
dmix|12 years ago
The state not only has a monopoly on violence, but also apparently on hacktivism.
Duhveed|12 years ago
And now, for another caricature of British victim speak:
"Pardon me, Mr. Assailant, would you be a good chap and ask your right hand to stop beating me thus about the face? It's rather painful and I fear it might ruin my good humor."
GunlogAlm|12 years ago
ahf|12 years ago
blibble|12 years ago
the other way to do it would be like freenode: do it quickly without understanding the risks... they used the same SSL cert for every ircd, then they got hacked, and with no PFS, all their past SSL'ed IRC is now effectively in the clear.
we are now actively working on the problem for server links, but ultimately believe that having ssl for client connections at this moment in time adds little value: https://www.quakenet.org/articles/99-trust-is-not-transitive...
csmithuk|12 years ago
acd|12 years ago
jostmey|12 years ago
shocks|12 years ago
beedogs|12 years ago
At this point, I think they only hire psychopaths.
simias|12 years ago
meebi|12 years ago
Cthulhu_|12 years ago
a3n|12 years ago
zecho|12 years ago
phusion|12 years ago
mschuster91|12 years ago
After all the NSA has the capability to do very deep going traffic manipulation as proven with Quantum Insert, so why not use it here?
vinkelhake|12 years ago
dewey|12 years ago
pera|12 years ago
Sorry but no, that's not the way they do it....
PavlovsCat|12 years ago
n2j3|12 years ago
jerf|12 years ago
I've phrased it with "probably"s on purpose; every once in a while a teenager will manage to escalate to the "true threat" level. However I think it is likely such a teen will either A: tend to show up by other, more practical measures or B: slip through a crack regardless; it doesn't justify harassing relatively innocent and frankly naive users, for what is probably little more than the purpose of padding numbers to make your enforcement look good by going for cheap, easy targets, regardless of whether that's good for anybody else.
Cthulhu_|12 years ago
driverdan|12 years ago
ahf|12 years ago
Aren't we getting to the point where we more or less must assume that these kind of things happens? I mean, taking into account all the news we have seen during the past, err, year :-)
slipstream-|12 years ago
Not that i've really ever used quakenet myself.
lucb1e|12 years ago
afreak|12 years ago
However, the solution is to make it so if you want to use Tor on an existing that you instead connect via a hidden service address, allowing the IRCd to mark you as a Tor user and then allow channels to stem abuse.
blibble|12 years ago
OTOH a lot of people do naughty things through tor (e.g. mass flooding) and get caught automatically by the network services, resulting in a large %age of tor hosts being banned for short periods.
unknown|12 years ago
[deleted]
cobookman|12 years ago
nsxwolf|12 years ago
adeptus|12 years ago
Crito|12 years ago
IRC clients typically also support DCC, though I am unaware of what the encryption options there are. There are are other forms of encrypted "IMing" however, if you want secure peer-to-peer text chat you should probably look outside what irssi has to offer.
stinkytaco|12 years ago
You can use FiSH, but that's really mostly for one to one communication in which both parties are trusted. I suppose you could use it for group chat, but it would become harder and harder the more people that were added (what happens if you trust all of them, but two of them don't trust each other and so on). There are plenty of good options for encrypting real time communication.
Encrypting group chat is a much more challenging issue and one could argue it goes against the whole spirit of IRC.
Datsundere|12 years ago
TrainedMonkey|12 years ago
fintler|12 years ago
paraboul|12 years ago
a3n|12 years ago
diminoten|12 years ago
Specifically, this line:
> as well as wholesale attacks on the IRC servers hosting the network.
What is this?
vehementi|12 years ago
edit: I'm receiving disagreement downvotes. What's up?
fnordfnordfnord|12 years ago
Where is the due process? There isn't any. Please tell me which actual crimes that some Anons have committed whose consequences are so critical that it justifies the abandonment of longstanding principles of fair governance, and military action to sabotage IRC operations in order to halt the occurrence of said crimes.