Archive.today is directing a DDoS attack against my blog?

3 days ago (gyrovague.com)

previously https://news.ycombinator.com/item?id=46624740

It is academically very interesting to think about this in light of their long-standing dispute with Cloudflare (https://community.cloudflare.com/t/archive-is-error-1001/182...) over EDNS, which could have privacy implications attached.

I think no matter how you slice it though, it's unethical and reprehensible to coordinate (even a shoddy) DDoS leveraging your visitors as middlemen. This is effectively coordinating a botnet, and we shouldn't condone this behavior as a community.

  • It's definitely interesting to see this roll around since the only individuals that see the CAPCHA page mentioned, are users of Cloudflare's DNS services (knowingly or not).

    P.S. Shout-out to dang for dropping the flags. I have a small suspicion that their may be some foul play, given the contents...

    • > the only individuals that see the CAPCHA page mentioned, are users of Cloudflare's DNS services

      I don't think this is true. I run my own recursive DNS resolver, and get a CAPTCHA when visiting archive.today.

      4 replies →

This likely means nothing, but the .is webmaster seems to have some sort of existing issue with Finland (where gyrovague is from), see https://news.ycombinator.com/item?id=37011955. I thought I would point it out.

Also, as someone interested in OPSEC and OSINT as a hobby, I find the measures taken by the .is webmaster, especially the dedication to setting up countless fake accounts for each persona, to be very intriguing. I spent about an hour looking into the Nora Puchreiner persona and all the accounts registered to it that I could find. It appears that "Tomas Poder" is another alter-ego used by the .is administrator. Nora also seems to have a sister: "Sara Puchreiner". Again, all very interesting and I can't seem to make a clear picture of the situation.

  • There are multiple reports of these archive.something sites redirecting users to Russian sites. Personally, I stopped using them after I saw one connection attempt to yandex dot ru

  • > Finland (where gyrovague is from)

    They should probably review existing case around how Finnish courts treat the journalistic exception in the context of citizen's journalism (as he relied on that at least as one of the reasons): https://tuomioistuimet.fi/hovioikeudet/ita-suomenhovioikeus/...

    Of course facts are different, but at least two Finnish court seem to require a lot more reasoning from the controller in the context of citizen journalism compared to traditional media when they want to invoke the journalistic exception. No clue which side this would fall into.

It's a puzzling situation:

- The DDoS was certainly unethical and unneeded

- Although the blog post only shows an extremely one-sided version of the story by skipping straight to the threats, there are reasons to think that diplomacy has also failed terribly

- The website owner has all eyes of the "thought police" on them, and given the current political situation in Russia, it's more than likely they reside somewhere where it has real power; realistically speaking, who wouldn't be losing it?

- The blog post is preserving information that could aid further investigations even if purged from the original sources, and reveals non-OSINT information in the follow ups

- At the same time, it's, to say the least, hypocritical of the archive.today owner to attempt forcefully taking the original post down, when archive.today itself is an OSINT tool

I don't think there's a way to fairly untangle this mess anymore.

Hence, I'd focus on the possible outcomes: do we want archive.today taken down over this? Who would lose and who would benefit the most from this takedown?

  • Gyrovague here. As linked in the blog entry, you can view both sides of the email correspondence here: https://pastes.io/correspond

    As for outcomes, I'm very much a bit player/spectator in this drama, nobody's going to be "taking them down" over DDOSing an obscure nerd blog.

    If they do go down, it'll be the FBI or equivalent, and it will be publicly justified as some combination of "protecting the children" (cf. WAAD) and/or copyright violations.

    • > As linked in the blog entry, you can view both sides of the email correspondence here: https://pastes.io/correspond

      Thanks, I must have missed this.

      > [...] nobody's going to be "taking them down" over DDOSing an obscure nerd blog.

      > If they do go down, it'll be the FBI or equivalent, and it will be publicly justified as some combination of "protecting the children" (cf. WAAD) and/or copyright violations.

      Yes, this is exactly what I fear. That we might be playing into the hands of the greater evil by escalating a small, personal conflict.

  • > Do we want archive.today taken down over this?

    I don't think that's on the table. I would say use this as your incentive to support archive.org, who has proven much more accountable. Archive.Today is weaponizing their traffic, and reducing traffic is the best way to deal with it. Vote with your feet.

    • I don't think these two are exactly equivalent.

      Internet Archive is a registered non-profit organization. It is more trustworthy and accountable, but it cannot realistically stand against government-imposed censorship. We've seen this unfold before with Twitter and Meta, partly with Telegram.

      Archive.today may be similar on the surface, but if you take a closer look, it's actually an underground "evil twin" that has all the right tools to publish information the governments and the largest of companies want silenced.

      Ideally, there would be no such information in the first place. However, the reality is that this classification has only been broadened to cover more content since the invention of the Internet, regardless of which political parties are in power. The fact that the owner of Archive.today is chased by the FBI even though the website already blocks archival of the kinds of content all of us would unanimously find disturbing speaks for itself.

      1 reply →

    • There is a perception that the use of the archive by the HN community has some positive value for the archive.

      But in fact:

      1. HN uses a free service that someone else pays for.

      2. HN abuses its paywall bypass function, which is not its main function, is not advertised (unlike 12ft).

      3. HN creates legal problems for the archive by highlighting and framing the archive as a paywall-circumvention tool first.

      4. HN promotes doxing.

      Who would be more motivated in reducing traffic here?

    • archive.org supports DMCA. If you don't like some information in the Wayback Machine, you just have to send a form email and it will be removed from the Waybaeck machine.

      archive.today/is/ph is adversarial. It archives things that don't want to be archived. That's why Trump's FBI is trying to unmask it.

Archive.today does not seem to have worked for people connecting from Finland since mid-January, it just gives an endless captcha loop. Is this related to whatever this drama is?

  • I would assume so. I can see from my browser history that i succesfully submitted captures to archive.today on 7th of January, but failed to do so starting from 12th of January. IIRC they contacted gyrovague around the 10th so seems unlikely to be a coincidence. Applies to VPNs as well. Tried first with a VPN located in Finland and it gets endless captcha loop, then with a Swedish VPN which let me through to the front page after solving one captcha.

  • I’d give it a high probability, especially when the CAPTCHA loop is the bit of the site that causes the DDoS and the fact that the admin seems to consider all Finns nazis.

… seems like we the HN community should find a new site to mirror with.

  • There isn't one. As far as I know, no one really knows for sure how they bypass all these paywalls. (Most credible theory I heard: They actually just pay for the subscriptions.)

  • I think there are multiple hurdles that make a new competitor very unlikely.

    The first one is money. You need lots of it to run such an operation (servers, IPs, paying to bypass all these paywalls, etc.).

    The second one is the legality, as no one wants to be hunted by the FBI, especially not for running a website that is also losing money.

Why is this flagged?

Given the content, I find this suspicious.

  • I didnt flag the article, but anecdotally, I was initially unable to load the article at all. It mentions how it ended up in an adblock list. The article makes it sound like this is a good thing, as it stops the DDOS, but it isn't preventing people from loading the page directly. That may be true for people using an adblocking extension, but my adblocking DNS seems to be blocking it based on that same list. I had to manually tweak my dns-based adblocker to allow the domain in order to read the article.

  • I looked at the flags and they seem to be legit flags from legit users. My guess is that they thought this was below-the-radar drama that wasn't on topic for HN. (I could make a "people who flagged X also flagged" list a la https://news.ycombinator.com/item?id=46771900 to support the point, but it's a time-consuming pain so I'd rather not!)

    Edit: after looking at this more closely, I have a counterintuitive (to me at least) take: I think this is interesting enough to transcend the usual categories. That is, we'd normally downweight this kind of post off the frontpage - but in this case there are so many unusual variables that the usual rules don't apply.

    I say this despite having zero clue what's going on here. We do have a nose for what the HN community might find interesting (we'd bloody well better after doing this job for so long), so let's override the flags and see what happens.

    But without relitigating WWII please.

Archive sites are very important for freedom due to many different entities out there attacking sites and getting them taken down.

Unfortunately Archive.today complies with these attack requests in some situations, but is still usually better than others.

  • >Unfortunately Archive.today complies with these attack requests in some situations, but is still usually better than others.

    Use Onion version :D

    • Thanks so much for the tip.

      Placing the link for others:

      archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion

      Fingers crossed that it works!

Stupid question, but CORS is designed explicitly to defend against this type of side-surf attack. Adding a strict cors policy should fix this, or am I missing something?

  • Not here, though. The exact code:

      fetch("https://gyrovague.com/?s="+Math.random().toString(36).substring(2,3+Math.random()*8),{ referrerPolicy:"no-referrer",mode:"no-cors" });
    

    "no-cors" means the request will not be preflighted, but also that JS will be denied access to the body. But the body doesn't matter here — the attack only requires the request be sent.

    But more to the point, so long as the request meets the requirements of a "simple request", CORS won't preflight it. GETs qualify as a simple request so long as no non-CORS-safelisted headers are sent; since the sent headers are attacker-controlled, we can just assume that to be the case. In a non-preflighted request, the CORS "yes, let JS do this" are just on the response headers of the actual request itself.

    Since GETs are idempotent, the browser assumes it safe to make the request. CORS could/would be used to deny JS access to the response.

    Things are this way b/c there are, essentially, a myriad of other ways to make the same request. E.g.,

      <img src="https://gyrovague.com/?s=…">
    

    in the document would, for all intents and purposes, emit the same request, and browsers can't ban such requests, or at least, such a ban would be huge breaking change in browsers.

My tinfoil guess is archive.today is compromised by a state actor. Simply shutting it down would cause too much drama. Instead turn it into villain, and then take it down.

Why does this say it's been posted 8 hours ago but on hn.algolia.com is archived 2 days ago, also I'm sure I already saw it yesterday.

Temporarily see if you can put the blog behind a cloudflare or something using their DNS service.

Whatever is going on here, is so magnificently complicated: sockpuppeting, doxxing, ddosing, psyops, pirating, FBI, cyberpunk capitalists, Russian hackers and Finnish activists. Somehow it does feel like in the middle of information war.

  • When I read the original article it doesn't really feel like the Finnish guy is even an activist. He seems to be just a curious nerd who wrote one article about this topic (who's behind this big site that everyone uses) and about a whole load of completely unrelated and non-activist topics like why did Japan stop building subway lines. Then his blog gained some traction because of the reporting around the FBI threats.

    The article is also really appreciative of archive.today. It doesn't feel like a hit piece at all.

I reported a few times to the owner of archive.is/archive.today that he was hosting dox of a friend and he never cared. So, too fucking bad that he's the one getting doxxed now. A bit of karma.

  • Yep, I have heard of many such cases and I know someone affected personally. For someone who refuses to take down the personal information of others this is extremely hypocritical.

Why were you trying to dox the archive owner?

> Well, I wish I had one, but at this stage I really don’t. The most charitable interpretation would be that the investigative heat is starting to get to the webmaster and they’re lashing out in misguided self-defense.

I don't think they're lashing out in self-defense. This is a harmless way for them to get attention, which is what they're desparate for because the FBI is after them at the behest of Bezos and other billionaires who control the paywalled media and don't like archive.today's role in making them accessible. The only thing that could possibly save them (though it almost certainly won't), is gathering as many eyeballs as possible from the people who like the service. HN having a super high concentration of those. Almost every paywalled post here has an archive.today link in the comments.

That's also why they posted about it on HN, explicitly under that name. To get HN eyeballs.

It's intentionally harmless because, as you confirmed, it's not costing you any money or resources.

[flagged]

  • Please, let's not re-fight WWII on HN.

    We know that the impact from that time is far from worked through, but to the extent it shows up here, commenters should make the effort not to fall back into war mode.

    You're welcome on HN, and so are the users you disagree with—but you all (i.e. we all) need to stay within the site guidelines when discussing tough stuff. These include: "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive." - https://news.ycombinator.com/newsguidelines.html

    p.s. This comment is not just for the user I'm replying to but everyone else who's expressing strong feelings below. It's amazing, and totally human, how alive these feelings are after 80+ years, but at the same time, 80+ years of distance should give us the ability to relate to each other a little bit better than our grandfathers and great-grandfathers were able to.

  • > Finland was one of Germany's most important allies in the attack on the Soviet Union, allowing German troops to be based in Finland before the attack and joining in the attack on the USSR almost immediately.

    I wonder, why on earth would Finland have any hostility towards the USSR in 1941? It beggars belief!

  • OTOH, after trying to conquer Finland in 1939-1940 Russians definitely have no moral right to judge Finns.

  • OP here. I obviously registered to post my own blog entry.

    You might also want to read your own link:

    https://en.wikipedia.org/wiki/Siege_of_Leningrad#Finnish_par...

  • Could it be that Germany was the only nation willing to help Finland fight the Soviets?

    From Wikipedia

    > Interim peace > ... > Defensive arrangements were attempted with Sweden and the United Kingdom, but the political and military situation in the context of the Second World War rendered these efforts fruitless. Finland then turned to Nazi Germany for military aid.

    https://en.wikipedia.org/wiki/Finland_in_World_War_II

[flagged]

  • Their admin is a member of HN but I've never seen them reply to these threads. [edit] Perhaps they could share their perspective on what has been done thus far to mitigate the problem.

I feel bad for the archive.is guy/girl.

It's clear the doxxing attempts are getting closer now to his/her real identity. On the other hand, they do something that's really useful to so many, and it will be sad if it's gone.

gyrovague-com: posted this thread, claims to own the blog

gyrovague: claimed to own the blog in the last thread

rabinovich: posted last thread linking to gyrovague.com, identifying the owner as... well... "Masha Rabinovich"

I believe these accounts are all connected.