383
What's if instead of a dead internet we end up with a dark forest internet (aussie.zone)
submitted 11 months ago by to c/showerthoughts@lemmy.world
81 comments fedilink hide all child comments
 

We all migrate to smaller websites try not to post outside drawing attention just to hide from the "Ai" crawlers. The internet seems dead except for the few pockets we each know existed away from the clankers

you are viewing a single comment's thread
view the rest of the comments
[–] 213 points 11 months ago (21 children)

I have a testing website. I have never gave the address to absolutely anyone, ever. It's not linked with anything. It's just a silly html site living in a domain.

It's still being ping and probed to death by bad actors. No necessarily AI scrappers. But it's dozens or hundreds of http petitions a day for random places all over the world.

There's no black forest. It's all light up and under constant attack, every tree is already on fire.

  • permalink
  • fedilink
  • source
  • hideshow 21 child comments
    •
  • [–] 109 points 11 months ago (10 children)

    That's because it's numerically possible to sweep through the entire IPv4 address range fairly trivially, especially if you do it in parallel with some kind of botnet, proverbially jiggling the digital door handles of every server in the world to see if any of them happen to be unlocked.

    One wonders if switching to purely IPv6 will forestall this somewhat, as the number space is multiple orders of magnitude larger. That's only security through obscurity, though, and it's certain the bots will still find you eventually. Plus, if you have a doman name the attackers already know where you are — they can just look up your DNS record, which is what DNS records are for.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 9 points 11 months ago (2 children)

    Servers which are meant to be secure usually are configured to not react to pings and do not give out failure responses to unauthenticated requests. This should be viable for a authenticated only walled garden type website op is suggesting, no?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago

    There are several things you could do in that regard, I'm sure. Configure your services to listen only on weird ports, disable ICMP pings, jigger your scripts to return timeouts instead of error messages... Many of which might make your own life difficult, as well.

    All of these are also completely counterproductive if you want your hosted service, whatever it is, to be accessible to others. Or maybe not, if you don't. The point is, the bots don't have to find every single web service and site with 100% accuracy. The hackers only have to get lucky once and stumble their way into e.g. someone's unsecured web host where they can push more malware, or a pile of files they can encrypt and demand a ransom, or personal information they can steal, or content they can scrape with their dumb AI, or whatever. But they can keep on trying until the sun burns out basically for free, and you have to stay lucky and under the radar forever.

    In my case just to name an example I kind of need my site to be accessible to the public at large if I want to, er, actually make any sales.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 11 months ago

    I have suggested a couple of times now that ActivityPub should implement an encryption layer for user authentication of requests and pings. It already has a system for instances vauching for each other. The situation is that users of "walled garden" instances in ActivityPub lack means of interfacing with public facing instances that doesnt leave the network open for scraping. I believe a pivot towards default registered users only content service built on encrypted handshakes, with the ability for servers to opt-in to serving content to unregistered users would make the whole network much more robust and less dependent on third party contingencies like CloudFlare.

    Then again, maybe I should just be looking for a different network, I'm sure there are services in the blockchain/cryptosphere that take that approach, I just would rather participate in a network built on commons rather than financialization at it's core. Where is the protocol doing both hardened network and distributed volunteer instances?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 11 months ago

    It's not as simple as "only security through obscurity". You could say the same thing for an encryption key of a certain length. The private key to a public key is still technically just an obscurity, but it's still impractical to actually go through the entire range

    IPv6 is big enough where this obscurity becomes impractical to sweep. But of course, as you said, there may be other methods of finding your address

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 11 months ago (2 children)

    I love your "multiple orders of magnitude". I don't think you appreciate or realise how much larger ipv6 address space is :)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 8 points 11 months ago (1 child)

    I wasn't going to type that many commas for the sake of brevity, but it's 340,282,366,920,938,463,463,374,607,431,768,211,456 possible addresses. I.e. 2^128^. So yes, I do.

    I consider 96 orders (in binary, anyway) as "multiple." Wouldn't you?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 11 months ago

    No need to be defensive. I'm not insulting, I just find it funny :) usually people call that "dozens". But dozens of orders of magnitude really doesn't give the sense of scale.

    You could have 8 billion in habitants in every 10^24 stars in the universe and everyone could still have 42k addresses.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 7 points 11 months ago (3 children)

    Do you know how they find it? Is it just random input of address over and over?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 43 points 11 months ago (1 child)

    Almost certainly. There are only 4,294,967,296 possible IPv4 addresses, i.e. 4.3ish billion, which sounds like a lot but in computer terms really isn't. You can scan them in parallel, and if you're an advanced script kiddie you could even exclude ranges that you know belong to unexciting organizations like Google and Microsoft, which are probably not worth spending your time messing with.

    If you had a botnet of 8,000 or so devices and employed a probably unrealistically generous timeout of 15 seconds, i.e. four attempts per minute per device, you could scan the entire IPv4 range in just a hair over 93 days and that's before excluding any known pointless address blocks. If you only spent a second on each ping you could do it in about six days.

    For the sake of argument, cybercriminals are already operating botnets with upwards of 100,000 compromised machines doing their bidding. That bidding could well be (and probably is) probing random web servers for vulnerabilities. The largest confirmed botnet was the 911 S5 which contained about 19 million devices.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 6 points 11 months ago (2 children)

    I have a DDNS setup. Pretty random site name. Nonetheless, it’s been found and constantly probed. Lots of stuff from Russia, China, a few countries in Africa, and India. A smattering of others, but those are the constant IPs that are probing or attempting logins.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 11 months ago (1 child)

    DNS only translate a string address (www.mywebsite.com) to its IP address (xxx.xxx.xxx.xxx) so that it is easier to remember.

    Bots just try a range of address and they don't need to know your domain name. You could have the most unintelligible domain name in the world, bots would still ping your website because they use direct IP addresses.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •