back

by pentagrama·1y ago·view on hn ↗
The reported alert on the site states:

> Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!

But is this an official message from the company? It sounds odd and unprofessional, especially the "See 31 million of you on HIBP!" part, which jokingly refers to a huge privacy issue for users. Could it also be that the site was hacked, with hackers posting that message in addition to the data breach and DDoS attack?

4 comments
Troy Hunt's tweet mentions the IA getting breached, defaced AND DDoSed. Here it is, in case you don't want to use that site:

>>>

Let me share more on the chronology of this:

30 Sep: Someone sends me the breach, but I'm travelling and didn't realise the significance

5 Oct: I get a chance to look at it - whoa!

6 Oct: I get in contact with someone at IA and send the data, advising it's our goal to load within 72 hours

7 Oct: They confirm and I ask for a disclosure notice

8 Oct: I follow up on the disclosure notice and advise we'll load tomorrow

9 Oct: They get defaced and DDoS'd, right as the data is loading into HIBP

The timing on the last point seems to be entirely coincidental. It may also be multiple parties involved and when we're talking breach + defacement + DDoS, it's clearly not just one attack.

<<<

> The timing on the last point seems to be entirely coincidental. It may also be multiple parties involved and when we're talking breach + defacement + DDoS, it's clearly not just one attack.

It could also be that the attacker has compromised IA communication channels and timed it for maximum dramatic effect and confusion.

very likely compromised comms.

this was coordinated. several archive services hit around the same date. ddosecrets was the first to be hacked, as far as i can tell. span of one week.

here's list of suspects i guess https://en.m.wikipedia.org/wiki/List_of_material_published_b...

It's a thankless job to be always begging for donations to keep something working when the Internet at large doesn't value it as much as it should. And now getting targeted like that? I wouldn't judge them if this is an official communication coming from exhausted and frustrated staff.
Just a reminder that AI tried pivoting to much more clear-cut legitimate piracy, presumably because they got bored or something, and certainly put ‘donations’ toward that effort.

IA is an incredibly valuable resource, but let’s not put them on a pedestal.

heh, if they went 100% "we're operating our service from international waters and won't be taking any DMCA requests" i would donate $1000 on the spot (anonymously, of course, but entirely serious).
What's "legitimate piracy"? As a reminder, the scheme was designed to work exactly like typical lending libraries. Publishers were unable to show any harm, and the only evidence available proved they actually benefited from better sales thanks to the Internet Archive. Authors were clearly benefited. https://www.techdirt.com/2024/09/05/second-circuit-says-libr...

But I agree, no need to put them on a pedestal. Nobody is perfect.

> As a reminder, the scheme was designed to work exactly like typical lending libraries.

Wasn't the issue precisely that they removed that limitation and then never added it again?

Not really. I couldn't locate anywhere in the ruling an indication that the number of copies borrowed at any one time was a factor in the decision.
That's unfortunately exactly what happened though:

> He unveiled the National Emergency Library, a vast trove of digital books mostly unavailable elsewhere, and made access to it a breeze. This good deed backfired spectacularly. Four publishers claimed “willful mass copyright infringement” and sued. They won. On Friday, the publishers said through their trade association that they had negotiated a deal with the archive that would remove all their copyright books from the site.

Source: https://archive.ph/tFMY1#selection-841.212-853.182

And here's the announcement from Archive.org when they rolled out this feature: https://archive.ph/vGoMq

There is no evidence that, under the NEL, more digital copies of books were borrowed than physical copies were (un)available in the closed libraries. I've not re-read all the materials from the lower court recently, but IIRC publishers didn't even bother to argue this point. Did you find any place where the judge relied on this?
The alert is gone now. It appears the attacker compromised their front end deployment