Hacker News Reader

Comment by blakesterz | Hacker News Reader

"To be brief: Apple's infrastructure is massive. They own the entire 17.0.0.0/8 IP range, which includes 25,000 web servers with 10,000 of them under apple.com, another 7,000 unique domains, and to top it all off, their own TLD (dot apple)."

Wow. I would think it's just impossible to secure all that, and that's not even everything.

View on HN

> I would think it's just impossible to secure all that

You can make sure your village have no spies, you cannot ensure the same for a city. I bet every large enough network is compromised to some degree.

This is the truth. I've worked in large organizations and it really is impossible organizationally to be fully secure. People come and go. Responsibilities change.

The comparison of the city is a really good one.

It's interesting that by owning and using that Class A block, Apple are making it easier to scan for their infrastructure. Moving that to IPv6 and releasing the Class A would help them avoid the preliminary scanning that was performed.

There's also something to be said about migrating internal DNS to a subdomain of apple.com that is only visible internally.

Not solutions to security, but making things harder to scan makes it harder to find the vulnerabilities.

Why do they need 17.0.0.0/8 (16,777,216 addresses) if they only have 25000 webservers? #eattheIPrich

edit: fixed the number of addresses

You can use those IPs for something other than webservers.

But yeah, that a bit much for one company. I'll give hosting providers a pass on owning a million IPs, because they're for the lending out to customers.

a /8 is actually 16M addresses, not 1M.

They probably don't, but there are weirder cases. Ford was allocated 17.0.0.0/8, Prudential 48.0.0.0/8, USPS 56.0.0.0/8

This [0] is a really interesting page.

Companies that have an entire /8 block are AT&T, Apple, Ford, Cogent, Prudential Financial, USP and Comcast.

For some reason the US Department of Defense has 13 /8 blocks.

All others belong to regional internet registries (AFRINIC, ARIN, APNIC, LACNIC, RIPE NNC).

I really don't know why anyone other than the registries needs/deserves/got /8 blocks.

[0]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

Wow Prudential and Ford (if USP is supposed to be UPS, that too) are the odd ducks. At least the others have the internet as a core competency.

My guess as to the answer of “why” is power and leverage. It’s the same as nations claiming physical land. “Maybe we’ll need it, maybe we won’t. But either way, now it’s ours to decide.” Writing that out, do they own those? Can someone take those back?

USP is supposed to be USPS i.e. the U.S. Postal Service. It's still an odd one for sure.

> For some reason the US Department of Defense has 13 /8 blocks.

I did a bit of digging and looks like they're looking to sell:

https://datacentrereview.com/content-library/opinion/1522-th...

They don’t, they just got in early.

Because back in the early days you could get one just by asking and they did?

The internet was just a research project to connect some universities, government sites, and a handful of companies. No one realized where it was going.

By the time it was clear the IPv4 address space would be exhausted it was also clear reclaiming those IP blocks (for which there is no legal basis) would merely temporarily delay the exhaustion - likely by a year or two at best.

#letthemeatipv6

7,000 unique domains seems insane, what could they possibly need all of those for? Unless that includes subdomains, I guess.

7,000 does seem REALLY high, but I can imagine them needing the TLD for every possible spelling of Apple. Maybe applesucks as well. appl3, 8ppl3 and so on. Anything close to apple. Same goes for icloud, and I anything else. I guess you get to 1k pretty quick just covering typo squatters. They must have a team of people just to manage domain names!

It's probably semi-random domain names. Like "auth-8e3fe.icloud.apple.com" type stuff.

That's probably right. A quick internet search shows up domains like applecoronavirus.com and similar, as well as this court case [1] where they acquired a bunch of ipod related names.

I suspect they are only parking those names after recovering them or buying them preemptively. Domain names are cheap, so why not. I don't think that's any argument for the possession of the /8 though.

I remember Google had ownership of duck.com until recently, so they probably participate in the wholesale acquisition of random domains as well [2].

[1]: https://techcrunch.com/2010/01/07/apple-domain-names/ [2]: https://www.theverge.com/2018/12/12/18137369/duckduckgo-duck...

All parked domains could lead to the same IP. A single web server could distinguish which domain it’s contacted for, using the HTTP headers for example, and serve different content (probably all 301-redirects, but to relevant other websites of Apple).

In this case it looks like a lot of them don't have A records at all.

Reply on news.ycombinator.com