Hacker News Reader

Comment by ttul | Hacker News Reader

I run a cybersecurity company and I’ve had drinks with Krebs at various events over the years. He’s the real deal, digging up dirt on the people who ruin everything for everyone and risking his life in the process for a minuscule payoff. I don’t know why he does it; I suppose it’s just the journalist’s passion. A really nice guy in person too.

View on HN

As a testament to his effectiveness at digging out the various online scammers, Akamai "had to" boot Krebs off of their service - the criminal gangs wanted him and his website out of the picture, and directed enough DDoS volume to overwhelm Akamai's ability to handle the load.

IIRC Google intervened and offered to put him behind their shield system. Which I think tells more about Akamai than anything else. (Krebs's website address resolves to a Google network space.)

In a fit of irony, even sometime after that event, Krebs's website still sported Akamai's DDoS protection service ads.

To be fair to Akamai, they were providing their services to Krebs free of charge.

Sure, as a business decision it must have made perfect sense at the time - Akamai had bigger (paying) customers to protect. But that doesn't make the optics around it any less terrible.

The message they were telegraphing with their combined actions was effectively: "We protect some of the largest corporations on the planet... but do not have the resources to keep an individual journalist and blogger online. Your business could be next."

Whoever made the decision to pull service to Krebs should have also thrown their weight around to get those ads off of Krebs's website, because the compound outlook must have been hideous. (How do you get your ads off of a website without causing any more animosity? You quickly renegotiate an exclusivity deal and then choose not to run any ads at all on it.)

Heavy is the head that wears the crown (or offers mitigation services advertised on a cybersecurity website)

If Akamai can't (or won't) serve Krebs, I'm not sure I would want my business to pay them.

Can't edit now, but a point to this I'd like to add: 'serve' could absolutely mean best-effort (ie: filtered, moved, null routed, whatever). I don't intend for compulsory weathering-of-the-storm (for the sake of PR), but rather... recognition that this is part and parcel with The Business.

Maybe they/partners couldn't weather the storm. Report on it; Engineering blogs are all the rage. Being a CDN involves more than serving well-traveled bytes, getting paid, or touting how big of a reseller you are. Cat must chase mouse! Krebs is arguably the best customer for this; not e-commerce (can endure the worst outcome - no service) and has domain expertise.

If I enter a protection scheme with someone who - after all - isn't all that tough... why would I/anyone continue? The internet is a big place.

Unless you have direct 1p knowledge Im very skeptical of framing that as a capability or capacity problem (“had to” “overwhelm” etc). Im very confident it was purely an effort vs benefit discussion. Which isnt too hard when the benefit is an intangible good will.

Ive worked for a very large CDN, and Ive both unilaterally removed a customers access and involved in even more awkward “inviting them to use another provider more suited to their use case” discussions with account managers, PMs, legal, etc. There are a multitude of unsurprising reasons those things happen, even for credible and legitimate paying customers. It was _never_ because we were “overwhelmed.” However attracting a high operational burden or cost burden would certainly play in to the _business decision_.

As a trivial example a transparently online gambling site with nominal jurisdiction somewhere difficult in asia may generate very legitimate traffic and even pay their $20 or $200 bill. But that revenue isnt worth the cost of scaling up our network edge all across the AP for unmetered junk bits directed at their distribution, burning goodwill with peers when _their_ network gets blown up, or driving more operational and security load as their gambling site competitors employ more novel and bigger attacks. Simply put not all business is worth it, and you dont have to accept all customers. Part on reasonable terms when possible and apply by relevant laws. Thats the actual obligation.

While I don't have immediate first-person knowledge, the event and decisions were widely reported at the time.

https://www.zdnet.com/article/krebs-on-security-booted-off-a... -- note the quote, in particular

https://www.theregister.com/2016/09/26/google_shields_krebs/ -- "could no longer shield the site without impacting paying customers"

Krebs's own post from the time does not reference the business decisions, only the technical aspects: https://web.archive.org/web/20160922124922/http://krebsonsec...

"without impacting paying customers"

This all makes sense. But then since Google is not a benevolent entity either, why did Krebs make sense as a customer for Google and not for Akamai?

Very good PR that will get shared in the groups like this one, where some of us are in decision making tables for purchasing such products?

Every company I've worked for has certain clients/customers that the company would (for various reasons) be better off financially to no longer have those clients/customers. At some point, those internal conversations become much less awkward as every realizes the reality of the situation. Those companies that had to undergo bidding processes usually fixed the glitch at that time by making very noncompetitive bids.

Even worse in health insurance.

I didn't realise Krebs was a person, I thought it was a collection of people using a unified moniker. To your point though, we're lucky to have 'unreasonable' people like him, I know I don't have the courage

His first name is Brian. That’s his picture at the top. I can’t think of any other groups or organizations that have the persona of a single person. Can anyone point to an example? Genuinely curious about this.

I think it’s on the down low when that’s done.

Does "Nicolas Bourbaki" count?

https://en.wikipedia.org/wiki/Nicolas_Bourbaki

This is IMO an excellent example, and the one I came to post.

I always felt Banksy was a collective of artists.

Banksy is one person but he does have a team that executes most of his projects for/with him.

How do you know?

Well, for one, he can't film himself installing, e.g., fake artworks in the greatest museums in the world, as he did.

And, for those who don't know, he is from Bristol, England, the home of the band Massive Attack. I've been digging their music lately, especially their songs with the late Sinead O'Connor.

There's multiple interviews from over the years with people that worked very closely with him, including the person who was his publicist for a long time (or a very similar role, I forget exactly). You can obviously decide that it's all part of some long game of deception but it's just not needed. No one is trying to arrest him here and they haven't seriously wanted to for over a decade, he's become an institution like baked beans.

There’s video of the creation of the death of a phone box piece in his documentary and it was indeed a team of a few people.

trump

I always thought Krebbs was a cybersecurity firm organized like a lawyer's or dentist's office, where there is one senior person on the cover but they are rarely involved with individual pieces of work. Crazy to learn it is just one person actually, they do a lot of good work.

Previously, McAffee (John McAfee) and Norton (Peter Norton).

What about Kaspersky?

As it happens, Kaspersky was founded by three people, two of which are Kaperskys.

For my mind they also haven't really traded on the 'individual security hero come to save you' person(which Norton definitely did in the early years).

Peter Norton also put his photo on the box of AntiVirus.

Anything Elon Musk owns?

The "Tyler Durden" author on ZeroHedge.

Using that name specifically has a bit of a different connotation than a generic one with no previous association like "Brian Krebs", though. If anything, it would be _more_ surprising to find out that someone going by the name Tyler Durden was just a single, regular person rather than something else going on.

We don't know but some argue Banksy could be a team effort by now, part of the allure of anon work

Same with Shakespeare, though that might’ve been disproven

Mavis Beacon.

I'm not parent, but at some point McAffee could refer to either the person or the company in the past.

Whenever I read a Wolfram blog post that floats to the HN frontpage, I'm never certain if the post is entirely the effort of just Stephen Wolfram, or is a group effort.

Happens in some artistic fields. Rodin didn't personally sculpt all of his sculptures. He directed the effort, but it was too much work for one person. I've seen Tom Clancy novels continue getting published even though he died over a decade ago. I think there are living authors doing the same thing, farming out production to ghost writers and just signing their name to the end product.

There are famous examples in advice columns, sort of. I don't know that any of them have ever been written by different people at the same time, but they've maintained stable personas and names even as the writers have moved on or died. The original founder of the Dear Abby column was famously the twin sister of the second iteration of Ann Landers and they feuded for the rest of their lives over it. They're both dead now but the columns go on using the same byline name.

That Cringely guy who used to post an IT column.

Cringely used to be a house name (cf. https://en.wikipedia.org/wiki/Pen_name ) until one particular writer who had done most of the work managed to wrest it away for his use (https://en.wikipedia.org/wiki/Robert_X._Cringely )

Previously, Ray Wenderlich.

He also doxxes random people just because their tool got abused as malware.

There's a German community donating thousands to cancer research each year because "fuck Krebs" (Krebs means cancer in German).

Pr0s js crypto miner?

Reply on news.ycombinator.com