A closer look at a BGP anomaly in Venezuela
blog.cloudflare.com
blog.cloudflare.com
Cloudflare's post is pretty boring here in that regard. They dig into how BGP works and propose that similar leaks seem common for the Venezuelan ISP in question.
Sure they could be wrong or even actively hiding the truth of what happened here, but the article mentions nothing of Cloudflare being involved in the action and they're describing a networking standard by pointing to publicly available BGP log data.
What am I missing here that everyone else seemed to zero in on?
Or it's just Russian and China socket accounts? Who knows...
Combine that with the news of Trump publicly admitting that the US is willing to take military action to bring other countries in line, even against their own allies: https://edition.cnn.com/2026/01/06/politics/us-options-green...
Personally, I don't think the Americans would bother hide their attack and make it look like an accident under the current regime. Trump would announce the CIA/NSA/FBI/whatever did the Greatest Attack, and Amazing Attack, to Completely Control and break the Weak Government of Venezuela to Rescue Their Oil. I'll believe the "it was just a misconfiguration" explanation for now.
I think it only makes sense that people start fearing the influence of American companies given the current developments. When America is in the news, it's either threatening someone, pulling out of cooperative efforts, or delivering on a previous threat. That's bound to derail discussions whenever American companies are involved and it'll only get worse with the way things are developing.
Eat the rich. History won't forget.
That said, based on what we know already, there is no reason to take everything is this article at face value necessarily.
Firstly, if anybody isn't aware of the history of Stuxnet, it's worth reading, because otherwise you'd underestimate the government's ability to use 0-days by an order of magnitude (we're talking full custom-written multi-month hacking projects with root-kits and custom fake drivers delivered successfully to an airgapped system, source wikipedia). Also worth learning about Dual EC DRBG debacle.
Secondly am immediate friend of mine worked at a FANG company that routinely sent a firehose of all sorts of things matching all sorts of filters directly to governments. In fact many ISPS have back-doors built in and that's not really disputed (wikipedia: room641A).
So the question to ask yourself is -- if this was a deliberate interaction that cloudfare was required to participate in via a warrant, would they legally even be allowed to publish a blog post that contradicted this?
So I think that is probably the default attitude of skepticism you are seeing, which in my opinion is a good default. Plus the primary claim of this article "Look it wasn't 1 routing issue, it's been happening for even longer! Therefore nothing to look at here!" seems really weak.
So you're proposing they could be in a situation where they can either:
1. Publish an untruthful blog post, relying on public data available from multiple parties, trying to somehow explain it all while avoiding talking about their involvement in a way that would get them in PR, legal or political hot water; or
2. Publish nothing.
And they chose #1?
The only way #1 makes any sense at all is if some greater consequence to not publishing was put in place. But that would be more something like "the US gov essentially forced Cloudflare to write this" than "Cloudflare was part of this".
Unless they were part of this, _and_ the government forced them to write a post saying they're _not_ part of it and...
For my money: this is something in the news making it a good marketing opportunity which is ultimately what the blog is--trying to market Cloudflare and the brand to technical crowds.
I work in go to market, specifically for businesses like Cloudflare, I can and have said "this real world situation is going to have resonance for the next 5-10 days, what is the lowest cost blog post you could publish that is related?" - because I only manage teams who produce content that is genuinely, at some level, value add or interesting to my target market, you would end up with a blog post exactly like this. In fact, this blog post is doing that job, here we are, cloudflare users, discussing cloudflare.
Such as, losing trust,
due to this being the one postmortem you don’t write about?
It's actually really strong since it implies that there's no real time-based correlation with the recent action in Caracas. Especially as the purported correlation was rather weak to begin with.
Now ... I don't think any of this actually supports the parent comment's implication that Cloudflare took some anti-Venezuela action at the request of the US government, just that your criticism is kinda unfounded.
They were having a lot of trouble with pirate receivers, so they added small chunks of code to normal device updates and this went on over a period of weeks/months. On the final update, it stitched all those bits of code together and every receiver that wasn't a legitimate one displayed the message "GAME OVER" on the screen and stopped working.
Obvs it was a long time ago so forgive me if I get some details wrong.
That said, looking at their Cloudflare radar page now for AS8048, I don't recall there being any other BGP route leaks listed there for December from AS8048 and I definitely don't recall there being any BGP origin hijacks listed. The latter is something rather different from a route leak - that looks like someone blackholing some of CANTV's IPs.
I don't think I somehow just missed that since I definitely looked at CANTV's historical behavior to see if anything they did was unusual and that would have been one of the first things I checked, but perhaps they updated radar with data from other collectors or re-ran anomaly detection on historical data.
This could be a classic fat finger config error, most likely a route map intended to manipulate traffic engineering for their own upstream links that inadvertently leaked widely because of a missing deny-all clause. Neverthless, a good reminder that BGP is still fundamentally a trust based system where a single typo in a config file can cascade globally. Never attribute to malice that which is adequately explained by a missing export filter.
That's presumptuous: A state actor would (and could trivially) pad the wrong directions to flow traffic down to pops that are not making new announcements (and thus not-implicated by cloudflare and other "journalistic" efforts).
There's also a lot between fat-fingers and deep-state: I know of some non-state actors who do this sort of thing just to fuck with ad impressions. I also doubt much usable intelligence can be gained from mere route-manipulation thing, but I do know that if it is a fat-finger, every techdude in the area was busy at that time trying to figure it out, and wasn't doing their best work twelve hours later...
> most likely a route map intended to manipulate traffic engineering for their own upstream links
...that being said, this does seem plausible: Most smaller multihomed sites I've seen (and a few big ones!) have some kind of adhoc health monitoring/rebalance function that snmp or something and does autoexpect/curl or something-else to the router to run some (probably broken) script, because even if your uplinks are symmetrical, the rest of the Internet isn't, so route-stuffing remains the best way to manipulate ingress traffic.
> Never attribute to malice that which is adequately explained by a missing export filter.
As soon as I peer with two big sites that don't peer directly with each-other, they both gotta let me forward announcements unfiltered across them. Once I have a third, I have a legitimate need to manipulate my own ingress.
The problems with the BGP are legion, and not just one thing that prevents BGP and security from sharing time in a sentence.
This isn't how BGP works. An AS-PATH isn't the path the traffic will follow; it's the path that this overall announcement has allegedly tranversed and is (one of many attributes) used to judge the quality of route. The next hop tells our peer where they should send the data if they like this route.
Putting more things in the AS path makes the route less attractive. Leaking a new route isn't going to magically make some other route become more preferred.
This is exactly how BGP works.
https://bgplabs.net/policy/7-prepend/
> Leaking a new route isn't going to magically make some other route become more preferred.
Not magic, but technology can look like magic when you don't understand it.
> > Leaking a new route isn't going to magically make some other route become more preferred.
> Not magic, but technology can look like magic when you don't understand it.
Please let me know of the scenario where route A is preferred, undesirable, long-path route B is advertised/leaked, and as a result traffic flows over route C.
I've used BGP for over 25 years, so I'm really curious what you're thinking. Or if you're describing something else, you're being really unclear.
Or if you're just describing withdrawing a route and replacing it with a really undesirable route -- sure, we do that all the time. But that doesn't match this scenario and isn't going to get flagged as a routing anomaly.
> https://bgplabs.net/policy/7-prepend/
You know what's really toxic? Not explaining what you mean and just sending some introductory lab documentation about what the other person has already clearly shown they understand.
I don't even know what you mean by a lot of these things.. e.g.
> > > As soon as I peer with two big sites that don't peer directly with each-other, they both gotta let me forward announcements unfiltered across them.
A straightforward reading of "forward" doesn't work for this sentence. I should not take a route from peer A and send it to peer B. Peering isn't transitive. If I try, it should be filtered.
Peering means to give your own routes (and your transit customers' routes) to someone else. Not your other peers routes.
> ... I'm really curious what you're thinking
That the actor actually wanted the traffic to flow over route C.
> You know what's really toxic? Not explaining what you mean and just sending some introductory lab documentation about what the other person has already clearly shown they understand.
I think perhaps you and I have different ideas of what is "clear", for example when you said something that is totally covered in introductory lab documentation, I thought it was clear that you did not understand.
> I don't even know what you mean by a lot of these things
That is clear! But confusing! How can you clearly understand but not know what I mean?
> Peering means to give your own routes (and your transit customers' routes) to someone else.
That's exactly what's happening here: Not every transit customer peers with every other transit customer.
Yes, but how does advertising undesirable route B make traffic go over route C? This is why I think you're confused.
> That's exactly what's happening here: Not every transit customer peers with every other transit customer.
I am not understanding what you're saying at all. You said:
> > > > As soon as I peer with two big sites that don't peer directly with each-other, they both gotta let me forward announcements unfiltered across them.
This is the thing you are supposed to never do as a peer, and the thing that I have a whole bunch of filtering to prevent my peers from inadvertently doing.
Are you misusing the word "peer"? It's hard to talk about BGP and routing policy without using these words correctly.
I think I'm going to give up here.
I think you're confused.
> I am not understanding what you're saying at all.
And that is why; You seem to have a very strong opinion about something that you don't understand "at all" and frankly I cannot understand how that can work.
> This is the thing you are supposed to never do as a peer
So you say, but that's what I did when back in the early 2000s, and that's what the parties in the news were doing, and if you're not totally lying to me, you know this because it's the default in BGP, that's why you would say you need to:
> I have a whole bunch of filtering to prevent my peers from inadvertently doing.
because that's how BGP works. Duh.
> It's hard to talk about BGP without using these words correctly.
and I am flabbergasted you continue to persist at it, when I have even offered you "introductory lab documentation" to help.
Transit means "give our entire table, receive their routes plus their downstream customers routes".
You don't give one peer's routes to another. You filter to make sure you are not doing this. They hopefully filter (using data from RIRs) to make sure you're not doing it. If both parties screw up the filtering, you "leak routes" like we're discussing here.
This has been standard practice for peering since at least 1997. It is codified, among other places, in RFC7454.
> And that is why; You seem to have a very strong opinion about something that you don't understand "at all" and frankly I cannot understand how that can work.
Do you operate an AS? Are you a peering contact? I mean, I only do it mostly for funsies now but for quite awhile that was part of my job. :P
Also, still seeking an answer to this question:
> > > Yes, but how does advertising undesirable route B make traffic go over route C [that previously went over route A]? This is why I think you're confused.
> I mean, I only do it mostly for funsies now but for quite awhile that was part of my job. :P
I'm retired now. I wrote some about my experiences on HN a long time ago:
https://news.ycombinator.com/item?id=18535518
https://news.ycombinator.com/item?id=2727993
I set up multihoming in the US (going through ARIN assignment for ASN and PI) in the early 2000s and for another larger company in the UK (doing the same same but different) in the early 2010s.
> Also, still seeking an answer to this question:
Not sure what to tell you. I've answered this within the context of the news article, if you're asking specifically what kinds of configurations do that they're the kinds that are in that "introductory lab documentation" and if you're not overstating your credentials you should be able to understand.
If you are buying transit for multihomed site, you just mostly need to worry about advertising your few local routes and receiving a table.
These words mean specific things in a provider environment. Peering between providers is not transitive. You should not give a peer's routes to another peer-- else you are offering to provide transit to that peer.
None of the three parties involved (the peer the route came from, the peer the route would go to, or you), generally, want this.
> As soon as I peer with two big sites that don't peer directly with each-other, they both gotta let me forward announcements unfiltered across them.
So -- this is true for neither scenario. If you buy transit from two people, you don't want to "forward" routes between them. Likewise for two peers. You only want to pass on your own routes, plus routes for your downstream customers or to your downstream customers.
The other topic that caused confusion: leaking a route to somewhere won't change where traffic goes unless that new leaked route wins. If it wins, the traffic will come to you (regardless of AS path). If it doesn't win, the existing route will still be used.
I'm retired-ish now, too (now I'm mostly a high school teacher for the funsies). But if you find yourself with BGP infrastructure in HE.NET Fremont, or somewhere that can peer with FREMIX, or somewhere that can access KCIX, feel free to send me a peering request. I currently have 2 direct upstream transit providers and 55 peers across 3 sites and export 6 prefixes plus 2 downstream prefixes :P
Not saying that this is the case with Venezuela, just explaining the reality of BGP where path prepends are often ignored.
It's possible he's saying something else, but I can't figure out, and he hasn't clarified.
I know this has always been the case, of course, but now I have lost trust. Whatever the reasons of this "leak" were, I am not accepting any information written in this message (search for the link to another coverage of the incident in the comments).
It is quite weird and quite logical at the same time: this is the end of an era.
More positively, what's your opinion on this closer look post from Cloudflare?
Imagine an overworked, underpaid, network engineer. Mistakes happen. This time though, the entire world is hyper fixated on what amounts to an easy to make mistake and now your mistake is in the intel briefs of 50 countries. Oops. Rough day at the office.
At Cloudflare?
These kinds of infrastructure is present everywhere, for a very long time. Just because not everyone is talking about the matter doesn't make it non-existent.
For example, in 2003, I saw how Japan monitored their network traffic in real time. It was eye opening for me, too. Technologies like DPI which required beefy servers are now trivial to implement with the right hardware.
This is all I can say.
Even if you have your own rack at a colocation, you could argue that if you don't have full disk encryption someone could simply copy your disk.
I am just trying to be practical. If someone is intent on reading what users specifically send me, they can probably find bad hygiene on my part and get it but my concern is they should not be able to do this wholesale at scale for everyone.
You can have full-disk encryption then. It can still possibly be compromised using more advanced methods like cold boot attacks but they are relatively involved, and is very detectable in the form of causing downtime.
Having the private key of the root cert does not allow you to decrypt traffic either.
It's "well known"? News to me.
I doubt the NSA has storage space for even 1 year's worth of "most of encrypted Internet traffic", much less for permanently storing it.
I suppose it's both but the latter is a more scarce resource
just kidding, it's just backup access via the datacenter wifi.
By "law enforcement", I'd assume the feds and not local. Why not just say which agency? Wouldn't this pretty much be FBI? Why use such a generic term?
the point is, this isn't the action of local authorities. this is state level activity. if it is local, that's a level of sophistication and corruption that I have ever been aware.
We(?) more or less want this to be a place of general curiosity,
perhaps revolving loosely around those things, but not tightly clung to them.
Sure it has!
The resolution was “go fuck yourself, what the fuck are you going to do about it?”.
Y’know: respectfully.
Cloudflare's post boils down to Hanlon's razor: a plausible benign interpretation of the facts is available, so we should give some scrutiny to accusations of malice.
Are there specific relevant facts being omitted in the article, or other factors that diminish Cloudflare's credibility? They're clearly a qualified expert in this space.
Let's assume for the sake of argument that the BGP leaks (all of them from the month of December, in fact) were the result of secret US military intelligence operations. The fact that militaries generally use cyber vulnerabilities to achieve their objectives is not news, and the US military is no exception. Keeping specific exploits secret preserves a valuable advantage over competitor states.
One could argue that Cloudflare's post helps to preserve USG's secrecy. We can't know publicly whether USG solicited the article. But even if we assume so (again assuming malice): Is Cloudflare wrong to oblige? I don't think so, but reasonable people could disagree.
Merely pointing out Hanlon's razor doesn't fundamentally change the facts of the situation. In Cloudflare's expert opinion, the facts don't necessarily implicate USG in the BGP leaks without an assumption of malice. Assuming Cloudflare is malicious without justification is just deeper belief in the conspiracy that they're arguing against.
If Cloudflare is distorting the facts, we should believe (rightly) that they're malicious. But I don't see any evidence of it.
EDIT: Clarity tweaks.
The section of the article pointing out the AS prepending makes it really clear the route leak is a nothing Burger.
It's incredibly unlikely this leak change how any traffic was flowing, and is more indicative of a network operator with an understaffed/underskilled team. Furry evidence is that a similar leak has been appearing on and off for several weeks.
That's not to say the US government can't, doesn't or didn't use the Internet to spy, it's just that this isn't evidence of it.
Relevant section below: > Many of the leaked routes were also heavily prepended with AS8048, meaning it would have been potentially less attractive for routing when received by other networks. Prepending is the padding of an AS more than one time in an outbound advertisement by a customer or peer, to attempt to switch traffic away from a particular circuit to another. For example, many of the paths during the leak by AS8048 looked like this: “52320,8048,8048,8048,8048,8048,8048,8048,8048,8048,23520,1299,269832,21980”.
> You can see that AS8048 has sent their AS multiple times in an advertisement to AS52320, because by means of BGP loop prevention the path would never actually travel in and out of AS8048 multiple times in a row. A non-prepended path would look like this: “52320,8048,23520,1299,269832,21980”.
> If AS8048 was intentionally trying to become a man-in-the-middle (MITM) for traffic, why would they make the BGP advertisement less attractive instead of more attractive? Also, why leak prefixes to try and MITM traffic when you’re already a provider for the downstream AS anyway? That wouldn’t make much sense.
"NSA Network Shaping 101". Big descriptions of ASINs, and layer 3 shaping. Written in 2007.
The NSA and thirteen eyes generally have detailed traffic logging capability at core internet exchanges around the world. It is reasonable to think that a good way of exfiltrating data would be by having something like an ICMP or maybe even TTL based covert channel, such that there is no chance that the sent data is ever received by the recipient. I am just speculating – but that's why I thought this was interesting.
2. It was not in any way related to this BGP, of which, as someone in networking, looks like a simple and fairly common mistake. It wouldn't really buy them anything anyway, the breach happened 6+ months before.
After waiting for 3 years, I gave up ended up paying one of their technicians I randomly found working in the street. He gave me a phone line that apparently used to belong to a taxi company, judging by all the wrong number calls I got. All that just to get 4mbps DSL service in 2019.
Last year, out of nowhere, I finally got a call from the company saying they were ready to install it.
Thankfully, a bunch of companies appeared out of nowhere (a lot of them with links to people in the govt, surprise) in 2020 and we got fiber.
Oh and a couple of years ago, my parents "lost" their phone line and have been without POTS ever since. Maybe it's karma for me paying for a phone line all those years ago...
And Venezuela is very very corrupt country. No cyberattack needed when you can pay $10,000 - $100,000 for a dude to pull the lever or to forget to pull the lever and literally 99.99% of people in a country do it.
Though these theories are easy to explain because people in mostly US community like HN have no understanding of what total corruption look like in a shit hole countries.
I assumed it was a badly performing algorithm. But if it had instead routed me through a McDonalds drive through, I'd have assumed it was foul play.
I think the article makes a decent case that this was the former and not the latter, though it would be interesting to see route leaks visualized on a map over time. Too many odd coincidences could sway me the other way.
At this this, US is basically enemy to EU. Good for us, we will be less dependent on US global oil police.
I hope EU companies will stop manufacturing US airplanes and other things.
And yet, here you are...
It's right for all of us to consider whether our online presence supports fascist dictators be they from USA, Russia, Venezuela, or wherever.
Thanks for the reminder that even here people are sometimes shit, I guess.
I'm pretty sure you know what the parent poster meant, and you should take it as a compliment to you and our HN community that they didn't intend you, or us, to be included in that definition of 'anything US-based'.
Stirring the pot like that isn't helpful to you, to HN itself, or any of our community.
In current times, encrypted accesses to Usenet and IRC via I2P and the like will boost the platforms more than ever. Why? IRC and Usenet are dead simple, Emacs has ports to everything and among being a Lisp env, an editor and a minimal web browser, it's an IRC and Usenet client too even under Android. Oh, and you can set I2P under Android too. Thus, you just have to set Emacs against it. There are several guides online.
Rocksolid BBS' federate with the whole Usenet (and some newsgroups catch anything text based, no binaries). On I2P proxies to Libera.chat, it's just a matter of time to exist. Meanwhile, there's ILITA IRC with I2PD.
Difficult? A Chinese Bluetooth keyboard it's worth very little today, and the gains are enormous. You can chat with people with really small bandwidths but encrypted either with TLS or I2P. You don't have blocks (except bans under IRC), comment limits, enforced timelines and any enshittification coming from social networks. Also, you can short Usenet threads by score. That's it, it's there a brilliant poster and comp.misc, you set the score for all his comment to 1000; then that random Joe will always be on top in any group. Try that with X/Twitter, Reddit or whatever.
You will be able to chat with Western Europeans, Eastern Europeans, the Japanese, anyone. Forget tribes, forget the bullshit made to earn zillions of cash from X with shitty fabricated polemics. Forget Meta's snooping and industrial stealing. You aren't enforced to give your real name and address.
> I hope EU companies will stop manufacturing US airplanes and other things.
Independent of how little we may like current US politics: a) it will probably change, more sooner than later. And b) starting a trade war with the US is not very good idea. We like it or not, there are many things that we need desperately to be able to produce. Starting with computers and SW. And please don't start with "OOS SW" as much as I like the idea, and I constantly advocate for it, even if we start yesterday, it will take decades to build everything again.
Sure.
Though I think the EU is thinking that blowing up critical energy pipelines and seriously damaging Europes economy through the resulting much higher energy prices wasn't too friendly.
All to boost US energy exports, make US manufacturing more competitive and met US geopolitical goals.
ie that's not declaring war - but's it's a pretty big FU wake up call. Turning a blind eye when the US treats central and south american countries with contempt is one thing, but it's a bit of a shock when it openly does the same to you - cf Greenland as another example.
Although if you ask "cui bono?" there are some pointers in that direction, is not proven, and there are also pointers in other directions. I refrain of accusing without reasonable proof.
>All to boost US energy exports, make US manufacturing more competitive and met US geopolitical goals.
I cannot blame them for that. Of course anything they do is in their benefit. Some may argue, is precisely what the government should do. It is clear, that while the action in Venezuela was against a very shady government, was done thinking in US interests (as can be clearly seen by titles as "Trump Says Venezuela Will Buy Only US-Made Products From Oil Deal Proceeds").
So yes, they do all in own interest, and the EU isn't and wasn't very different. Alone if you consider the long colonialism years. Now the EU is acting poorly, but I would say not out of altruism, but incompetence and bureaucratic stagnation.
I will not say "is impossible" they do the same in Greenland... For good reason I think. BUT comparing the 2 is also farfetched. I know plenty of people from Venezuela, and unless you were part of the government, you were strongly against it. I know no venezuelan (from the at least 100 I know) that wanted Maduro there. And many are still in party modus. Granted, I know primarily expats, so, survivor bias may apply... but still.
Exactly - the views of people who have left Cuba, Venezuelan, or Iran are typically not representative - by definition they chose or were forced to leave.
Indeed if they have left - why are their views informing armed intervention - should Italian American's force political change through American might in Italy over the people that still live in Italy?
It's all just performative - bottom line Trump doesn't care about good governance and democratic in Venezuela - indeed he has just come out against fresh elections - all he cares about is the flow of money and resources.
But this isn't something unique to Trump - just look at the history if US meddling in central and south america. Democracy and the will of the people ( whatever that is ) isn't the driving factor.
BTW totally accept Europe has a very similar past, and to some extent present - and you could argue that the fact that the EU is less involved in this sort of thing these days is a question of capacity rather than desire.
However that's rather my point - in a globalised world - the differences in power will equalise meaning whether countries like it or not just going around doing what you want is going to no longer be an option - and it's better to gracefully accept that and adjust rather than rage against the dying of the light and inviting in the four horsemen.
Again, that is not speaking well of the acting government. Is just not normal that so much people choose or even worst are forced to leave. That just does not speak well of that regime. Does it? So dismissing their opinions does not seem to be a useful reasoning. I know from friends of mine in many different places in Latin America (mind you, in both "left" (brasil/MX) and "right" (Arg/ Chile) countries) that there are literally thousands of venezuelans in exile. That is not normal and is not a good sign.
> bottom line Trump doesn't care about good governance and democratic in Venezuela
Totally agree. But as I said, is not "Trump". Is not a person, is institutional. Which you could reasonably argue is much worse. But OTOH, there are many people again, does not matter if they went or stay... many people from that very country that are very happy with the intervention...
My way of seeing it is: we have to wait to be able to weight the prons and cons. WWII + Plan marshal was basically the same, wasn't it? And I'm pretty happy with the results and how everything played out...
Being forced to leave in itself is not a bad sign - do people not flee the US to Mexico to avoid justice? Perhaps they were part of an old corrupt cabal running the country for their own benefit?
Or perhaps they had to leave because of dire economic circumstances largely caused by foreign sanctions rather than internal mismanagement?
Let's be clear I'm not a fan of the current governments in the countries I've listed, but then I'm not a fan of Trump either. In neither case does it justify military invention - I'm not advocating abducting Trump to free the America people from a leader who sends troops on to the streets in cities of his political opponents.... and openly ignores the constitution.
> But OTOH, there are many people again, does not matter if they went or stay... many people from that very country that are very happy with the intervention...
The whole point of democracy is you don't have people like you and me making arbitrary choices from afar based on hearsay - and if there isn't democracy - in my view it's still a democratic choice to decide whether the cost of a rebellion is worth the price. Outside countries shouldn't be making that choice for other people ( We decided that your son dying is a price worth paying for a change in political system ).
Note that doesn't mean you shouldn't stand for your values and be assertive - and driving very hard to ensure no military inbalances. However that's a long way from self-interested coups under pre-texts.
> WWII + Plan marshal was basically the same, wasn't it? And I'm pretty happy with the results and how everything played out...
A closer comparison would be the 1953 coup to remove a democratically elected government of Iran in an attempt by UK/US to get back control of the oil. The installation of a non-democratic autocrat who was friendly to the west directly lead to revolution and the situation today.
Of course, what connects Europe and the USA forever is that they think the same in these matters. No one can trust them.
You know the US is explicitly threatening with military action on Greenland, which is part of Denmark, which is in NATO, just like the US?
The US's international appeal (especially for EU countries) is crumbling by the day.
Is it, given this kind of talk from POTUS preceding the more recent threats?
> Let's be honest, the European Union was formed in order to screw the United States. That's the purpose of it, and they've done a good job of it.
And https://www.politico.eu/article/donald-trump-putin-russia-eu...
https://www.theguardian.com/us-news/2026/jan/05/a-warning-no...
It looks mutual between EU citizens and Trump.
https://www.politico.eu/article/half-europeans-see-donald-tr...
USA an enemy to EU because of Venezuela? LMAO, EU has said nothing. In fact we agree. We have no relations to Venezuela. Now if the USA attacks Greenland, that is different.
Also, only reacting to US aggression after Greenland is attacked? Not prepare at all and then write a strongly worded letter after the fact?
If, after everything Trump has done, you still think he isn't serious about annexing Greenland then you and people like you, including the eurocrats, are truly hopeless.
I suspect most countries would prefer a multi-polar world where the majority is dominant ( democratic ), not one particular country ( autocratic ).
ie why do we have to choose to be under the heel of the US or under the heel of China?
The US has been playing the benevolent dictator role for the last 70 years, but when faced with losing the dictator role, the benevolent facade is dropping.
The US is mistaken to think that countries not wanting US dominance is the same as wanting Chinese dominance - they, in fact, want neither.
Zambia defaulted during the pandemic.
Ethiopia defaulted in 2023.
Ghana suspended payments on most external debt to try and make the Chinese debt payments in 2022/2023.
Pakistan just keeps rolling those loans into other loans so it won't default.
Loas got so bad China now owns their power grid.
Suriname defaulted in 2020.
Kenya stopped paying govt workers for awhile to make their loan payments.
"Recent reports from the Lowy Institute and the World Bank indicate that 75 of the world's poorest countries face a record high of approximately $35 billion in debt repayments to China in 2025 alone."
2026 will see more countries default to be pressed into extreme measures to make the payments.
This seems to come from the US obsession with hegemony as the only strategy ( without realising that only works for 1 out of 200 countries ) - everything is framed as a US/China tussle for top dog.
Note this isn't a purely a Trumpian thing - he is just being more open/less subtle about it.
The US has to realise that it's days of global dominance are coming to and end - just as the UK had to ~100 years ago. What I hope is this time we won't have a couple of world wars during the transition to a multi-polar world.
I'd argue that leaders in South/Central America were under no illusions of how the US operated - the fact that Trump does so openly doesn't really change that. The 'great game' goes on.
What's changed is the wider public perception - both home and abroad. The question is will that create political pressure for a change.
For example, the new openess of the US-Israeli agenda in Gaza and the West Bank and elsewhere appears to have really shifted the political landscape domestically in the US in terms of unconditional support for Israel. The US self image is potentially shifting - this could have much bigger domestic implications.
Likewise aboard, while the current US hostility to China is not a suprise to the leadership in China - it's a continuation. The view of the US in the general population in China will be shifting, which will potentially create political change in the response.
Now I'm not sure Trump understands he is potentially squandering that soft power, because he lives a bubble which applauds the strongman messaging - and let's face it - he has won 2 elections on the back of it.
That for me here is the real risk - people shifting from thinking they were the good guys ( even if that was not entirely true ) to accepting they are out for themselves - and how that then effects both domestic and foreign policy over time - will US society fragment with people being ever more isolated domestically and as a country abroad?
EU, Germany especially Loves Russian oil.
So congrats?
Other CDN companies can do it too, it's just that they don't work on signalling their engineering focused organization.
Until their systems block you for no reason. I recently had a similar issue on a work related site. Fortunately, I was able to reach to the administrator (which is on another country) and had the knowledge to write a report which was useful enough for the said administrator.
And this is for a system which has the same static IP which is not shared with anything for 10ish years.
Found out that I was blocked from it in my default setup. Firefox with default settings, and no VPN.
I'm working hard to turn Cloudflare off.
Cloudflare is not remotely awsome. It's also a solution to a problem (aggressive scrapers that produce DOS) which is worse.
New traffic isn't humans. I blocked some AI scraper user-agents, which helped, a bit. But most new user agents are identifying as vanilla browsers, not scrapers.
I don't have numbers. It was enough to consume all nginx worker_connections. Raising the number doesn't help, as it's just reverse proxying to JVM.
After the switch, Cloudflare showed USA and Singapore as heavy traffic sources.
I don't mind scrapers on the site, but app is a search engine (of sorts) so every page view consumes some CPU. Including 'facet this search' buttons. My (WIP) solution is to rewrite to make it all client-side and put it all on a CDN.
This is how they get you, alongside with "residential proxy" services they use. They appear to be benign browsers from various homes.
Systems get infected, and new "residential proxies" get made of unsuspecting internet subscribers all the time.
It's just another IP to them.
https://www.ripe.net/analyse/internet-measurements/routing-i...
There were BGP anomalies during the Venezuela blackout
If BGP only really needed to represent three types of peers (provider, customer, actual peer), wouldn't BGP configuration and perhaps even BGP be massively simplified?
Simple isn't always good.
By analogy: i could massively simplify google maps direction algorithm by getting rid of all that annoying and unnecessary traffic information, annoyingly complex labels about speed limits and lane count, and all the data points about stop signs, traffic lights, and so on. Its just a path-finding algorithm after all and all that extra info just makes for more computation and complexity. Who cares if it mean all the traffic for a major metro goes across a 1-lane bridge and leaves all the other roads empty.... its the shortest path, what could go wrong?
Does anyone have data on what the general frequency of these leaks is likely to be across the network?
US SIGINT agencies? They’d just pwn the routers they are interested in. And almost certainly they’ve already done it. Like 10+ years ago.
BGP hijacks are really low-tech and trivial to detect. And competent intelligence agencies don’t do either, unless it comes with enough plausible deniability that it would even be insane to suggest foul play.
I operate a small BGP hobbynet under 2 different AS numbers, and even I keep logs about path changes. Not for any practical purpose, just sheer curiosity.
BGP is a globally distributed and decentralized system. The messages (announcements) propogate virtually across the entire internet. If someone hijacked a route to a prefix that I’ve received, and the path I’ve received is the hijacked one, I’d get that information.
So yes, if that happened, I’d totally expect CloudFlare to publish it, unless they got a NSL. Which they most probably wouldn’t get, as NOTHING about the event would be secret—-it would be out in the open for everyone to see the instant it would happen. There are also tools like https://bgp.tools which operate public route collectors, with the data being publicly available. RIPE has one too.
https://observatory.manrs.org/#/overview
And Cloud flare has some publicly available reporting in radar
https://arstechnica.com/information-technology/2018/11/major...
> Google goes down after major BGP mishap routes traffic through China
At first pass you probably use HTTPS/TLS for the web, and you know that you shouldn't click through invalid certificate warnings. So the web, tentatively, looks pretty safe.
Email jumps out as vulnerable to eavesdropping, as we largely use opportunistic encryption when transferring messages between mail servers and an on-network-path attacker can use STARTTLS stripping or similar techniques. Most mail servers happily send using cleartext or without validating the TLS certificate. Check that you and your counter-parties are using DNSSEC+DANE, or MTA-STS to ensure that authenticated encryption is always used. Adoption is still quite low, but it's a great time to get started. Watch out for transactional email, like password reset messages, which virtually never validate encryption in transit (https://alexsci.com/blog/is-email-confidential-in-transit-ye... ; instead use multi-factor encryption).
TLS certificates themselves are at risk, unfortunately. An attacker who controls the network in-and-out of your DNS servers can issue domain-verified certificates for your domain; even removing protections like CAA records. DNSSEC is the classic solution here, although using a geographically distributed DNS provider should also work (see multi-perspective validation). Certificate transparency log monitoring should detect any attacker-issued certificates (a review of certificates issued for .ve domains would be interesting).
Ideally, we should build an internet where we don't need to trust the network layer. A BGP route leak would be a performance/availability concern only. We're not there yet, but now is a great time to take the next step in that direction.
If you're interested in talking about something other than DNSSEC, I would be interested in your thoughts here.
A funny note here: I track changes, and in the last 150 days, there has been one (1) (someone turned DNSSEC off.)
While analyzing the Jabber.ru incident (which used this exact BGP->TLS vector), I discovered that Cloudflare's "Universal SSL" actively injects permissive CAA records that override user-defined restrictions.
If a user sets a strict accounturi CAA record (RFC 8657) to lock issuance to their specific account—specifically to prevent BGP hijackers from getting a cert—Cloudflare's system automatically appends a wildcard record alongside it to keep their automation working. Because CAs accept any valid record, this effectively nullifies the protection.
It creates a situation where you think you have mitigated the BGP risk via DNS, but the vendor has silently reopened the door.
I wrote up the technical analysis of this override behavior here: https://david-osipov.vision/en/blog/cybersecurity/cloudflare...
Kind of like wanting to learn how a car engine works and asking about fleet management in trucks/ lorries.
BGP is one of things I've learnt then forget the next day (multiple times)
The goal for me is conceptual understanding, not to build an ISP. And network knowledge is light... just enough to be a cloud monkey
BGP is just the way networks exchange routes (paths to a specific IP address) between each other. Once you know a little bit about how routing works it will make sense.
http://freedman.net/bgp102.ppt
http://avi.freedman.net/fromnetaxs/multi.html
This is how I imagine Russian companies in Russia write about the Russian war on Ukraine.
A corollary to the Hanlon's razor: prefer assuming incompetence over malice if there's Telecom Italia involved in any shape or form
What is a BGP?
It's entirely detached from anything else so you're pretty unlikely to have heard of it. In that way it's similar to SS7.
hah.