The Internet Archive is under a DDoS attack

Original Article ↗ Hacker News Discussion ↗

Nature and status of the attack

  • Internet Archive (IA) is under a DDoS; data is safe but many services became unavailable.
  • Described as tens of thousands of fake information requests per second, i.e., a volumetric denial-of-service.
  • Service later came back up; staff characterize it as a back‑and‑forth with attackers, with weekends/holidays being common attack times.
  • The announcement is hosted on IA’s Mastodon instance; visiting that post is said not to worsen the core attack.

Speculation about motives

  • “Cui bono?” answers include: large publishers, paywalled media, and the broader copyright industry that dislike persistent public access to historical content.
  • Others suggest: extortion/ransom, DDoS‑for‑hire companies showing off capabilities, simple vandalism by bored individuals, or state/terror groups.
  • A popular but contested theory is that someone wants incriminating or embarrassing archived content temporarily inaccessible; an IA insider firmly rejects this as a motive, which some readers accept and others wish had more explanation.
  • Overall, motive is considered unclear, with many noting that DDoS is now cheap and commoditized, so “anyone” could do it.

DDoS ecosystem and Cloudflare debate

  • Several comments describe DDoS‑as‑a‑service “stressers” as cheap subscription services using botnets and amplification attacks.
  • Some criticize Cloudflare for:
    • Protecting DDoS‑for‑hire websites behind its CDN while also selling mitigation.
    • Alleged “extortionist” upselling (notably in a case involving an online gambling site and IP reputation).
  • Others defend Cloudflare as a generally valuable, mostly ethical provider whose sales tactics occasionally cross lines, and argue its IP‑reputation concerns were legitimate.

Defenses and mitigation strategies

  • Effective defense is framed mainly as an infrastructure and network‑position problem, not just software: you need huge spare bandwidth plus upstream scrubbing (often via Tier‑1 ISPs).
  • Open‑source and architectural ideas mentioned: HAProxy, application‑layer filters, proof‑of‑work gateways, CAPTCHAs, and per‑request micropayments/“blockchain” fees.
  • Critics note PoW/captchas don’t solve saturated inbound pipes, and micropayment schemes face practical and economic issues.

Decentralization and personal archiving

  • Suggestions include a decentralized or distributed IA (e.g., via IPFS/Filecoin‑style systems or Arweave) to avoid a single point of failure; there’s interest but also concern about scope and governance.
  • Many describe running their own web archives (wget mirroring, ArchiveBox, local WWWOFFLE‑style setups) to preserve sites and reduce dependence on any one institution.

Values and community reactions

  • Repeated comparisons cast the attack as burning a library/orphanage—an attack on history, accountability, and human progress.
  • Some worry persistent attacks could be used to justify broader rollbacks of privacy and civil liberties.
  • There are strong calls to support IA financially and morally, alongside acknowledgment that it remains a single, vulnerable institution.