Tech CEO sentenced to 5 years in IP address scheme

https://krebsonsecurity.com/2023/10/tech-ceo-sentenced-to-5-years-in-ip-address-scheme/

by todsacerdoti • 3 years ago

395 297 3 years ago

lalith_c• 3 years ago

Move to ipv6 already

DonHopkins4• 3 years ago

No way, they're a dime a dozen million. NCP addresses are worth much more, because there were only 256 of them. That's where the big money's at. I saw the classic NCP address 134 (MIT-AI) appraised for millions on the Antique Information Superhighway Road Show.

https://en.wikipedia.org/wiki/Network_Control_Protocol_(ARPA...

autokad4• 3 years ago

ipv6 is such a failure. even if it eventually 'takes over', its still a failure. Its over engineered for something customers didnt ask for (an ip address for every grain of sand in the universe).

There's something to be said about a human readable IP address. Where you can't tell a person the address, you have to copy and paste. where you cant infer any information about the IP address just by looking at it. It adds unnecessary overhead to small packets, etc.

staringback• 3 years ago

It adds unnecessary overhead to small packets

Are you forgetting that NAT exists? IPv4 is barely functional based on how many workarounds we've had to implement over the years

overgard4• 3 years ago

Is human readable IP that important though? I mean even though I know about CIDR it's still hard for me to intuitively think about it, and I will say by far the part of kubernetes I dislike the most is figuring out the networking layer design. I feel like the only reason we need human readable IP's in the first place is for understanding all this NAT stuff that we wouldn't particularly need if we had bigger IP ranges

c223• 3 years ago

Customers never asked for ip addresses at all. They're just a technical requirement for networking.

p1mrx2• 3 years ago

an ip address for every grain of sand in the universe

https://en.wikipedia.org/wiki/Observable_universe estimates 10^53 kg in the observable universe.

10^53 kg / 2^128 = 10^14 kg per address, though I have no idea what fraction of the universe is sand.

In practice, the number of allocations is much smaller because IPv6 is effectively a 64 bit address space, with the second half reserved for edge networks.

There's something to be said about a human readable IP address.

Is 2a01:4f8:1c1c:f6aa::1 really so unreadable, given that every device needs a different number?

alphager• 3 years ago

The large address space and thus the king addresses are an artifact of optimizing the routing.

I think just saving the endless discussions of "my Xbox only got nat type 2, how do I change it?" alone saves more lifetimes than are lost by c&p adresses (not to speak of the large infrastructure costs of maintaining gcnat at scale).

talent_deprived4• 3 years ago

No.

PrivateButts• 3 years ago

One complaint that I have about ipv6 and mac addresses is that they use hex separated by colons. Not only is it way longer than an ipv4 address, you can't rattle one off using a number pad. Back when I did full time IT, that sounds like a nightmare if in ipv6 land you have to enter addresses as commonly as you have to enter ipv4 addresses.

hnlmorg• 3 years ago

While I do agree with you, I do think we should be long past the point of needing to manually enter IP addresses. We have several good service discovery protocols, and DHCP and DNS, which are less great but still has pretty good tooling these days

hinkley5• 3 years ago

I think 1 IP address per human was short sighted. We ran out before the human population doubled. But I think a billion per human was someone liking powers of two, and nothing more. “Ipv5” with 48 bit addressing would have done pretty well. As 6 octets or 4 base 12. For humans you could reserve all ambiguous addresses and have about 50k times as many addresses while people sort themselves out. You could still be able to see at a glance that they were ipv5 addresses. 1047.258.300.0/24

AndroidKitKat• 3 years ago

When I was in a phase of really enjoying IPv6, I went out and bought one of these: https://ipv6buddy.com

I don't type in many IPv6 addresses anymore, so this doesn't see much use anymore. It does make a great desk nicknack, though!

goalonetwo4• 3 years ago

5 years in jail seems a bit of an overreaction.

_jal2• 3 years ago

He aimed too low.

janosdebugs2• 3 years ago

I guess you missed this part:

Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist.

goalonetwo4• 3 years ago

No I didn't. I'm wondering how putting someone that is arguably a smart entrepreneur behind jail for 5 year is going to better our society.

We need to think about the bigger picture and how this fits into rehabilitation.

ozr4• 3 years ago

The main element of the crime here was creating imaginary people to 'sign' the affidavits submitted to ARIN. Phony companies, phony people, etc.

Then the jail time is calculated based on the value of what was taken as a result of the fraud.

5 years seems fairly reasonable for a multi-million dollar scheme, involving multiple employees, explicitly designed to defraud.

lostlogin2• 3 years ago

White collar crime getting a lengthy custodial sentence is not the normal.

gruez• 3 years ago

That's in line with US sentencing guidelines[1][2][3]. Most of it came from the fact that the ip addresses were worth millions.

[1] https://www.ussc.gov/guidelines/2021-guidelines-manual/annot...

[2] https://www.ussc.gov/guidelines/2021-guidelines-manual/annot...

[3] https://www.ussc.gov/guidelines/2021-guidelines-manual/annot...

not2b2• 3 years ago

Fines don't work, they are treated like the cost of doing business, and are easy to escape (if the corporation, not the person, is fined, move as much of the money away as possible and have the corporation go bankrupt).

So execs need to consider that serious prison time is a possibility, or there will be no constraints on bad behavior.

Ensorceled2• 3 years ago

> "Prosecutors estimated those addresses were valued at between $10 million and $14 million."
> "production of notarized affidavits in the names of people who didn’t exist"
5 years in jail seems a bit of an overreaction.

Multiple counts of fraud that would have netted $10M and did net a percentage of that? Breaking the notarization process? By a CEO of a tech company?

5 years seems about right, maybe even too lenient.

primitivesuave• 3 years ago

If someone walks into a bank and carries out an unlawful scheme (i.e. fake notarized paperwork) that nets millions of dollars, 5 years would be a lenient sentence.

Also, it is 3 years in jail followed by 2 years of supervised release.

jacquesm3• 3 years ago

For fraud?

snvzz• 3 years ago

This is evil, and I feel zero sympathy.

They should indeed make an example out of him.

fred_is_fred• 3 years ago

Given the jail time, I am surprised he wasn't on the Forbes 30 under 30 list.

k1ns• 3 years ago

Well, you see, he's 40.

goalonetwo4• 3 years ago

still time for the 50 under 50!

A_D_E_P_T• 3 years ago

This highlights something tangential, but interesting nevertheless: Oftentimes getting embroiled in a civil lawsuit will, if impropriety is uncovered via the process of discovery, lead to separate criminal charges.

The lesson here is that if you have something to hide, and it looks like you're going to be dragged into civil court (especially Federal civil court,) you should rush to settle or beg for arbitration behind closed doors.

boeingUH60• 3 years ago

Texan billionaire Robert Brockman sued an Australian for stealing $20 million from his trust in 2020 [1].

A few months later, he was indicted for hiding $2 billion of income from the IRS [2]. He died before trial took place anyway..

1- https://amp.smh.com.au/national/australian-barrister-denies-...

2- https://www.justice.gov/opa/pr/ceo-multibillion-dollar-softw...

chatmasta2• 3 years ago

I wonder if the target of his civil lawsuit could have ratted him to the IRS and collected a whistleblower payment...

MiscCompFacts• 3 years ago

Did he actually die, or conveniently “die”? I guess it’s hard to know.

JumpCrisscross2• 3 years ago

or beg for arbitration behind closed doors

Arbitration records aren’t protected from disclosure to law enforcement.

i_am_jl• 3 years ago

"Not protected from disclosure to law enforcement" is still better than "entered into the public record by default" as a result of being offered as evidence in a civil trial.

avar• 3 years ago

Wouldn't it be better to rush to a country without an extradition treaty with the US?

Tao3300• 3 years ago

If I had to guess, no.

hinkley5• 3 years ago

At this point are there any that don’t also have huge problems with blackmail and extortion? It’s like being the weakest pirate on Pirate Island. You might have a bad time.

axus• 3 years ago

I wish the lesson were "If something might be criminal, check first and then don't do it".

Makes you wonder if anyone has started an "AI-powered legal database miner as-a-service" for rent to zealous prosecutors.

donatj3• 3 years ago

Basically everything is criminal in the eyes of the right prosecutor. Narrowly avoiding their gaze is about all you can do.

kstrauser9• 3 years ago

The underlying crime was wire fraud, and it happened to be about acquiring IP addresses. He wasn’t prosecuted because he got too many, but for how he got them.

belter• 3 years ago

IPv4 addresses are like Socks. You can never have too many...

JoshGlazebrook• 3 years ago

Now just to find where those missing ipv4 addresses are going along with those missing socks.

mtillman• 3 years ago

Please tell me this was a SOCKS pun.

KMag3• 3 years ago

Back around the turn of the millennium, there was a company called AllAdvantage. They paid you to install spyware/ad injection software and watch you browse, and sold the add space and analytics to corporations. They'd pay you for... I think it was 48 hours of ad-injected spied browsing per month, and then stop paying you (but keep injecting ads and spying on you). There was also a pyramid aspect where you'd get something like 10% of all of the amount earned by your direct referrals, with no monthly cap. Also, 48 hours of browsing wasn't enough to hit their minimum threshold for AllAdvantage to mail you a cheque.

Edit: maybe there wasn't actually spyware and it just injected extra banner ads in your browsing. I never looked into installing it myself.

A /16 subnet was routed to our fraternity house, licensed to house up to 22 people. 65,536 (minus broadcast, gateway, and network address) IPv4 addresses for 22 people. My roommate bought 1 GB of RAM (about $4k at the time) and a VMWare student license for his Linux desktop. He cut down Win95 to be able to run in 32 MB of RAM (including his COM scripting bot, Internet Explorer, and the AllAdvantage spyware). I seem to remember him configuring the VMs to run 16-bit color to save memory footprint. He scripted the Win95 boot process to read a CSV file off of NFS, remove the top line, and write the file back. The CSV file contained fake name, fake address, etc. The VM would register itself with AllAdvantage, with my roommate as the referrer, and then randomly click on links in Internet Explorer until hitting the payout limit, and then shut down the VM. A Perl script (remember the late 90s?) on the Linux host would re-launch a clean VM every time an old VM shut down, and keep the CSV populated with fake account details.

30 VMs were browsing 24x7 for ALlAdvantage. My roommate set up a caching proxy on his Linux box, so he didn't hose the house's T1 connection. 10% of the payout (the referral fees) over something like 4-5 months paid for the whole desktop. AllAdvantage never got returned cheques from the fake addresses because they never paid out. I think he ran his system for over a year before AllAdvantage went out of business, for a total of something like $12k in profit.

He ran his own DNS server that hopped randomly all over the /16 to reduce the probability of detection. He's pretty convinced AllAdvantage's fraud people noticed him as an extreme outlier. He suspects they ignored him because the data he was generating for them cost 1/11th as much as most of the other data they were selling to customers.

Edit: a quick search shows the AllAdvantage rate was maybe $0.40/hr. 10% of this was $0.04 x 30 VMs = $1.20/hr 24x7. 8766 hours/year works out to about $10,000 per year. $12k in profit, $4k in RAM, and $1k for the rest of the machine works out to a bit under 2 years of running the system, if the rest of my memory is roughly accurate.

A few years later, our school kept the /16 allocated to us, but only routed the first /24 to the house. I'm sure my roommate wasn't the only one to get up to shenanigans with so many IP addresses.

Edit: He also found some online casinos that didn't explicitly forbid bots and he set up some poker bots that would keep track of its winning percentages against all other players. He set up some monitoring/control software for his feature phone (or was it a PDA?) so he could watch his losses from class and shut it down if necessary.

He kept records of every card seen in every game his bots played. I asked on at least 3 occasions for access to that data, to check for (1) naive shuffling (2) using a linear congruential generator instead of cryptographic quality random numbers and (3) seeding with time instead of a true random seed. He told me at least 3 times that he would give me FTP access to card histories, but never did. A couple years later, a paper came out detailing a code review of the most common online poker software finding (1) naive shuffling (2) using a linear congruential generator (3) seeded using only the time the game started and (4) containing an off-by-one error in the naive shuffle. The off-by-one error might have prevented me from figuring it all out from the poker bot histories, but there's some alternate history where we made millions in online poker, fully within the published rules of the sites. (Unfortunately, the millions would have come entirely from other players, the online casinos not bearing any of the costs of the shoddy coding.)

He mused several times that it would be fun to create a cardboard box with one of those see-through windows for a shipping label... and two subtle slits allowing a continuous roll of various shipping addresses and an advancement mechanism to be hidden within the package. He'd use a battery and/or inertial energy harvesting weight to power a device to change the sipping address every 4 hours. He wanted to send such a package with tracking information and watch it ping-pong around the country until someone realized something was fishy with the package.

He eventually dropped out of school and was living off of his poker bots until (without health insurance) his appendix burst and he was forced to get a day job to pay off his medical debt.

I hope he gets elected to Congress someday (though he's not very political) just to make a great epilogue to a biographical film.

tlogan2• 3 years ago

Yep. If he had real people or real companies buying these IP addresses (even if they are shell companies) he would be fine. Apparently he started like that but then he got greedy and said: fuck I will just invent some fake people.

The actual criminal activity (fradulent affidavits, forged signatures) started in 2017.

itchyouch• 3 years ago

I worked for a dial-up ISP that was going out of business and their last hurrah was selling renting servers doling out clean IPs from their /16 blocks so the clients could spam like crazy.

Then we encountered these spammers were willing to forge BGP LOA stating that they could announce certain, defunct and unused blocks on BGP.

I left there in a hurry, but it seems like they got away with it for a while. It would've been pretty catastrophic if their upstream ISPs decided to cut them off because they were announcing blocks they should not have been.

nodesocket2• 3 years ago

I'm not clear why he needed to use fake names and forged signatures? Couldn't he just create legal LLC's in various states (Nevada is a good one) which don't expose the entities owners and use those to purchase the IPs from ARIN? Rinse and repeat.

klipt• 3 years ago

At what point does using a fake name turn into a felony?

How about creating an email address using a pseudonym?

Or does it have to involve money? If someone uses a fake name to order a sex toy delivered (out of embarrassment) is that wire fraud?

broknbottle2• 3 years ago

Nah he was doing the forging way before that as I had left my previous role in NOC back in 2017. I dealt with this guy probably around 2015-2016 and after we got a complaint about announcement we suspected forgery as the rightful owner shared more than this guy could except for some docs which apparently the other party never signed but magically there was a signature.

hn_throwaway_992• 3 years ago

Wire fraud, wire fraud, it's nearly always wire fraud. Elizabeth Holmes, George Santos, Charlie Javice, all the people who got fake Covid funds - wire fraud, wire fraud, wire fraud.

In this day and age if you're committing fraud it's pretty hard for it not to be wire fraud given how everything is transmitted digitally. And penalties for wire fraud are extremely steep (up 20 years for each charge), and it automatically makes it a federal crime. So just don't...

tpmx4• 3 years ago

If he had used e.g. the USPS mail service, would it then have been mail fraud instead? Similar sentencing?

WD40forRust2• 3 years ago

Sounds like I need to target wire fraud as well, with drug cultivation/sales, firearm manufacture/sale/possession (even by a felon), and tax evasion to my list of charges to jury nullify on...

queuebert3• 3 years ago

It's often easier to prove this (or, even more often, tax evasion) than prove the alleged criminal activity. Either way, bad guy goes to jail, so the government is happy.

JacobThreeThree• 3 years ago

Governments love overbroad laws that can be selectively enforced.

lost_tourist2• 3 years ago

I wonder if it's ancient communications methods fraud if you do it by carrier pigeon...

moffkalast• 3 years ago

Unless you do it over wifi, then it's technically wireless fraud.

carrja99• 3 years ago

Get out of here with your facts. I want to live in a world where I can believe an individual will get hard time for acquiring too many IP addresses.

rs999gti2• 3 years ago

The underlying crime was wire fraud

The other crime was looking like a douche canoe for his profile pic - https://krebsonsecurity.com/wp-content/uploads/2019/08/amirg...

kstrauser9• 3 years ago

"The prosecution would like to present Exhibit A..."

bhdlr• 3 years ago

He looks like he was in a goth band while he was getting really good grades at one of Canada's top business schools

DonHopkins4• 3 years ago

I know somebody who basically stole a class A IP network many years ago, in the very early days of IPV4. (He wouldn't tell me which one, but he had inside knowledge of how the system worked, and I know his background, so I believe him. ;)

The huge company that owned it went out of business, so he registered their domain name, and sent in an email to authorize the transfer.

Once you've got a hot class A network on your hands, but don't have 16,777,216 computers to use it, what can you possibly with it? How do you launder it?

It's not as if you can hide it in your garage, file the serial number off, repaint it, and put them all up for sale on the black market or ipBay individually!

Given that there are 24 bits for host identifiers, the total number of possible addresses in a Class A network is: 2^24 = 16,777,216

However, two addresses within that range are reserved: The "all zeros" host address is reserved as the network address, and the "all ones" host address is reserved as the broadcast address for the network. So count those out.

Therefore, the number of usable IP addresses in a Class A network is: 16,777,216 - 2 = 16,777,214

And at today's price of at least $15 a pop, 16,777,214 addresses × $15/address = $251,658,210

He ended up trading it under the table to a company that could use it, in exchange for the promise of free service for life.

wmf• 3 years ago

The ham radio /8 was also "stolen" and resold, although for a good cause.

mixmastamyk• 3 years ago

That’s it? Free service?

toast0• 3 years ago

The problem is a /8 is too big to transact on. Somebody is going to ask questions, and then the scam will be unwound at best, you'll end up in jail at worst.

If he had taken a defunct entity's /16 (class B), it could probably have been marketed more directly. Although, I'm assuming this was long enough ago that it might have been still quite possible to get a previously unused class B from ARIN.

Olipro• 3 years ago

Nobody's going to run a /8 on a single LAN segment.

If you want maximum efficiency, your hosts all have RFC1918 IPs and you route the public IP addresses to them. zero wastage, everything usable.

DonHopkins4• 3 years ago

That's the joke! Imagine not getting caught these day running a giant routable stolen class A network on a single LAN segment. It would require Trump-level audacity!

jonathantf2• 3 years ago

I have unfortunately seen that many a time.

icedchai6• 3 years ago

When I went to college in the mid 90's, the entire campus was on a /16, flat network, every machine had a 255.255.0.0 netmask. There was no subnetting, everything was switched (they said "bridged" at the time.)

With today's switches, you could do much crazier things. Definitely not an /8 though.

Aurornis• 3 years ago

This story is hard to believe as told.

Even back in the early days of the internet, non-government Class A blocks were few and far between. I doubt there was a form you could fill out and authorize a transfer to a random individual by merely having an e-mail address and a domain name.

Even if you could finagle a transfer by impersonating the company via e-mail, that would be a clear case of fraud and theft from the defunct company's assets. You couldn't actually expect to use or sell the block without anyone noticing.

He ended up trading it under the table to a company that could use it, in exchange for the promise of free service for life.

If the story is true, what likely happened is that they coordinated the actual sale through proper channels and laughed at your friends' fraud, er, antics, choosing to give him a token gesture instead of actually buying anything from him.

icedchai6• 3 years ago

I can believe a class B or C block. They gave those out like candy up until the mid 90's. Class A is hard to believe though. There weren't a ton of those.

I do know folks who have "defacto" control of legacy blocks belonging to defunct organizations. In fact, if you look hard enough, you can find entire ASNs full of them. Basically, IP squatters.

ohashi2• 3 years ago

"in a 2020 interview with KrebsOnSecurity, Golestan claimed that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers. Throughout that conversation, Golestan maintained his innocence, even as he explained that the creation of the phony companies was necessary to prevent entities like Spamhaus from interfering with his business going forward."

He had to commit fraud, otherwise the business wouldn't work!

costco• 3 years ago

It is reasonable to not want your name plastered on a website run by vigilante cyber police who we have given quasi-law enforcement powers and the ability to de facto shut down ISPs (and in one case a ccTLD). It's even more reasonable when you realize they are incorporated in Andorra - good luck suing them if they get something wrong!

jacquesm3• 3 years ago

I've seen Microsoft, Yahoo and Google all blackhole IP blocks wrongly because they were mixed up with IPs operated by spammers but I've never seen Spamhaus do this, in fact they went absolutely out of their way (without any requests from us) to ensure that our lonely IP on a Toronto ISP that did a lot of shady stuff was excepted.

lkjalsdjklkj• 3 years ago

LOL I used to belong to "alternative asset" investor circles and saw that picture. They were looking for investors to buy/sell IPv4 addresses. Glad I noped out of that one

__loam• 3 years ago

"Do I look like someone who would commit wire fraud?"

duped• 3 years ago

He pleaded guilty two years ago, why did sentencing take so long?

m3kw9• 3 years ago

Bet he made peanuts compared to the 5 years sitting in prison

overgard4• 3 years ago

Honest question, why are we not all just on IPV6 now? It seems like at this point almost all the underlying hardware and software should support it?

It seems like the only argument for sticking with IPv4 is NAT, but I can't think of a technical reason we couldn't do NAT with IPv6?

c7DJTLrn• 3 years ago

The effort required to make a company IPv6-enabled is not to be underestimated.

icedchai6• 3 years ago

Good thing people have had years, even decades, to make it happen, then.

floren2• 3 years ago

NAT is a strong argument against IPv4 -- it's an absolute pain in the ass for bidirectional communication.

Yeah, NAT acts as a defacto firewall, but you can just... use a real firewall.

talent_deprived4• 3 years ago

it's an absolute pain in the ass for bidirectional communication

You're right and that's what I love about NAT, IPv6 in contrast is a hacker/spy tracking digital superhighway right through my front door and straight into my devices.

unshavedyak• 3 years ago

Question from an ignorant network person: is IP rotation still common on ipv6? My primary fear with IPv6 is the touted "feature" of every device having an IP. While it's possible, yea, it sounds like a nightmare for privacy and tracking.

Do the proponents of IPv6 also advocate for large ranges of IP rotations to deal with this?

pierat• 3 years ago

As a content company who owns ISPs, I would LOVE NATs.

Why? Keeps P2P like BitTorrent, soulseek, gnutella, and newer protocols crippled. And content creators don't want people consuming content other than through themselves.

And a NAT can also differentiate between "consumer household" and "business" - do you get a real IP or not?

It's also why companies like Comcast zero-rate their own content.

EDIT: for you -1'ers ; you DO realize that most mega-ISP-content companies want the push-style of the television back, right? And these companies will institute NAT, data caps, and "3 strikes" to boot people off.

deathanatos• 3 years ago

It's an absolute pain for even single direction communication, as most NATs are going to be stateful — they have to retain, somewhere, the mapping between internal IP/port & external port. And that mapping is in finite memory, and old mappings are usually timed out of it, killing the connection, if there is one.

(You can hack around this with keepalives, but it's just another PITA because of the original sin of breaking the end to end principle.)

exabrial• 3 years ago

is it really? I'm on one right now talking with people across the world.

cj• 3 years ago

The barrier for our company is that there's simply not much benefit to upgrading our AWS networking stack from ipv4 to ipv6. It's definitely doable, but there's no real benefit (especially when your infrastructure is behind Cloudflare (or any CDN) which adds ipv6 support for end users without needing the underlying infra to be ipv6.

Even if we were setting up a VPC from scratch, it would probably be ipv4 since it's what everyone knows how to easily do. There's a learning curve with deploying a ipv6 network and very little benefit when it's all behind a ipv6-enabled CDN.

NullPrefix• 3 years ago

I assume IPv6's are less trusted by spam filters

icedchai6• 3 years ago

The only reason we're even still on IPv4 is because of NAT. End-to-end connectivity, public IPs everywhere, is how it should work. In the early days, this is how IPv4 worked. I remember having full, publicly routable IPs both at home, school, and work, no NAT. This doesn't mean you shouldn't use firewalls, though many in the early days didn't!

p1mrx2• 3 years ago

but I can't think of a technical reason we couldn't do NAT with IPv6

Correct, NAT works fine with IPv6, there just aren't many reasons to use it.

One of the main uses for IPv4 NAT is extending a network without the operator's permission. On IPv6 that can usually be accomplished with ND Proxy.

mrweasel• 3 years ago

I recently switch ISP and the new ISP gives you an IPv6 address and have their router just hand out IPv6 addresses on your LAN as well. It generally works really really well. The only weirdness I've seen is in Firefox when using DoH and IPv6. Sites like Google or Wikipedia just worked, while others simply doesn't and because it's DoH in the browser, you can't actually debug the issue all that well. I believe it may be tied to the combination of a specific DoH service and my ISP, but I haven't tested it fully yet.

Why would you want to use NAT with IPv6 though?

starttoaster• 3 years ago

Why would you want to use NAT with IPv6 though?

I imagine it being far simpler for the average person to adopt IPv6 without much research if all of their current firewall rules, including port forwards, work exactly the same as they did with IPv4. You may not need those port forwards without NATs, but do you trust the firewalls on your servers to disallow accessing other ports from outside your local network?

ajross• 3 years ago

To first approximation, we are. Essentially all mobile networks are IPv6 now. Many wired client drops are IPv4 NAT behind an IPv6 pipe. Most datacenter-internal communication is IPv6, at least at the big players.

The only regime that is still "IPv4-by-default" is public facing servers, which (obviously) still need to present the old addresses for compatibility.

But that last 5% will still be around until we all die. There are just too many client devices out there that will never get an IPv6 update, and client devices tend to live much, much longer than you (or their designers!) think they should.

preinheimer• 3 years ago

Big cloud providers have good IPv6 support. The long tail is terrible. We work with ~200 different hosting providers, half of them have no IPv6 support at all, another ~15% it only works occasionally and they clearly don't monitor it.

There's also a fair number of still popular libraries and frameworks that don't handle IPv6 well. Maybe not in their latest release, but in their more popular older ones.

sgjohnson3• 3 years ago

but I can't think of a technical reason we couldn't do NAT with IPv6?

We absolutely can do NAT with IPv6, but there's no reason why anyone should (aside from stateless NAT66 in case you get a dynamic prefix that changes every now and then, but that's about the only use case)

clnq• 3 years ago

In large part, because of ISPs. There are big costs to the transition that none of their clients care about.

Besides, NAT gives ISPs insight into their users (number of devices, services running on devices, how much traffic each service uses, etc). So you can probably do regional pricing based on that and some other things.

ufmace• 3 years ago

IPv6 is still a mess of compatibility issues, and being an early adopter is not always fun.

I had a really weird problem where Youtube videos were unwatchably laggy on my home desktop PC. Gigabit hard-wired connection. Every other streaming site worked great, ditto every other device I owned. Even downloading the videos on the same device using yt-dlp worked great. After much tearing of hair, I noticed that in the network tab for attempting to watch Youtube, all of the requests for video data that were laggy were going to IPv6 addresses. So I turned off IPv6 at my network adapter and everything worked great after that. I guess Youtube and that PC and browser were the only things that supported v6, every other site, device, and Python dropped to v4 and worked fine.

I guess I could dig deeper into what really went wrong and try to fix it, but I feel like I've already spent enough time and headaches on it. The off switch is just easier.

HumblyTossed3• 3 years ago

Why do some CEOs take such ... interesting(?) ... photos?

Is it supposed to present him in such a way (other than just me thinking that's odd)?

bityard• 3 years ago

CEO is a popular career choice for narcissists.

Jenk2• 3 years ago

That looks like an old photo, the dress and hair are very reminiscent of early-mid 00s style.

HumblyTossed3• 3 years ago

Article says he's 40. 2023 - 40 is ...

Yeah, that can't be it.

dhfbshfbu4u3• 3 years ago

Case History: https://www.courtlistener.com/docket/15573090/united-states-...

The delays were partially due to COVID then later he was able to get it caught up with SCOTUS review of criteria for denaturalization.

But geez his backstory is wild. Iranian born, escaped with parents to Dubai. Started his business in his bedroom at 16. Bought quite a rock for his sweetie back in 2012 (https://youtu.be/FhPiC7zC7wA). She divorced him after everything came undone. Apparently they have a lot of stuff in storage in London. Amazing what you can find in 15 minutes with google.

stickfigure• 3 years ago

I confess, I had to watch a few minutes. It's exactly as cringe as I imagined.

greggsy2• 3 years ago

These highly produced videos are the height of ego, eclipsing most instagram personalities

qingcharles3• 3 years ago

Wow. I don't know what to say about that video.

I did a crazy stunt proposal, but it wasn't douchey like this. And no photos or video were taken.

nashashmi• 3 years ago

Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, the government was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN.

Golestan created 20 companies under false names. And wrote 1 check from each company. Which means 20 cases of (money) wire fraud.

What’s funny here is the chain of laws used to get to a prosecution. Apparently creating twenty companies under twenty false names was not illegal enough.

ozr4• 3 years ago

It's prosecutorial discretion. Generally speaking, they want to charge things that are a combination of big and easy-to-prove.

There's nothing beyond convention that would stop them from _also_ charging for creating companies under fictious names, for adding a wire fraud count for every e-mail he sent as one of the people, for not including their real address on any marketing e-mails they sent, etc etc.

cgb223• 3 years ago

Is the federal govt going to sell the seized IP addresses?

I bet you could get a really good price on them

crhulls• 3 years ago

I find myself looking at the guy's picture and telling myself "of course that is what he looks like!"

But on the flip side, we all know it is a bad idea to judge a book by its cover. How many times can we all recall doing this and feeling bad when our snap judgement was incorrect?

But look at the guy! What is it we are all picking up on in these comments. I am not the only one. Is there something about how he is positioning himself that warrants this? Or do we need to be more aware of our own biases?

wongarsu• 3 years ago

I suspect it's less his physical characteristics, or even his clothing and jewelry, but almost exclusively his body language that is producing this reaction.

Alupis• 3 years ago

No, it's definitely the accoutrements he decides to wrap himself in.

Normal people don't dress or look like that. It's a choice, and he's using it to communicate and signal non-verbally who he is and what he values.

His clothing, accessory, and hair style choices make him appear like he's about to sell me a used car, or muscle me out of my own company.

vikramkr• 3 years ago

I think judging based on the cover is fine when we're judging what the cover is clearly and intentionally trying to communicate to us about the book within.

The pose, the unbuttoned shirt, the hair, those are all conscious choices to communicate a sleazeball personality that probably plays great with his friend/colleague network.

If we were judging someone from a cultural context that's unfamiliar to us or based on irrelevant characteristics like race or gender that would be incorrect and likely biased. But in this case we're just clearly receiving the message he's trying to communicate with intentionality

roughly• 3 years ago

There's a difference between physical characteristics and fashion. You should not judge someone by their physical characteristics - by and large that's out of their control. Their fashion, on the other hand, is how they've decided to present themselves, and is absolutely fair game for judgement, especially for things like corporate headshots in which one is very intentionally choosing how they would like to be viewed by the world.

This fellow decided to present himself as something like a cross between a pickup artist and a street magician, which seems like it was pretty on the money.

adventured• 3 years ago

The photo gives off RapGenius founder vibes (google their photos for anyone not around for the time when the tech media proclaimed that site was going to be the next big thing).

pjot• 3 years ago

If he was instead featured in a haircut magazine on a table in a SuperClips, it’d be less jarring.

confbias• 3 years ago

This thread is an almost perfect example of confirmation bias.

lightbendover• 3 years ago

I would wager some of it is from unconscious bias since he is already positioned as a criminal before you even even see the photograph. Your brain wants to tell itself that it can identify such criminals so it picks up on what it can.

The rest is very much "oh, this person is now known as a criminal, let me find the most sinister looking photo of them possible."

_spduchamp• 3 years ago

There is a reason that photo was selected for the article. It definitely amplifies a message.

southernplaces7• 3 years ago

He's almost like the caricature image of a techbro douchebag scammer CEO, but then all kinds of people can look like all sorts of things and be far from them. SBF, the biggest techbro douchebag scammer CEO of them all, doesn't really look at all like what he is. He perhaps should have looked more like this guy and a few less people would have been fooled (maybe).

overgard4• 3 years ago

The part I struggle with is what exactly he's trying to say with his dress. Like if it was classically formal, I could see that he's trying to convey maybe a trusted solid businessman. But this is more like.... street magician? I'm all for people doing interesting things with their personal style, but man his style sends a very weird message.

tonymet• 3 years ago

If i heard about a system that doesn’t have fraud I think “ yet” or “you probably haven’t bothered to look”

hinkley5• 3 years ago

At some point I knew enough people who “lost” things and a kleptomaniac or two and it really called into question what “crime rate” means. It’s things people noticed and that they thought they could get the authorities interested in. What’s the real number?

apfsx• 3 years ago

What was he doing with the IPs? Reselling them?

greggsy2• 3 years ago

Spam

yieldcrv• 3 years ago

Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, the government was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN.

Should have just walked outside and asked some homeless people to be nominees

And plus he changed to a guilty plea and didn’t wait for the trial

That bolsters my opinion that a small clerical change would have nullified prosecutor’s zeal on the criminal side

Most of this kind of clerical stuff is simply making the exact same action legal by paying attention to the clerical structure

thomastjeffery• 3 years ago

federal prosecutors in South Carolina, who in May 2019 filed criminal wire fraud charges against Golestan, alleging he’d orchestrated a network of shell companies and fake identities to prevent ARIN from knowing the addresses were all going to the same buyer.

So the sentence is for the "Scheme", not the "IP Address".

This is pretty unclear if you have only read the title.

ganoushoreilly• 3 years ago

What's crazy is this story went even further than what's been disclosed. He had working relations with know scammers/crime groups in the Middle east. If you want to read about how crazy this guy was, read the court docs for his divorce.. To say he was a piece of work is an understatement.

Edit: There's also numerous cases ongoing for fraud relating to loans / purchases under these companies. One of the things he did was buy dormant LLCs around the US so they'd have logenvity making it easier to secure loans.

Source: Worked with a National Paper on the story back when it started.

saghm• 3 years ago

Yeah, my initial reading of the headline was that they were being sentenced to be stuck in some IP address scheme for 5 years; I assumed it was a joke about a CEO making a mistake that locked the company into some suboptimal state.

sgjohnson3• 3 years ago

each IPv4 address can fetch between $15-$25

$15-$25? when was that? Currently it's $40-$55 on ipv4.global.

footlose_3815• 3 years ago

Was it the same event as this? https://arstechnica.com/information-technology/2021/04/penta...

_xnmw• 3 years ago

Legitimate question: how do I get myself some IPv4 address space, and then how do I use it with my AWS, Hetzner, etc.?

zX41ZdbW• 3 years ago

Good article on this topic: https://quantum5.ca/2023/10/10/what-i-wish-i-knew-when-i-got...

Recently, I've created an interactive map of all IPv4 addresses, PTAL: https://reversedns.space/

dilyevsky2• 3 years ago

Minimum range you can actually own is /24 so at current prices you’re looking at $10-20k minimum. Not sure about hetzner but aws can use byo address space

ada1981• 3 years ago

Can someone explain to me why this super complicated method was needed?

They must limit IP address purchased on a per org / person basis?

artursapek• 3 years ago

I actually read 4 of the 5 years were for the hair.

wqtz• 3 years ago

As far as I know the strategy he used - "Shell Companies + Phony Individual Information" can be used to purchase any form of assets. Usually, either federal law agencies ignores these activities mostly because how difficult it is to prosecute them. I am out of my depth here, but that is what I know. It is illegal but rarely people get punished for it. I don't think he is getting punished for the acquisition part, but for something else.

What makes ARIN so special? I am going to bet for other RIRs this is pretty normal. AFRINIC IPv4 has a hassle to transfer, and ARIN and RIPE IPs is the target. That leaves APNIC and LACNIC.

I believe, APNIC allocated MASSIVE IP ranges to government research agencies and government educational institution which are slowly being traded and re-registered under ARIN and RIPE.

qingcharles3• 3 years ago

It's a federal case, so he'll have to do at least 85% of that 5 years in prison. Prison sucks horribly, even if you are in a camp like him. Especially if you are smart and techy.

They pushed him into a plea deal though. They were likely to mash all the charges consecutively and he'd be looking at 100 years like Ross Ulbricht if he lost at trial. I know people who have played that game and lost.

What is the deal with the notarized affidavits, though? Each of those is a federal offense which carries 5 years on its own, IIRC.

broknbottle2• 3 years ago

I’ve mentioned this before on HN but I personally dealt with this guy when I was in NOC at a smaller cloud / dedicated hosting provider. He wanted us to announce range for him and everything appeared to check out until we got a complaint and we promptly withdrew the announcement while we got to the bottom. This guy wasn’t very pleasant to deal with and he kept coming back trying to get us to announce different IP ranges. He eventually went away as we just kept pushing back.

mavelikara• 3 years ago

Discussed previously at:

https://news.ycombinator.com/item?id=22360642

https://news.ycombinator.com/item?id=22354357

Tech CEO sentenced to 5 years in IP address scheme

Related Stories