But practical people will find his (the consultant to the newspapers) excuse almost as damning as the evidence that provokes it, for a truly excellent strategy will tolerate myriad failures in execution, while a weak strategy reveals its weakness in the very fact that it is impossible to execute correctly.

As long as craigslist can support its 30 employees on “merely” an estimated $100 million in revenue, there simply isn’t enough cash in this space to keep a giant-sized competitor interested over the long term. When I first saw Jim Buckmaster talk, in 2004, he described his strategy in three words: unbrand, uncompete and demonetize. His victory over eBay illustrates the paradoxical power of demonetization.

By eliminating marketing, sales, and business development, craigslist’s programmers have cut out all the cushioning layers that separate them from the users they serve, and any right they have to teach lessons in public service comes from the odd situation of running a company that is directly subservient only to the public. Here’s the lesson: The public is a motherfucker.

Craig Newmark says that craigslist works because people are good, and he has stuck to this point of view without wavering. Whether you accept it as true will depend on your standard of goodness.

Yet it seems,

And just as people who run technical companies are reaching an apex of confidence in their ability to invent new forms of community based on sharing everything, craigslist still treats social life as dangerously complex, deserving the most jaded caution. Corporate isolation, user anonymity, refusal of excessive profit, glacial adoption of new features: These all signal Newmark and Buckmaster’s wariness about what humans, including themselves, might do if given the chance. There may be a peace sign on every page, but the implicit political philosophy of craigslist has a deeply conservative, even a tragic cast. Every day the choristers of the social web chirp their advice about openness and trust; craigslist follows none of it, and every day it grows.

But we didn’t understand the protocol. At least I didn’t.

This article on Wired details another Internet Security flaw involving BGP.

I can’t say I understand BGP more than before but after reading the article I’m beginning to appreciate more what it really means to understand how something works.

I’m beginning to realize that things weren’t setup for us to question, to understand. I didn’t question, didn’t try to understand. I was contented with just knowing.

I guess that’s why I admire hackers. You can’t hack if you don’t understand. Knowing facts isn’t enough. Knowing isn’t enough. Period.

Here’s how it works. When a user types a website name into his browser or clicks “send” to launch an e-mail, a Domain Name System server produces an IP address for the destination. A router belonging to the user’s ISP then consults a BGP table for the best route. That table is built from announcements, or “advertisements,” issued by ISPs and other networks — also known as Autonomous Systems, or ASes — declaring the range of IP addresses, or IP prefixes, to which they’ll deliver traffic.

The routing table searches for the destination IP address among those prefixes. If two ASes deliver to the address, the one with the more specific prefix “wins” the traffic. For example, one AS may advertise that it delivers to a group of 90,000 IP addresses, while another delivers to a subset of 24,000 of those addresses. If the destination IP address falls within both announcements, BGP will send data to the narrower, more specific one.

To intercept data, an eavesdropper would advertise a range of IP addresses he wished to target that was narrower than the chunk advertised by other networks. The advertisement would take just minutes to propagate worldwide, before data headed to those addresses would begin arriving to his network.

The attack is called an IP hijack and, on its face, isn’t new.

But in the past, known IP hijacks have created outages, which, because they were so obvious, were quickly noticed and fixed. That’s what occurred earlier this year when Pakistan Telecom inadvertently hijacked YouTube traffic from around the world. The traffic hit a dead-end in Pakistan, so it was apparent to everyone trying to visit YouTube that something was amiss.

Pilosov’s innovation is to forward the intercepted data silently to the actual destination, so that no outage occurs.

Ordinarily, this shouldn’t work — the data would boomerang back to the eavesdropper. But Pilosov and Kapela use a method called AS path prepending that causes a select number of BGP routers to reject their deceptive advertisement. They then use these ASes to forward the stolen data to its rightful recipients.