Ubuntu infrastructure has been down for more than a day
Ubuntu infrastructure has been down for more than a day
Ubuntu 基础设施已宕机超过一天
Servers operated by Ubuntu and its parent company Canonical were knocked offline on Thursday morning and have remained down ever since, a situation that’s preventing the OS provider from communicating normally following the botched disclosure of a major vulnerability. 由 Ubuntu 及其母公司 Canonical 运营的服务器于周四上午离线，且至今未能恢复。这一状况导致该操作系统提供商在披露一个重大漏洞出现失误后，无法进行正常的沟通。
Attempts to connect to most Ubuntu and Canonical webpages and download OS updates from Ubuntu servers have consistently failed over the past 24 hours. Updates from mirror sites, however, have continued to work normally. 在过去 24 小时内，尝试连接大多数 Ubuntu 和 Canonical 网页以及从 Ubuntu 服务器下载操作系统更新的操作均告失败。不过，来自镜像站点的更新仍能正常工作。
A Canonical status page said: “Canonical’s web infrastructure is under a sustained, cross-border attack and we are working to address it.” Other than that, Ubuntu and Canonical officials have maintained radio silence since the outage began. Canonical 的状态页面显示：“Canonical 的网络基础设施正遭受持续的跨境攻击，我们正在努力解决这一问题。”除此之外，自宕机开始以来，Ubuntu 和 Canonical 的官方人员一直保持沉默。
A decades-long scourge
长达数十年的祸害
A group sympathetic to the Iranian government has taken credit for the outage. According to posts on Telegram and other social media, the group is responsible for a DDoS attack using Beam, an operation that claims to test the ability of servers to operate under heavy loads but, like other “stressors,” are, in fact, fronts for services miscreants pay for to take down third-party sites. In recent days, the same pro-Iran group has taken credit for DDoSes on eBay. 一个同情伊朗政府的组织声称对此次宕机负责。根据 Telegram 和其他社交媒体上的帖子，该组织利用“Beam”发动了 DDoS 攻击。Beam 本身声称是用于测试服务器在高负载下的运行能力，但实际上，它和其他“压力测试工具”（stressors）一样，都是不法分子付费用于攻击第三方网站的幌子。最近几天，同一个亲伊朗组织还声称对 eBay 的 DDoS 攻击负责。
According to a moderator on AskUbuntu.com, URLs that remained unavailable include: security.ubuntu.com, jaas.ai, archive.ubuntu.com, canonical.com, maas.io, blog.ubuntu.com, developer.ubuntu.com, Ubuntu Security API – CVEs, Ubuntu Security API – Notices, academy.canonical.com, ubuntu.com, portal.canonical.com, assets.ubuntu.com. 据 AskUbuntu.com 的一位版主称，目前仍无法访问的网址包括：security.ubuntu.com、jaas.ai、archive.ubuntu.com、canonical.com、maas.io、blog.ubuntu.com、developer.ubuntu.com、Ubuntu 安全 API – CVEs、Ubuntu 安全 API – 通知、academy.canonical.com、ubuntu.com、portal.canonical.com 以及 assets.ubuntu.com。
Ubuntu and Canonical infrastructure went down hours after researchers released potent exploit code that allowed untrusted users in data centers, university settings, and elsewhere to gain all-powerful root control of servers running virtually all Linux distributions, including Ubuntu. The outage has limited Ubuntu’s ability to communicate security guidance to affected users. As noted earlier, updates remain available from mirror sites. 在研究人员发布了一段强大的漏洞利用代码数小时后，Ubuntu 和 Canonical 的基础设施便陷入了瘫痪。该漏洞允许数据中心、大学环境及其他地方的非受信任用户获得运行几乎所有 Linux 发行版（包括 Ubuntu）服务器的最高 root 控制权。此次宕机限制了 Ubuntu 向受影响用户传达安全指导的能力。如前所述，镜像站点仍可提供更新。
Stressor sites, also known as booter sites, have operated for decades. The DDoS-as-a-service operators have come under the attention of law enforcement in multiple countries, but attempts to shut down this scourge have never succeeded. It’s unclear why the infrastructure has remained unavailable for so long. There’s a wealth of DDoS protection services, at least one of which is free. 压力测试网站（也称为“引导程序”网站）已经存在了数十年。这些“DDoS 即服务”的运营商已引起多国执法部门的关注，但关闭这一祸害的尝试从未成功过。目前尚不清楚为什么该基础设施会长时间处于不可用状态。市面上拥有丰富的 DDoS 防护服务，其中至少有一种是免费的。