13 ms·
I would like to correlate the comments in this thread with past comments on every single article about AWS or GCE of the form "this is so expensive / complicate
by thrownaway2424 11y ago
I would like to correlate the comments in this thread with past comments on every single article about AWS or GCE of the form "this is so expensive / complicated I run my boxes on Linode for half the price". DDoS protection is one of the things you pay for on the big clouds.
- mwcampbell 11y agoWhat about DigitalOcean? Its pricing is comparable to Linode's, yet DigitalOcean is now the second largest web host in the world according to Netcraft. Do you still think that AWS, Google Cloud Platform, and Microsoft Azure offer better protection?
- deno 11y agoOVH offers very comprehensive DDoS protection with all but the most budget servers: https://www.ovh.com/us/anti-ddos/ https://www.ovh.com/us/anti-ddos/
- MichaelGG 11y agoComments from people seem to indicate their anti DDoS was "we blackhole you if you draw an attack". Has that changed?
- deno 11y agoYes. This hasn’t been true for a long time. OVH runs a huge network and they invested in tools to mitigate and neutralize DDoS attacks[1]. Of course an attack can still saturate your servers’ NICs but they won’t drop you anymore. At their scale they are basically forced to handle big attacks on regular basis. The fact that they offer this protection in their basic package is what makes them a great host[2]. They don’t get a fraction of the love Cloudflare gets, but they should. [1] https://www.ovh.com/us/anti-ddos/hoovering-up.xml https://www.ovh.com/us/anti-ddos/hoovering-up.xml [2] https://www.ovh.com/us/news/articles/a1171.protection-anti-ddos-service-standard https://www.ovh.com/us/news/articles/a1171.protection-anti-d...
- tombrossman 11y agoGood to see OVH getting some recognition here. I am a happy customer of both OVH and DigitalOcean but my usage has become strongly weighted towards OVH. The OVH web interface could be improved (I've had to open support tickets for basic things like activating auto-renewal), that's the only downside with them really. Range of products, network, disk speed and responsiveness are all consistently very good. Their new 2016 'Cloud' VPSs have markedly better disk speed than DigitalOcean's SSDs, which are already pretty fast. For a quick side project I still like DigitalOcean's hourly billing and user interface, but any machine I plan on using for a month or more are all with OVH by default.
- X-Istence 11y agoTheir Anti-DDoS setup is amazing. Once they detect an attack it goes through their VAC setup, and legitimate traffic will still reach you, but illegitimate traffic won't. Got hit with a DDoS to my DNS servers, I didn't see any external service disruption thanks to OVH's setup. I have several of their cheaper SoYouStart servers, and it's awesome.
- pizzeys 11y agoYes. We moved an IRC server that was under attack (and being dropped from DO/Linode) there, and it ate it fantastically well for the price. I've never seen anyone else do it that well for that cheap, to be honest.
- sumedh 11y agoWhy is ovh so cheap compared to linode and DO, whats the catch?
- deleted 11y ago[deleted]
- ivank 11y agoHere's the email I received (many times) when someone sent a smallish 1Gbit/s DDoS to my digitalocean server: > Our system has automatically detected an inbound DDoS against your droplet named xyz with the following IP Address: xx.xx.xx.xx > As a precautionary measure, we have temporarily disabled network traffic to your droplet to protect our network and other customers. Once the attack subsides, networking will be automatically reestablished to your droplet. The networking restriction is in place for three hours and then removed. > Please note that we take this measure only as a last resort when other filtering, routing, and network configuration changes have not been effective in routing around the DDoS attack. > Please let us know if there are any questions, we're happy to help. This happened mere seconds after the DDoS begun! Therefore they lied about having tried to mitigate the attack. No amount of contacting support got me un-blackholed before the 3 hour mark, and when I popped back into the network, I was blackholed again for another 3 hours... I moved to a $3.50/mo OpenVZ VPS at OVH, and OVH's VAC system soaked up the DDoS just fine.
- nacs 11y agoI've received the same type of email multiple times from DigitalOcean and its extremely frustrating. With even the smallest of traffic spikes, DigitalOcean will detect it as a DDoS and immediately cut off your server for 3 hours. If even a typical (< 100Mbit) broadband-cable connection hits your server with a spike of traffic for less than 5 minutes, your server will be taken offline for 3 hours minimum. I've used multiple VPS providers and dedicated-server providers and DO is absolutely the worst when it comes to DDoS policy.
- solusipse 11y agoThat's why DigitalOcean isn't ready for production (unless hiding ip address behind, lets say, cloudflare is an option in your case) and that's why I decided not to use their services anymore.
- mwcampbell 11y agoJust curious, what do you use instead?
- cddotdotslash 11y agoIf you even have the slightest inkling that your site will be attacked by a DDOS (either targeted or randomly) please reconsider DigitalOcean. Their method of handling a DDOS is basically "your node is being attacked, so we're disconnecting it from the network for a few hours. Try to figure out why someone is attacking you." Then, the machine gets reconnected three hours later and the attack cycle continues. Not to mention that since the machine is offline, there is no way of logging in to check access logs, modify firewalls, etc. I've never dealt with a company like DO before. Switched to AWS last year and, even when I was getting extreme traffic, AWS never just shut down access without notice.
- jedicoffee 11y agoYea, throw money at Netcraft and you can be batman of the internet. The numbers being provided to the public are not accurate in any way.
- Diederich 11y agoThat is true. However, how many of the people impacted by the current DDoS against Linode are only affected BECAUSE they are using Linode?
- busterarm 11y agoGuilty. This has caused all kinds of pain for us this weekend. We use WPEngine to host some sites, who in turn host everything on Linode. Honestly WPEngine has some real nerve charging people big bucks for a failover plan that apparently doesn't exist. This is just another of a half-dozen or so Linode failures that took us and loads of other of their customers down completely. We're lucky that we planned for this ahead of time, but we weren't 100% ready to go live on a competing service either. A lot of folks are working on their vacations right now. I think the two questions I'll be asking every host now and into the future are: 1) Do you host your services on Linode. 2) If you do, do you failover to another provider? A yes to the first question and a no to the second is a non-starter in my experience.
- workitout 11y agoAnd yet after years on Linode they are still the best out of many I've tried the past 2 decades, weird how our experiences vary isn't it?
- busterarm 11y agoThe entire market is quite bad across the board. I guess what I should be really saying is that if you're hosting your platform on these services and offer some kind of redundancy, make that redundancy through another host.
- davidvwp 11y agoHey Busterarm, David here from WPE. Are you using our HA solution (Geographic redundancy)? Did that fail? If so, did you open a ticket with support & inquire about an SLA credit? Keep in mind we have many levels of redundancy with all of our plans, but not every plan includes Geo redundancy. Very few sites anywhere truly use hot/hot geo redundancy because of the complexity of database syncing and the expense of duplicating server environments in different data centers. In a DDoS attack (which can happen at any data center, backbone provider, etc.) or any other data center wide outage, the only work around is Geo redundancy. Many hosts have different infrastructure providers and offsite redundancy (e.g. all of our customers enjoy offsite backups), which can allow you to recover your site even if the data center burns down, but don't necessarily provide a true hot/hot level of redundancy. A true hot/hot configuration requires hardware in multiple locations, live database syncing, and geo load balancing. While some of our customers do purchase geo redundancy, it isn't a default part of every account. Again, if you're an HA customer and that failed, please open a ticket. If you have questions on Geo redundancy, you can ask about it in that ticket as well. If you do move hosts, remember any host can be the victim of a DDoS attack and unless you have true hot/hot or hot/warm geo redundancy with your account, you could still be susceptible to data center wide outages like large-scale DDoS attacks. -D
- Mahn 11y agoAs a Linode customer, I guess this wouldn't have happened with AWS, but the way they handle it is still far better than "your server, your bandwidth, deal with it" that you'd get with e.g. Hetzner dedicated servers. We had several hours of downtime, which sucks, but other than that we didn't have to worry about taking measures against the DDoS ourselves.
- deno 11y agoOn AWS the DDoS hits the wallet instead. What’s the difference? It’s “denial of service,” not denial of server and network resources.
- otterley 11y agoAWS ELBs don't forward DNS and NTP traffic to the backends, and ingress bandwidth isn't billed to you. So there's no impact on the wallet when the most common DDoS traffic is aimed at you.
- deno 11y agoThat’s a great point. Still leaves you open for a lot of abuse though.
- otterley 11y agoWhat would be an effective alternative?
- deno 11y agoI’m a fan of OVH myself[1]. Heard good things about x4b.net as well. [1] https://news.ycombinator.com/item?id=10807392 https://news.ycombinator.com/item?id=10807392
- otterley 11y agoIf they're using the typical anti-DDoS mitigation equipment (usually Arbor) then they're almost certainly throwing out good traffic along with bad. AWS's approach of having an ingress pipe large enough to absorb DDoS traffic rates and allowing only valid HTTP requests to pass through the ELB is a superior solution, IMO.
- deno 11y agoWell, yeah, infinite resources are always the best DDoS solution ;) Valid requests ≠ clean traffic. That just moves the attack couple of layers up.
- scurvy 11y agoWhat DDoS protection does AWS provide? The only thing mentions on their webpage is autoscaling, more nodes, etc. In other words, AWS' DDoS protection strategy is to open up your wallet. About 6 months ago they did hire Jeff from BlackLotus. Given that timeline, I'd expect them to announce some sort of DDoS protection offering in the next few quarters. Edit to be more specific: AWS gets hit with a lot of DDoS attacks. While all of AWS isn't unreachable during an attack, parts of it are. It's so large that you might not notice, but parts are unreachable. AWS/GCE size only makes it less noticeable, but they have no customer facing DDoS protection offerings. Their only offering is to buy more of their services. These providers don't have magical 1000000gbps links. They're regular 100gbps links (or 100gbps LACP channels) that can get overrun in large enough attacks.
- gist 11y ago"I'd expect them to announce some sort of DDoS protection offering in the next few quarters." It will be very interesting to see how cost effective that protection actually is and what they charge for it. Nice profit center off of FUD.
- scurvy 11y agoIf they price it like cheap insurance, they will make a lot of money and offer a worthwhile service. Pay them a low monthly rate (X) to have the service active and then pay hourly at Y rate during an attack. You can play with X and Y to maximize your monthly revenue while still offering a cheap (but very valuable) service that retains your customers.
- thrownaway2424 11y agoI don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.
- deleted 11y ago[deleted]
- scurvy 11y ago
- scurvy 11y agoAfter thinking about it more, I now realize that there is one way that AWS/GCE can lessen effects of a DDoS. Given that a lot of attack machines are hosted inside of AWS/GCE, they can handle this with lots of internal network bandwidth. They see less north/south (transit) attack bandwidth than a regular hoster would. In short, if a large amount of the attack traffic originates inside of AWS/GCE, it's better to be off in AWS/GCE. Between the two, neither have any kind of automated tooling to detect and shutdown rogue attack instances (AFAICT). They still rely on third parties to tell them "Hey, you're sending me 300 gbps of DoS traffic."
- frik 11y agoyou mean discussions like this (2 days ago), first comment sub-thread: https://news.ycombinator.com/item?id=10794951 https://news.ycombinator.com/item?id=10794951
- thrownaway2424 11y agoExactamente.
- eeeeeeeeeeeee 11y agoSure, but tell me what your bill is at Amazon when you get hit by a massive attack. Amazon is incredibly resilient against attacks due to their size, but it comes at a price too.