3 ms·
On AWS the DDoS hits the wallet instead. What’s the difference? It’s “denial of service,” not denial of server and network resources.
by deno 11y ago
On AWS the DDoS hits the wallet instead. What’s the difference?
It’s “denial of service,” not denial of server and network resources.
- otterley 11y agoAWS ELBs don't forward DNS and NTP traffic to the backends, and ingress bandwidth isn't billed to you. So there's no impact on the wallet when the most common DDoS traffic is aimed at you.
- deno 11y agoThat’s a great point. Still leaves you open for a lot of abuse though.
- otterley 11y agoWhat would be an effective alternative?
- deno 11y agoI’m a fan of OVH myself[1]. Heard good things about x4b.net as well. [1] https://news.ycombinator.com/item?id=10807392 https://news.ycombinator.com/item?id=10807392
- otterley 11y agoIf they're using the typical anti-DDoS mitigation equipment (usually Arbor) then they're almost certainly throwing out good traffic along with bad. AWS's approach of having an ingress pipe large enough to absorb DDoS traffic rates and allowing only valid HTTP requests to pass through the ELB is a superior solution, IMO.
- deno 11y agoWell, yeah, infinite resources are always the best DDoS solution ;) Valid requests ≠ clean traffic. That just moves the attack couple of layers up.