5 ms·

I strongly believe it's not possible to safely run a site without DDoS protection for all servers anymore. Anyone with $20 can take down anything on Digital Oce

I strongly believe it's not possible to safely run a site without DDoS protection for all servers anymore. Anyone with $20 can take down anything on Digital Ocean, Linode, Hetzner, and many others. Or they can run up a huge bill for you on AWS. I would love to use Cloudflare but I can't afford $6000/mo for DDoS protection on my servers with the wildcard requirements we need. Linode may have solved their DDoS problems with their own stuff, but what about their customers' VPSes? I really wish people would start taking DDoS more seriously. It's really not something we can just null route servers for anymore. It's becoming a very serious problem. It's not going away, it's amplifying and getting far worse. I'm also not sure how effective it would be, but it would be nice to see the FBI, NSA or whomever spend at least as much time fighting these DDoS warlords as they did persecuting whistleblowers and trying to shove backdoors into cryptography.

ryanlol 11y ago
Of all the DDoS protection solutions you could spend $6000/mo on CloudFlare is probably the worst choice, hell Voxility will give you better service for $600 a month (And on top of that, they don't give the NSA unfettered access to your all of your traffic). Don't buy CloudFlare for just DDoS protection, their pricing and products are far from competitive.
- zwetan 11y ago
  our you can host your server where DDoS protection is included by default OVH for example https://www.ovh.com/us/news/articles/a1171.protection-anti-ddos-service-standard https://www.ovh.com/us/news/articles/a1171.protection-anti-d...
  - ryanlol 11y ago
    You get what you pay for, in the case of OVH they'll do a decent job tanking volumetric attacks, but fall short for anything that doesn't involve tons of bandwidth.
  - rmdoss 11y ago
    Kinda... I used OVH in the past and they rely on TCP resets/disconnects for large syn floods, making your servers pretty much unusable while being attacked. I found it better to hide the server behind Sucuri or Incapsula if you are worried about ddos.
click170 11y ago
I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders. IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen?
- ryanlol 11y ago
  >I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders. The importance of spoofed traffic to attackers is greatly exaggerated, I could personally easily send 500+ Gbit (probably terabit) sized attacks by spending a couple of weeks building a router botnet. No need to spoof IPs and at that point diminishing returns would make amplification attacks useless. Not only that, but most amplified attacks are particularly inexpensive to filter. >IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen? Who would penalize them? Why? And I'm not entirely sure if you understand what RFCs are, that RFC (which hasn't even been around for very long) is - most other RFCs - completely meaningless.
  - cft 11y ago
    In practice, most volumetric attacks have spoofed IPs- amplified UDP reflection attacks and even SYN floods with no amplification. Getting rid of UDP amplification reflection attacks will get rid of 90% of volumetric attacks.
    - ryanlol 11y ago
      We had volumetric attacks every day much before reflection attacks became common, the biggest attacks these days aren't reflected but from router nets. And you simply cannot solve IP spoofing without rebuilding the entire internet, not to mention the fact that it does have legitimate use cases. Also, if IP spoofing is making filtering difficult for you then you're doing filtering wrong.
rmdoss 11y ago
Take a look at Incapsula or Sucuri: https://incapsula.com https://incapsula.com https://sucuri.net/website-firewall/ https://sucuri.net/website-firewall/ Both a lot cheaper and do a great job protecting against ddos.
- HappyTypist 11y ago
  Not really. Incapsula is useless for DDoS mitigation unless you want to pay for their enterprise plans, starting at $15,600 a year and offers 4 Gbps of protection. http://i.imgur.com/NUnQqlS.jpg http://i.imgur.com/NUnQqlS.jpg My site was DDoS'd for 2 Gbps, according to Incapsula's charts. Incapsula demanded me sign up for a $15.6k annual contract. Cloudflare got back to me in 15 minutes and told me they will gladly host me on their $20/mo plan, which includes 'light DDoS protection'. 2 Gbps is light for cloudflare.
- ryanlol 11y ago
  I'm curious, why not a "real" DDoS protection service? On Incapsula you'll be screwed if your other infra gets hit. Also, for the love of god don't use sucuri. They've had a plenty of opportunities to fully ditch linode but apparently still haven't.
  - rmdoss 11y ago
    They don't use Linode for their DDoS service. I think only some of their blog is in there.
    - ryanlol 11y ago
      Of course they don't, but it gives a good idea about their approach to security.
rdl 11y ago
If it's <3000 records you could just use the API to generate DNS entries, no need for wildcard.

ryanlol 11y ago

Of all the DDoS protection solutions you could spend $6000/mo on CloudFlare is probably the worst choice, hell Voxility will give you better service for $600 a month (And on top of that, they don't give the NSA unfettered access to your all of your traffic). Don't buy CloudFlare for just DDoS protection, their pricing and products are far from competitive.

zwetan 11y ago
our you can host your server where DDoS protection is included by default OVH for example https://www.ovh.com/us/news/articles/a1171.protection-anti-ddos-service-standard https://www.ovh.com/us/news/articles/a1171.protection-anti-d...
- ryanlol 11y ago
  You get what you pay for, in the case of OVH they'll do a decent job tanking volumetric attacks, but fall short for anything that doesn't involve tons of bandwidth.
- rmdoss 11y ago
  Kinda... I used OVH in the past and they rely on TCP resets/disconnects for large syn floods, making your servers pretty much unusable while being attacked. I found it better to hide the server behind Sucuri or Incapsula if you are worried about ddos.

click170 11y ago

I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders. IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen?

ryanlol 11y ago
>I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders. The importance of spoofed traffic to attackers is greatly exaggerated, I could personally easily send 500+ Gbit (probably terabit) sized attacks by spending a couple of weeks building a router botnet. No need to spoof IPs and at that point diminishing returns would make amplification attacks useless. Not only that, but most amplified attacks are particularly inexpensive to filter. >IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen? Who would penalize them? Why? And I'm not entirely sure if you understand what RFCs are, that RFC (which hasn't even been around for very long) is - most other RFCs - completely meaningless.
- cft 11y ago
  In practice, most volumetric attacks have spoofed IPs- amplified UDP reflection attacks and even SYN floods with no amplification. Getting rid of UDP amplification reflection attacks will get rid of 90% of volumetric attacks.
  - ryanlol 11y ago
    We had volumetric attacks every day much before reflection attacks became common, the biggest attacks these days aren't reflected but from router nets. And you simply cannot solve IP spoofing without rebuilding the entire internet, not to mention the fact that it does have legitimate use cases. Also, if IP spoofing is making filtering difficult for you then you're doing filtering wrong.

rmdoss 11y ago

Take a look at Incapsula or Sucuri: https://incapsula.com https://incapsula.com https://sucuri.net/website-firewall/ https://sucuri.net/website-firewall/ Both a lot cheaper and do a great job protecting against ddos.

HappyTypist 11y ago
Not really. Incapsula is useless for DDoS mitigation unless you want to pay for their enterprise plans, starting at $15,600 a year and offers 4 Gbps of protection. http://i.imgur.com/NUnQqlS.jpg http://i.imgur.com/NUnQqlS.jpg My site was DDoS'd for 2 Gbps, according to Incapsula's charts. Incapsula demanded me sign up for a $15.6k annual contract. Cloudflare got back to me in 15 minutes and told me they will gladly host me on their $20/mo plan, which includes 'light DDoS protection'. 2 Gbps is light for cloudflare.
ryanlol 11y ago
I'm curious, why not a "real" DDoS protection service? On Incapsula you'll be screwed if your other infra gets hit. Also, for the love of god don't use sucuri. They've had a plenty of opportunities to fully ditch linode but apparently still haven't.
- rmdoss 11y ago
  They don't use Linode for their DDoS service. I think only some of their blog is in there.
  - ryanlol 11y ago
    Of course they don't, but it gives a good idea about their approach to security.

rdl 11y ago

If it's <3000 records you could just use the API to generate DNS entries, no need for wildcard.