6 ms·

Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about

Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this up before: https://news.ycombinator.com/item?id=11261882 https://news.ycombinator.com/item?id=11261882 https://news.ycombinator.com/item?id=11000086 https://news.ycombinator.com/item?id=11000086 Many people that are in denial about this. This article is not an outlier, this is exactly how DDoS is now. DDoSes are cheap to execute and devastating to the host. Your competitor will chip in a little Bitcoin and get these people to attack your site. Or they'll just do it because they're bored and it's basically free for them. I knew a guy that worked on a site, he told me they always got DDoSed every time his site put on a sale. Guaranteed DDoS. Who gets the $30,000+ bandwidth bill for the attack? Well, if you're using AWS or GCS, you do of course (it happened to Greatfire, why won't it happen to you?) 30x market bandwidth markups, zero DDoS mitigation. Good luck. Edit: Oh, and VPS providers (DigitalOcean, Linode) that just null route servers for hours or days during a DDoS: you're not off the hook either.

deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
Scoundreller 11y ago
Most residential Canadian internet connections have bandwidth caps. They're usually between 20gb and 200gb. Customers could only wish that their markup on overage was just 30x...
- wongarsu 11y ago
  Because of economies of scale bandwidth in a datacenter is always going to be substantially cheaper than bandwidth in homes. Connecting thousands of homes to an internet backbone requires much more infrastructure than connecting one datacenter.
mgo 11y ago
Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.
- takeda 11y ago
  That protects you from dumb attackers who don't understand how things work. How will you protect the origin?
  - mgo 11y ago
    By never revealing the IP address of the origin. Conceal it completely behind CF. A properly configured CF setup will mean your real server IP never gets revealed ever.
    - billmalarky 11y ago
      Not always possible without expensive plans. For example, if you use websockets you will need a business/enterprise level plan in order to pipe through cloudflare. Non http/https services often fail to go through cloudflare as well. For example, you're gonna have to reveal origin to use ftp/sftp.
      - kijin 11y ago
        Not everyone needs websockets, and only the legitimate administrator needs to know the true IP address for ssh. Plenty of websites can be perfectly hidden behind CloudFlare as long as they don't have an MX record or unused subdomain that points to the same server.
        billmalarky 11y ago
        >and only the legitimate administrator needs to know the true IP address for ssh Again this is a blanket statement. I recently integrated with a service that required sftp access to function. Is this ideal? No, but if I could recreate the service efficiently I wouldn't be paying for it in the first place. This and the websockets scenario were just two examples I can come up with from personal experience, I'm sure there are many other situations that I've never come across. My point is that the above commenter was acting like cloudflare is a panacea for DDOS attacks. >"A properly configured CF setup will mean your real server IP never gets revealed ever." This makes it sound like only engineers who are inept with cloudflare are vulnerable to origin ip leaks which simply isn't true. > Plenty of websites can be perfectly hidden behind CloudFlare as long as they don't have an MX record or unused subdomain that points to the same server. I agree with you here 100%.

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

Scoundreller 11y ago

Most residential Canadian internet connections have bandwidth caps. They're usually between 20gb and 200gb. Customers could only wish that their markup on overage was just 30x...

wongarsu 11y ago
Because of economies of scale bandwidth in a datacenter is always going to be substantially cheaper than bandwidth in homes. Connecting thousands of homes to an internet backbone requires much more infrastructure than connecting one datacenter.

mgo 11y ago

Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.

takeda 11y ago
That protects you from dumb attackers who don't understand how things work. How will you protect the origin?
- mgo 11y ago
  By never revealing the IP address of the origin. Conceal it completely behind CF. A properly configured CF setup will mean your real server IP never gets revealed ever.
  - billmalarky 11y ago
    Not always possible without expensive plans. For example, if you use websockets you will need a business/enterprise level plan in order to pipe through cloudflare. Non http/https services often fail to go through cloudflare as well. For example, you're gonna have to reveal origin to use ftp/sftp.
    - kijin 11y ago
      Not everyone needs websockets, and only the legitimate administrator needs to know the true IP address for ssh. Plenty of websites can be perfectly hidden behind CloudFlare as long as they don't have an MX record or unused subdomain that points to the same server.
      - billmalarky 11y ago
        >and only the legitimate administrator needs to know the true IP address for ssh Again this is a blanket statement. I recently integrated with a service that required sftp access to function. Is this ideal? No, but if I could recreate the service efficiently I wouldn't be paying for it in the first place. This and the websockets scenario were just two examples I can come up with from personal experience, I'm sure there are many other situations that I've never come across. My point is that the above commenter was acting like cloudflare is a panacea for DDOS attacks. >"A properly configured CF setup will mean your real server IP never gets revealed ever." This makes it sound like only engineers who are inept with cloudflare are vulnerable to origin ip leaks which simply isn't true. > Plenty of websites can be perfectly hidden behind CloudFlare as long as they don't have an MX record or unused subdomain that points to the same server. I agree with you here 100%.