6 ms·

This is awesome. One question I have in comparison to GitHub Pages is if a global CDN is used and if there is effective DDOS protection built in. GitHub has to

This is awesome. One question I have in comparison to GitHub Pages is if a global CDN is used and if there is effective DDOS protection built in. GitHub has to deal with regular DDOS attacks, and I imagine GitLab will have a few too. GitHub does a pretty good job with it, but before I move to GitLab Pages I'd like to understand that better but didn't see that info anywhere.

dangrossman 11y ago
GitLab's hosted on Azure. I don't think Azure will fall over to a DDOS, you'll just wake up to a hefty bandwidth bill.
- nixgeek 11y ago
  Not all DDoS is volumetric, and even in volumetric attacks it can be complex to differentiate legitimate traffic from the noise being generated by the botnet. Effective mitigation is about far more than "How big is your pipe?" so this comment reads as somewhat uninformed. tl;dr - Azure does not have a magic <SOLVE DDOS> button which someone pushes, fixes all kinds of attacks, and just charges you for this at $1175/hr whilst you sleep peacefully.
jobvandervoort 11y ago
Right now, GitLab Pages is hosted on the same servers as GitLab.com, so it gets the same attention from our engineers in terms of reliability and uptime. We're not using a global CDN, but this is something we will explore.
- sytse 11y ago
  We're working on adding Cloudflare in front of GitLab Pages in https://gitlab.com/gitlab-com/operations/issues/75 https://gitlab.com/gitlab-com/operations/issues/75 We don't have a lot of experience yet with DDOS protection so there might be downtime as we learn that. As you can see in the issue we're working to implement protection before we need it but it might not be ready in time nor can it protect against everything.
  - deleted 11y ago
    [deleted]
  - mynewtb 11y ago
    Please do not use Cloudflare. Their 'protection' against privacy aware Tor users makes accessing sites through incredibly painful.
    - iancarroll 11y ago
      GitLab can just disable that...
      - sytse 11y ago
        Good idea, I made a note in https://gitlab.com/gitlab-com/operations/issues/75#note_4599684 https://gitlab.com/gitlab-com/operations/issues/75#note_4599...
    - the_mitsuhiko 11y ago
      For what it's worth Cloudflare does not do anything different for Tor than for regular IPs. Since those are static pages with most likely not exactly questionable content the use of Tor is probably not all that important anyways that the total number of users that might be affected would be miniscule.
      - dublinben 11y ago
        >the use of Tor is probably not all that important anyways Who are you to decide that my use of Tor is not important enough?
        sneak 11y ago
        A site operator. It isn't censorship for someone to decide who they want to talk to. CF is simply giving site owners levers to use if they so choose. While I am a strong supporter of Tor, privacy, and anonymity, CF has done nothing wrong here by allowing site operators to selectively choose who they wish to serve to.
amelius 11y ago
Better to ask about their minimum availability guarantee. Knowing that the servers can handle a DDOS attack is of little value if the service goes down for maintenance every day (just to give an example).
- sytse 11y ago
  GitLab.com runs the same GitLab as our users and some upgrades require downtime. Other operations should not require downtime, we have multiple application servers and load balancers. The backend services are HA except the file storage until we complete the move to CephFS.
  - gsmethells 11y ago
    Why did you guys choose Ceph instead of OpenStack Swift? Just curious.
    - jobvandervoort 11y ago
      I'm not sure whether we've seriously considered Swift, but high bandwidth is important to improving our performance, one area in which Ceph seems to be the better choice [0]. [0]: http://www.sparkmycloud.com/blog/a-performance-review-of-swift-vs-ceph/ http://www.sparkmycloud.com/blog/a-performance-review-of-swi...
      - amelius 11y ago
        IIRC there was an issue (in Ceph) with performance in the case of many small files. Is that solved now?
      - sytse 11y ago
        Swift only provides object storage and we need block storage.

dangrossman 11y ago

GitLab's hosted on Azure. I don't think Azure will fall over to a DDOS, you'll just wake up to a hefty bandwidth bill.

nixgeek 11y ago
Not all DDoS is volumetric, and even in volumetric attacks it can be complex to differentiate legitimate traffic from the noise being generated by the botnet. Effective mitigation is about far more than "How big is your pipe?" so this comment reads as somewhat uninformed. tl;dr - Azure does not have a magic <SOLVE DDOS> button which someone pushes, fixes all kinds of attacks, and just charges you for this at $1175/hr whilst you sleep peacefully.

jobvandervoort 11y ago

Right now, GitLab Pages is hosted on the same servers as GitLab.com, so it gets the same attention from our engineers in terms of reliability and uptime. We're not using a global CDN, but this is something we will explore.

sytse 11y ago
We're working on adding Cloudflare in front of GitLab Pages in https://gitlab.com/gitlab-com/operations/issues/75 https://gitlab.com/gitlab-com/operations/issues/75 We don't have a lot of experience yet with DDOS protection so there might be downtime as we learn that. As you can see in the issue we're working to implement protection before we need it but it might not be ready in time nor can it protect against everything.
- deleted 11y ago
  [deleted]
- mynewtb 11y ago
  Please do not use Cloudflare. Their 'protection' against privacy aware Tor users makes accessing sites through incredibly painful.
  - iancarroll 11y ago
    GitLab can just disable that...
    - sytse 11y ago
      Good idea, I made a note in https://gitlab.com/gitlab-com/operations/issues/75#note_4599684 https://gitlab.com/gitlab-com/operations/issues/75#note_4599...
  - the_mitsuhiko 11y ago
    For what it's worth Cloudflare does not do anything different for Tor than for regular IPs. Since those are static pages with most likely not exactly questionable content the use of Tor is probably not all that important anyways that the total number of users that might be affected would be miniscule.
    - dublinben 11y ago
      >the use of Tor is probably not all that important anyways Who are you to decide that my use of Tor is not important enough?
      - sneak 11y ago
        A site operator. It isn't censorship for someone to decide who they want to talk to. CF is simply giving site owners levers to use if they so choose. While I am a strong supporter of Tor, privacy, and anonymity, CF has done nothing wrong here by allowing site operators to selectively choose who they wish to serve to.

amelius 11y ago

Better to ask about their minimum availability guarantee. Knowing that the servers can handle a DDOS attack is of little value if the service goes down for maintenance every day (just to give an example).

sytse 11y ago
GitLab.com runs the same GitLab as our users and some upgrades require downtime. Other operations should not require downtime, we have multiple application servers and load balancers. The backend services are HA except the file storage until we complete the move to CephFS.
- gsmethells 11y ago
  Why did you guys choose Ceph instead of OpenStack Swift? Just curious.
  - jobvandervoort 11y ago
    I'm not sure whether we've seriously considered Swift, but high bandwidth is important to improving our performance, one area in which Ceph seems to be the better choice [0]. [0]: http://www.sparkmycloud.com/blog/a-performance-review-of-swift-vs-ceph/ http://www.sparkmycloud.com/blog/a-performance-review-of-swi...
    - amelius 11y ago
      IIRC there was an issue (in Ceph) with performance in the case of many small files. Is that solved now?
    - sytse 11y ago
      Swift only provides object storage and we need block storage.