5 ms·

DDoS is making it so small players (and very large ones like the IA) can't run web sites anymore. It's time to stop bullshitting this problem and pretending it'

DDoS is making it so small players (and very large ones like the IA) can't run web sites anymore. It's time to stop bullshitting this problem and pretending it's going to go away or that you can sign up for a magic cheap plan somewhere and all the problems stop happening. We really, really need to start getting active about solving this problem. That means building DDoS protection into the nature of the web and all hosting by default (AWS and GCS I'm looking at you), and that means actively prosecuting DDoS attackers. That also means, if you're a cloud DDoS provider, not helping to protect the sites where these attacks are marketed.

hartator 10y ago
How do you do that? The nature of DDOS is to send multiple requests from multiple locations. It's not easy to counter this if you can't scale up as big as the DDOS is. If you start banning IPs, you are going to also ban legitimate users. (search for "tor and cloudflare")
- kyledrake 10y ago
  DDoS attacks are not the result of millions of people individually attacking a site, they are almost always the result of small criminal organizations that are controlling botnets that do the attack on compromised systems for-profit. They offer these attack services via market web sites. It's highly likely that this person used one of these markets to execute the attack against the Internet Archive. It's not easy to go after them, but neither is it easy to go after CP peddlers, and yet we still go after them and arrests are made. It's one part of a many-faceted strategy that will be needed to get some control over a problem that is clearly getting worse.
jacquesm 10y ago
> That means building DDoS protection into the nature of the web No, you'd have to build it into the nature of the internet, specifically into all the users of insecure machines and all the builders of core routers. One good thing that could be done is to have an organized response to any DDOS and to make it so easy to trigger this response that victims will lose very little in terms of downtime. Commercial responses to DDOS (CloudFlare for instance) are useful, but only as a stop-gap measure, essentially the fact that there is a business opportunity here documents a huge flaw in the way the internet currently works. Remember that hosting providers are as much (or even more) on the receiving end of these (for instance: when a customer of a hosting provider gets DDOS'd all the other customers will suffer too), and signaling they are part of the problem is akin to victim blaming.
- kyledrake 10y ago
  It's not victim blaming to insist that supercorporations like Amazon and Google provide the same proactive DDoS mitigation services that many other providers do. If OVH can do it, they can too. OVH can't even figure out how to do recurring billing properly and they can do it. It is victim blaming when people tell you it's your fault you're getting DDoSed because you can't afford several thousand dollar DDoS mitigation, it is victim blaming when someone's server simply gets null routed because they're being attacked, and it is victim blaming is when AWS hands Greatfire a crazy bandwidth bill because China attacked them.
  - AznHisoka 10y ago
    How does ovh handle ddos attacks for their customers? Do they just claim it or do they actually provide it in your experience?
    - pfg 10y ago
      It works reasonably well against typical DDoS attacks. I've read that booters have started to show warnings that they're ineffective when used against IPs belonging to OVH. It probably doesn't do much against resource exhaustion attacks at the application layer (that's more of a job for WAFs/rate limiting, anyway.) Their site has some details: https://www.ovh.co.uk/anti-ddos/analysis.xml https://www.ovh.co.uk/anti-ddos/analysis.xml
      - joepie91_ 10y ago
        There are quite a few more technical details here: https://www.ovh.com/us/news/articles/a1171.protection-anti-ddos-service-standard https://www.ovh.com/us/news/articles/a1171.protection-anti-d...
    - X-Istence 10y ago
      They actually provide it. They have some documents on how: https://www.ovh.co.uk/anti-ddos/ https://www.ovh.co.uk/anti-ddos/
    - 10y ago
inanity 10y ago
Hope this serves as a reminder for the importance of a decentralized web; I'd gladly host an Archive@Home node.
- throwaway6436 10y ago
  AKA "torrent". You are so cute.
  - effingwewt 10y ago
    No, a decentralized node. But your attempt at oversimplification coupled with sarcasm was....so cute.
- mekarpeles 10y ago
  In the same vein, the Internet Archive recently hostly the Decentralized Web Summit in SF (http://decentralizedweb.net http://decentralizedweb.net).

hartator 10y ago

How do you do that? The nature of DDOS is to send multiple requests from multiple locations. It's not easy to counter this if you can't scale up as big as the DDOS is. If you start banning IPs, you are going to also ban legitimate users. (search for "tor and cloudflare")

kyledrake 10y ago
DDoS attacks are not the result of millions of people individually attacking a site, they are almost always the result of small criminal organizations that are controlling botnets that do the attack on compromised systems for-profit. They offer these attack services via market web sites. It's highly likely that this person used one of these markets to execute the attack against the Internet Archive. It's not easy to go after them, but neither is it easy to go after CP peddlers, and yet we still go after them and arrests are made. It's one part of a many-faceted strategy that will be needed to get some control over a problem that is clearly getting worse.

jacquesm 10y ago

> That means building DDoS protection into the nature of the web No, you'd have to build it into the nature of the internet, specifically into all the users of insecure machines and all the builders of core routers. One good thing that could be done is to have an organized response to any DDOS and to make it so easy to trigger this response that victims will lose very little in terms of downtime. Commercial responses to DDOS (CloudFlare for instance) are useful, but only as a stop-gap measure, essentially the fact that there is a business opportunity here documents a huge flaw in the way the internet currently works. Remember that hosting providers are as much (or even more) on the receiving end of these (for instance: when a customer of a hosting provider gets DDOS'd all the other customers will suffer too), and signaling they are part of the problem is akin to victim blaming.

kyledrake 10y ago
It's not victim blaming to insist that supercorporations like Amazon and Google provide the same proactive DDoS mitigation services that many other providers do. If OVH can do it, they can too. OVH can't even figure out how to do recurring billing properly and they can do it. It is victim blaming when people tell you it's your fault you're getting DDoSed because you can't afford several thousand dollar DDoS mitigation, it is victim blaming when someone's server simply gets null routed because they're being attacked, and it is victim blaming is when AWS hands Greatfire a crazy bandwidth bill because China attacked them.
- AznHisoka 10y ago
  How does ovh handle ddos attacks for their customers? Do they just claim it or do they actually provide it in your experience?
  - pfg 10y ago
    It works reasonably well against typical DDoS attacks. I've read that booters have started to show warnings that they're ineffective when used against IPs belonging to OVH. It probably doesn't do much against resource exhaustion attacks at the application layer (that's more of a job for WAFs/rate limiting, anyway.) Their site has some details: https://www.ovh.co.uk/anti-ddos/analysis.xml https://www.ovh.co.uk/anti-ddos/analysis.xml
    - joepie91_ 10y ago
      There are quite a few more technical details here: https://www.ovh.com/us/news/articles/a1171.protection-anti-ddos-service-standard https://www.ovh.com/us/news/articles/a1171.protection-anti-d...
  - X-Istence 10y ago
    They actually provide it. They have some documents on how: https://www.ovh.co.uk/anti-ddos/ https://www.ovh.co.uk/anti-ddos/
  - 10y ago

inanity 10y ago

Hope this serves as a reminder for the importance of a decentralized web; I'd gladly host an Archive@Home node.

throwaway6436 10y ago
AKA "torrent". You are so cute.
- effingwewt 10y ago
  No, a decentralized node. But your attempt at oversimplification coupled with sarcasm was....so cute.
mekarpeles 10y ago
In the same vein, the Internet Archive recently hostly the Decentralized Web Summit in SF (http://decentralizedweb.net http://decentralizedweb.net).