5 ms·

It is the fragility of the TCP/IP infrastructure relative to DDOS attacks that is the problem. I would love to hear about DDOS resilient service architectures

by gwright 10y ago

It is the fragility of the TCP/IP infrastructure relative to DDOS attacks that is the problem. I would love to hear about DDOS resilient service architectures that don't require something like Cloudflare.

DanielDent 10y ago
A pre-funding project I am working will achieve DDoS resilience without gatekeepers like Cloudflare, if I am able to bring it to market. It turns out that there's actually a ton of academic research on a number of very promising techniques, in addition to the approaches I'm hoping to develop. I see the issue more as UI/UX/ease of use/cost of adoption. Right now a lot of approaches you could probably defend a Ph.D. on the topic. They need to instead become approaches developers choose because it's the easiest and most cost-effective way to deliver a high-quality service.
- corobo 10y ago
  How does it work?
  - DanielDent 10y ago
    There's a lot of different technologies and ideas that need to come together in an easy to use way. Three of the most important: * Blockchains * Protocol-level anti-DDoS changes (protocols specifically designed to make them less suitable for use in in DoS) * https://en.wikipedia.org/wiki/Content_centric_networking https://en.wikipedia.org/wiki/Content_centric_networking
    - gwright 10y ago
      I think content centric networking is very interesting, but my original comment was in the context of TCP/IP as it exists today. My gut says that real solutions to DDOS problems are going to have to come from new approaches to networking in general and not just tweaks to TCP/IP or throwing massive amounts of infrastructure at the problem.
      - DanielDent 10y ago
        I think we fundamentally agree. But I would point out a subtle distinction: I believe TCP/IP and DNS provide an adequate building block for what needs to happen in a backwards-compatible progressive enhancement way. I distinguish this from IPv6 which - because of how we chose to implement it - has created a ton of chicken-egg issues with the incentives for adoption.
mindslight 10y ago
Bittorrent, Freenet, IPFS. I know there are a lot of sheep to be shorn in the centralized httpasture, but that shouldn't prevent us earnestly appraising how various technologies effect society.
- viraptor 10y ago
  I don't think Bittorrent and IPFS really qualify for decentralisation of random content on public internet. Do you want to advertise to the world that you're distributing the content you found on a random service you visited? You can become responsible for redistribution of copyrighted just because the website includes it. It could work of course for very restricted applications, like software updates, but general, unfiltered web? No thank you. Unless you're thinking of lots of content mirroring services where you can publish your mirrored content... but then, what's the difference from cloudflare?
  - mindslight 10y ago
    Nothing in the architecture of those protocols requires everyone to republish, especially publicly. The difference is in the namespace of those protocols. Rather than just reusing L4 addresses, they create addresses that are conducive to decentralization. The problem with site mirroring services is once again fundamentally comes down to the naming. Either the site operator has to setup and incorporate the mirrors, or site visitors have to discover and visit each mirror manually. There is no middleground where you can ad-hoc casually ask a peer for a copy and have the exact same functionality.
    - viraptor 10y ago
      If you skip the P2P aspect of those networks, I'm not sure how much it really differs from distributing HTTP traffic over multiple domain names with possible anycast on IPs. You even get an automatic DNS split per region. What's the reason to go with IPFS / BT for distribution from only the endpoints that you control on the internet? (I do see good reasons for it in private networks) Yes, it is non-trivial to setup, but if you need it, then automating this part may be more trivial than getting clients to switch to a new protocol.

by gwright 10y ago

DanielDent 10y ago

A pre-funding project I am working will achieve DDoS resilience without gatekeepers like Cloudflare, if I am able to bring it to market. It turns out that there's actually a ton of academic research on a number of very promising techniques, in addition to the approaches I'm hoping to develop. I see the issue more as UI/UX/ease of use/cost of adoption. Right now a lot of approaches you could probably defend a Ph.D. on the topic. They need to instead become approaches developers choose because it's the easiest and most cost-effective way to deliver a high-quality service.

corobo 10y ago
How does it work?
- DanielDent 10y ago
  There's a lot of different technologies and ideas that need to come together in an easy to use way. Three of the most important: * Blockchains * Protocol-level anti-DDoS changes (protocols specifically designed to make them less suitable for use in in DoS) * https://en.wikipedia.org/wiki/Content_centric_networking https://en.wikipedia.org/wiki/Content_centric_networking
  - gwright 10y ago
    I think content centric networking is very interesting, but my original comment was in the context of TCP/IP as it exists today. My gut says that real solutions to DDOS problems are going to have to come from new approaches to networking in general and not just tweaks to TCP/IP or throwing massive amounts of infrastructure at the problem.
    - DanielDent 10y ago
      I think we fundamentally agree. But I would point out a subtle distinction: I believe TCP/IP and DNS provide an adequate building block for what needs to happen in a backwards-compatible progressive enhancement way. I distinguish this from IPv6 which - because of how we chose to implement it - has created a ton of chicken-egg issues with the incentives for adoption.

mindslight 10y ago

Bittorrent, Freenet, IPFS. I know there are a lot of sheep to be shorn in the centralized httpasture, but that shouldn't prevent us earnestly appraising how various technologies effect society.

viraptor 10y ago
I don't think Bittorrent and IPFS really qualify for decentralisation of random content on public internet. Do you want to advertise to the world that you're distributing the content you found on a random service you visited? You can become responsible for redistribution of copyrighted just because the website includes it. It could work of course for very restricted applications, like software updates, but general, unfiltered web? No thank you. Unless you're thinking of lots of content mirroring services where you can publish your mirrored content... but then, what's the difference from cloudflare?
- mindslight 10y ago
  Nothing in the architecture of those protocols requires everyone to republish, especially publicly. The difference is in the namespace of those protocols. Rather than just reusing L4 addresses, they create addresses that are conducive to decentralization. The problem with site mirroring services is once again fundamentally comes down to the naming. Either the site operator has to setup and incorporate the mirrors, or site visitors have to discover and visit each mirror manually. There is no middleground where you can ad-hoc casually ask a peer for a copy and have the exact same functionality.
  - viraptor 10y ago
    If you skip the P2P aspect of those networks, I'm not sure how much it really differs from distributing HTTP traffic over multiple domain names with possible anycast on IPs. You even get an automatic DNS split per region. What's the reason to go with IPFS / BT for distribution from only the endpoints that you control on the internet? (I do see good reasons for it in private networks) Yes, it is non-trivial to setup, but if you need it, then automating this part may be more trivial than getting clients to switch to a new protocol.