17 ms·
Isn't this the point at which Cloudflare is supposed to gain a handful of PR points for putting him back online, pro bono, and then doing a write up on how effo
by zx2c4 10y ago
Isn't this the point at which Cloudflare is supposed to gain a handful of PR points for putting him back online, pro bono, and then doing a write up on how effortlessly they handled the bandwidth with eBPF?
- Jweb_Guru 10y agoUnfortunately, Krebs has (correctly) repeatedly attacked Cloudflare for sheltering most of the most prolific DDOS attackers. I doubt that's going to happen.
- zx2c4 10y agoCare to fill in the details for me? Do you mean to say the most prolific DDoS attackers work for Cloudflare? Or that their network somehow (?) shelters them? What do you mean exactly? This sounds interesting.
- Jweb_Guru 10y agoThere's another comment that links to one of his posts about it (http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...).
- invokestatic 10y agoCloudflare hilariously acts as a reverse proxy for booters and does not respond to abuse reports against them.
- kyledrake 10y agoI can confirm that this is true. "Hilarious" is not the word I would use to describe it, "potentially criminal" I think is closer to correct.
- fleitz 10y agoI'd call it business savvy.
- Dylan16807 10y agoThey seem to think they have firm legal ground. Keep in mind that most reverse proxies will do the same thing. The only difference with Cloudflare is that you don't know the destination IP.
- deleted 10y ago[deleted]
- driverdan 10y ago> potentially criminal Not even remotely. If the government steps in with a subpoena for the origin host IP or an injunction to stop protecting the site they'd stop. Someone on the internet asking them has no legal power to do so.
- kyledrake 10y agohttps://news.ycombinator.com/item?id=12568256 https://news.ycombinator.com/item?id=12568256
- belorn 10y agoWhy send cloudflare the abuse report rather than the police who are paid by the government to investigate crimes. I have little understanding for this current trend of letting suspected criminals go un-investigated while all focus is on private third-parties that is held up to act police, judge and jury.
- yoo1I 10y agoBecause one would think that it would be in CloudFlare's interest not to harbour criminals on their network. This logic seems to work almost everywhere else on the internet, including privacy friendly hosters in iceland. It's mostly just CloudFlare who replies to every abuse report with the same "WE R A REVERSE PROXY", no matter what the actual issue that was raised with them was. If they were any smaller, their IP ranges would just go into the rogue-isp-blocklist, and that would be the end of that. But because they're mixing in the criminals with their normal customers, that's not really possible. And since I am unlikely to be in any jurisdiction that CloudFlare is in, nor do I have any chance of finding out who these criminals are because CloudFlare is protecting them, going to the police here wouldn't really achieve much.
- dec0dedab0de 10y agoBecause one would think that it would be in CloudFlare's interest not to harbour criminals on their network. It's also not in their best interest to take on the burden of deciding who the criminals are.
- QuantumYeti 10y agoHe might be referring to vDOS using Cloudflare: http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:kaymYsb...
- yolesaber 10y ago>The DDoS-for-hire service is hidden behind DDoS protection firm Cloudflare, but its actual Internet address is 82.118.233.144. https://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:kaymYs...
- npiazza83 10y agoI have personally witnessed Akamai use strongarm tactics to "prove" you need their, "protection" in such a ridiculously high profile instance I am sure they have no shame. If this is a CloudFlare Vs Akamai attack Krebs isn't saying, but I would put dollars to doughnuts it is.
- nolok 10y agoWhile I'm open to believe you if true, you need proof, links to affected people giving details, etc... Not your personal anecdote that may or may not have happened the way you describe it. Otherwise your post is merely an unsubstantiated personal attack against akamai.
- npiazza83 10y agoI've talked about it before in lots of contexts and no one believes me anyway. Why bother?
- shunhai 10y agoCloudflare protects everybody who signs up, including control panels for "booter sites", which are web pages where you can allegedly buy a DDoS attack for an hourly rate. Kind of like the police protects gangsters from getting shot by other gangsters, but you would really like them not to do that, so that the gangsters can just shoot each other. In this case, Brian Krebs tried to convince Cloudflare to kick off the booter sites, so they are unprotected, and can DDoS each other. Cloudflare didn't put any effort into that idea, and now he's apparently angry that he didn't get through to them.
- kyledrake 10y agoThat's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on them instead of cowardly resorting to a throwaway account like you just did. Cloudflare is not the police. They're a private organization that makes a profit from offering "protection" for people getting DDoS attacked. They enable the people doing the DDoS attacks by protecting their booter sites (https://www.google.com/search?q=ddos+booter https://www.google.com/search?q=ddos+booter). That's called a racketeering operation (https://en.wikipedia.org/wiki/Racket_(crime) https://en.wikipedia.org/wiki/Racket_(crime)), and that's illegal. There are laws against it. Just because our crappy government is too incompetent to file charges doesn't mean it isn't illegal. If Cloudflare thinks they can foster criminal activity through their network because they're running a juiced up nginx proxy, they're wrong. The "slippery slope" argument is absolute nonsense. As Krebs himself pointed out, they already remove sites that are hosting phishing attacks and malware. Cloudflare, it's time to do the right thing here and stop protecting DDoS booters. Your policies are helping to damage the internet and censor people, whether they're illegal (they are) or not.
- MichaelGG 10y agoThey enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.
- 10y ago
- elmin 10y agoCloudflare has a pretty simple policy. They only censor content when they legally have to, or when it's child porn. That actually opens them up to a lot of heat from people who aren't big fans of the KKK, the Westboro Baptist Church, or botnets. BUT they don't specifically allow botnets as a weird method of promoting them, it's a widely applied policy. I would bet things would be a fair bit easier for them if they agreed to take things down which most people don't like, but from my position they are taking a very principaled stand for free speech. Are people on hn actually arguing we want more censorship on more places on the web?
- kyledrake 10y agoNobody in here is proposing that Cloudflare censor unpopular speech. We are asking that they stop protecting for-profit DDoS attack sites that are destroying the internet and using violence to censor people's ability to speak. That isn't a freedom of speech debate, it's a debate on the ethics and legality of defending and protecting criminal activity that financially benefits them, a timely topic now that this activity is actively threatening the ability of the internet to function for any kind of speech http://www.webhostingtalk.com/showthread.php?t=1599694 http://www.webhostingtalk.com/showthread.php?t=1599694 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...
- pooper 10y agoI mostly agree with you but let's not take it too far. > We are asking that they stop protecting for-profit DDoS attack sites that are destroying the internet and using violence to censor people's ability to speak. A DoS is not a violent act. I am mostly ignorant of these things but I think attacks if this kind are a service that test our capabilities. My fear is that there might be calls for legislative actions against "DoS attacks" which would then apply to people sitting at home pressing F5.
- ryanlol 10y ago
- elmin 10y agoCloudflare has a pretty simple policy. They only censor content when they legally have to, or when it's child porn. That actually opens them up to a lot of heat from people who aren't big fans of the KKK, the Westboro Baptist Church, or botnets. BUT they don't specifically allow botnets as a weird method of promoting them, it's a widely applied policy. I would bet things would be a fair bit easier for them if they agreed to take things down which most people don't like, but from my position they are taking a very principaled stand for free speech. Are people on hn actually arguing we want more censorship on more places on the web?
- r721 10y agoThey proposed, but he didn't reply: https://twitter.com/eastdakota/status/779063982984355840 https://twitter.com/eastdakota/status/779063982984355840 https://twitter.com/eastdakota/status/779129927543033856 https://twitter.com/eastdakota/status/779129927543033856
- zx2c4 10y agoI wonder why. Any ideas?
- rasz_pl 10y agoI imagine he is still talking with Akamai(they did not comment after all) and expects to be back after attacks die out. Switching would burn that bridge.
- totalZero 10y agoAkamai was good to him by providing services pro bono, so I doubt he wants to knowingly become a PR stunt for CloudFlare.
- godzillabrennus 10y agoI'm surprised that the Azure or Google Cloud teams aren't on top of this. They want tech people to pay attention to their stacks, why not host a high profile site like this to gain the respect of the industry?
- tomlock 10y agoI feel like Brian Krebs is a public good at this point. Would love to see Google foster a better web by hosting him!
- toss1941 10y agoThey should, and get agreements with CDN's / ISP's to forego charges in case of a DDOS. If anyone could pioneer such an agreement, it would be Google.
- deleted 10y ago[deleted]
- nolok 10y agoYou want them to push the idea that isp and other middle men networks should not be dumb pipes, but charge a different pricing depending on traffic type and intent? Your comment may have the best of intentions, but that's how you take net neutrality out the window.
- mastax 10y agoNew way to get on google for free: make an AMP site. Until they start charging for that at least.
- neurostimulant 10y agoConsidering they charge per GB data transfer, even if your site survive the attack you'll get an amazingly expensive bill at the end of the month.
- 10y ago
- Thaxll 10y agoAkamai is probably way bigger than Cloudflare, so if they don't take customer that got a 620Gb DDoS I doubt Cloudflare will.
- johncolanduoni 10y agoI think the bigger issue was that he wasn't a customer (they provided the service pro bono), not that Akamai wouldn't keep a customer that got hit with such an attack.
- michaelt 10y agoTraditionally, journalists and celebrities getting freebies get /better/ service than regular paying customers. I don't see why being pro bono would matter in an established company?
- thomasahle 10y agoCloudflare has this on their website: "600Gbps: Largest DDoS attack stopped" - https://www.cloudflare.com/under-attack-hotline/ https://www.cloudflare.com/under-attack-hotline/ But I suppose attacks may differ in other ways that Gbps.
- VoidWhisperer 10y agoIf I remember what cloudflare's article said, that 600gbps attack was a reflection/amplification attack, which for them is likely easier to filter out then just large amounts of direct DDoS traffic, which is what this was evidently.
- buro9 10y agoIf you're under attack, try us out. We'll aim to surprise you in the most unsurprising and dull way possible, by keeping your site online throughout.
- yabatopia 10y agoShouldn't it be the job of the police to protect his web property. The police, or another government agency, protects citizens offline, why not online? Why do we have to rely on private entities for basic protection online? Time for an online fire department or something similar?
- luch 10y agoI'm pretty sure I've heard some peoples describe CERT/CIRST centers as "web firemen".
- johncolanduoni 10y agoNot that I'm opposed to something like that, but depending on how big a target you are private security is already a must in the real world.
- deleted 10y ago[deleted]
- lsc 10y agohave things changed so much that cloudflare has enough capacity to seriously contemplate handling something that Akamai could not handle? You've gotta get the bandwidth to your filtering servers before you can filter it. DDoS mitigation, as I understand it, is first and foremost a matter of having more capacity than the attacker.