8 ms·

Irony alert: > "But technology providers in the United States could suffer blowback. As Dyn fell under recurring attacks on Friday, Mr. York, the chief strate

by gamegod 10y ago

Irony alert: > "But technology providers in the United States could suffer blowback. As Dyn fell under recurring attacks on Friday, Mr. York, the chief strategist, said such assaults were the reason so many companies are pushing at least parts of their infrastructure to cloud computing networks, to decentralize their systems and make them harder to attack." Pushing your infrastructure to cloud computing is not decentralization - it's centralization, and we're all doing it. Imagine if an attack like this was against AWS... we'd all be screwed.

Symbiote 10y ago
You're correct, it's centralisation, at least for the whole community. It decentralises that one company's DNS -- instead of having one or two DNS servers, perhaps at two sites, they now have 20, at 20 sites. If someone wants to target them, they're probably better protected. But it's the same 20 servers as a million other companies, so the chance of those servers being a target is much greater.
- gamegod 10y ago
  > But it's the same 20 servers as a million other companies, so the chance of those servers being a target is much greater. Yeah, that's what I was getting at. I feel like my chances of being collateral damage on an attack against someone else is way higher in the cloud. Even today with GitHub and other SaaS platforms going down, we were all affected.
smegger001 10y ago
The cloud can be more decentralized but it more expensive, Done properly having redundancy across multiple clouds aws, rackspace, google, azure, in geographically different areas with different internet service providers it can be done in a very distributed decentralized fashion, just no one actaully does that. Instead they throw everything on one provider and pray its is backed up and secured by that cloud provider better than the IT guy down the hall they just laid off.
- paulddraper 10y ago
  If you're talking rendering some VPS's, sure that's possible. But that's a fraction of the cloud. It's hard to integrate every service the hopeful equivalent of every other service.
traskjd 10y ago
Interestingly, in some ways this is a big selling point of AWS/Azure/Goog. The absolute scale they can handle is way up there. The downside of course, is that whilst their infrastructure can likely handle it, handling the bill associated with 'just scale up your service' could be worse than the attack itself.
- deegles 10y ago
  That's a good point. If anything, it makes DDOS attacks more effective since you can't easily scale up your bank account :)
- deleted 10y ago
  [deleted]
- stcredzero 10y ago
  If Azure and Google would like to gain a competitive advantage over AWS, then I would suggest this: Build out a suite of tools for fighting DDOS. Enable private consultants and companies to provide this as a service. Do this in such a way, that cloud customers save money and have to worry about less. Hell, let companies jump in structured as insurance companies! Also bring in cooperation with law enforcement and use data gathering to catch and prosecute DDOS-ers.
  - bogomipz 10y ago
    You can't just build a "suite of tools" and give them to a customer to fight a DDOS. The way DDOS is mitigated is by making routing changes at the network edge. This is not something you want a customer to be able to do for obvious reasons. And these in themselves are sometimes not enough and DDOS mitigation will require coordinating with transit providers, again not something you would want put in a customer console.
  - capecodcarl 10y ago
    Doesn't Google already have the infrastructure to deal with an attack of this magnitude? I remember recently reading about Krebs on Security moving to Google's Project Shield service: http://www.zdnet.com/article/google-rescues-krebs-on-security-from-the-abyss/ http://www.zdnet.com/article/google-rescues-krebs-on-securit...
duaneb 10y ago
It's orthogonal to centralization. Abstracting your infrastructure allows you to easily replicate infrastructure providing the same services. This is only ironic if you expected moving to the cloud to be what provides the redundancy.
cookiecaper 10y ago
This is one of the many reasons AWS and cloud computing in general are way overrated. I know of a company that pays an AWS bill sufficient to buy the equivalent of their pre-cloud datacenter's hardware every 1.5 months. The extra staff required to perform hardware maintenance would also cost about 2 months' worth of AWS each year (that means they're paying ~3x more than they would with hardware). Yet they moved to the cloud because it's the hip thing to do. Cloud has upsides and things that are useful, especially for smaller proprietors who can take advantage of cheap droplets from DigitalOcean et al, but for grown-up companies, moving off your hardware shouldn't be automatic.
- brazzledazzle 10y ago
  I think in some cases it might simply be the means to dump 1) people/groups that just don't have a large scale mindset and 2) bypass business processes that are absolutely not designed for large scale systems. In that scenario you have a bunch of entrenched groups fighting about capex, capacity planning and budget all to get barely enough hardware to account for what you're doing in the next 3-12 months. Instead of taking a step back and creating a long term simple process for regular growth and replacement they get caught in the weeds because they have very old school mindsets. Then you have your old school finance groups who are using terrifyingly delicate and complex interconnected spreadsheets to manage hardware expenditures and depreciation while maintaining old school draconian policies concerning CapEx budgets but allowing you to basically go nuts with OpEx. You could try to change the culture in these entrenched groups who will view your attempts to make things better as political moves against them or you could just say "we're moving everything into the cloud" and make a complete end run around all of the people and baggage. The former is probably the "right" thing to do but the latter is going to let you focus on your product letting you get you back to being competitive.
abluecloud 10y ago
AWS was hit today, we saw a spike failures. Got hold of one of AWS guys and they basically noticed that the issue they saw in the US earlier in the day happened again in EU west. Funnily enough they probably could have avoided it if they'd deployed their mitigation to the other zones.
matt4077 10y ago
I'm pretty sure DDos against http resources have become quite hard to pull of, which is why there was string of attempts to blackmail smaller email provider but nothing like it happens to similar startups relying on the web. Even the Linode attacks are only possible because they're highly target at a few critical systems there.
intrasight 10y ago
It's harder, but you can distribute your web resources across multiple cloud providers
- gamegod 10y ago
  If GitHub and Twitter are struggling with this, what chance do the rest of us have?
  - bigiain 10y ago
    Well one upside of not being a Unicorn is that doubling the infrastructure/hosting costs for a project that's at a "cup of coffee a day" or a "diner and a movie a month" budget isn't a showstopper. Doubling Twitter's infrastructure costs would not be good...
mancerayder 10y ago
AWS was affected at one point. I fully agree with you about the paradox of how, in the intent to de-centralize we centralize into cloud VPSes and managed services. The real reason for the move is that same showtune that we keep hearing in our heads and wish we could tune it out: it's cheaper to move from physical infrastructure to the cloud. It's cheaper to skimp on security by not updating IoT devices. It's cheaper to skimp on security because features need to come first. It's cheaper to outsource operational management to parties with less expertise in places that pay less. To spend less time securing infrastructure perimeters because it costs money. We feel almost as if we feel comfort hiding behind heavyweights like Google and Amazon will protect us from the bad elements of the world, where we hear about major breaches every few weeks (eg., Yahoo being the most recent). Will this strategy pan out long-term? With this DDOS, articles about machine learning picking up better password-cracking/guessing algorithms by having previously analyzed large volumes of passwords, major breaches in the financial world, talk of state-sponsored attacks (a la DNC emails) it certainly FEELS like the Internet has gotten a little bit more wild.
dredmorbius 10y ago
There's also the difference between cabled systems, in which multiple elements can independently support load, and chained systems, in which any given link can fail. The BBC was affected by the Dyn outage not because they themselves relied on Dyn, but because components of their site did.

by gamegod 10y ago

Symbiote 10y ago

You're correct, it's centralisation, at least for the whole community. It decentralises that one company's DNS -- instead of having one or two DNS servers, perhaps at two sites, they now have 20, at 20 sites. If someone wants to target them, they're probably better protected. But it's the same 20 servers as a million other companies, so the chance of those servers being a target is much greater.

gamegod 10y ago
> But it's the same 20 servers as a million other companies, so the chance of those servers being a target is much greater. Yeah, that's what I was getting at. I feel like my chances of being collateral damage on an attack against someone else is way higher in the cloud. Even today with GitHub and other SaaS platforms going down, we were all affected.

smegger001 10y ago

The cloud can be more decentralized but it more expensive, Done properly having redundancy across multiple clouds aws, rackspace, google, azure, in geographically different areas with different internet service providers it can be done in a very distributed decentralized fashion, just no one actaully does that. Instead they throw everything on one provider and pray its is backed up and secured by that cloud provider better than the IT guy down the hall they just laid off.

paulddraper 10y ago
If you're talking rendering some VPS's, sure that's possible. But that's a fraction of the cloud. It's hard to integrate every service the hopeful equivalent of every other service.

traskjd 10y ago

Interestingly, in some ways this is a big selling point of AWS/Azure/Goog. The absolute scale they can handle is way up there. The downside of course, is that whilst their infrastructure can likely handle it, handling the bill associated with 'just scale up your service' could be worse than the attack itself.

deegles 10y ago
That's a good point. If anything, it makes DDOS attacks more effective since you can't easily scale up your bank account :)
deleted 10y ago
[deleted]
stcredzero 10y ago
If Azure and Google would like to gain a competitive advantage over AWS, then I would suggest this: Build out a suite of tools for fighting DDOS. Enable private consultants and companies to provide this as a service. Do this in such a way, that cloud customers save money and have to worry about less. Hell, let companies jump in structured as insurance companies! Also bring in cooperation with law enforcement and use data gathering to catch and prosecute DDOS-ers.
- bogomipz 10y ago
  You can't just build a "suite of tools" and give them to a customer to fight a DDOS. The way DDOS is mitigated is by making routing changes at the network edge. This is not something you want a customer to be able to do for obvious reasons. And these in themselves are sometimes not enough and DDOS mitigation will require coordinating with transit providers, again not something you would want put in a customer console.
- capecodcarl 10y ago
  Doesn't Google already have the infrastructure to deal with an attack of this magnitude? I remember recently reading about Krebs on Security moving to Google's Project Shield service: http://www.zdnet.com/article/google-rescues-krebs-on-security-from-the-abyss/ http://www.zdnet.com/article/google-rescues-krebs-on-securit...

duaneb 10y ago

It's orthogonal to centralization. Abstracting your infrastructure allows you to easily replicate infrastructure providing the same services. This is only ironic if you expected moving to the cloud to be what provides the redundancy.

cookiecaper 10y ago

This is one of the many reasons AWS and cloud computing in general are way overrated. I know of a company that pays an AWS bill sufficient to buy the equivalent of their pre-cloud datacenter's hardware every 1.5 months. The extra staff required to perform hardware maintenance would also cost about 2 months' worth of AWS each year (that means they're paying ~3x more than they would with hardware). Yet they moved to the cloud because it's the hip thing to do. Cloud has upsides and things that are useful, especially for smaller proprietors who can take advantage of cheap droplets from DigitalOcean et al, but for grown-up companies, moving off your hardware shouldn't be automatic.

brazzledazzle 10y ago
I think in some cases it might simply be the means to dump 1) people/groups that just don't have a large scale mindset and 2) bypass business processes that are absolutely not designed for large scale systems. In that scenario you have a bunch of entrenched groups fighting about capex, capacity planning and budget all to get barely enough hardware to account for what you're doing in the next 3-12 months. Instead of taking a step back and creating a long term simple process for regular growth and replacement they get caught in the weeds because they have very old school mindsets. Then you have your old school finance groups who are using terrifyingly delicate and complex interconnected spreadsheets to manage hardware expenditures and depreciation while maintaining old school draconian policies concerning CapEx budgets but allowing you to basically go nuts with OpEx. You could try to change the culture in these entrenched groups who will view your attempts to make things better as political moves against them or you could just say "we're moving everything into the cloud" and make a complete end run around all of the people and baggage. The former is probably the "right" thing to do but the latter is going to let you focus on your product letting you get you back to being competitive.

abluecloud 10y ago

AWS was hit today, we saw a spike failures. Got hold of one of AWS guys and they basically noticed that the issue they saw in the US earlier in the day happened again in EU west. Funnily enough they probably could have avoided it if they'd deployed their mitigation to the other zones.

matt4077 10y ago

I'm pretty sure DDos against http resources have become quite hard to pull of, which is why there was string of attempts to blackmail smaller email provider but nothing like it happens to similar startups relying on the web. Even the Linode attacks are only possible because they're highly target at a few critical systems there.

intrasight 10y ago

It's harder, but you can distribute your web resources across multiple cloud providers

gamegod 10y ago
If GitHub and Twitter are struggling with this, what chance do the rest of us have?
- bigiain 10y ago
  Well one upside of not being a Unicorn is that doubling the infrastructure/hosting costs for a project that's at a "cup of coffee a day" or a "diner and a movie a month" budget isn't a showstopper. Doubling Twitter's infrastructure costs would not be good...

mancerayder 10y ago

AWS was affected at one point. I fully agree with you about the paradox of how, in the intent to de-centralize we centralize into cloud VPSes and managed services. The real reason for the move is that same showtune that we keep hearing in our heads and wish we could tune it out: it's cheaper to move from physical infrastructure to the cloud. It's cheaper to skimp on security by not updating IoT devices. It's cheaper to skimp on security because features need to come first. It's cheaper to outsource operational management to parties with less expertise in places that pay less. To spend less time securing infrastructure perimeters because it costs money. We feel almost as if we feel comfort hiding behind heavyweights like Google and Amazon will protect us from the bad elements of the world, where we hear about major breaches every few weeks (eg., Yahoo being the most recent). Will this strategy pan out long-term? With this DDOS, articles about machine learning picking up better password-cracking/guessing algorithms by having previously analyzed large volumes of passwords, major breaches in the financial world, talk of state-sponsored attacks (a la DNC emails) it certainly FEELS like the Internet has gotten a little bit more wild.

dredmorbius 10y ago

There's also the difference between cabled systems, in which multiple elements can independently support load, and chained systems, in which any given link can fail. The BBC was affected by the Dyn outage not because they themselves relied on Dyn, but because components of their site did.