3 ms·

Where are you getting all this? I have a thought - perhaps it's not that everyone but you and your favourite organization is automatically incompetent! Perhaps

Where are you getting all this? I have a thought - perhaps it's not that everyone but you and your favourite organization is automatically incompetent! Perhaps there are reasons people do things! Perhaps there is more to something than what you can immediately glean! You could wait to learn more to pass judgement, but it seems you don't feel like doing that. > they were eliminating FreeBSD and had a brain drain a few years ago. Overall pretty unsurprising outcome. Thus they must be incompetent, because in their narrow minded foolishness, they don't understand that it is the Superior Operating System. There could be no other reason to do what they did. It couldn't have made sense for some other reason. Right? I also appreciate the BSDs for what they are, but this is so condescending. This whole post is so condescending. > Internet reliability no more complex and certainly much cheaper than analogous critical infrastructure like electrical generation for a region Not if you're trying to also make it cost effective? Electrical generation has well understood usage patterns, hasn't grown that much in the last few decades and doesn't have the kind of demand spikes that happen on the internet. Plus, power companies are mostly monopolies and charge whatever they want. It's an apples and oranges comparison. Also, electrical grids fail from time to time too! See the northeast blackout of 2003. Verisign has a similar monopoly to power companies and charges a huge tax margin on domains for all the services it provides. Without arguing about whether this is good or bad, we can say that Verisign is in effect pre-subsidized to provide however complex / redundant / reliable a service they want to provide. edit: Here's Krebs' breakdown of the attack: https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/ https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twit... Looks like OVH, the latest mirai attack, was around 1.2tbps. That's nothing to scoff at.

kev009 10y ago
Where am I getting what? My argument is that weak leadership causes the problems we see. You sound personally affronted because the I am pointing out a view of the industry that is not rosy glasses where we are all geniuses and Silicon Valley inspired culture solves all the hard problems with slam dunks. These problems are preventable and the tech industry is actually a wasteland of poor understanding and repeating organizational and managerial failure. These are ignored because everyone else is as almost as bad, and most people can't judge the good from the bad. This isn't cutting edge research, you carbon copy a competent company's design and they will probably explain it publicly if you ask nicely. There are forums like IETF and NANOG where you can exchange these practices, and professionals do that to build the profession. Swap out BSD with anything you please, just don't single source when you've hit breakout success and revenue loss from failure is material. I'm not a zealot, I even think WinNT is a pretty nice kernel and could fit into this picture with the new Microsoft. The point is you aren't holding up whole digit numbers of worldwide GDP on one kernel with a very poor security track record. Every modern widely used kernel applies to this statement. This is insane, I hope you can take that away from this thread at least. The cost of designing against common mode failure is inconsequential when properly budgeted against cost of actual failure. Any company in the Fortune 500, non-tech included, could afford to create a DDOS-proof DNS and web platform. Luckily they shouldn't have to if the service providers acted more like Verisign. And it scales down too, it would cost at most $100s of dollars a year for a single person company to multisource cloud providers, but likely it will be a wash since IAAS is most commonly usage billing.
kev009 10y ago
Your sense of mechanical sympathy is not aligned with the advances in hardware and internet infrastructure. It would be possible to handle a 1.2tbps DDOS in a single IX like LON, AMS, FRA, LGA, IAD, ORD, ATL, MIA, SJC, LAX, SIN, HKG, ICN, KIX let alone world wide. It would take a lot more active management and work across companies if someone is clogging regional interconnect to a spoke, but that would not cause worldwide outage. 1.2tbps is 120 of Verisign's 2013 server and code, maybe a million dollars CapEx. And 12 100g peering ports, $150k monthly at bulk transit pricing if you can't do any settlement free for some reason. Yes there are other costs, but it is easy to scale and well within the means of midsize business let alone unicorns. The thing about DDOS -- it's a lot harder to get aggregate bandwidth, those eyeball networks will bottleneck a lot sooner than 1000 meter runs of fiber between peers at an IX. And there are some natural imbalanced ratios like CDNs that are sitting on dozens of tbps of unused ingress that can jump into offering services for other companies that don't want to figure it all out.

kev009 10y ago

Where am I getting what? My argument is that weak leadership causes the problems we see. You sound personally affronted because the I am pointing out a view of the industry that is not rosy glasses where we are all geniuses and Silicon Valley inspired culture solves all the hard problems with slam dunks. These problems are preventable and the tech industry is actually a wasteland of poor understanding and repeating organizational and managerial failure. These are ignored because everyone else is as almost as bad, and most people can't judge the good from the bad. This isn't cutting edge research, you carbon copy a competent company's design and they will probably explain it publicly if you ask nicely. There are forums like IETF and NANOG where you can exchange these practices, and professionals do that to build the profession. Swap out BSD with anything you please, just don't single source when you've hit breakout success and revenue loss from failure is material. I'm not a zealot, I even think WinNT is a pretty nice kernel and could fit into this picture with the new Microsoft. The point is you aren't holding up whole digit numbers of worldwide GDP on one kernel with a very poor security track record. Every modern widely used kernel applies to this statement. This is insane, I hope you can take that away from this thread at least. The cost of designing against common mode failure is inconsequential when properly budgeted against cost of actual failure. Any company in the Fortune 500, non-tech included, could afford to create a DDOS-proof DNS and web platform. Luckily they shouldn't have to if the service providers acted more like Verisign. And it scales down too, it would cost at most $100s of dollars a year for a single person company to multisource cloud providers, but likely it will be a wash since IAAS is most commonly usage billing.

kev009 10y ago

Your sense of mechanical sympathy is not aligned with the advances in hardware and internet infrastructure. It would be possible to handle a 1.2tbps DDOS in a single IX like LON, AMS, FRA, LGA, IAD, ORD, ATL, MIA, SJC, LAX, SIN, HKG, ICN, KIX let alone world wide. It would take a lot more active management and work across companies if someone is clogging regional interconnect to a spoke, but that would not cause worldwide outage. 1.2tbps is 120 of Verisign's 2013 server and code, maybe a million dollars CapEx. And 12 100g peering ports, $150k monthly at bulk transit pricing if you can't do any settlement free for some reason. Yes there are other costs, but it is easy to scale and well within the means of midsize business let alone unicorns. The thing about DDOS -- it's a lot harder to get aggregate bandwidth, those eyeball networks will bottleneck a lot sooner than 1000 meter runs of fiber between peers at an IX. And there are some natural imbalanced ratios like CDNs that are sitting on dozens of tbps of unused ingress that can jump into offering services for other companies that don't want to figure it all out.