4 ms·

While I suspect the DDOS was fabricated, the linked reddit comment is flawed. They claim that because the FCC uses Akamai as a CDN, that the FCC is immune from

While I suspect the DDOS was fabricated, the linked reddit comment is flawed. They claim that because the FCC uses Akamai as a CDN, that the FCC is immune from DDOS attacks. The FCC comment section is heavily reliant on a database, and you could simply overwhelm the database to DDOS that site. I would bet it is unlikely that the FCC utilized a cache for the queries.

hilyen 9y ago
It really depends, the calls to their database wouldn't be direct, it'd be through a REST API which then communicates with a DB. That REST API likely has some sort of DDOS protection, like for example how cloudflare protects ALL requests to the domain. But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection.
- featherverse 9y ago
  > But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection. This. At what point did the government become a special interest group which does not exist to protect the nation it serves? Providing good security advice is their job. Even if they do have some super secret techniques, keeping them secret is not a strategy, it's what idiots who don't know anything about technology or computers or network security would do. I would trust Cloudflare's staff over the FCC's I.T. department every day of the week, and I hate Cloudflare.
  - lilott8 9y ago
    Not only that, in what way does an independent agency having zero ties to national security or the IC have any right to hold just about* anything secret? This is asinine!
    - arca_vorago 9y ago
      I think you underestimate just how far we've allowed natsec expansion to taint even the most benign agencies. As a constitutionalist, the real problem as I have condensed it is that the balance between providing for the common defense has completely overshadowed things like securing the blessings of liberty. Our gov is increasingly leaning authoritarian, and the populace has allowed it.
      - lilott8 9y ago
        I wouldn't say I've underestimated anything. That was an honest question; as in: "what mental gymnastics did the FCC do to even think that keeping secrets is allowable?" That aside, I would agree with you.
        arca_vorago 9y ago
        Ah, a small miscommunication I guess. My guess is the decision to keep secrets was made and then someone was told to do the gymnastics.
- mattmanser 9y ago
  You have to set up protection on an API, it doesn't come magically installed by default.
- codedokode 9y ago
  > like for example how cloudflare protects ALL requests to the domain. The primary purpose of cloudflare is to hide the IP address of the server and filter packets on IP level. It does not magically protects from any attack, especially on application level. It is wrong to assume that there is a universal automatic solution against DDOS. Neither CDN nor Cloudflare nor REST API (how?) can help with this.
gerdesj 9y ago
"While I suspect the DDOS was fabricated, the linked reddit comment is flawed." I too think that the DDOS is bollocks but I wouldn't go so far as to describe the reddit comment as flawed - MNGrrl presents quite a lot of additional evidence alongside the Akamai assertion. If you have some spare time it is worth reading/skimming the rest of the reddit thread. Whilst you are at it, look at the posting history of the highly rated commentators for some contextual bias hints. Follow links as well and lose a lot of time 8) On balance the official story really does not stack up and I think a fully tooled up investigative journo could tear the FCC to pieces if given enough time and motivation to dot the Is and cross the Ts. The keyword there is motivation ...
taf2 9y ago
Like a dude in a Starbucks on free wifi and a script?

hilyen 9y ago

It really depends, the calls to their database wouldn't be direct, it'd be through a REST API which then communicates with a DB. That REST API likely has some sort of DDOS protection, like for example how cloudflare protects ALL requests to the domain. But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection.

featherverse 9y ago
> But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection. This. At what point did the government become a special interest group which does not exist to protect the nation it serves? Providing good security advice is their job. Even if they do have some super secret techniques, keeping them secret is not a strategy, it's what idiots who don't know anything about technology or computers or network security would do. I would trust Cloudflare's staff over the FCC's I.T. department every day of the week, and I hate Cloudflare.
- lilott8 9y ago
  Not only that, in what way does an independent agency having zero ties to national security or the IC have any right to hold just about* anything secret? This is asinine!
  - arca_vorago 9y ago
    I think you underestimate just how far we've allowed natsec expansion to taint even the most benign agencies. As a constitutionalist, the real problem as I have condensed it is that the balance between providing for the common defense has completely overshadowed things like securing the blessings of liberty. Our gov is increasingly leaning authoritarian, and the populace has allowed it.
    - lilott8 9y ago
      I wouldn't say I've underestimated anything. That was an honest question; as in: "what mental gymnastics did the FCC do to even think that keeping secrets is allowable?" That aside, I would agree with you.
      - arca_vorago 9y ago
        Ah, a small miscommunication I guess. My guess is the decision to keep secrets was made and then someone was told to do the gymnastics.
mattmanser 9y ago
You have to set up protection on an API, it doesn't come magically installed by default.
codedokode 9y ago
> like for example how cloudflare protects ALL requests to the domain. The primary purpose of cloudflare is to hide the IP address of the server and filter packets on IP level. It does not magically protects from any attack, especially on application level. It is wrong to assume that there is a universal automatic solution against DDOS. Neither CDN nor Cloudflare nor REST API (how?) can help with this.

gerdesj 9y ago

"While I suspect the DDOS was fabricated, the linked reddit comment is flawed." I too think that the DDOS is bollocks but I wouldn't go so far as to describe the reddit comment as flawed - MNGrrl presents quite a lot of additional evidence alongside the Akamai assertion. If you have some spare time it is worth reading/skimming the rest of the reddit thread. Whilst you are at it, look at the posting history of the highly rated commentators for some contextual bias hints. Follow links as well and lose a lot of time 8) On balance the official story really does not stack up and I think a fully tooled up investigative journo could tear the FCC to pieces if given enough time and motivation to dot the Is and cross the Ts. The keyword there is motivation ...

taf2 9y ago

Like a dude in a Starbucks on free wifi and a script?