4 ms·

Meh, or just block UDP to your networks that have no reason to run UDP. Every carrier will do upstream ACL's these days. 5 years ago that wasn't the case. These

by scurvy 9y ago

Meh, or just block UDP to your networks that have no reason to run UDP. Every carrier will do upstream ACL's these days. 5 years ago that wasn't the case. These days, they all do. Some free, some charge. re: chat ops vs a web page. It's just a single BGP advertisement -- big whoop. Chatops is just hipster famous right now.

mirashii 9y ago
A snarky reply like this comes up every time there's discussion of a DDOS, but it ignores the fact that there is some point that has to filter that UDP traffic, and if that point is saturated, the DDOS still worked. Mitigating attacks of this size isn't a firewall rule or a support ticket with your ISP.
- scurvy 9y ago
  Snark or not, the traffic is filtered upstream before your handoff. If you pick your carriers well, there's not a problem. Many carriers have turned upstream filters into a product. NTT's DPS Lite springs to mind. This just comes down to experience and knowing how to build a network. I'd think that Github would have people knowing how to architect this. They've been through a few DDoS before. Edit: It looks like Github uses NTT for traffic. Hello Github Netops person, you need to call your sales rep and turn on DPS Lite. It's like $100 per 10gig port and you get full ACLs. Telia, another one of your carriers, will do this too. At least they have for me. Level3 though? Lol kick that sorry network to the curb Also, get another /22 allocation so you can at least separate out your DC-origin traffic from your customer traffic.
  - scurvy 9y ago
    Whiners can downvote all you want, but you can't say I'm wrong. So either admit you're wrong or go pound sand. Such sensitive.
  - jack9 9y ago
    It's interesting that on HN, some experience doesn't get rewarded, just because there's some rather opinionated language. The majority of voters are barely exposed to these kinds of overwhelming attacks, leaving practical analysis to be buried unless it's got some big company name drop to legitimize it.
    - alex_duf 9y ago
      Maybe the experience isn't rewarded because of said opinionated language? I mean someone can be right, but that doesn't give that person the right to be dismissive. Treating ignorance with disdain isn't going to make anyone smarter.
  - deleted 9y ago
    [deleted]
- scurvy 9y ago
  Also lol at "support ticket with your ISP." We're talking about major tier 1 carriers here.
lbotos 9y ago
AS much as I hate chatops as a fad, it makes it really easy for others to also see what happened and follow along. "Hey Jim, Did you go adjust that thing?" vs. "10:15am [JIM] /chatbot adjust x to y"
- scurvy 9y ago
  Fair enough, I guess visibility, in the one thing everyone's looking at in a crisis, is good.

by scurvy 9y ago

mirashii 9y ago

A snarky reply like this comes up every time there's discussion of a DDOS, but it ignores the fact that there is some point that has to filter that UDP traffic, and if that point is saturated, the DDOS still worked. Mitigating attacks of this size isn't a firewall rule or a support ticket with your ISP.

scurvy 9y ago
Snark or not, the traffic is filtered upstream before your handoff. If you pick your carriers well, there's not a problem. Many carriers have turned upstream filters into a product. NTT's DPS Lite springs to mind. This just comes down to experience and knowing how to build a network. I'd think that Github would have people knowing how to architect this. They've been through a few DDoS before. Edit: It looks like Github uses NTT for traffic. Hello Github Netops person, you need to call your sales rep and turn on DPS Lite. It's like $100 per 10gig port and you get full ACLs. Telia, another one of your carriers, will do this too. At least they have for me. Level3 though? Lol kick that sorry network to the curb Also, get another /22 allocation so you can at least separate out your DC-origin traffic from your customer traffic.
- scurvy 9y ago
  Whiners can downvote all you want, but you can't say I'm wrong. So either admit you're wrong or go pound sand. Such sensitive.
- jack9 9y ago
  It's interesting that on HN, some experience doesn't get rewarded, just because there's some rather opinionated language. The majority of voters are barely exposed to these kinds of overwhelming attacks, leaving practical analysis to be buried unless it's got some big company name drop to legitimize it.
  - alex_duf 9y ago
    Maybe the experience isn't rewarded because of said opinionated language? I mean someone can be right, but that doesn't give that person the right to be dismissive. Treating ignorance with disdain isn't going to make anyone smarter.
- deleted 9y ago
  [deleted]
scurvy 9y ago
Also lol at "support ticket with your ISP." We're talking about major tier 1 carriers here.

lbotos 9y ago

AS much as I hate chatops as a fad, it makes it really easy for others to also see what happened and follow along. "Hey Jim, Did you go adjust that thing?" vs. "10:15am [JIM] /chatbot adjust x to y"

scurvy 9y ago
Fair enough, I guess visibility, in the one thing everyone's looking at in a crisis, is good.