5 ms·

Submissions like this one make me wish Hacker News had a downvote button...

taf2 7y ago
Why? Isn’t this the kind post hacker news is all about ? Is there something about this post that’s misleading or false? I don’t see any explanation of facts to make me believe your comment ?
- dylz 7y ago
  iptables to defend against an attack will not accomplish much in 2019. It's pretty much futile to even try.
  - taf2 7y ago
    It can’t hurt or are you saying this is bad if you only have one server what about if your balancing your traffic over thousands of servers wouldn’t this help?
    - nicolaslem 7y ago
      The only way to protect yourself is having a bigger pipe than the bad guys. Only a handful of companies have these big pipes.
  - NightlyDev 7y ago
    It really does help. Most SYN floods can easily be handled with proper tuning and iptables. Most DDoS attacks are small.
    - dylz 7y ago
      I am kind of curious what field you see attacks in, or how "most attacks are small" - even two slapfighting kids having a minecraft argument routinely exceeds 50-70Gbps+ from what I've seen..
      - cpach 7y ago
        How are they able to employ such volumes? Do they buy DDoS as a service?
        dylz 7y ago
        Yes. It costs less than $1-3 for a month or week of 'service' with a maximum of typically 3-5 minutes per attack, you can pay with PayPal, you can pay with Runescape gold or Roblox/Fortnite/game of the month currency, sign in to a (typically really badly made novice PHP-based) panel, often behind Cloudflare free plan themselves, and enter an IP/hostname and click the button. These typically use PHP scripts/perl scripts/whatever and fork off in the background to do some mix of sshing into some machines legitimately purchased or with stolen cards at crappy "offshore" providers that allow spoofing or otherwise to launch reflected DNS/NTP attacks, hitting upstream APIs that do the same (as a reseller of attacks), hitting uploaded webshells to do `fsockopen('udp://'...` on a ton of cheap shared hosting machines or hacked sites, usually old PHP CMS type stuff. Comes complete with fake "terms of service" like how it's only meant to be used for legal testing of your own servers, but in practice that's effectively there as a joke. There's a huge market of these, "step by step" guides on youtube with affiliate links to these services, like https://www.youtube.com/watch?v=tHKBZr00IOA https://www.youtube.com/watch?v=tHKBZr00IOA for example.
        cpach 7y ago
        Wow. Didn’t know it was that easy. The humanity...
      - NightlyDev 7y ago
        Developing and running a multiplayer game for 11 years, and games definetly is one of the industries that has most DoS attacks. It's rare that attacks are 50-70 Gbps, and that large SYN attacks are definetly not common. Reflection attacks of 50-70 Gbps are easily blocked by the firewall as the port is likely blocked.
boulos 7y ago
If you think the post is harmful/incorrect or even off-topic then you can flag it. It's not clear from your comment that flagging would have been appropriate though, unless you find this disastrously bad for a post.
karmakaze 7y ago
The problem is really that upvote means different things. If we had upvote correct and upvote interested we would be able to serve the now broad HN readership without downvote.

taf2 7y ago

Why? Isn’t this the kind post hacker news is all about ? Is there something about this post that’s misleading or false? I don’t see any explanation of facts to make me believe your comment ?

dylz 7y ago
iptables to defend against an attack will not accomplish much in 2019. It's pretty much futile to even try.
- taf2 7y ago
  It can’t hurt or are you saying this is bad if you only have one server what about if your balancing your traffic over thousands of servers wouldn’t this help?
  - nicolaslem 7y ago
    The only way to protect yourself is having a bigger pipe than the bad guys. Only a handful of companies have these big pipes.
- NightlyDev 7y ago
  It really does help. Most SYN floods can easily be handled with proper tuning and iptables. Most DDoS attacks are small.
  - dylz 7y ago
    I am kind of curious what field you see attacks in, or how "most attacks are small" - even two slapfighting kids having a minecraft argument routinely exceeds 50-70Gbps+ from what I've seen..
    - cpach 7y ago
      How are they able to employ such volumes? Do they buy DDoS as a service?
      - dylz 7y ago
        Yes. It costs less than $1-3 for a month or week of 'service' with a maximum of typically 3-5 minutes per attack, you can pay with PayPal, you can pay with Runescape gold or Roblox/Fortnite/game of the month currency, sign in to a (typically really badly made novice PHP-based) panel, often behind Cloudflare free plan themselves, and enter an IP/hostname and click the button. These typically use PHP scripts/perl scripts/whatever and fork off in the background to do some mix of sshing into some machines legitimately purchased or with stolen cards at crappy "offshore" providers that allow spoofing or otherwise to launch reflected DNS/NTP attacks, hitting upstream APIs that do the same (as a reseller of attacks), hitting uploaded webshells to do `fsockopen('udp://'...` on a ton of cheap shared hosting machines or hacked sites, usually old PHP CMS type stuff. Comes complete with fake "terms of service" like how it's only meant to be used for legal testing of your own servers, but in practice that's effectively there as a joke. There's a huge market of these, "step by step" guides on youtube with affiliate links to these services, like https://www.youtube.com/watch?v=tHKBZr00IOA https://www.youtube.com/watch?v=tHKBZr00IOA for example.
        cpach 7y ago
        Wow. Didn’t know it was that easy. The humanity...
    - NightlyDev 7y ago
      Developing and running a multiplayer game for 11 years, and games definetly is one of the industries that has most DoS attacks. It's rare that attacks are 50-70 Gbps, and that large SYN attacks are definetly not common. Reflection attacks of 50-70 Gbps are easily blocked by the firewall as the port is likely blocked.

boulos 7y ago

If you think the post is harmful/incorrect or even off-topic then you can flag it. It's not clear from your comment that flagging would have been appropriate though, unless you find this disastrously bad for a post.

karmakaze 7y ago

The problem is really that upvote means different things. If we had upvote correct and upvote interested we would be able to serve the now broad HN readership without downvote.