5 ms·

Good. I'm tired of people not learning that trusting a single gateway with 50% of the internet is bad. Yes, I know, free DDOS protection. There has to be anot

by pmlnr 7y ago

Good. I'm tired of people not learning that trusting a single gateway with 50% of the internet is bad. Yes, I know, free DDOS protection. There has to be another way of doing this, some mesh based DDOS protection or so.

Avamander 7y ago
With a lot of these things, if people can't agree to make a standard system to do all of it just as well then there's going to be a big company that does so. We have had this with e-mail, signed exchanges, DDOS protection and will probably have it with many other things unless people pull themselves together at least after these proprietary solutions are created and create better alternatives.
Waterluvian 7y ago
I get your point. But I'm not sure I can ever grok the mindset of someone who thinks, "good, that'll teach 'em". Not sure I'd ever want to work with that individual.
- bovermyer 7y ago
  This is important to recognize. Victim blaming is a highly destructive practice.
  - inimino 7y ago
    Assigning blame for technical business decisions to the people who made those decisions is victim blaming?
    - bovermyer 7y ago
      Targeting the process or behavior that lead to an event is far more effective than targeting the person that triggered it. Do not conflate the two.
- drunkpotato 7y ago
  For the kind of coworker I’d like, a grumpy old cynic beats the peppy corporate cheerleaders any day of the week.
  - enraged_camel 7y ago
    I feel like that's a false dichotomy.
- pmlnr 7y ago
  Fair point. I'm wondering though, how else you make people understand something like this?
  - bovermyer 7y ago
    Education and positive reinforcement. Teach people the right way to do things, and then make that behavior self-rewarding.
    - deleted 7y ago
      [deleted]
    - luckylion 7y ago
      What if that behavior isn't self-rewarding and is actually expensive? Not using Cloudflare, Google Maps, Analytics et all means you need to use something else, need to spend attention points somewhere, need to pay for the services. Very few people will do that because "it's the right thing to do".
      - bovermyer 7y ago
        I didn't say it was easy or obvious. If it were, I would be out of a job.
harshreality 7y ago
I don't think there is another cheap & easy to administer way, or more people would be doing that. Also CF is nice for the slight protection it provides against obvious bots and mass hacking attempts. And decreasing requests for static page resources. And it also (as long as your website doesn't leak its own ip, i.e. not sending emails except through Received-path-scrubbing services) hides your ip somewhat, meaning if you're careful you can run a website from your home on a raspberry pi without any issues.
lkbm 7y ago
This seems like a case for putting more of the internet through a single gateway. Having my downtime correlated with everyone else's means users will be more forgiving because they'll perceive it as "the Internet's down" rather than "lkbm's site is broken". (We saw this with CloudFlare. Some users were pissed, and others jumped in with "it's not their fault; AWS is down". That doesn't happen when our stuff specifically goes down. We need to decentralize the Internet, but this occurrence is not the reason. It's an argument to keep consolidating.
- camgunz 7y ago
  CYA buddy, CYA (sarcasm!)
- _wmd 7y ago
  Centralizing more of the Internet to help people align their excuses is probably the worst reasoning I've ever read
  - MrGilbert 7y ago
    But maybe this is how "the collective" works?
- hoechst 7y ago
  How cares whose fault it is? In the end, you're not able to provide service to your users and you potentially lose money.
  - pmlnr 7y ago
    Business risk cares. SLAs, SLOs, SLIs, they are all about this; to be able to direct the blame.
  - lkbm 7y ago
    The argument being made above only holds water if Cloudflare has worse uptime than smaller providers, and that it's because they're big. This is often the case when monopolies realize they're in a position where they can get away with sucking, but I don't believe that to be the case with Cloudflare yet.
buildbuildbuild 7y ago
Their free CDN is my biggest draw to their service: I can handle millions of requests per day with a $5 VM, sane caching headers, unoptimized code, and Cloudflare free tier.
dalore 7y ago
9.6% not 50%
- pmlnr 7y ago
  9.6% including providers like digitalocean. I'm skeptical about that 9.6%.
philipwhiuk 7y ago
It is slightly ironic that the best defence for a distributed problem is to build a single point of failure.
eeeeeeeeeeeee 7y ago
I agree that the centralization of the internet is troubling, but Cloudflare is solving a systemic problem that nobody else is tackling. The DDoS problem was not being solved for anyone except for enterprise customers until Cloudflare came along and to this day there is very little competition in this space. Your post makes it sound like making a "mesh based DDoS" system is somehow trivial. Who is going to pay for this? How does it work? How do you ensure latency is not atrocious? Why hasn't someone made this already? Cloudflare at least has a financial model that can be sustained, and it doesn't include harvesting all of our personal data. Without CF, many websites would not stay on-line during an attack. And they would cease to exist because many of those places would never be able to afford DDoS protection. I know so many sites, including ones I run, that I would not be able to keep on the public internet without CF DDoS protection. There really is no real competition in this space. I think we need to consider the fact that while this outage does take a lot of sites off-line at once, it is temporary, and it is still extremely rare. And the alternative is potentially that many websites would cease to exist at all, period, without something like Cloudflare existing.
- pmlnr 7y ago
  > Your post makes it sound like making a "mesh based DDoS" system is somehow trivial. It does not. "There has to be" ends in "!" and is an expression is a wish. > Who is going to pay for this? All of us. Everyone. I keep circling back to the idea that we should all join a protection ring, so we'd all share "cost" on this. > How do you ensure latency is not atrocious? > Why hasn't someone made this already? First one is very technical, and the answer is most probably by localisation and by only actually turning it on when needed. For the second: because it's a very hard technical problem and there is basically no money in it. Business value maybe, but it would need people and companies to collaborate, it would probably need committee level decisions, and so far, nobody wanted to deal with this. Or at least that's my theory. EDIT Maybe dat:// will eventually become a viable option, and with that, due to the distributed nature, this kind of DDOS protection is sort of built in.
dictum 7y ago
I agree on principle, but as an end user, I must selfishly disagree. I find life after Cloudflare to be better than before it. There's a Cloudflare location right next to me, and that improves latency across many of the websites I use, and makes their public DNS service the fastest. I just wish they had active competition in the same space. CDNs have network locations nearby but they don't offer an easy UX for relatively unexperienced website owners, and DDoS protection services usually have less network locations than content CDNs.

by pmlnr 7y ago

Avamander 7y ago

With a lot of these things, if people can't agree to make a standard system to do all of it just as well then there's going to be a big company that does so. We have had this with e-mail, signed exchanges, DDOS protection and will probably have it with many other things unless people pull themselves together at least after these proprietary solutions are created and create better alternatives.

Waterluvian 7y ago

I get your point. But I'm not sure I can ever grok the mindset of someone who thinks, "good, that'll teach 'em". Not sure I'd ever want to work with that individual.

bovermyer 7y ago
This is important to recognize. Victim blaming is a highly destructive practice.
- inimino 7y ago
  Assigning blame for technical business decisions to the people who made those decisions is victim blaming?
  - bovermyer 7y ago
    Targeting the process or behavior that lead to an event is far more effective than targeting the person that triggered it. Do not conflate the two.
drunkpotato 7y ago
For the kind of coworker I’d like, a grumpy old cynic beats the peppy corporate cheerleaders any day of the week.
- enraged_camel 7y ago
  I feel like that's a false dichotomy.
pmlnr 7y ago
Fair point. I'm wondering though, how else you make people understand something like this?
- bovermyer 7y ago
  Education and positive reinforcement. Teach people the right way to do things, and then make that behavior self-rewarding.
  - deleted 7y ago
    [deleted]
  - luckylion 7y ago
    What if that behavior isn't self-rewarding and is actually expensive? Not using Cloudflare, Google Maps, Analytics et all means you need to use something else, need to spend attention points somewhere, need to pay for the services. Very few people will do that because "it's the right thing to do".
    - bovermyer 7y ago
      I didn't say it was easy or obvious. If it were, I would be out of a job.

harshreality 7y ago

I don't think there is another cheap & easy to administer way, or more people would be doing that. Also CF is nice for the slight protection it provides against obvious bots and mass hacking attempts. And decreasing requests for static page resources. And it also (as long as your website doesn't leak its own ip, i.e. not sending emails except through Received-path-scrubbing services) hides your ip somewhat, meaning if you're careful you can run a website from your home on a raspberry pi without any issues.

lkbm 7y ago

This seems like a case for putting more of the internet through a single gateway. Having my downtime correlated with everyone else's means users will be more forgiving because they'll perceive it as "the Internet's down" rather than "lkbm's site is broken". (We saw this with CloudFlare. Some users were pissed, and others jumped in with "it's not their fault; AWS is down". That doesn't happen when our stuff specifically goes down. We need to decentralize the Internet, but this occurrence is not the reason. It's an argument to keep consolidating.

camgunz 7y ago
CYA buddy, CYA (sarcasm!)
_wmd 7y ago
Centralizing more of the Internet to help people align their excuses is probably the worst reasoning I've ever read
- MrGilbert 7y ago
  But maybe this is how "the collective" works?
hoechst 7y ago
How cares whose fault it is? In the end, you're not able to provide service to your users and you potentially lose money.
- pmlnr 7y ago
  Business risk cares. SLAs, SLOs, SLIs, they are all about this; to be able to direct the blame.
- lkbm 7y ago
  The argument being made above only holds water if Cloudflare has worse uptime than smaller providers, and that it's because they're big. This is often the case when monopolies realize they're in a position where they can get away with sucking, but I don't believe that to be the case with Cloudflare yet.

buildbuildbuild 7y ago

Their free CDN is my biggest draw to their service: I can handle millions of requests per day with a $5 VM, sane caching headers, unoptimized code, and Cloudflare free tier.

dalore 7y ago

9.6% not 50%

pmlnr 7y ago
9.6% including providers like digitalocean. I'm skeptical about that 9.6%.

philipwhiuk 7y ago

It is slightly ironic that the best defence for a distributed problem is to build a single point of failure.

eeeeeeeeeeeee 7y ago

I agree that the centralization of the internet is troubling, but Cloudflare is solving a systemic problem that nobody else is tackling. The DDoS problem was not being solved for anyone except for enterprise customers until Cloudflare came along and to this day there is very little competition in this space. Your post makes it sound like making a "mesh based DDoS" system is somehow trivial. Who is going to pay for this? How does it work? How do you ensure latency is not atrocious? Why hasn't someone made this already? Cloudflare at least has a financial model that can be sustained, and it doesn't include harvesting all of our personal data. Without CF, many websites would not stay on-line during an attack. And they would cease to exist because many of those places would never be able to afford DDoS protection. I know so many sites, including ones I run, that I would not be able to keep on the public internet without CF DDoS protection. There really is no real competition in this space. I think we need to consider the fact that while this outage does take a lot of sites off-line at once, it is temporary, and it is still extremely rare. And the alternative is potentially that many websites would cease to exist at all, period, without something like Cloudflare existing.

pmlnr 7y ago
> Your post makes it sound like making a "mesh based DDoS" system is somehow trivial. It does not. "There has to be" ends in "!" and is an expression is a wish. > Who is going to pay for this? All of us. Everyone. I keep circling back to the idea that we should all join a protection ring, so we'd all share "cost" on this. > How do you ensure latency is not atrocious? > Why hasn't someone made this already? First one is very technical, and the answer is most probably by localisation and by only actually turning it on when needed. For the second: because it's a very hard technical problem and there is basically no money in it. Business value maybe, but it would need people and companies to collaborate, it would probably need committee level decisions, and so far, nobody wanted to deal with this. Or at least that's my theory. EDIT Maybe dat:// will eventually become a viable option, and with that, due to the distributed nature, this kind of DDOS protection is sort of built in.

dictum 7y ago

I agree on principle, but as an end user, I must selfishly disagree. I find life after Cloudflare to be better than before it. There's a Cloudflare location right next to me, and that improves latency across many of the websites I use, and makes their public DNS service the fastest. I just wish they had active competition in the same space. CDNs have network locations nearby but they don't offer an easy UX for relatively unexperienced website owners, and DDoS protection services usually have less network locations than content CDNs.