3 ms·

Be the change you want to see in the world :) There are no somebodys somewheres. One question is how to do DDoS protection without somebody like Cloudflare. So

Be the change you want to see in the world :) There are no somebodys somewheres. One question is how to do DDoS protection without somebody like Cloudflare. Some new protocol for edge caching, perhaps?

toast0 6y ago
DDoS has two components: a) complexity: trick your servers into doing something hard b) volumetric: overwelm your servers with a lot of traffic c) volumetric part two: overwelm your servers with a lot of requests, so you respond with a lot of traffic A and C are things you can work on your self --- try to limit the amount of work your server does in response to requests, and/or make resource consuming responses require resource consuming requests; and monitor and fix hotspots as they're found. B is tricky, there's two ways to solve volumentric attack; either have enough bandwidth to drop the packets on your end, or convince the other end to drop the packets (usually called null routing). Null routes work great, but usually drop all packets to a particular destination IP, which means you need to move your service to another IP if you want it to stay online; that's hard to do if your IP needs to stay fixed for a meaningful time (TTL for glue records at TLDs is usually at least a day); and IP space is limited, so if your attackers are quick at moving attacks, you could run out of IPs to use. Some attacks are going above 1 Tbps though, so that's a lot of bandwidth if you need to accept and drop; and of course, the more bandwidth people get so they can weather attacks, the more bandwidth that can be used to attack others if it's not well secured.
- tick_tock_tick 6y ago
  B) is the only one that really needs a solution and traffic is breaking two or three levels above you.
- huderlem 6y ago
  I'm not very familiar with DDoS protection strategies. Can you please elaborate on what is meant in (c) by "make resource consuming responses require resource consuming requests"?
  - toast0 6y ago
    Make people login before doing a search is a common example for forums. Search is hard, unauthenticated search will bring low end forums down, so they make you create an account and login. That sort of thing.

toast0 6y ago

DDoS has two components: a) complexity: trick your servers into doing something hard b) volumetric: overwelm your servers with a lot of traffic c) volumetric part two: overwelm your servers with a lot of requests, so you respond with a lot of traffic A and C are things you can work on your self --- try to limit the amount of work your server does in response to requests, and/or make resource consuming responses require resource consuming requests; and monitor and fix hotspots as they're found. B is tricky, there's two ways to solve volumentric attack; either have enough bandwidth to drop the packets on your end, or convince the other end to drop the packets (usually called null routing). Null routes work great, but usually drop all packets to a particular destination IP, which means you need to move your service to another IP if you want it to stay online; that's hard to do if your IP needs to stay fixed for a meaningful time (TTL for glue records at TLDs is usually at least a day); and IP space is limited, so if your attackers are quick at moving attacks, you could run out of IPs to use. Some attacks are going above 1 Tbps though, so that's a lot of bandwidth if you need to accept and drop; and of course, the more bandwidth people get so they can weather attacks, the more bandwidth that can be used to attack others if it's not well secured.

tick_tock_tick 6y ago
B) is the only one that really needs a solution and traffic is breaking two or three levels above you.
huderlem 6y ago
I'm not very familiar with DDoS protection strategies. Can you please elaborate on what is meant in (c) by "make resource consuming responses require resource consuming requests"?
- toast0 6y ago
  Make people login before doing a search is a common example for forums. Search is hard, unauthenticated search will bring low end forums down, so they make you create an account and login. That sort of thing.