8 ms·

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to clients literally half a world away?

grishka 5y ago
As I user, I simply don't care. I repeatedly get punished for doing nothing wrong. It's almost like airport security. > What does your cdn solution look like? > Route optimization from your (single) endpoint to clients literally half a world away? And as a developer, I don't understand this newfangled obsession over CDNs either. Yes, there will be 200 ms RTT in some cases. So what? Get over it. Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP.
- ehutch79 5y ago
  I don't think you understand why that captcha is there in the first place then. Cloudflare prevents a bunch of crap that site operators just don't want to deal with. Especially for smaller sites that are run by one person. Dealing with a wordpress site getting hacked because you missed an update by a day, or a bulletin bored getting swarmed with bots, or some asshat ddos'ing your site because you banned them. Suddenly that site just isn't worth running. Complaining that about a thing that prevents that headache because it's a minor inconvenience to you is so self centered it boggles the mind.
  - grishka 5y ago
    Yeah, so centralizing the entire internet around a black box that sees all your traffic in cleartext is clearly the right solution. /s > Dealing with a wordpress site getting hacked because you missed an update by a day Maybe don't use something this vulnerable then and rely on a third party to protect you from exploits. > or a bulletin bored getting swarmed with bots Maybe require email verification and/or a captcha when signing up or posting. Don't punish people for passive actions. Somehow, there are many forums that aren't behind cloudflare, yet there are no spam bots. > or some asshat ddos'ing your site because you banned them Sure ddos is such an everyday occurrence? I just don't understand. I run a personal website. There's literally nothing to "deal" with. I set it all up once and it works. I only have to pay for the server and for the domains on time.
    - ehutch79 5y ago
      Monocultures are always bad, but I don't see any alternative services with this level of ease of use. You're definitely overestimating the technical expertise/available time of a lot small time admins out there. You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet (in plain text). I don't think you're considering how many services see your posts, even when you don't trip a captcha. email accounts are trivial to sign up for, especially for bots. I always recommend charging $1 (or local equivalent) for an account, that's a lot harder to fake. My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view. Saying "well it never happened to me, so it must never happen" is similarly self absorbed. Maybe consider that your experience is not everyones experience
      - jjav 5y ago
        > My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view. Who is serving whom here? If a business thinks it's ok to impose cloudflare inconvenience on me, the customer, for the priviledge of giving them my money, who is self centered here? The simple answer is I'll close the tab and go buy it from a competitor. I'm not playing captcha games to buy something.
        deleted 5y ago
        [deleted]
        ehutch79 5y ago
        Why do I feel like you ask to speak to managers a lot?
      - NaturalPhallacy 5y ago
        >prevents a bunch of crap that site operators just don't want to deal with >I don't see any alternative services with this level of ease of use. Both of these boil down to laziness, IMHO. And for how awful they are for half the internet, that's not okay to me. Not as a user or as a developer. When a user requests a site they expect to get the site. When you utterly disregard their utterly reasonable expectation and force them to train someone's ML algorithm for free for a minute or two you utterly destroy the user experience. If that's my experience as a user, your entire site gets an instant 1/10 rating from me. I'll likely leave instantly and never return.
- ehutch79 5y ago
  that 200ms rtt does matter to users. it becomes very noticeable. especially when you're writing an app, not a brochure site. You need to tree shake so you're not serving a huge spa all at once. I've see much worse times for users, and a cdn absolutely help with our staff in asia dealing with our internal apps. Of course they're not always tripping up cloudflare and being shown captchas. I almost _never_ see a cloudflare captcha either... huh...
  - gsich 5y ago
    What use has an app that requires a full RTT fot every buttonpress?
    - ehutch79 5y ago
      None? Why would every button press require a full rtt?
      - gsich 5y ago
        >that 200ms rtt does matter to users. it becomes very noticeable. especially when you're writing an app, not a brochure site. You need to tree shake so you're not serving a huge spa all at once. Because this implies that.
        ehutch79 5y ago
        No it doesn't. at all. Page load speeds by themselves can be painful. Open devtools and have your browser throttle to poor 3g speeds. Try browsing around. even well optimized sites. Now try uploading a couple dozen files through an api. This is legit what some users deal with. In New York state even, you don't need to go that far to find poor connectivity. Even if all your users have awesome home connections, think sales people taveling to a client. or on site inspections of a manufacturer in a warehouse that's mostly metal and has bad wifi.
        gsich 5y ago
- aseipp 5y ago
  > Yes, there will be 200 ms RTT in some cases. So what? Get over it. You're missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. (It's actually somewhat revealing when someone throws out a number like this without any qualification; what exactly made you conclude 200ms is the magic number?) > Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP. You don't need a very big imagination to think about cases where RTT will have significant impacts e.g. in the event you need to issue multiple sequential requests that are dependent on one another. These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.) This comes across as a classic "I don't actually understand the problem domain very well at all, but get off my lawn" answer to the problem.
  - grishka 5y ago
    > You're missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. Well, it does say 130 ms in here: https://www.quora.com/How-long-would-it-take-for-light-to-fly-around-the-earth https://www.quora.com/How-long-would-it-take-for-light-to-fl... And that's around the planet, to go around and end up at the same spot. In practice, with sanely-configured routes, your packets should never need to traverse more than half that distance. So, divide it by 2, then that cancels out because RTT is a measure of how long it takes for a signal to travel back and forth. You then add some time on top of that to account for buffering and processing in the various equipment along the way. > These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.) If you mean REST API requests, the kind that trigger some code to dynamically generate a response, how would a CDN solution like cloudflare help? The request still needs to get to the server and the response still needs to come back, all the way, because that's where that code runs. CDNs only really work for cacheable static content, don't they? I mean it's in the name. A blog or a news website certainly doesn't need a CDN.
    - joshuamorton 5y ago
- deleted 5y ago
  [deleted]
floatboth 5y ago
For regular public web pages, serving the actual fucking page should not be more expensive than serving the captcha page! What the hell is a "bad actor" in relation to GET requests to a public page? To a public page, all actors should be inherently neutral.
- ehutch79 5y ago
  There's a lot of potential side effects. Not every GET request retrieves a static asset. A list view with filters for instance. Either way, you could be dumping any arbitrary data along with a request. Or just try fuzzing parameters. some pages might be poorly done graphQL endpoints, and your might find your db tied up. There are MANY ways a legit a get request can cause issues, let alone someone with bad intentions.
  - ipaddr 5y ago
    All users are hostile users and all users are preferred users. Define what your system will allow through rate limits and caching. Assume users would destory your site if given the chance because they will. If you are exposing private data through graphgl config it or drop the private data or drop graphgl and user a backend.
    - ehutch79 5y ago
      I 100% agree you should be looking at all incoming traffic as hostile or at least potentially hostile. The other comments are contending that there's nothing a hostile user could do to a 'public' page. One of the things using cloudflare gets you is all those protections without having to know how to do them yourself. Which a lot of the developers don't know how to do. There's also something to be said for catching a lot of this at the network layer on a cluster of machines that can handle any incoming traffic that your one poor neglected vm can't.
      - ipaddr 5y ago
        If you use cloudflare you give up freedom not to force captcha. If you avoid them you can choose where you want to captcha. When cloudflare goes down you go down unnecessarily. If worried about a ddos attack cloudflare or another provider might be a good choice. But adding ddos support by default seems unncessary. In my 20 years of running 100s of sites I haven't run into a situation where I need ddos support. The vast majority will never be the target. Once in awhile google or bing will ddos you but using cloudflare to block that seems like overkill.
D-Nice 5y ago
Why is every and any TOR and sometimes VPN user deemed a DoS attack... it discriminates against users who value privacy by forcing hCaptcha on them by default. Worst of all... it could be a de-anonymization attack as well, hence why I as a regular TOR user, just exit the page immediately when that happens. For any of my pages that do happen to use Cloudflare, I am luckily able to disable this discrimination in the CP so kudos for that at least, but terrible defaults imo.
- sroussey 5y ago
  From experience, traffic via Tor was always 99%+ fraud.
  - jlokier 5y ago
    You can conduct fraud by accessing public, read-only web pages? You can conduct fraud by searching on Google? Those are the two I find repeatedly blocked when accessing via Tor. The former by Cloudflare, the latter by Google. I use Tor to lookup phone numbers that have just called me, to decide whether it's a good idea to answer. Since I don't want to be personally associated with such numbers I prefer to search anonymously. But often it's impossible to get a result. Sometimes even spending 5 minutes solving captchas isn't enough. (I'd only spend that long to see if it's just an outlier. No, it's quite common.) This creates an immense pressure to tell various services exactly who is phoning me, which is a terrible attitude to privacy.
    - ehutch79 5y ago
      Then don't use sites that are behind cloudflare? It's not your choice if the site owners/admins use cloudflare. It IS your choice not to use those sites.
      - jlokier 5y ago
        In practice the information I'm looking for is behind Cloudfare. There are other sites; they tend to lack the information. There is no "don't use" if I want to get my task done. I can choose not to obtain the information, but then I still have the problem I started with.
jjav 5y ago
> How do you mitigate ddos attacks and other bad actors hitting a page? Not sure what "bad actors hitting a page" even means. I host public info so people can see it, be it good or "bad" people. Let them see it. DDoS is different and can be devastating of course. Also, very rare. In decades hosting content (started my first hosting business in 1994) I've never experienced anything remotely like a DDos. I know it happens, but definitely very rare for most people. Driving tons of legitimate users away with relentless captcha annoyances for the once in a liftime possibility of a DDoS is not a good tradeoff. If you're in a business that attracts DDoS like flies then deal with that, otherwise lay off the captchas.
- midev 5y ago
  > Not sure what "bad actors hitting a page" even means I would refrain from commenting on this topic then. > I host public info so people can see it, be it good or "bad" people. Let them see it. If your site ever gets big enough, you'll understand.
zo1 5y ago
We're solving the wrong thing here. We should be going directly to the source: The mis-behaving (for whatever reason) IP and the ISP that owns it. We should be fostering an ecosystem that solves that problem, not one that results in a CloudFlare popping up. Which proverbially just throws spaghetti (money, technical-expertise and infrastructure) at the problem, and then using that accumulated power to shape (or manipulate) the web to its liking, and to kick-off anyone it doesn't like off it, of course.

How do you mitigate ddos attacks and other bad actors hitting a page? What does your cdn solution look like? Route optimization from your (single) endpoint to clients literally half a world away?

grishka 5y ago

As I user, I simply don't care. I repeatedly get punished for doing nothing wrong. It's almost like airport security. > What does your cdn solution look like? > Route optimization from your (single) endpoint to clients literally half a world away? And as a developer, I don't understand this newfangled obsession over CDNs either. Yes, there will be 200 ms RTT in some cases. So what? Get over it. Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP.

ehutch79 5y ago
I don't think you understand why that captcha is there in the first place then. Cloudflare prevents a bunch of crap that site operators just don't want to deal with. Especially for smaller sites that are run by one person. Dealing with a wordpress site getting hacked because you missed an update by a day, or a bulletin bored getting swarmed with bots, or some asshat ddos'ing your site because you banned them. Suddenly that site just isn't worth running. Complaining that about a thing that prevents that headache because it's a minor inconvenience to you is so self centered it boggles the mind.
- grishka 5y ago
  Yeah, so centralizing the entire internet around a black box that sees all your traffic in cleartext is clearly the right solution. /s > Dealing with a wordpress site getting hacked because you missed an update by a day Maybe don't use something this vulnerable then and rely on a third party to protect you from exploits. > or a bulletin bored getting swarmed with bots Maybe require email verification and/or a captcha when signing up or posting. Don't punish people for passive actions. Somehow, there are many forums that aren't behind cloudflare, yet there are no spam bots. > or some asshat ddos'ing your site because you banned them Sure ddos is such an everyday occurrence? I just don't understand. I run a personal website. There's literally nothing to "deal" with. I set it all up once and it works. I only have to pay for the server and for the domains on time.
  - ehutch79 5y ago
    Monocultures are always bad, but I don't see any alternative services with this level of ease of use. You're definitely overestimating the technical expertise/available time of a lot small time admins out there. You don't see bots and spam on those forums either because they are actually using cloudflare, and you're just not seeing the captcha, or because in the backend they're feeding all their posts through akismet (in plain text). I don't think you're considering how many services see your posts, even when you don't trip a captcha. email accounts are trivial to sign up for, especially for bots. I always recommend charging $1 (or local equivalent) for an account, that's a lot harder to fake. My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view. Saying "well it never happened to me, so it must never happen" is similarly self absorbed. Maybe consider that your experience is not everyones experience
    - jjav 5y ago
      > My point in all this is that bitching that site is using cloudflare to not have to deal with crap, is a self centered view. Who is serving whom here? If a business thinks it's ok to impose cloudflare inconvenience on me, the customer, for the priviledge of giving them my money, who is self centered here? The simple answer is I'll close the tab and go buy it from a competitor. I'm not playing captcha games to buy something.
      - deleted 5y ago
        [deleted]
      - ehutch79 5y ago
        Why do I feel like you ask to speak to managers a lot?
    - NaturalPhallacy 5y ago
      >prevents a bunch of crap that site operators just don't want to deal with >I don't see any alternative services with this level of ease of use. Both of these boil down to laziness, IMHO. And for how awful they are for half the internet, that's not okay to me. Not as a user or as a developer. When a user requests a site they expect to get the site. When you utterly disregard their utterly reasonable expectation and force them to train someone's ML algorithm for free for a minute or two you utterly destroy the user experience. If that's my experience as a user, your entire site gets an instant 1/10 rating from me. I'll likely leave instantly and never return.
ehutch79 5y ago
that 200ms rtt does matter to users. it becomes very noticeable. especially when you're writing an app, not a brochure site. You need to tree shake so you're not serving a huge spa all at once. I've see much worse times for users, and a cdn absolutely help with our staff in asia dealing with our internal apps. Of course they're not always tripping up cloudflare and being shown captchas. I almost _never_ see a cloudflare captcha either... huh...
- gsich 5y ago
  What use has an app that requires a full RTT fot every buttonpress?
  - ehutch79 5y ago
    None? Why would every button press require a full rtt?
    - gsich 5y ago
      >that 200ms rtt does matter to users. it becomes very noticeable. especially when you're writing an app, not a brochure site. You need to tree shake so you're not serving a huge spa all at once. Because this implies that.
      - ehutch79 5y ago
        No it doesn't. at all. Page load speeds by themselves can be painful. Open devtools and have your browser throttle to poor 3g speeds. Try browsing around. even well optimized sites. Now try uploading a couple dozen files through an api. This is legit what some users deal with. In New York state even, you don't need to go that far to find poor connectivity. Even if all your users have awesome home connections, think sales people taveling to a client. or on site inspections of a manufacturer in a warehouse that's mostly metal and has bad wifi.
        gsich 5y ago
aseipp 5y ago
> Yes, there will be 200 ms RTT in some cases. So what? Get over it. You're missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. (It's actually somewhat revealing when someone throws out a number like this without any qualification; what exactly made you conclude 200ms is the magic number?) > Optimize your website to load in fewer round-trips. TCP congestion control adapts well enough to any latency. RTT only really matters in gaming and VoIP. You don't need a very big imagination to think about cases where RTT will have significant impacts e.g. in the event you need to issue multiple sequential requests that are dependent on one another. These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.) This comes across as a classic "I don't actually understand the problem domain very well at all, but get off my lawn" answer to the problem.
- grishka 5y ago
  > You're missing a zero in that RTT for users in places like Asia if your server is anywhere in the west. Well, it does say 130 ms in here: https://www.quora.com/How-long-would-it-take-for-light-to-fly-around-the-earth https://www.quora.com/How-long-would-it-take-for-light-to-fl... And that's around the planet, to go around and end up at the same spot. In practice, with sanely-configured routes, your packets should never need to traverse more than half that distance. So, divide it by 2, then that cancels out because RTT is a measure of how long it takes for a signal to travel back and forth. You then add some time on top of that to account for buffering and processing in the various equipment along the way. > These are unavoidable and occur often in more than just websites, but anything that e.g. uses HTTP as an API (a very simple one is something like recursively downloading dependencies.) If you mean REST API requests, the kind that trigger some code to dynamically generate a response, how would a CDN solution like cloudflare help? The request still needs to get to the server and the response still needs to come back, all the way, because that's where that code runs. CDNs only really work for cacheable static content, don't they? I mean it's in the name. A blog or a news website certainly doesn't need a CDN.
  - joshuamorton 5y ago
deleted 5y ago
[deleted]

floatboth 5y ago

For regular public web pages, serving the actual fucking page should not be more expensive than serving the captcha page! What the hell is a "bad actor" in relation to GET requests to a public page? To a public page, all actors should be inherently neutral.

ehutch79 5y ago
There's a lot of potential side effects. Not every GET request retrieves a static asset. A list view with filters for instance. Either way, you could be dumping any arbitrary data along with a request. Or just try fuzzing parameters. some pages might be poorly done graphQL endpoints, and your might find your db tied up. There are MANY ways a legit a get request can cause issues, let alone someone with bad intentions.
- ipaddr 5y ago
  All users are hostile users and all users are preferred users. Define what your system will allow through rate limits and caching. Assume users would destory your site if given the chance because they will. If you are exposing private data through graphgl config it or drop the private data or drop graphgl and user a backend.
  - ehutch79 5y ago
    I 100% agree you should be looking at all incoming traffic as hostile or at least potentially hostile. The other comments are contending that there's nothing a hostile user could do to a 'public' page. One of the things using cloudflare gets you is all those protections without having to know how to do them yourself. Which a lot of the developers don't know how to do. There's also something to be said for catching a lot of this at the network layer on a cluster of machines that can handle any incoming traffic that your one poor neglected vm can't.
    - ipaddr 5y ago
      If you use cloudflare you give up freedom not to force captcha. If you avoid them you can choose where you want to captcha. When cloudflare goes down you go down unnecessarily. If worried about a ddos attack cloudflare or another provider might be a good choice. But adding ddos support by default seems unncessary. In my 20 years of running 100s of sites I haven't run into a situation where I need ddos support. The vast majority will never be the target. Once in awhile google or bing will ddos you but using cloudflare to block that seems like overkill.

D-Nice 5y ago

Why is every and any TOR and sometimes VPN user deemed a DoS attack... it discriminates against users who value privacy by forcing hCaptcha on them by default. Worst of all... it could be a de-anonymization attack as well, hence why I as a regular TOR user, just exit the page immediately when that happens. For any of my pages that do happen to use Cloudflare, I am luckily able to disable this discrimination in the CP so kudos for that at least, but terrible defaults imo.

sroussey 5y ago
From experience, traffic via Tor was always 99%+ fraud.
- jlokier 5y ago
  You can conduct fraud by accessing public, read-only web pages? You can conduct fraud by searching on Google? Those are the two I find repeatedly blocked when accessing via Tor. The former by Cloudflare, the latter by Google. I use Tor to lookup phone numbers that have just called me, to decide whether it's a good idea to answer. Since I don't want to be personally associated with such numbers I prefer to search anonymously. But often it's impossible to get a result. Sometimes even spending 5 minutes solving captchas isn't enough. (I'd only spend that long to see if it's just an outlier. No, it's quite common.) This creates an immense pressure to tell various services exactly who is phoning me, which is a terrible attitude to privacy.
  - ehutch79 5y ago
    Then don't use sites that are behind cloudflare? It's not your choice if the site owners/admins use cloudflare. It IS your choice not to use those sites.
    - jlokier 5y ago
      In practice the information I'm looking for is behind Cloudfare. There are other sites; they tend to lack the information. There is no "don't use" if I want to get my task done. I can choose not to obtain the information, but then I still have the problem I started with.

jjav 5y ago

> How do you mitigate ddos attacks and other bad actors hitting a page? Not sure what "bad actors hitting a page" even means. I host public info so people can see it, be it good or "bad" people. Let them see it. DDoS is different and can be devastating of course. Also, very rare. In decades hosting content (started my first hosting business in 1994) I've never experienced anything remotely like a DDos. I know it happens, but definitely very rare for most people. Driving tons of legitimate users away with relentless captcha annoyances for the once in a liftime possibility of a DDoS is not a good tradeoff. If you're in a business that attracts DDoS like flies then deal with that, otherwise lay off the captchas.

midev 5y ago
> Not sure what "bad actors hitting a page" even means I would refrain from commenting on this topic then. > I host public info so people can see it, be it good or "bad" people. Let them see it. If your site ever gets big enough, you'll understand.

zo1 5y ago

We're solving the wrong thing here. We should be going directly to the source: The mis-behaving (for whatever reason) IP and the ISP that owns it. We should be fostering an ecosystem that solves that problem, not one that results in a CloudFlare popping up. Which proverbially just throws spaghetti (money, technical-expertise and infrastructure) at the problem, and then using that accumulated power to shape (or manipulate) the web to its liking, and to kick-off anyone it doesn't like off it, of course.