10 ms·

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for w

• elwell 3y ago
  Leave it to HN to find the fly in the ointment when Google is mentioned.
• rs999gti 3y ago
  > Cloudflare a protection tax $NET gives away DDOS protection for free for non-businesses
• falcor84 3y ago
  Nothing "forces botnets to up their game", they just want to make money (or in some cases, "watch the world burn"); I don't see how any coordination whatsoever would diminish these motivations.
• grotorea 3y ago
  So the email spam solution? Doesn't that come with its own list of problems? Also, stupid question from someone not that familiar with DDoS, can't you flood the target with requests even if the source address will be rejected? Or even if the IP packet has a falsified source address?
  • tmpX7dMeXU 3y ago
    Yes.
• kijin 3y ago
  A spamhaus-like blacklist for botnet IPs is an interesting idea. What if Google and Cloudflare collectively reverse-DoSed all the infected IPs, not by sending them any traffic, but simply by refusing to accept any connections from them to any part of their infrastructure? Whoever is on those IPs will suddenly find that half the internet doesn't work anymore. Which is probably a good enough incentive for them to replace their router, format their PC, or whatever else is necessary to disinfect themselves. In many parts of the world, landline IP allocations tend to be stable enough for this to have a real effect. Phones are a different story, but phones are also much less likely to be useful in a DDoS botnet. (The owner would immediately notice the sudden heat and data usage.) If we're going to live in a world where a small number of companies own half the internet, at least they could use their power to do some good.
  • londons_explore 3y ago
    Google already does this. "Something on your network is causing unusual traffic, please fill in this captcha to continue". And then you have to fill in a new captcha every 5 minutes or so just to keep using google maps/gmail/search. It's kinda annoying, and usually the culprit is someone else who shares my IP, not me (ie. a school, university, workplace, open wifi).
    • londons_explore 3y ago
      For any googlers reading: This behaviour sometimes hits an ajax request (map data downloads when panning or zooming). The client side javascript then fails badly and the user sees a broken site rather than a captcha request. Plz fix.
  • hayyyyydos 3y ago
    > In many parts of the world, landline IP allocations tend to be stable enough for this to have a real effect. And what about CGNAT?
    • kijin 3y ago
      In that scenario, it's on the ISP to clean their network of abuse, the same thing they would need to do if Gmail had blacklisted their IPs for spamming. After all, an ISP that can't connect to YouTube isn't going to stay in business for long. People have been begging ISPs for ages to do a bit of egress filtering, for example, to prevent source address falsification. They've demonstrated time and again that they don't give a crap unless it affects their bottom line.
      • vasachi 3y ago
        OK, but how should an ISP distinguish a good HTTP/2 connection from a bad one (I'm talking about this particular attack)? As far as I can tell, the DoS starts after the connection from bot to server is established, at which point the connection is fully encrypted. Should all ISPs MITM their clients to ensure that all traffic is good and proper?
• AdamN 3y ago
  The only answer is publicly-resourced protection and it's not that weird when you think about it. My apartment has a basic lock that any locksmith can undo and I'm safe because of my community and government protection (police, mental healthcare, justice system, etc...). Seems like the same logic should apply to my website or other digital property.
  • candiddevmike 3y ago
    ISPs will gladly quarantine/rate limit folks for pirating stuff, why don't they use those tools to combat botnets? Though I could see this leading to a slippery slope of remote attestation for internet access.
    • KomoD 3y ago
      > why don't they use those tools to combat botnets? Because they probably don't care.
  • 542458 3y ago
    Where this breaks down is that because of the nature of the internet and DDoS attacks it’s not something that can easily be solved with better policing - even identifying a perp might be near-impossible, and they might be in another country anyways. The government does try to prosecute botnets and DDoS attacks today, but it’s of limited success. Is there a practical solution here I’m missing?
    • gwright 3y ago
      I don't know about a "practical solution", but there are research efforts to think about new ways to build internets that mitigate some of these problems. Here is one that I'm aware of: https://named-data.net https://named-data.net
  • starcraft2wol 3y ago
    Community yes. Government protection no. When was the last time you heard of police stopping a break-in or making a successful investigation ? Independent of police, in bad communities your neighbors are willing to break in. In good communities they don't.
• londons_explore 3y ago
  Plenty of even quite-large websites just don't get attacked by DDoS attacks, because nobody has any particular reason to attack them.
  • tristan9 3y ago
    You’re completely wrong. All large sites regularly get attacked. The average skiddie’s motivations are that they’re bored. So they DoS a site they use regularly just to see. Heck they generally don’t even mean to cause damage per-se, and just think it’s a funny use of their evening. You have to stop thinking DoS attacks are always particularly personal. They really often just aren’t, and it’s a monumental pain in the ass to be on the receiving end.
    • londons_explore 3y ago
      I run boring sites like government websites which say what kinds of recycling go in which color trash cans. Well used, but never attacked.
      • tristan9 3y ago
        Well, lucky you. Or unlucky me and everyone I know running a large website. Guess we’ll never know.
• dsign 3y ago
  For a side-hobby of mine (writing), I imagine what would happen if current trends would continue. Thus, big caveat, it's all just thought experiments, not realistic predictions of any kind. For this particular scenario, the public Internet would get so bad ("enshitified") that people would tend to leave it alone. For essential public services, governments would set up their own networks disconnected from the Internet, where all devices and their connections must be authenticated to a person or corporation[^1]. Maybe something equivalent would exist for corporations and to enable e-commerce. [^1] China works like this already, to a high degree.
  • grotorea 3y ago
    You heard of New IP? The Huawei/Chinese plan to reform the Internet that keeps getting criticized for a variety of reasons. I haven't had the times to read the proposals proper, but the stuff about build trust directly into the network seems like it could solve this problem, at a price. > Having security and trust be “intrinsic” to the network will require core layers to carry metadata about the users, applications and services being transported. If users need to register in order to have packets sent to their destination, the result is that network operators, and those who license the operators, can remove individual users’ access at any time. https://dnsrf.org/.k-media/d3c1d810de1e98bdf7af7aa52406e837.pdf https://dnsrf.org/.k-media/d3c1d810de1e98bdf7af7aa52406e837.... (critical of the proposal)
• vmfunction 3y ago
  > pay Google, Amazon or Cloudflare a protection tax. Just FYI: hetzner has free DDoS https://www.hetzner.com/unternehmen/ddos-schutz https://www.hetzner.com/unternehmen/ddos-schutz I'm sure other hosting companies also offers it.
  • tpetry 3y ago
    Only for mini DDoS attacks - for larger ones they disable routing for your ip address. I guess they don‘t have the capacity to handle the big DDoS attacks nowadays.
    • tmpX7dMeXU 3y ago
      Yep, and null-routing your IP is exactly what providers did in the days GP is longing for, and still do do, especially outside of big cloud providers.
  • ilyt 3y ago
    Doesn't really work for those types of attacks > In this final layer, we filter out attacks in the form of SYN floods, DNS floods, and invalid packets. We are also able to flexibly adapt to other unique attacks and to reliably mitigate them. Which means any legit http2 connection will go just fine. Even if such connection now triggers hundreds of substreams. Push for end to end encrypted internet also means you can't really stop any more advanced attack. You could have just few dozen of hosts doing 20-30 connections each (i.e. "looking perfectly normal" for DDoS protection provider) generating tens of thousands per second in http2 streams. I'm speaking from experience of mitigating attack like this. Our DDoS provider was near-useless..
    • bombcar 3y ago
      For the higher layer attacks you have to have something like the "modified cryptominer in the browser" things that cloud flare and friends do now - those interstitial pages that pop up for a few seconds are doing mathematical hashing to burn processor time on your end - which greatly complicates the ability to DDoS.
• DanielBMarkham 3y ago
  Why don't we just require major providers to provide a realtime list of IPs that are attacking so that we can drop them in a block list with an expiration date of a month or so. If your computer is infected, I don't want to talk to you for a month. If it continues to be infected, I might up that to a year, or permanently ban you. It's your problem. Go fix it.
  • afavour 3y ago
    Banning a large number of customers for an entire month? doesn’t make economic sense, it’ll be cheaper to just pay a big cloud provider for protection. (not to mention the number of false positives you'd get, etc etc)
  • scrpl 3y ago
    Great solution for a world without shared and dynamic ips.
    • dmm 3y ago
      Block the whole subnet and make it the ISP's problem?
      • cryptonym 3y ago
        Because when a single machine is infected, at one ISP, it's a good idea to block the whole subnet? I don't think any commercial activity could afford such security strategy, blindly blocking legit users by thousands.
      • judge2020 3y ago
        How does the ISP solve it? Send a mass mail/email telling people to reset their devices because someone has a device with botnet malware?
        • AnimalMuppet 3y ago
          Egress filtering? A botnet DDOS stream should not look like normal network traffic...
• terlisimo 3y ago
  I've witnessed a few sustained (hours/days long) DDOS attacks that were straight up extortion: owners contacted with "give us money or we will keep your site offline". Most of the time I see attacks lasting 15-20 minutes. I'm assuming it's either someone doing it "for the lulz" or some cyber warfare outfit testing their big guns. I always consider the possibility of someone using DDOS to mask a more sophisticated attack.
• RandomLensman 3y ago
  We could also treat it as a public security threat and act accordingly.
  • justaman 3y ago
    I think this is the key take away. Unfortunately world leaders are not tech savvy enough to even consider this a threat.
    • jacquesm 3y ago
      Yet. But we're getting there.
  • supertrope 3y ago
    Which jurisdiction are you referring to with “we”?
    • RandomLensman 3y ago
      Any that matters, I guess ("we" as in the collective of people).
• nonameiguess 3y ago
  The actual solutions are: 1) Egress filtering by the ISPs 2) Better malware resistance and vulnerability mitigation on easily-compromised appliance and IoT devices But neither is going to happen. 1 is a coordination problem. It has to be all or nothing, which can only be compelled by law, and we have no global laws and no global law enforcement mechanism. Some countries inevitably don't care and the rest won't partition the entire Internet by permanently cutting them off. 2 would probably make the entire Internet of Things and a whole lot of home computing just not happen because it isn't economically feasible. Poor security effectively acts as a tacit tax. We all pay a little bit each, but the tax is collected by criminals instead of governments. Note that even your proposed solution here only works if 1 happened. Otherwise, source IP spoofing easily defeats a blocklist.
  • ilyt 3y ago
    The problem with this type of attack is that you can't really catch it as MITM DDoS protection. You're not seeing any SYN flood, just a bunch of TCP connections (equivalent of say search crawler), that are encrypted. Only after unpacking on loadbalancer those are visible as one TCP stream sheltering thousand HTTP2 streams.
• gchamonlive 3y ago
  What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't just delegate to cloud providers the whole effort in preventing attacks, but just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution. Because it doesn't end with this type of mitigation and dependency. A similar argument could be made for not using proprietary chip designs made by cloud providers. Or any proprietary API solution for that matter. It really is a matter of convenience that a community solution might cover in the future, abstracting away fundamental building blocks every cloud provider must have (name resolution, network, storage and computing services) to provide such higher level functions without lock in. We are just not there yet.
  • codedokode 3y ago
    There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.2.3.4/16. But ISPs do not want to adopt such protocol.
    • HumblyTossed 3y ago
      I am pretty sure that protocol would be just as abused.
      • codedokode 3y ago
        How exactly? You can authenticate sender by sending a special confirmation token back.
• turminal 3y ago
  It's worth noting that features like the one that enabled Rapid Reset are pushed into standards by the exact same companies, because they are needed for performance at their scale. So in a way this was partially caused by the existence of insanely big tech companies that need such features.
  • lostmsu 3y ago
    Either I misunderstood the issue, but it sounds like rapid reset was not the cause.
    • turminal 3y ago
      Rapid Reset is the name given to the technique behind the attack. The cause is a flaw in HTTP/2 stream multiplexing that enables this technique.
• raincole 3y ago
  Just like the law enforcement forced the criminals to up their games, so the only option we have is to pay tax? Well, I wrote this comment to ridicule yours... but actually that was what happened.
• paulddraper 3y ago
  [flagged]
  • blueflow 3y ago
    There is Marek's disease, so you still need to show that GP is in the wrong.
  • deleted 3y ago
    [deleted]
  • starcraft2wol 3y ago
    One is about machines on the internet serving images and forum posts. This comment is low quality and is a form of name calling.
  • mihaic 3y ago
    I was writing it with a "using antibiotics in absolutely every mundane product causes superbugs" energy actually, which is something that is really a problem.
• siva7 3y ago
  A protection tax? You realize that DDoS protection costs them providers real money?
  • mihaic 3y ago
    Yes, but cloud providers share that protection over all customers. Someone hosting their own websites needs the same level of protection just for themselves. DDoS is really the only thing that you can't host yourself on your own machines in today's internet.
    • siva7 3y ago
      I don't think they do. There are a variety of DDoS attacks which require more expensive computing to detect
• balls187 3y ago
  This is akin to the argument that bike helmets makes people less safe (and invariably has a comment about the Dutch and their safety record)
  • lozenge 3y ago
    It is like saying effective spam filters are bad for email as a distributed system. It's the spam that killed email, not the filters.
• tonmoy 3y ago
  In less words, it’s DDoS attackers that make the internet a worst place
• zelon88 3y ago
  Most of them are dynamic IPs. Some of them are infected mobile devices. What happens when you log an attack from a device that is attacking you from a school or business WiFi network? Block the whole IP forever? What if the user is on a CGNAT. Are you going to block the edge proxy for that entire ISP? What if you're getting hit from a residential connection that gets a new rotated IP every couple of weeks? Block whoever gets that IP from now on? Your solution doesn't stop attacks. It just stops regular users.
  • tristan9 3y ago
    > What happens when you log an attack from a device that is attacking you from a school or business WiFi network? Block the whole IP forever? No, but for a day perhaps. > What if the user is on a CGNAT. Are you going to block the edge proxy for that entire ISP? Maybe. If the ISP doesn’t bother doing anything about it (which is THEIR job, not mine as a website operator). If the ISP can’t be arsed to do their job, why am I supposed to care about them at all? > What if you're getting hit from a residential connection that gets a new rotated IP every couple of weeks? Block whoever gets that IP from now on? Same as the CGNAT one. It’s the ISP’s job to handle their misbehaving customers. If they refuse to do it and get complaints from their other customers that they’re getting blocked, maybe they’ll actually get to it. > Your solution doesn't stop attacks. It just stops regular users. No. It puts pressure on the ISPs to finally stop whining loudly when they receive an attack while closing their eyes on any attack originating from their network. This is not sustainable.
    • zelon88 3y ago
      Trust me when I say that you don't want the ISP's to inspect web traffic. That is not how to solve this. That is costly for the ISP and will drive up costs. It also makes supporting a website impossible. The ISP is assumed by all parties to be impartial. That assumption is required for the internet to be operational. Sure it might function your way, but it would be impossible to support. And maybe Facebook and Google are big enough to push around the ISP's, but they are the only ones. Nobody will bat an eyelash if 15,000 Comcast users in Phoenix AZ can access your hokey-pokey website. Comcast doesn't care. The users won't blame their ISP. They will blame you, or whoever owns the hokey-pokey website. If you want traffic, you need to be equipped to handle traffic. You are the one with the internet facing infrastructure. You are the one blocking traffic. Not the ISP. That is how it should be. The ISP should be impartial. You pay for connectivity. Consider yourself connected. For better or for worse. You are responsible for what you put onto that connection.
• sophacles 3y ago
  DDoS attacks were growing in size and frequency before these companies started creating products to address them. They took down sites, demanded ransom, and cost a lot of money in lost business and hosting bills. If you want to complain about an actual working solution, that's your right, but realize that without an alternate solution you're advocating for giving small gangs the ability to disrupt everyone else's lives on a whim.
• JAlexoid 3y ago
  Proliferation of low cost computing is the cause of this, not big players being able to mitigate this. This is not coming from "known botnet IPs", this is from random infected devices. Some aren't even permanently doing this, just one request from a device per day - it already large enough to cause issues.
• glimshe 3y ago
  Do you remember the pre-DDoS mitigation days? Botnets could easily bring down major, important sites and make them unavailable to users. This caused monetary loss and could even cause life loss depending on the site. How is the previous state better than, well, not suffering from these problems?
• tiler2915072 3y ago
  It’s a prisoner dilemma! The only way to win is for both service providers and “bad people” to not escalate. That’s not going to happen.
  • gwright 3y ago
    The typical way of dealing with "bad people" is to subject them to the criminal justice system (or vigilantism if the problem is bad enough and the criminal justice system is inadequate). This tends to reduce, but not eliminate, the misbehaving. Improving the ability to track down and prosecute perpetrators tends to result in less anonymity/privacy, so that makes the problem challenging. Thinking in the long/very-long term, we need to get more innovative with the underlying technology to mitigate abuse. I mentioned this effort https://named-data.net https://named-data.net in another part of the thread.
• FrenchDevRemote 3y ago
  >but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something. Using any kind of community coordinated IP ban is useless and would hurt a lot of people, millions(or even billions) of devices have dynamic IP addresses. You would not stop botnets from DDoSing you and on top of that you'd block millions of legitimate users.
• KomoD 3y ago
  > The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet Don't agree. > the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. It's not. > come through some community coordinated list of botnet infected IPs How would that help?
• babypuncher 3y ago
  > I'd really wish for them to come through some community coordinated list of botnet infected IPs or something. The problem is that IP addresses are not a reliable identifier, especially for the kinds of folks whose routers have been infected by malware. Few ISPs hand out static IP addresses anymore. It's why online games no longer bother with IP bans anymore, because as soon as the target reboots their router they evade your ban and some other poor sap on the same ISP gets stuck with the flagged IP.
• DaveSchmindel 3y ago
  I smell what you're stepping in here, but I grow more comfortable with the idea of big conglomerates continuing to improve their attack mitigation efforts on behalf of their locales when I compare this to the concept to vaccines. Vaccines inevitably lead to stronger viruses, but would you argue we should go back and not have began to use them? Cloudflare and Google may be some sites' only hope to staying alive in the event of network-driven attacks. I suppose this landscape is a double-edged sword.