7 ms·
But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inab
by _ea1k 3y ago
But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inability to stop attacks at the source and heavy overreliance on massive cloud providers to do it for us.
2FA and password managers didn't make us heavily reliant on massive companies.
- meowface 3y agoYes, but if these cloud providers didn't exist eventually there'd be botnets that no site could protect against, rather than the status quo of at least some sites being able to resist them. The idea that the existence of cloud providers that can soak up a lot of traffic is making things worse by causing botnets to get more powerful just seems silly.
- gchamonlive 3y ago> 2FA and password managers didn't make us heavily reliant on massive companies. Retool: https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/ https://arstechnica.com/security/2023/09/how-google-authenti... Lastpass: https://news.ycombinator.com/item?id=34516275 https://news.ycombinator.com/item?id=34516275
- rglullis 3y agoIf Google Authenticator goes away, people will still be able to use 2FA (I for one use Aegis, it's available on F-droid and does everything I need, including encrypted backups) If Lastpass goes away, people will still be able to use keepass or any of the large number of open source password managers, some of them even with browser integrations. If I have a website that is frequently attacked by botnets and Cloudflare goes away, what can I use to replace it?
- gchamonlive 3y agoI am sorry, but if your password manager goes away and you have no disaster recovery scenario planned you might not be able to just move to a competitor: https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 My response was to illustrate how insidious big companies are. Of course nothing compares to the backbone of the web going down. If AWS North Virginia suffers widespread downtime to all its availability zones, much of the web will just go dark, no question about it.
- bee_rider 3y ago2FA, I’m not sure. But Lastpass doesn’t represent the whole of password managers. Storing your passwords in an online service is a really silly thing to do (for passwords that matter at least). Use something local like keepass.
- gchamonlive 3y agoHope you plan ahead for a house fire with a 3-2-1 approach for backups. Maintaining an always on off-site storage is expensive unless you resort to cloud solutions like OneDrive or Dropbox, but then you go back to the problem of having your passwords on the cloud, even if encrypted. Not using cloud is just very expensive and time consuming for the average user.
- adrianN 3y agoPasswords are small enough that you can make physical backups easily.
- gchamonlive 3y agoHonest question, because it is interesting and might change how I approach backing up my passwords. How would you go about maintaing that physical copy updated? What I think would make this approach hard is that you would have to ponder if a newly created account is important at creation time in order to know if you should update the off-site, physical copy of your most important passwords (I say this because if you want to backup everything and avoid the cloud entirely it is just not viable, having to update this physical backup for each new account. I am currently at over 400 logins in my pw manager, 2 years ago it was half as much). I think having your passwords encrypted with a high enough entropy master password and a quantum-resistant encryption algorithm, and having an off-site, physical backup of your cloud account credentials is enough for anyone not publicly exposed, like a politician or someone extremely wealthy, even though I would be skeptical these people go through such lengths to protect their online accounts.
- 3y ago
- 89vision 3y ago20 years ago if a blog or website ended up on slashdot/digg/whatever there was a good chance it was going down. Scalable websites are a commodity today
- rglullis 3y agoThat goes both ways. What was the price then to get a botnet with 10k nodes making 1k requests / second? What is the price today?
- ExoticPearTree 3y agoFor the website or for the use of the botnet?
- spacephysics 3y agoA similar analogy can be made with the likes of westward expansion in the continental US. Back then, you got a piece of land, and really could do what you wanted with it. Build a business, farm, etc. some government taxes but nothing crazy. But you had to deal with criminals, lack of access to medical care, and lack of education. Now to do the same, you have a slew of building codes, regulations, zoning laws, and are basically forced to have municipal services. Higher Taxes to pay the roads, police force, fire fighters, education services etc. However, home owners can still just have an egg or vegetable stand at the end of their driveway. It won’t be the same as having a storefront in town, but it’s still doable without the overhead. Similarly, as the internet matures, we’re going to see more and more overhead to sustain a “basic” business. But you can still have a personal blog ran in your closet, for lower-level traffic. The analogy isn’t perfect, but unfortunately as threat-actor’s budgets increase, so too do their quality/sophistication of their attacks. If it was cheap to defend against some of the more costly attacks, they would find a different vector. The answer, to me, is some tangential technology that is some mix of federated or decentralization. Not in a crypto bro sense, but just some tech whose fundamental design solves the inherit problem with how our web is built today. Then threat actors will find another way, rinse and repeat…
- dmd 3y ago> home owners can still just have an egg or vegetable stand at the end of their driveway No you can't. That is illegal without a "cottage food" license, training, and labeling in most of the US. https://www.pickyourown.org/CottageFoodLawsByState.htm https://www.pickyourown.org/CottageFoodLawsByState.htm
- bombcar 3y agoChild-run lemonade stands are technically illegal in most states (some have actually carved out exemptions for them because of overzealous policing). Garage sales often have a specific carve out, also, and limitations on numbers of time per year, etc. Most areas nobody cares at all until it becomes a nuisance somehow.
- 3y ago
- dylan604 3y agoyou don't need enterprise grade tools just to host a simple website. however, if your simple site ever gains enough attraction to come under an attack, especially like this, you'll never survive. you can either just accept that your service will not survive the attack and just shut it down until the attackers realize mission accomplished and stops. you can then hope they don't notice when you bring it back. no simple site will be able to afford what's required to stay up from these attacks. i'm not saying i like having to put the majority behind the services of 2 or 3 companies, but if you ever get shut down from some DDOS, you'll understand why people think they need to.
- lazide 3y agoIt won’t survive - until a day or so later you’ve migrated to one of the large providers who provide the protection.
- lazide 3y agoIt doesn’t take enterprise grade tools to host a website. It does take enterprise grade tools to defend against the largest DDoS ever attempted. Those are not the same thing. And those DDoS’s often are aimed at things besides a HTTPS endpoint.