5 ms·

Wait. I thought the problem of being DDoS-ed is widely solved, i.e., just pick someone else (cloudflare, akamai, fastly, etc) to be the "proxy" of your site, an

by qxfys 3y ago

Wait. I thought the problem of being DDoS-ed is widely solved, i.e., just pick someone else (cloudflare, akamai, fastly, etc) to be the "proxy" of your site, and then let them defend the attack for you. No?

cranberryturkey 3y ago
kind of goes against the principles for existing.
ninjin 3y ago
Sure, but the problem with that solution is that it de facto centralises the Internet as everything then has to pass through a handful of large corporations. I do not claim to have a better solution though, but would be happy to hear other ways forward as DDoS appears to be a threat that is here to stay.
- tourmalinetaco 3y ago
  As was mentioned and shown off earlier in the thread, I feel more websites would benefit from proof-of-work rate limiting. It doesn’t solve it entirely, but I’ve heard it can handle around tens-of-thousands of connections.
koito17 3y ago
> just pick someone else ... to be the "proxy" of your site, If you have deep enough pockets, sure, just pay anyone ASAP. But as far as I can tell, Codeberg is a non-profit entirely dependent on donations and, according to Drew DeVault, paying Cloudflare to protect SourceHut is prohibitively expensive even at his scale, so I doubt Codeberg is in any better position to finance this. See https://news.ycombinator.com/item?id=38960189 https://news.ycombinator.com/item?id=38960189
- rapnie 3y ago
  They aren't. Even though many people use Codeberg, only few become members. This is a problem. Passing Join + Donate pages from archive.org. According to their November newsletter: > More than 100.000 projects as of late on Codeberg. Codeberg e.V. has 401 members in total, these are 281 members with active voting rights, 113 supporting members and 7 honorary members. [0] Joining: https://web.archive.org/web/20240106140505/https://join.codeberg.org/ https://web.archive.org/web/20240106140505/https://join.code... [1] Donating: https://web.archive.org/web/20240106140512/https://docs.codeberg.org/improving-codeberg/#donate-to-codeberg https://web.archive.org/web/20240106140512/https://docs.code...
  - crotchfire 3y ago
    The fact that they only take SEPA for payments is a big part of the problem. Screams "if you aren't European we don't want you here".
    - Aachen 3y ago
      That's what credit-card-required donations feel like to me. I didn't need a credit card except for giving americans money, then I applied for one and it was denied seemingly based on not having a credit score (not good, not bad, just none: privacy is suspicious!). Afaik you can also do wire transfers in other countries but there are some fees involved, so isn't IBAN available to anyone with any bank account if they're okay seeing fees which the payment platform would otherwise hide?
      - crotchfire 3y ago
        No, SEPA/IBAN is Europe-only: https://en.wikipedia.org/wiki/International_Bank_Account_Number#National_check_digits https://en.wikipedia.org/wiki/International_Bank_Account_Num... https://en.wikipedia.org/wiki/Single_Euro_Payments_Area https://en.wikipedia.org/wiki/Single_Euro_Payments_Area Only European bank accounts can do SEPA transfers.
        6510 3y ago
        IBAN is International. https://www.swift.com/resource/iban-registry-pdf https://www.swift.com/resource/iban-registry-pdf
        crotchfire 3y ago
        What's your point? Europe is many nations, not one.
        6510 3y ago
        For example Emirates and Egypt are not in Europe.
viraptor 3y ago
This isn't solved. This is "we've got workarounds provided by people who have absolutely no incentive to solve the problem they protect you from for $$$". Solving this issue would be having actually working abuse contacts that can boot the customer off their network long-term. That's extremely unlikely to happen.
- mariusor 3y ago
  Also the incentives set by tier ones are completely wrong for the DDoS problem to be solved. Instead of finding ways to isolate and blackhole the offending networks - granted that refining this data into small enough ranges would be quite difficult - they instead punish the targets, who are already suffering to begin with. This is mobster mentality. You can bet that if random ISPs ranges would get blackholed when there are missbehaving clients, they would instantly come up with ways to detect and mitigate excessive traffic, net neutrality be damned.
  - viraptor 3y ago
    The problem for ISPs is that they can't really tell who's misbehaving. Does the user do lots of requests to a host? Maybe they're part of DDoS. Maybe they're uploading a file in many fragments. Maybe they have automation for that endpoint setup and the service being down causes repeating request. Maybe ... If the ISP listens to every abuse complaint, we could easily take down most residential ranges by claiming they're part of DDoS on their local Netflix PoP IP.
    - mariusor 3y ago
      The ISPs can tell that someone is missbehaving when their upstream informs them their IPs are taking part in a DDoS. This information can trickle down from the tier one that presently just blackholes the victim. Nobody says that infrastructure that was designed in the late eighties can't be improved upon with additional functionality, namely passing top down information about missbehaving network ranges and or IPs. As an ISP you already see devices on your network sending traffic in unusual patters, and when receive the warning that they are part of a DDoS you shut them down. If not, your whole range goes down, etc. Let's add a fourth to the three-napkin protocol.

by qxfys 3y ago

cranberryturkey 3y ago

kind of goes against the principles for existing.

ninjin 3y ago

Sure, but the problem with that solution is that it de facto centralises the Internet as everything then has to pass through a handful of large corporations. I do not claim to have a better solution though, but would be happy to hear other ways forward as DDoS appears to be a threat that is here to stay.

tourmalinetaco 3y ago
As was mentioned and shown off earlier in the thread, I feel more websites would benefit from proof-of-work rate limiting. It doesn’t solve it entirely, but I’ve heard it can handle around tens-of-thousands of connections.

koito17 3y ago

> just pick someone else ... to be the "proxy" of your site, If you have deep enough pockets, sure, just pay anyone ASAP. But as far as I can tell, Codeberg is a non-profit entirely dependent on donations and, according to Drew DeVault, paying Cloudflare to protect SourceHut is prohibitively expensive even at his scale, so I doubt Codeberg is in any better position to finance this. See https://news.ycombinator.com/item?id=38960189 https://news.ycombinator.com/item?id=38960189

rapnie 3y ago
They aren't. Even though many people use Codeberg, only few become members. This is a problem. Passing Join + Donate pages from archive.org. According to their November newsletter: > More than 100.000 projects as of late on Codeberg. Codeberg e.V. has 401 members in total, these are 281 members with active voting rights, 113 supporting members and 7 honorary members. [0] Joining: https://web.archive.org/web/20240106140505/https://join.codeberg.org/ https://web.archive.org/web/20240106140505/https://join.code... [1] Donating: https://web.archive.org/web/20240106140512/https://docs.codeberg.org/improving-codeberg/#donate-to-codeberg https://web.archive.org/web/20240106140512/https://docs.code...
- crotchfire 3y ago
  The fact that they only take SEPA for payments is a big part of the problem. Screams "if you aren't European we don't want you here".
  - Aachen 3y ago
    That's what credit-card-required donations feel like to me. I didn't need a credit card except for giving americans money, then I applied for one and it was denied seemingly based on not having a credit score (not good, not bad, just none: privacy is suspicious!). Afaik you can also do wire transfers in other countries but there are some fees involved, so isn't IBAN available to anyone with any bank account if they're okay seeing fees which the payment platform would otherwise hide?
    - crotchfire 3y ago
      No, SEPA/IBAN is Europe-only: https://en.wikipedia.org/wiki/International_Bank_Account_Number#National_check_digits https://en.wikipedia.org/wiki/International_Bank_Account_Num... https://en.wikipedia.org/wiki/Single_Euro_Payments_Area https://en.wikipedia.org/wiki/Single_Euro_Payments_Area Only European bank accounts can do SEPA transfers.
      - 6510 3y ago
        IBAN is International. https://www.swift.com/resource/iban-registry-pdf https://www.swift.com/resource/iban-registry-pdf
        crotchfire 3y ago
        What's your point? Europe is many nations, not one.
        6510 3y ago
        For example Emirates and Egypt are not in Europe.

viraptor 3y ago

This isn't solved. This is "we've got workarounds provided by people who have absolutely no incentive to solve the problem they protect you from for $$$". Solving this issue would be having actually working abuse contacts that can boot the customer off their network long-term. That's extremely unlikely to happen.

mariusor 3y ago
Also the incentives set by tier ones are completely wrong for the DDoS problem to be solved. Instead of finding ways to isolate and blackhole the offending networks - granted that refining this data into small enough ranges would be quite difficult - they instead punish the targets, who are already suffering to begin with. This is mobster mentality. You can bet that if random ISPs ranges would get blackholed when there are missbehaving clients, they would instantly come up with ways to detect and mitigate excessive traffic, net neutrality be damned.
- viraptor 3y ago
  The problem for ISPs is that they can't really tell who's misbehaving. Does the user do lots of requests to a host? Maybe they're part of DDoS. Maybe they're uploading a file in many fragments. Maybe they have automation for that endpoint setup and the service being down causes repeating request. Maybe ... If the ISP listens to every abuse complaint, we could easily take down most residential ranges by claiming they're part of DDoS on their local Netflix PoP IP.
  - mariusor 3y ago
    The ISPs can tell that someone is missbehaving when their upstream informs them their IPs are taking part in a DDoS. This information can trickle down from the tier one that presently just blackholes the victim. Nobody says that infrastructure that was designed in the late eighties can't be improved upon with additional functionality, namely passing top down information about missbehaving network ranges and or IPs. As an ISP you already see devices on your network sending traffic in unusual patters, and when receive the warning that they are part of a DDoS you shut them down. If not, your whole range goes down, etc. Let's add a fourth to the three-napkin protocol.