4 ms·
Interesting to learn the reason HN was down: > You may have noticed that Hacker News was down on January 10th; we believe that was ultimately due to Cogent’s h
by Aissen 3y ago
Interesting to learn the reason HN was down:
> You may have noticed that Hacker News was down on January 10th; we believe that was ultimately due to Cogent’s heavy handed approach to mitigating the DDoS targetting SourceHut (sorry, HN, glad you got it sorted).
It was also in https://news.ycombinator.com/item?id=38939532 https://news.ycombinator.com/item?id=38939532 but I did not see it earlier.
- kazen44 3y agoto be fair, you reach a certain point when the only options left for DDoS protection are Remote Triggered blackholing on your edge. This results in an entire /24 network not being routed to your network and being dropped by your peer instead.
- mariusor 3y agoWhich is a totally reasonable way of going about the problem, of course. /s
- coldacid 3y agoNobody has ever accused Cogent of being reasonable or competent.
- bityard 3y agoThat's not true. I work for a company that sells DDoS mitigation products to large network operators like Cogent for helping them deal with exactly these kinds of attacks in a much more sane manner than, "oy, just blackhole the destination and head out to lunch." Either Cogent didn't buy our product (or a competitor's equivalent), or they have a network op who's a fresher and only knows how to blackhole things. Either way, it's a bad look for Cogent.
- dfc 3y agoThat is not a new look for cogent.
- cpach 3y agoI remember at one point back in 2009 or so I wasn’t able to download from one of SourceForge’s mirrors. Turned out the reason for that was that Cogent had cut off my ISP (Telia) for some weird reason. IIRC Cogent and Telia hadn’t agreed on a peering policy, so Cogent just said whatever, we’ll cut you off (:
- booi 3y agoWe were a Cogent customer for years. Blackhole was there one and only tool for DDoS. Eventually we just left.
- tillulen 3y agoAre there upstream providers in the US or EU that are known to deal with this kind of attacks in a more thoughtful way?
- zakki 3y agoFor a blackhole /32 (single IP) I believe is allowed in most ISP/INP. Many ISP also have DDOS mitigation using bgp flowspec to block dirty traffic only and let valid traffic pass through.
- gadders 3y agoSurprised he put that shout out in, considering he doesn't like Hacker News.
- scour 3y agoi’m confused; is he saying that Cogent black-holed sourcehut’s IP addresses and that somehow affected HN’s IP addresses? they’re in completely separate IP allocations and ASNs...