5 ms·

What are the ways to manage a DDoS attack, preferably using open source? Don't say Cloudflare because they're an extortionist firm.

Capricorn2481 2y ago
I have asked this a few times and never gotten an answer beyond "One day they could turn evil." What is the reason Cloudflare is an extortionist firm? I am way more concerned about Amazon than Cloudflare.
- remram 2y ago
  There was a recent anonymous critic of Cloudflare on the front page: https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808
- tripletao 2y ago
  Beyond the upselling under duress, I've also seen complaints that Cloudflare protects the client-facing websites of DDoS-as-service operators. This enables them to sell their service, which then creates demand for Cloudflare's service from their targets. Cloudflare describes that policy as a commitment to content neutrality rather than extortion, and I think that's more or less sincere (since they've protected many other unpopular sites that didn't give them such a benefit, with a few high-profile exceptions). It does work out very conveniently for them, though.
  - fortran77 2y ago
    > Cloudflare describes that policy as a commitment to content neutrality rather than extortion But we know that's not true. Point out problems with a very controversial blogger and they'll cancel your service.
- ClassyJacket 2y ago
  "What is the reason Cloudflare is an extortionist firm?" Because they are a publicly traded company
  - OutOfHere 2y ago
    Nailed it. The implications are saddening.
  - Capricorn2481 2y ago
    So is Amazon.
jsyang00 2y ago
Cloudflare is not "an extortionist firm". It is a large tech company, where occasionally teams employ shitty sales tactics to meet their numbers, but generally provides a valuable service and acts reasonably ethically. There are open source tools to mitigate DDoS, but all of them will have some marginal cost to run, and they will all be significantly worse than Cloudflare as they benefit from neither Cloudflare's data moat or scale.
- OutOfHere 2y ago
  No, thanks. Cloudflare acts ethically only until it suits them. It is the pre-exploitation phase to lure a customer. We are not fools here. The report at https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808 says it all. Secondly, considering Cloudflare would MITM all traffic, it would make a data good source for the NSA, thereby violating all user privacy.
  - bdlowery 2y ago
    Nah. Just don’t do anything illegal and you’re good
  - Capricorn2481 2y ago
    > Secondly, considering Cloudflare would MITM all traffic, it would make a data good source for the NSA, thereby violating all user privacy. This seems like a weak argument. Should we just take down anything widely accessed because it might be used by the NSA? What about AWS?
    - cess11 2y ago
      Yes, that's pretty much the view in Schrems II from the European Court of Justice. The CLOUD Act does not respect data protection rights.
    - OutOfHere 2y ago
      Is AWS providing DDoS mitigation services now, coupled with MITM access to user traffic?
robertakarobin 2y ago
Aw darn, they are? I was just considering migrating my frontend to them after seeing all the positive reviews. What's the issue?
- OutOfHere 2y ago
  Refer to the report at https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808 Secondly, considering Cloudflare would MITM all traffic, it would make a data good source for the NSA, thereby violating all user privacy.
remram 2y ago
If your application can take it, drop it in the application. If your load balancers can take it, drop it on your load balancers. Otherwise you have to get your provider to drop it, if they can take it. Worse case they'll drop all traffic meant for you to protect the rest of their network.
Joe_Cool 2y ago
HAProxy + DDOS protection? https://www.haproxy.com/blog/application-layer-ddos-attack-protection-with-haproxy https://www.haproxy.com/blog/application-layer-ddos-attack-p... Or any proof of work proxy that delays the ingress traffic. If you only have one server there is very little you can do except maybe redirect to a static page or kill the DNS entries.
- OutOfHere 2y ago
  HAProxy looks good, but I would also consider a unique unguessable subdomain per established customer. This won't thwart the IP-level attacks, but it will thwart most subdomain attacks for those customers.
overstay8930 2y ago
Plenty of DDoS mitigation firms use open source tech, but that’s only step one of mitigation, most normal firms will never be able to stop a DDoS attack without someone else with a lot of resources tanks the attack for you. Even if you go all out and buy a bunch of huge IP transit links, you are not gonna be able to stop the IXP 800 miles away from getting congested and blocking your customers from accessing your site anyways. You need access to a backbone to route traffic differently to avoid those kinds of issues, which is why DDoS scrubbing services will partner with a T1 ISP to do most of the work.
emporas 2y ago
The only universal way IMHO, is to associate a small cost to every internet request. The cost has to be as small as possible, but it has to be there for million/billion/trillion requests to add up the cost and make it uneconomical to continue the attack past some point. It is the same problem with email spam. What's stopping someone from sending billions of spam mails? If we suppose that: a blockchain exists which is fast enough, cheap enough, and spread out enough on the globe (to mitigate latency), then there is no reason, for a tcp packet to not carry with it a small money transaction, in the order of a millionth of a cent. Information gets served back, only when the transaction is confirmed. In that way, any request with no transaction gets discarded, and only requests with a small cost pass through. Suddenly by sending requests one after another and no end in sight, DDoS attacks and mail spam start to cost money. It is the serving of request that makes DDoS attacks and mail spam to be effective. The problem however, is that no blockchain is fast enough and cheap enough as of today. But there will be one in a handful of years.
- jimbobthrowawy 2y ago
  That would assume the cost is borne by the attacker, and not every smart thermostat in their botnet.
- 0xcde4c3db 2y ago
  Similar systems were proposed in the late '90s/early 2000s (hashcash/micropayments) to combat spam. The big problem isn't a technological one, it's that it presupposes some "sweet spot" price (negligible for legitimate users, yet prohibitive for abusers) that has never been shown to exist in reality. (also, you're arguably just moving the problem to DDoSing the payment processing / firewall mechanism)
  - emporas 2y ago
    > Similar systems were proposed in the late '90s/early 2000s (hashcash/micropayments) to combat spam. These ideas indeed exist for decades. > The big problem isn't a technological one, it's that it presupposes some "sweet spot" price (negligible for legitimate users, yet prohibitive for abusers) that has never been shown to exist in reality. Advances in technology, software and hardware, make it easier and easier for that sweet spot to exist. That sweet spot, didn't exist in the past, certainly, but we are close right now. One example that i think is useful here, is aluminum cans for fizzy drinks. Aluminum, a strong metal compared to cardboard or plastic or glass, is better at withstanding pressurized gases without exploding. The downside, is that it's more expensive. When manufacturing prices dropped down a lot, then it was feasible to drink half a liter of liquid and just throw away the metal. Aluminum still not free though, but the small price did worth it. Huge waste of energy as well to smelt all that metal and throw it away after 10 minutes of drinking, but it is economically viable. One could manufacture Titanium cans, and drink even more fizzy drinks. But that's not economically viable as of today. > you're arguably just moving the problem to DDoSing the payment processing / firewall mechanism. Yes, the problem is moved elsewhere, that's the weak link in the scheme i described. The thing is that a flood of transactions still costs money. Blockchains cannot be flooded just with requests, they have to be flooded by transactions. Take a look at the article [1] which outlines some ideas. I don't agree with a lot of things in there, but it states the problem and gives some numbers. The theory when it comes to blockchain deterring DDoS attacks (and other kind of attacks), is that there are not bad guys in general, just rational economic actors who use dirty tricks. When a dirty trick starts to cost money, and profit disappears from an attack, then the rational economic actor will stop the attack. The bad guy will resume the attack regardless of profit, but that's one of the axioms of the theory, that there are no bad guys. [1] https://www.dlnews.com/articles/defi/ddos-attacks-are-an-increasing-problem-for-blockchains/ https://www.dlnews.com/articles/defi/ddos-attacks-are-an-inc...
brokenmachine 2y ago
Proof of work gateways and really annoying captchas.
- BenjiWiebe 2y ago
  That won't fix the issue of your inbound pipe being saturated, preventing legitimates from accessing your site.
  - brokenmachine 2y ago
    I believe it would though? Isn't that the whole point? If you need PoW for every connection, it's going to end up being very expensive for an attacker to saturate the connection. And the captcha is probably a different server to the main site.
    - BenjiWiebe 2y ago
      You can't check the PoW until it's at your connection. Do you mean that every packet everywhere would have PoW that is checked by their ISP/upstream?
      - brokenmachine 2y ago
        No, I meant just a usual gateway. I thought a gateway would work for that purpose. Are you sure it wouldn't? In that case there's no defending against ddos.
        BenjiWiebe 2y ago
        A gateway (router/firewall) on your own connection cannot protect you against a DDoS. Really nothing at your connection can prevent you from getting DDoSed. The attacker can cause you to go offline/degraded even if you are 100% successful at dropping his packets. They still fill up your inbound pipe and prevent (or majorly hinder) legitimate traffic from fitting in. The filtering/dropping of packets has to be upstream of your connection to be able to protect your connection - additionally somewhere where the available bandwidth is greater than the attacker's bandwidth.
rcxdude 2y ago
It's not (just) a case of the software, it's the hardware and the position in the network. These DDoS primarily just saturate your internet pipe: you need to be able to co-ordinate with core ISPs to block the ddos traffic before it concentrates too much.

Capricorn2481 2y ago

I have asked this a few times and never gotten an answer beyond "One day they could turn evil." What is the reason Cloudflare is an extortionist firm? I am way more concerned about Amazon than Cloudflare.

remram 2y ago
There was a recent anonymous critic of Cloudflare on the front page: https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808
tripletao 2y ago
Beyond the upselling under duress, I've also seen complaints that Cloudflare protects the client-facing websites of DDoS-as-service operators. This enables them to sell their service, which then creates demand for Cloudflare's service from their targets. Cloudflare describes that policy as a commitment to content neutrality rather than extortion, and I think that's more or less sincere (since they've protected many other unpopular sites that didn't give them such a benefit, with a few high-profile exceptions). It does work out very conveniently for them, though.
- fortran77 2y ago
  > Cloudflare describes that policy as a commitment to content neutrality rather than extortion But we know that's not true. Point out problems with a very controversial blogger and they'll cancel your service.
ClassyJacket 2y ago
"What is the reason Cloudflare is an extortionist firm?" Because they are a publicly traded company
- OutOfHere 2y ago
  Nailed it. The implications are saddening.
- Capricorn2481 2y ago
  So is Amazon.

jsyang00 2y ago

Cloudflare is not "an extortionist firm". It is a large tech company, where occasionally teams employ shitty sales tactics to meet their numbers, but generally provides a valuable service and acts reasonably ethically. There are open source tools to mitigate DDoS, but all of them will have some marginal cost to run, and they will all be significantly worse than Cloudflare as they benefit from neither Cloudflare's data moat or scale.

OutOfHere 2y ago
No, thanks. Cloudflare acts ethically only until it suits them. It is the pre-exploitation phase to lure a customer. We are not fools here. The report at https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808 says it all. Secondly, considering Cloudflare would MITM all traffic, it would make a data good source for the NSA, thereby violating all user privacy.
- bdlowery 2y ago
  Nah. Just don’t do anything illegal and you’re good
- Capricorn2481 2y ago
  > Secondly, considering Cloudflare would MITM all traffic, it would make a data good source for the NSA, thereby violating all user privacy. This seems like a weak argument. Should we just take down anything widely accessed because it might be used by the NSA? What about AWS?
  - cess11 2y ago
    Yes, that's pretty much the view in Schrems II from the European Court of Justice. The CLOUD Act does not respect data protection rights.
  - OutOfHere 2y ago
    Is AWS providing DDoS mitigation services now, coupled with MITM access to user traffic?

robertakarobin 2y ago

Aw darn, they are? I was just considering migrating my frontend to them after seeing all the positive reviews. What's the issue?

OutOfHere 2y ago
Refer to the report at https://news.ycombinator.com/item?id=40481808 https://news.ycombinator.com/item?id=40481808 Secondly, considering Cloudflare would MITM all traffic, it would make a data good source for the NSA, thereby violating all user privacy.

remram 2y ago

If your application can take it, drop it in the application. If your load balancers can take it, drop it on your load balancers. Otherwise you have to get your provider to drop it, if they can take it. Worse case they'll drop all traffic meant for you to protect the rest of their network.

Joe_Cool 2y ago

HAProxy + DDOS protection? https://www.haproxy.com/blog/application-layer-ddos-attack-protection-with-haproxy https://www.haproxy.com/blog/application-layer-ddos-attack-p... Or any proof of work proxy that delays the ingress traffic. If you only have one server there is very little you can do except maybe redirect to a static page or kill the DNS entries.

OutOfHere 2y ago
HAProxy looks good, but I would also consider a unique unguessable subdomain per established customer. This won't thwart the IP-level attacks, but it will thwart most subdomain attacks for those customers.

overstay8930 2y ago

Plenty of DDoS mitigation firms use open source tech, but that’s only step one of mitigation, most normal firms will never be able to stop a DDoS attack without someone else with a lot of resources tanks the attack for you. Even if you go all out and buy a bunch of huge IP transit links, you are not gonna be able to stop the IXP 800 miles away from getting congested and blocking your customers from accessing your site anyways. You need access to a backbone to route traffic differently to avoid those kinds of issues, which is why DDoS scrubbing services will partner with a T1 ISP to do most of the work.

emporas 2y ago

The only universal way IMHO, is to associate a small cost to every internet request. The cost has to be as small as possible, but it has to be there for million/billion/trillion requests to add up the cost and make it uneconomical to continue the attack past some point. It is the same problem with email spam. What's stopping someone from sending billions of spam mails? If we suppose that: a blockchain exists which is fast enough, cheap enough, and spread out enough on the globe (to mitigate latency), then there is no reason, for a tcp packet to not carry with it a small money transaction, in the order of a millionth of a cent. Information gets served back, only when the transaction is confirmed. In that way, any request with no transaction gets discarded, and only requests with a small cost pass through. Suddenly by sending requests one after another and no end in sight, DDoS attacks and mail spam start to cost money. It is the serving of request that makes DDoS attacks and mail spam to be effective. The problem however, is that no blockchain is fast enough and cheap enough as of today. But there will be one in a handful of years.

jimbobthrowawy 2y ago
That would assume the cost is borne by the attacker, and not every smart thermostat in their botnet.
0xcde4c3db 2y ago
Similar systems were proposed in the late '90s/early 2000s (hashcash/micropayments) to combat spam. The big problem isn't a technological one, it's that it presupposes some "sweet spot" price (negligible for legitimate users, yet prohibitive for abusers) that has never been shown to exist in reality. (also, you're arguably just moving the problem to DDoSing the payment processing / firewall mechanism)
- emporas 2y ago
  > Similar systems were proposed in the late '90s/early 2000s (hashcash/micropayments) to combat spam. These ideas indeed exist for decades. > The big problem isn't a technological one, it's that it presupposes some "sweet spot" price (negligible for legitimate users, yet prohibitive for abusers) that has never been shown to exist in reality. Advances in technology, software and hardware, make it easier and easier for that sweet spot to exist. That sweet spot, didn't exist in the past, certainly, but we are close right now. One example that i think is useful here, is aluminum cans for fizzy drinks. Aluminum, a strong metal compared to cardboard or plastic or glass, is better at withstanding pressurized gases without exploding. The downside, is that it's more expensive. When manufacturing prices dropped down a lot, then it was feasible to drink half a liter of liquid and just throw away the metal. Aluminum still not free though, but the small price did worth it. Huge waste of energy as well to smelt all that metal and throw it away after 10 minutes of drinking, but it is economically viable. One could manufacture Titanium cans, and drink even more fizzy drinks. But that's not economically viable as of today. > you're arguably just moving the problem to DDoSing the payment processing / firewall mechanism. Yes, the problem is moved elsewhere, that's the weak link in the scheme i described. The thing is that a flood of transactions still costs money. Blockchains cannot be flooded just with requests, they have to be flooded by transactions. Take a look at the article [1] which outlines some ideas. I don't agree with a lot of things in there, but it states the problem and gives some numbers. The theory when it comes to blockchain deterring DDoS attacks (and other kind of attacks), is that there are not bad guys in general, just rational economic actors who use dirty tricks. When a dirty trick starts to cost money, and profit disappears from an attack, then the rational economic actor will stop the attack. The bad guy will resume the attack regardless of profit, but that's one of the axioms of the theory, that there are no bad guys. [1] https://www.dlnews.com/articles/defi/ddos-attacks-are-an-increasing-problem-for-blockchains/ https://www.dlnews.com/articles/defi/ddos-attacks-are-an-inc...

brokenmachine 2y ago

Proof of work gateways and really annoying captchas.

BenjiWiebe 2y ago
That won't fix the issue of your inbound pipe being saturated, preventing legitimates from accessing your site.
- brokenmachine 2y ago
  I believe it would though? Isn't that the whole point? If you need PoW for every connection, it's going to end up being very expensive for an attacker to saturate the connection. And the captcha is probably a different server to the main site.
  - BenjiWiebe 2y ago
    You can't check the PoW until it's at your connection. Do you mean that every packet everywhere would have PoW that is checked by their ISP/upstream?
    - brokenmachine 2y ago
      No, I meant just a usual gateway. I thought a gateway would work for that purpose. Are you sure it wouldn't? In that case there's no defending against ddos.
      - BenjiWiebe 2y ago
        A gateway (router/firewall) on your own connection cannot protect you against a DDoS. Really nothing at your connection can prevent you from getting DDoSed. The attacker can cause you to go offline/degraded even if you are 100% successful at dropping his packets. They still fill up your inbound pipe and prevent (or majorly hinder) legitimate traffic from fitting in. The filtering/dropping of packets has to be upstream of your connection to be able to protect your connection - additionally somewhere where the available bandwidth is greater than the attacker's bandwidth.

rcxdude 2y ago

It's not (just) a case of the software, it's the hardware and the position in the network. These DDoS primarily just saturate your internet pipe: you need to be able to co-ordinate with core ISPs to block the ddos traffic before it concentrates too much.