6 ms·

In principle I agree, but in practice - what the better ways of doing things, as of now?

observationist 1y ago
Use other services where necessary, and sparingly. Use only what's functionally necessary, and diversify. Encourage your employer or organization to avoid vendor lock. Don't ever meet with salespeople, stay in charge of your websites and infrastructure. Find a highly disagreeable technical engineer to tell you what you can get away with; you probably don't need the scale of the things CloudFlare, AWS, et al impose by default. AI right now can do all of that for you; pay for the best initially, have it do deep searches that meet what you need, and find appropriate contractors and services. Drop down to the plus tier after you get what you need initially, if the $200+ versions are too steep, but you can absolutely afford one month to plan an overhaul that doesn't empty your wallet. Mandate open standards and bake in flexibility to your organization; pivot frequently and aggressively away from companies and services that don't meet your principles or standards. Wherever possible use self hosting, decentralized protocols, open standards, FOSS software, and pay for expertise over the massive overkill "but wait, there's more!" the conglomerators offer. Their economies of scale serve to consolidate unearned and unaccountable power, often in cooperation with very shady players. Yeah, tragedy of the commons, this is why we can't have nice things, because it's hard, and complex, and actual evil people exist who will absolutely ddos sites and exploit every and any opportunity to grift people out of their money. Cloudflare is a well marketed bundle of solutions for real problems, but it's definitely not the only solution. It's up to you to what extent you compromise on principles - with AI it's becoming much easier to find acceptable alternatives without having extensive domain expertise. Normal search engines are almost completely captured by SEO and big market players, and we have a window of opportunity to use new AI search to find things that defy the status quo. The window will probably close sometime in the near future, but until then, take full advantage and position yourself to not be subject to companies or industries that shouldn't be taking it upon themselves to gatekeep the internet. Also, yell at your representatives about getting a digital bill of rights, protecting the open internet, breaking apart monopolies, and cultivating what's best for the internet, and the world. We have to stop pissing away the good for the convenience of the cheap. /soapbox
- BinaryIgor 1y ago
  Good points - thank you for a thoughtful answer!
- bsder 1y ago
  DDoS via AI bots doesn't have a straightforward solution at the individual level (Anubis-like solutions only neutralize the dumbest of bots). If you have a reference otherwise, I'd love to have it.
  - observationist 1y ago
    Digital bill of rights and enforcing laws already on the books, imposing requirements on ISPs to remove bad actors, and having governments and law enforcement agencies actually do the boring and tedious work of tracking these people down and shutting them down. Disconnecting ISPs from the rest of the internet when they cannot police themselves. Shutting down "VPN" services that harvest and abuse residential IP blocks of their users to evade detection while accepting money from bot herders, and other criminal activity that gets ignored. We have sensible laws on the books, treaties, and all sorts of agreements with entities ranging from big corporations to ISPs to countries, but they aren't enforced. Just look at how long spam call centers have been an issue - if we start playing hardball and simply shutting off entire regions until providers and governments comply with basic enforcement, we can have a civilized internet. These botnets are not magic. They're not subtle. They're not ultra-secure beyond the reach of mere mortals to do anything about. They're allowed to persist for all sorts of reasons, ranging from utility to nation state level threat actors to local ISP corruption and bribery to simple laziness and incompetence. From the top down, governments merely need to enforce the rules that are already in play. I guarantee if you disconnect large regions of India where many of these sorts of problems originate, the people there will convince their local officials to take appropriate action - and if that doesn't work, we don't need them on the internet anyway. Same goes for any regional ISPs in the US, or Canada, or anywhere else in the world. We have rules, let's try following them before we decide on mechanisms like CloudFlare or other centralized controls.
    - bsder 1y ago

Use other services where necessary, and sparingly. Use only what's functionally necessary, and diversify. Encourage your employer or organization to avoid vendor lock. Don't ever meet with salespeople, stay in charge of your websites and infrastructure. Find a highly disagreeable technical engineer to tell you what you can get away with; you probably don't need the scale of the things CloudFlare, AWS, et al impose by default. AI right now can do all of that for you; pay for the best initially, have it do deep searches that meet what you need, and find appropriate contractors and services. Drop down to the plus tier after you get what you need initially, if the $200+ versions are too steep, but you can absolutely afford one month to plan an overhaul that doesn't empty your wallet. Mandate open standards and bake in flexibility to your organization; pivot frequently and aggressively away from companies and services that don't meet your principles or standards. Wherever possible use self hosting, decentralized protocols, open standards, FOSS software, and pay for expertise over the massive overkill "but wait, there's more!" the conglomerators offer. Their economies of scale serve to consolidate unearned and unaccountable power, often in cooperation with very shady players. Yeah, tragedy of the commons, this is why we can't have nice things, because it's hard, and complex, and actual evil people exist who will absolutely ddos sites and exploit every and any opportunity to grift people out of their money. Cloudflare is a well marketed bundle of solutions for real problems, but it's definitely not the only solution. It's up to you to what extent you compromise on principles - with AI it's becoming much easier to find acceptable alternatives without having extensive domain expertise. Normal search engines are almost completely captured by SEO and big market players, and we have a window of opportunity to use new AI search to find things that defy the status quo. The window will probably close sometime in the near future, but until then, take full advantage and position yourself to not be subject to companies or industries that shouldn't be taking it upon themselves to gatekeep the internet. Also, yell at your representatives about getting a digital bill of rights, protecting the open internet, breaking apart monopolies, and cultivating what's best for the internet, and the world. We have to stop pissing away the good for the convenience of the cheap. /soapbox

BinaryIgor 1y ago
Good points - thank you for a thoughtful answer!
bsder 1y ago
DDoS via AI bots doesn't have a straightforward solution at the individual level (Anubis-like solutions only neutralize the dumbest of bots). If you have a reference otherwise, I'd love to have it.
- observationist 1y ago
  Digital bill of rights and enforcing laws already on the books, imposing requirements on ISPs to remove bad actors, and having governments and law enforcement agencies actually do the boring and tedious work of tracking these people down and shutting them down. Disconnecting ISPs from the rest of the internet when they cannot police themselves. Shutting down "VPN" services that harvest and abuse residential IP blocks of their users to evade detection while accepting money from bot herders, and other criminal activity that gets ignored. We have sensible laws on the books, treaties, and all sorts of agreements with entities ranging from big corporations to ISPs to countries, but they aren't enforced. Just look at how long spam call centers have been an issue - if we start playing hardball and simply shutting off entire regions until providers and governments comply with basic enforcement, we can have a civilized internet. These botnets are not magic. They're not subtle. They're not ultra-secure beyond the reach of mere mortals to do anything about. They're allowed to persist for all sorts of reasons, ranging from utility to nation state level threat actors to local ISP corruption and bribery to simple laziness and incompetence. From the top down, governments merely need to enforce the rules that are already in play. I guarantee if you disconnect large regions of India where many of these sorts of problems originate, the people there will convince their local officials to take appropriate action - and if that doesn't work, we don't need them on the internet anyway. Same goes for any regional ISPs in the US, or Canada, or anywhere else in the world. We have rules, let's try following them before we decide on mechanisms like CloudFlare or other centralized controls.
  - bsder 1y ago