4 ms·
I’d rather mitigate a DDoS attack on my own servers than deal with Cloudflare. Having to prove you’re human is the second-worst thing on my list, right after ac
by djfobbz 11mo ago
I’d rather mitigate a DDoS attack on my own servers than deal with Cloudflare. Having to prove you’re human is the second-worst thing on my list, right after accepting cookies. Those two things alone have made browsing the web a worse experience than it was in the late 90s or early 2000s.
- reassess_blind 11mo agoHow do you plan on mitigating a DDoS on your own servers?
- solusipse 11mo agohe'll politely ask them to stop
- schnebbau 11mo agoYou wait for it to stop.
- FinnKuhn 11mo agoThat is not what mitigating means.
- ramon156 11mo agoYou turn off the screen. They can't hurt you if you don't see them
- slipperybeluga 11mo ago[dead]
- djfobbz 11mo agoAlright kids, breathe...a DDoS attack isn't the end of the world, it's just the internet throwing a tantrum. If you really don't want to use a fancy protection provider, you can still act like a grown-up: get your datacenter to filter trash at the edge, announce a more specific prefix with BGP so you can shift traffic, drop junk with strict ACLs, and turn on basic rate limiting so bots get bored. You can also tune your kernel so it doesn't faint at SYN storms, and if the firehose gets too big, pop out a more specific BGP prefix from a backup path or secondary router so you can pull production away from the burning IP.
- deleted 11mo ago[deleted]
- arsome 11mo agoVery quickly you'll find this doesn't work. Your DC will just null your IP. You'll switch to a new one and the attackers will too, the DC will null that one. You won't win at this game unless you're a very sizeable organization or are just willing to wait the attackers out, they will get bored eventually.
- sedawkgrep 11mo ago> pop out a more specific BGP prefix from a backup path or secondary router so you can pull production away from the burning IP. This won't help against carpet bombing. The only workable solution for enterprises is a combination of on-prem and cloud mitigation. Cloud to get all the big swaths of mitigation and to keep your pipe flowing, and on-prem to mitigate specific attack vectors like state exhaustion.
- djfobbz 11mo agoI never claimed to be an enterprise, nor did I suggest this was the best option for them. Cheers!
- djfobbz 11mo agoWorrying about a DDoS on your tiny setup is like a brand-new dev stressing over how they'll handle a billion requests per second...cute, but not exactly a real-world problem for 99.99% of you. It's one of those internet boogeyman myths people love to panic about.
- GreenWatermelon 11mo agoThat may have been true before the age of LLMs, but now crawler bots bring down any website in their path.
- marticode 11mo agoThere's worse than having to prove (over and over and over again) that you are human: having your IP just completely blocked by Cloudflare zealous bot-filtering (and I use a plain mass market ISP in a developed country and not some shady network)
- philipwhiuk 11mo agoSome of the mass-market ISPs are very shady - AT&T's Room 641A for example :)
- codegeek 11mo agoAs much as this situation sucks, how do you plan to "mitigate a DDoS attack on my own servers". The reason I use Cloudflare is to use it as a proxy especially for DDOS attacks if they do occur. Right now, our services are down and we are getting tons of customer support tickets (like everyone else) but it is a lot easier to explain the the whole world is down vs its just us.
- djeastm 11mo ago>it is a lot easier to explain the the whole world is down vs its just us. Makes sense. The ability to pass the buck like this is 95% of the reason Cloudflare exists in the first place. Not being snarky, either.