11 ms·
If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder whi
by phyzome 11mo ago
If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger?
I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?
- throwaway150 11mo ago> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get. If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run circles around their support staff to bring back the website up again, then I guess, you don't have a problem. It's nice that you don't care. (Honestly speaking. Not being sarcastic at all.) Personally, I wouldn't mind DDoS on my personal site if the problem was just the DDoS. Unfortunately, mostly it isn't. A DDoS has other repercussions which I don't want to deal with exactly because it's a personal site. I just don't want to spend time with customer support staff to find out if and when I can bring my website back up again. DDoS on my personal website by itself isn't all that bad for me. But having to deal with the fallout is a pain in the neck.
- TZubiri 11mo agoStarting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.
- dymk 11mo agoThat’s like saying you should buy car insurance after you wreck your car
- unethical_ban 11mo agoThat's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?
- jimmydorry 11mo agoDepending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.
- bmicraft 11mo ago> If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.
- variadix 11mo agoDepends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare. This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.
- thfuran 11mo agoBut you can just download a new car.
- hypeatei 11mo agoUnless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.
- k4rnaj1k 11mo agoThis strategy requires you to be "on-call" for personal stuff. Honestly, I don't want to spend more time on pet projects than I already do. Or cutting some of it away on support instead of spending more on things I would actually be interested in. And resulting downtime might be even bigger than that with cloudflare.
- deleted 11mo ago[deleted]
- benmmurphy 11mo agoin the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy then when you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. i presume if BGP stops advertising the IPs then eventually you will stop getting the DOS traffic.
- HumanOstrich 11mo ago> When you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. You think people hosting personal sites are going to even have the access to manage their IPs with BGP? It's not something I've seen offered at that scale / pricing.
- close04 11mo ago> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't cut it.
- throwaway150 11mo ago> These are very different situations. It is obvious those two are very different situations. I'm not sure I understand your point. Yeah, nobody will be bothered by a short 15 minute DDoS attack. I prolly wouldn't even notice it unless I'm actively checking the logs. Sure, nobody is going to be bothered by that. But what if someone's DDoSing persistently with a purpose? Maybe they're just pissed at you. My point is... a sustained DDoS attack will just make your host drop you. So one situation directly leads to another and you are forced to deal with both situations, like it or not.
- close04 11mo ago> It is obvious those two are very different situations. I'm not sure I understand point. Your host taking down the site and forgetting to bring it back up after a DDoS attack isn't a common thing with any host, unless it's the kind that does this routinely even without a DDoS. And then you should look long and hard at your choice of hosting. Either you suffer from a DDoS attack and come back when it's over, or you have a host that occasionally brings your site down and fails to bring it up until you chase them. But one does not follow the other without a lot of twisting.
- NewJazz 11mo agoDDoS attacks are frequently shorting than 15 minutes. We've seen plenty of attacks last less than a minute.
- blueflow 11mo ago> a sustained DDoS attack will just make your host drop you I'd love to see someone suing the host for damages. The contract binds them as much as it binds you. Sounds like a good way to have your next gaming rig financed.
- wpm 11mo agoIf I wasn’t running my own personal site at home on a proxmox vm, why would I choose a hosting provider that doesn’t do DDOS protection themselves?
- samtheprogram 11mo agoYou keep saying stuff like "the fallout" and "the repercussions" but then the only example you can provide is talking to customer service to bring your stuff back online. Is that it? Honestly speaking, not being sarcastic at all.
- RijilV 11mo agoSo the internet is a series of pipes, or tubes, whatever. This quintessential personal blog website is hosted somewhere in this inter connected mess of things. There’s a hierarchy of these pipes/tubes, and they all have some ever diminishing capacity as they head from a mythical center to the personal blog website. When the bad guys want to DDoS the personal blog website they don’t go and figure out the correct amount they need to send to fill up that pipe/tube that directly connects the personal blog website, they just throw roughly one metric fton at it. This causes the pipes/tubes before the personal blog website to fill up too, and has the effect of disrupting all the other pipes/tubes downstream. The result is your hosting provider is pissed because their infrastructure just got pummeled, or if you’re hosting that on your home/business ISP they also are pissed. In both cases they probably want to fire you now.
- q3k 11mo agoThis is incorrect. Any decent host/ISP will instead (automatically, sometimes) emit a blackhole request for the given target IP address to their upstreams, causing the traffic to be filtered there (at the 'larger pipe'). In turn, these upstreams can also pass on the same blackhole request further up if necessary. This means the target is down from the point of view of the Internet, but there is no collateral damage. See: BGP Blackhole Community (usually 65535:666).
- ralferoo 11mo agoInteresting, I didn't realise blackholes were special-cased to allow BGP announcements of /32 instead of the usual /24 or larger. I'd just assumed (like the GP) that the traffic ended up on the target's closest network to the source and only then was it filtered.
- tcfhgj 11mo agoMy hoster wouldn't take me down though. Instead it will protect me for free: https://www.hetzner.com/unternehmen/ddos-schutz https://www.hetzner.com/unternehmen/ddos-schutz
- internetter 11mo agoIn my experience hetzner DDoS protection doesn't work
- mananaysiempre 11mo agoAs long as the hoster doesn’t actively make things worse by disconnecting you, any further help is just a happy accident. The bar is very low.
- internetter 11mo agoYeah I suppose by "doesn't work" I should clarify that maybe it is doing something and preventing some attacks, and that it doesn't take down my server. With that being said, it has certainly failed to mitigate attacks on numerous occasions that cf would've.
- amy_petrik 11mo agoI'm less scared of the hoster pulling down your site - not the end of the world - then decided to charge you bandwidth fees for all the MS-DOS attacks. The former presumably has no financial impact, the latter, potentially brutal
- axelthegerman 11mo agoThis!! Everyone seems to "really need" that unlimited scalability of AWS & Co - but they'll happily scale your compute and the bill for you. Sure maybe you'll get lucky and they waive it. But sometimes going down is a feature if you're not a multi m/billion dollar business
- eurleif 11mo ago
- nalekberov 11mo agoThis is mostly scaremongering, not all hosting providers take your site down just because someone you pissed off decided to DDoS you. In Russia (I have nothing against Russia - I just know this info about “Дождь ТВ”), some news websites have been targeted by state-baked DDoS attacks, but I highly doubt most people are in this category.
- immibis 11mo agoDid they put it back up when the DDoS ended? If so, they're not hurting you since it's no worse than the DDoS itself, and they're actually helping you by preventing themselves from having a reason to ban you to save the rest of their sites.
- RandomBacon 11mo agoA forum I manage was DDoSed, but I think it was by (AI) content scrapers as no one expressed any issues or anger towards the forum. I temporarily got around it by blocking the subnet of their IPs. I have since put it behind Cloudflare.
- graeme 11mo agoIt sounds like OP is describing a situation where someone persistently DDOS's them as long as it works. In which case DDOS time trivially dominates cloudflare outage time. Note that OP is posting, even now, from an anon account. This is a good essay: https://inoticeiamconfused.substack.com/p/ive-never-had-a-real-adversary https://inoticeiamconfused.substack.com/p/ive-never-had-a-re...
- huijzer 11mo ago> Note that OP is posting, even now, from an anon account. Lol I didn't even notice that my submission reached the front page. What is your evidence for that claim?
- graeme 11mo agoOh sorry, not you. The OP in the chat thread, they were DDOS'ed by someone and are commenting anonymously. Maybe grandparent is the correct word for it, in any event this is the comment I was referring to when I said OP, not your article: https://news.ycombinator.com/item?id=45966683 https://news.ycombinator.com/item?id=45966683
- MallocVoidstar 11mo ago> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares? Your host, assuming you're hosting your site on a VPS. Many of them have a policy of terminating clients who get DDoSed.
- woodrowbarlow 11mo agoand if you're hosting on your home network, a DDoS means connectivity problems for your home.
- bluGill 11mo agoNot just your home, it means connectivity problems for your neighbors. In turn your ISP will shut you down if they figure out what is happening.
- dpoloncsak 11mo agoI have my personal site behind CF because I'm hosting it locally. Wouldn't a DDoS like....affect my internet?
- nijave 11mo agoFor our SaaS, the uptime probably isn't much different but the cost definitely is. If any of your stack has usage based billing, things can get very expensive quickly.
- iLoveOncall 11mo agoMy blog was constantly going down for unknown reasons, with nothing obvious in the logs. I migrated it to CloudFlare and was able to track down the root-cause of the issue. I also blocked all the AI crawlers after moving to CloudFlare and have stopped a huge amount of traffic theft with it. My website is definitely much more stable, and loads insanely faster, since moving to CloudFlare.
- encom 11mo agoI need SponsorBlock for HN, this is ridiculous.
- iLoveOncall 11mo agoI don't give a penny to CloudFlare to be clear, and I would definitely not pay for those services for my blog. It's not because it's not a criticism that it's a sponsored post. I happen to have multiple sites that use the same technology (WordPress, with the same few plugins and the same theme) running on the same server, with one behind CloudFlare and one not. Left value is with CloudFlare, right is without: - First Contentful Paint: 0.4s - 0.7s - Largest Contentful Paint: 0.8s - 0.9s - Total Blocking Time: 0 ms - 0 ms - Cumulative Layout Shift: 0 - 0 - Speed Index: 0.4s - 8.9s The difference is quite staggering, and I'm located pretty close to my server (a Hetzner VPS), I can't imagine the difference for someone that lives across the world.
- encom 11mo agoSure, but your post reads like an infomercial, hence the snark. NARRATOR: - "Has THIS ever happened to you?" CUT TO: Black-and-white. Some guy stares in frustration and confusion at a terminal. Output of 'cat /usr/bin/gcc | xxd' or whatever scroll by. NARRATOR: - "Introducing CloudFlare™!" CUT TO: Full color. Sunlight. The same guy now sprawled on grass at a park. Two dogs tackle him with adoration. His kids hand him ice cream. NARRATOR: - "Stop debugging. Start living."
- jajuuka 11mo ago
- odie5533 11mo agoIt's like insurance. If you add up everyone's medical expenses, it's less than we all pay for insurance. But if you're the one getting hit, it matters a lot.
- wsatb 11mo agoThen who cares if your site is down for a few hours once in a blue moon because the auxiliary service in front of it is down?
- giancarlostoro 11mo agoI mean I'm not worried about it either, but I've been on the internet long enough that I know some of the people I used to know will probably do it just to do it. Gamers can be quite toxic.
- rcxdude 11mo agoThe downtime cause by DDoS. It's now an endemic problem in the modern internet. Even relatively tiny communities suffer from it, because it's so damn easy to do.