4 ms·

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

dymk 1y ago
That’s like saying you should buy car insurance after you wreck your car
- unethical_ban 1y ago
  That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?
  - jimmydorry 1y ago
    Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.
    - bmicraft 1y ago
      > If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.
- variadix 1y ago
  Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare. This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.
- thfuran 1y ago
  But you can just download a new car.
- hypeatei 1y ago
  Unless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.
- shortrounddev2 1y ago
  No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances
  - c22 1y ago
    It's more like buying the plug-in version after the battery dies... You already experienced the downtime, so if not having downtime was a goal you already failed. If avoiding downtime is not important then there's no reason to add anti-downtime capability to your system. The most charitable modeling of this approach is that the downtime incident may prompt one to realize that avoiding downtime actually is an important property for their system to possess.
    - Dylan16807 1y ago
      The actual charitable model is that you expect close to zero attacks, but if you actually get hit your expected rate of future attacks goes up by an order of magnitude or two. And it's that change in expectations that gets you to buy protection. You don't care about going down once, you do care about frequent outages. And you know this from the start, you don't realize it later.
      - c22 1y ago
        I'm not so sure. The risk of future attacks hasn't actually increased, your initial risk assessment was just incorrect.
        Dylan16807 1y ago
        Yes, the original assessment was wrong. Such things happen all the time to reasonable people. The person you were describing in your "most charitable" version above was not being reasonable. They didn't just underestimate the petty anger of the internet, they were being fundamentally foolish about their own desires. That's why I replied, to show you a different way someone could end up in this position.
- alwa 1y ago
  How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?
  - Johnny555 1y ago
    That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.
    - nmz 1y ago
      Not if you live in a desert, which most blogs do.
      - Johnny555 1y ago
        That continues the analogy -- it doesn't rain often in the desert, but almost all deserts receive rain. And since it rains so rarely, you're certainly not going to find an umbrella during the rainstorm. So again, if staying dry in the rain is important to you, buy an umbrella before the rain, if you don't care about getting wet from time to time, then no need for the umbrella. While the personal blog owner may not care about DDoS related downtime, he may face extra usage charges due to higher bandwidth, CPU usage, etc that he'd like to avoid.
        nmz 1y ago
        The people you see in a desert with umbrellas are not using it for the rain, but for shade, the rain is the least of their problems.
        Johnny555 1y ago
        Even in a desert, people still use umbrellas for protection from the rain: https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-brings-rain-across-the-valley/ https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-b... And the rain still causes problems, even (or maybe especially in) a desert: https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain-after-city-punished-by-floods/ https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain...
- phyzome 1y ago
  My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked. It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.
  - Johnny555 1y ago
    I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.
    - bmicraft 1y ago
      If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.
    - integralid 1y ago
      >or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS Why? with cloudflare it's very easy, just put your site behind a reverse proxy, change the dns and disable direct access. Am I missing something?
- deleted 1y ago
  [deleted]
- grayhatter 1y ago
  Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured. Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.
- iso1631 1y ago
  It's like saying you should buy volcano insurance after you get hit by a volcano
- OkayPhysicist 1y ago
  Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.
k4rnaj1k 1y ago
This strategy requires you to be "on-call" for personal stuff. Honestly, I don't want to spend more time on pet projects than I already do. Or cutting some of it away on support instead of spending more on things I would actually be interested in. And resulting downtime might be even bigger than that with cloudflare.
- deleted 1y ago
  [deleted]
benmmurphy 1y ago
in the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy then when you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. i presume if BGP stops advertising the IPs then eventually you will stop getting the DOS traffic.
- HumanOstrich 1y ago
  > When you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. You think people hosting personal sites are going to even have the access to manage their IPs with BGP? It's not something I've seen offered at that scale / pricing.

dymk 1y ago

That’s like saying you should buy car insurance after you wreck your car

unethical_ban 1y ago
That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?
- jimmydorry 1y ago
  Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.
  - bmicraft 1y ago
    > If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.
variadix 1y ago
Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare. This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.
thfuran 1y ago
But you can just download a new car.
hypeatei 1y ago
Unless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.
shortrounddev2 1y ago
No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances
- c22 1y ago
  It's more like buying the plug-in version after the battery dies... You already experienced the downtime, so if not having downtime was a goal you already failed. If avoiding downtime is not important then there's no reason to add anti-downtime capability to your system. The most charitable modeling of this approach is that the downtime incident may prompt one to realize that avoiding downtime actually is an important property for their system to possess.
  - Dylan16807 1y ago
    The actual charitable model is that you expect close to zero attacks, but if you actually get hit your expected rate of future attacks goes up by an order of magnitude or two. And it's that change in expectations that gets you to buy protection. You don't care about going down once, you do care about frequent outages. And you know this from the start, you don't realize it later.
    - c22 1y ago
      I'm not so sure. The risk of future attacks hasn't actually increased, your initial risk assessment was just incorrect.
      - Dylan16807 1y ago
        Yes, the original assessment was wrong. Such things happen all the time to reasonable people. The person you were describing in your "most charitable" version above was not being reasonable. They didn't just underestimate the petty anger of the internet, they were being fundamentally foolish about their own desires. That's why I replied, to show you a different way someone could end up in this position.
alwa 1y ago
How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?
- Johnny555 1y ago
  That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.
  - nmz 1y ago
    Not if you live in a desert, which most blogs do.
    - Johnny555 1y ago
      That continues the analogy -- it doesn't rain often in the desert, but almost all deserts receive rain. And since it rains so rarely, you're certainly not going to find an umbrella during the rainstorm. So again, if staying dry in the rain is important to you, buy an umbrella before the rain, if you don't care about getting wet from time to time, then no need for the umbrella. While the personal blog owner may not care about DDoS related downtime, he may face extra usage charges due to higher bandwidth, CPU usage, etc that he'd like to avoid.
      - nmz 1y ago
        The people you see in a desert with umbrellas are not using it for the rain, but for shade, the rain is the least of their problems.
        Johnny555 1y ago
        Even in a desert, people still use umbrellas for protection from the rain: https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-brings-rain-across-the-valley/ https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-b... And the rain still causes problems, even (or maybe especially in) a desert: https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain-after-city-punished-by-floods/ https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain...
phyzome 1y ago
My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked. It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.
- Johnny555 1y ago
  I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.
  - bmicraft 1y ago
    If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.
  - integralid 1y ago
    >or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS Why? with cloudflare it's very easy, just put your site behind a reverse proxy, change the dns and disable direct access. Am I missing something?
deleted 1y ago
[deleted]
grayhatter 1y ago
Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured. Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.
iso1631 1y ago
It's like saying you should buy volcano insurance after you get hit by a volcano
OkayPhysicist 1y ago
Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.

k4rnaj1k 1y ago

This strategy requires you to be "on-call" for personal stuff. Honestly, I don't want to spend more time on pet projects than I already do. Or cutting some of it away on support instead of spending more on things I would actually be interested in. And resulting downtime might be even bigger than that with cloudflare.

deleted 1y ago
[deleted]

benmmurphy 1y ago

in the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy then when you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. i presume if BGP stops advertising the IPs then eventually you will stop getting the DOS traffic.

HumanOstrich 1y ago
> When you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. You think people hosting personal sites are going to even have the access to manage their IPs with BGP? It's not something I've seen offered at that scale / pricing.