6 ms·

That’s like saying you should buy car insurance after you wreck your car

by dymk 11mo ago

unethical_ban 11mo ago
That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?
- jimmydorry 11mo ago
  Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.
  - bmicraft 11mo ago
    > If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.
variadix 11mo ago
Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare. This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.
thfuran 11mo ago
But you can just download a new car.
hypeatei 11mo ago
Unless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.
shortrounddev2 11mo ago
No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances
- c22 11mo ago
  It's more like buying the plug-in version after the battery dies... You already experienced the downtime, so if not having downtime was a goal you already failed. If avoiding downtime is not important then there's no reason to add anti-downtime capability to your system. The most charitable modeling of this approach is that the downtime incident may prompt one to realize that avoiding downtime actually is an important property for their system to possess.
  - Dylan16807 11mo ago
    The actual charitable model is that you expect close to zero attacks, but if you actually get hit your expected rate of future attacks goes up by an order of magnitude or two. And it's that change in expectations that gets you to buy protection. You don't care about going down once, you do care about frequent outages. And you know this from the start, you don't realize it later.
    - c22 11mo ago
      I'm not so sure. The risk of future attacks hasn't actually increased, your initial risk assessment was just incorrect.
      - Dylan16807 11mo ago
        Yes, the original assessment was wrong. Such things happen all the time to reasonable people. The person you were describing in your "most charitable" version above was not being reasonable. They didn't just underestimate the petty anger of the internet, they were being fundamentally foolish about their own desires. That's why I replied, to show you a different way someone could end up in this position.
alwa 11mo ago
How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?
- Johnny555 11mo ago
  That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.
  - nmz 11mo ago
    Not if you live in a desert, which most blogs do.
    - Johnny555 11mo ago
      That continues the analogy -- it doesn't rain often in the desert, but almost all deserts receive rain. And since it rains so rarely, you're certainly not going to find an umbrella during the rainstorm. So again, if staying dry in the rain is important to you, buy an umbrella before the rain, if you don't care about getting wet from time to time, then no need for the umbrella. While the personal blog owner may not care about DDoS related downtime, he may face extra usage charges due to higher bandwidth, CPU usage, etc that he'd like to avoid.
      - nmz 11mo ago
        The people you see in a desert with umbrellas are not using it for the rain, but for shade, the rain is the least of their problems.
        Johnny555 11mo ago
        Even in a desert, people still use umbrellas for protection from the rain: https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-brings-rain-across-the-valley/ https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-b... And the rain still causes problems, even (or maybe especially in) a desert: https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain-after-city-punished-by-floods/ https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain...
phyzome 11mo ago
My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked. It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.
- Johnny555 11mo ago
  I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.
  - bmicraft 11mo ago
    If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.
  - integralid 11mo ago
    >or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS Why? with cloudflare it's very easy, just put your site behind a reverse proxy, change the dns and disable direct access. Am I missing something?
deleted 11mo ago
[deleted]
grayhatter 11mo ago
Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured. Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.
iso1631 11mo ago
It's like saying you should buy volcano insurance after you get hit by a volcano
OkayPhysicist 11mo ago
Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.

That’s like saying you should buy car insurance after you wreck your car

by dymk 11mo ago

That’s like saying you should buy car insurance after you wreck your car

That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident. Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?

jimmydorry 11mo ago
Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.
- bmicraft 11mo ago
  > If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.

variadix 11mo ago

Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare. This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.

thfuran 11mo ago

But you can just download a new car.

hypeatei 11mo ago

Unless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.

shortrounddev2 11mo ago

No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances

c22 11mo ago
It's more like buying the plug-in version after the battery dies... You already experienced the downtime, so if not having downtime was a goal you already failed. If avoiding downtime is not important then there's no reason to add anti-downtime capability to your system. The most charitable modeling of this approach is that the downtime incident may prompt one to realize that avoiding downtime actually is an important property for their system to possess.
- Dylan16807 11mo ago
  The actual charitable model is that you expect close to zero attacks, but if you actually get hit your expected rate of future attacks goes up by an order of magnitude or two. And it's that change in expectations that gets you to buy protection. You don't care about going down once, you do care about frequent outages. And you know this from the start, you don't realize it later.
  - c22 11mo ago
    I'm not so sure. The risk of future attacks hasn't actually increased, your initial risk assessment was just incorrect.
    - Dylan16807 11mo ago
      Yes, the original assessment was wrong. Such things happen all the time to reasonable people. The person you were describing in your "most charitable" version above was not being reasonable. They didn't just underestimate the petty anger of the internet, they were being fundamentally foolish about their own desires. That's why I replied, to show you a different way someone could end up in this position.

alwa 11mo ago

How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?

Johnny555 11mo ago
That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.
- nmz 11mo ago
  Not if you live in a desert, which most blogs do.
  - Johnny555 11mo ago
    That continues the analogy -- it doesn't rain often in the desert, but almost all deserts receive rain. And since it rains so rarely, you're certainly not going to find an umbrella during the rainstorm. So again, if staying dry in the rain is important to you, buy an umbrella before the rain, if you don't care about getting wet from time to time, then no need for the umbrella. While the personal blog owner may not care about DDoS related downtime, he may face extra usage charges due to higher bandwidth, CPU usage, etc that he'd like to avoid.
    - nmz 11mo ago
      The people you see in a desert with umbrellas are not using it for the rain, but for shade, the rain is the least of their problems.
      - Johnny555 11mo ago
        Even in a desert, people still use umbrellas for protection from the rain: https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-brings-rain-across-the-valley/ https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-b... And the rain still causes problems, even (or maybe especially in) a desert: https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain-after-city-punished-by-floods/ https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain...

phyzome 11mo ago

My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked. It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.

Johnny555 11mo ago
I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.
- bmicraft 11mo ago
  If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.
- integralid 11mo ago
  >or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS Why? with cloudflare it's very easy, just put your site behind a reverse proxy, change the dns and disable direct access. Am I missing something?

deleted 11mo ago

[deleted]

grayhatter 11mo ago

Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured. Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.

iso1631 11mo ago

It's like saying you should buy volcano insurance after you get hit by a volcano

OkayPhysicist 11mo ago

Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.