5 ms·
General practice in the industry is not to discuss the details of attacks publicly. As much as it sucks, the rule of thumb is that you need every advantage you
by xb95 14y ago
General practice in the industry is not to discuss the details of attacks publicly.
As much as it sucks, the rule of thumb is that you need every advantage you can get when it comes to being attacked. You gain little by talking about these kinds of things publicly and stand to lose much (by giving away how you're mitigating the problem, for example, possibly leading the attackers to adjust their attack). It's just generally safer not to.
If you are someone who runs a web site, once you hit a certain size where you have to worry about DDoS attacks you will certainly have the kind of industry connections where you can talk about the issue privately and get help and/or help someone. Below a certain size you just don't generally have to worry about it -- and if you do get attacked, the response will mostly be done by your provider as there's not usually a lot you can do if you're just a few servers.
- dpweb 14y agoThe industry should reconsider. Not saying one should disclose ones counter-measures, but if the standard practice of keeping secrets amongst industry connected VIPs is the wise choice it's not working very well.
- xb95 14y agoIf someone is connected then they can just talk to their connections and get the information and help they need. I'm just saying it's not good to post these postmortems publicly. "We got hit by X. We did Y." Now when Q comes along to attack you, they know what not to do and also know how you mitigated X so they can more efficiently attack you. The EV from posting attack postmortems is just not there.
- anoncow 14y agoif you post the Ys publicly, eventually you will cover most of the possible attack cases and DDOSing anyone may not be worth it anymore.
- btilly 14y agoThe problem is that it is asymmetric with the advantage to the attacker since in general they are stealing the computing resources that they use, while the website actually has to pay for its side of those same resources.
- anoncow 14y agoif you post the Ys publicly, eventually you will cover most of the possible attack cases and DDOSing anyone may not be worth it anymore.
- brokentone 14y agoHow is it not working very well?
- phillmv 14y ago> the rule of thumb is that you need every advantage you can get when it comes to being attacked. Nah. Well, at least people shouldn't feel that way; publishing your solutions helps us all. I just don't think that someone sitting on gigabits and gigabits of zombie throughput needs any help figuring how to hose you down.
- lucb1e 14y agoAnyone can rent botnets; no technical skills required.
- chimi 14y agoThis sounds a lot like Security through Obscurity to me. Why does it work with DDOS, but not source code?
- lmkg 14y agoSecurity through Obscurity is actually a valid tactic, in most arenas. It can't be relied upon in isolation, which is what many people tried to do. If you already have a robust defense system, it adds an additional layer. Additionally, there are different trade-offs for DDOS vs source code. Source code you leave behind obscurity, in order to get a well-tested and well-vetted implementation. In DDOS, you're using ops, not code. All your responses are custom-crafted anyways, so there is no well-tested implementation for you to gain. The benefits of transparency are much smaller, and the benefit is the same.
- Hello71 14y agoJust in case anyone else was confused: The cost is the same.
- anoncow 14y agoIt doesn't. The only thing it does is help the attackers prey on another unsuspecting website. Open business practices anyone?
- taproot 14y agoLow hanging fruit principle.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- tlogan 14y agoYes agree but this is * * Hacker * * News.
- bslatkin 14y agoI couldn't agree more.
- mich41 14y agoPublishing detailed information about the attack itself doesn't give attackers any knowledge they don't already have.
- jtheory 14y agoWell, it doesn't give the original attackers any knowledge they don't already have. Any other malicious parties might find it useful.