9 ms·
A Note from one of Cloudflare's upstream providers
- meh02 14y agoYou mean Cloudflare spun some BS marketing to make this seem bigger and more interesting than it was? Color my shocked.
- malachismith 14y agoFantastic response. Thank you so much for writing and sharing. Cuts through all the spin and FUD effectively.
- e40 14y agoI never read the Gizmodo piece, because I think they're mostly trolls, but I really liked this response. Kudos to him.
- guelo 14y agoThe Gizmodo piece was better journalism than the nytimes or bbc articles which regurgitated Cloudfare's over the top PR uncritically.
- devindotcom 14y agoI disagree. Calling the story a straight-up lie was a mistake, and link bait to boot. I thought Biddle failed to understand what the risk to "The Internet" truly was, and how an attack like this (based on a known architecture vulnerability), if repeated or made more common or effective, could cripple a tier 1 provider and cause serious routing issues, among other things.
- lucb1e 14y agoBetter, but still a long way before it's factually correct.
- mtgx 14y agoNYTimes especially has been hyping up cyberattacks and cyberwarfare a lot lately.
- markisonfire 14y agoIn all fairness, the Gizmodo article was pretty well researched and informative. It was more like an anti-hype article - because that's what the headlines were. Interesting things did happen, but the internet was not "in danger" of being down.
- nullrouted 14y agoFor those of you who don't know Ras is one of the people that run/ran nlayer (now part of GTT) which is Cloudflare's primary provider.
- sargun 14y agoRAS has been pretty awesome in the community. He was actually the cofounder of the company we called nLayer. He's given a bunch of very valuable "101" talks at NANOG (think of this as the Hacker News for networking people), and until the acquisition, he was pretty active on the mailing list.
- dudus 14y agoIt amazes me how little I know about overral internet traffic infraestructures
- windexh8er 14y agoThat's why it's frustrating for those who have a network arch/eng background when we run across the sensationalized pieces. Or when all of the sec-only wonks make this out to be something to combat with a firewall, and put out pieces that never mention BGP, but are somehow helpful. End rant, but at least there's more of an awareness of good network folk with things related to this sort of story. Not that it's the ideal path, but still.
- niggler 14y agoWho is guilty of the sensationalized piece? My impression was that it was cloudflare itself.
- spinchange 14y agoThe New York Times and BBC took their account at face value and published it as fact.
- acomjean 14y agoI avoid most articles by John Markoff (nytimes) as he is prone to exaggerating, but he showed up on the radio talking about this story. It seems the way now that press releases can turn into articles.
- minimax 14y agoCloudflare can toot its own horn all day long. That's just marketing. If journalists take that marketing and reprint it without incorporating other sources then you have a "puff piece" rather than quality journalism. The onus is on the journalists to do a better job investigating.
- bigiain 14y ago
- morganwilde 14y agoMy first reaction to these kinds of news is fear. As someone who builds stuff for the web, I really hate the idea of some malicious being trying to purposefully ruin your work. My second reaction is that of "bring-it-on". Basically this is an impulse for improvement, and as with any major threat you either stand your ground or get run over.
- lsc 14y ago> This is definitely on the large end of the scale as far as DoS attacks go, but I wouldn't call it "record smashing" or "game changing" in any special way. It's just another large attack, maybe 10-15% larger than other similar ones we've seen inthe past Heh. Nice. Yeah, I expressed skepticism that 300G/sec qualified as "largest ever" - I mean, I personally have been hit by 10G+ attacks, and Cogent mostly shrugged. (I mean, my cogent side was down until the target was blackholed at the cogent border.) I know 10 gigabits is a lot less than 300 gigabits, but I am a nobody compared to the people involved in this little kerfuffle.)
- duaneb 14y agoI thought that it was the largest ever, but it wasn't larger enough to really be notable, just sort of the natural progression of internet traffic.
- knighthacker 14y agoExactly. The author already said "10-15% larger than other similar ones we've seen inthe past". Doesn't that make a record-changing by definition? :)
- mbell 14y agoRecord changing from a scientific definition? Yep. But, when the relatively non-technical populous hears 'record changing' a completely different set of emotions are triggered in their brains. Its just like any other overly grandios marketing headline, designed to excite those whom aren't familiar with the topic.
- lsc 14y agowell, what I got from the article was that the person was saying "We aren't the whole internet, this is larger than what we normally see, but not by a huge margin." - which is to say, it's possible that other providers have seen larger DDoS attacks.
- icambron 14y ago
- polarix 14y agoWhat if this had been Akamai and not Cloudflare? Would we even hear about it? Why is Cloudflare in the news regularly and never Akamai? Do they just like drama? Is that good or bad for their business?
- kyrra 14y agoCloudflare uses it as advertising. "Look at this attack we mitigated for our client!", which then gets picked up by HN and similar sites because Cloudflare does write fairly good blog posts about it. As others have said, Cloudflare does a fairly good job explaining parts of the internet that most of us don't get to see, so it gets attention.
- youngtaff 14y agoIt gets picked up by HN as CloudFlare post it to HN themselves. That said they're interesting articles if you ignore the hype.
- drakaal 14y agoMore like they invent drama to cover their bad days. Akamai tells its clients when they are under DDoS, Akamai didn't really notice anything going on. CF just had a bad day and decided to make a story out of it. One other time when CF claimed a DDoS it was because the Google Bot Decided to up it's crawl rate, and took down many CF sites. CF told clients it was DDoS and then later admitted it was an issue with Google.
- kaolinite 14y agoDefinitely good for their business that many people think it was a groundbreaking attack and CloudFlare stood strong against it.
- trotsky 14y agoAs an observation, the same day the new york times story ran sharespost announced that they had just added cloudfare to their secondary market platform. This typically means that an insider such as a founder or early investor plans to auction some of their shares. They can't put that in the media story as that breaks SEC rules, but positive press is very likely to drive up share pricing.
- zobzu 14y agoThat was a very nicely worded response that echos what, I hope/believe, most of us think. Plus; that was in ASCII. Damn. :)
- tiedemann 14y agoWord. Respects given to serving in text/plain (as is proper in this context).
- edmond_dantes 14y agoUber respect if the file had gzip content-encoding.
- lucb1e 14y agoOr if the output was gzip without encoding header. The FBI will be all over your place the next day with a warrant for the encryption key :D
- lelandbatey 14y agoAs someone who's fallen in love with writing absolutely everything in straight plain-text, seeing this brought a warmth feeling to my heart : )
- stevewilhelm 14y agoThis incident drives home the fact that there is no one entity responsible for "The Internet." It is run by a network of for-profit companies, governments, and non-profit public and private standards bodies.
- smackfu 14y ago>The next part is where things got interesting, and is the part that nobody outside of extremely technical circles has actually bothered to try and understand yet. Isn't this talked about in CloudFare's write-up?
- mpchlets 14y agoNice response, nice sentiment, nice format. I often dislike the sensationalism surrounding attacks or viruses - it makes people distrust and gives others excuses for issues.
- finnh 14y ago> But, having a bad day on the Internet is nothing new. That's my new quote of the year.
- eastdakota 14y agoThis is a great writeup and aligns with what we saw at CloudFlare. The most interesting part of the attack was that the attackers went after the IXs.
- eastdakota 14y agoPS - This was written by nLayer/GTT's CEO, one of CloudFlare's bandwidth providers. They have been a terrific partner and were extremely helpful as we mitigated this attack.
- spiantino 14y agoWould you mind explaining this piece of the story in a little more detail? "When the attackers stumbled upon this, probably by accident, it resulted in a lot of bogus traffic being injected into the IXP fabrics in an unusual way, until the IXP operators were able to work with everyone to make certain the IXP IP blocks weren't being globally re-advertised." It's pretty fascinating and I think most of the HN audience, myself included, would be able to understand the actual technical detail.
- rasatnlayer 14y agoUpdated with a few more details for you (but still trying to keep it in laymen's terms for those who don't do advanced networking). I wasn't really expecting this thing to take off or get linked anywhere, it was just a dump of the e-mail I sent this morning so I could link it to Facebook. :)
- darkarmani 14y agoThanks for the very informative write up! I have to smile when people are praising you for the plaintext writeup whose purpose was to link from facebook. It's like saying you finally got your house fully off-grid using your hand made windmill that generates power so you can watch the Kardashians. ;)
- Paige 14y agoRichard you can hit me with your cluepon any day.
- drakaal 14y agoStraight up Lie. Talking with Google Engineers, and Amazon Engineers they say this is not happening. So unless someone picked a fight with CF, it is more likely CF is just having a bad day.
- barkingcat 14y agoI think this just reminds everyone that as large as google, facebook, etc seem to be, they are just a small part of this huge global network we humans have created. As large as Google, Facebook, Amazon, etc is on the web, the major telcos have to be even larger (in terms of network size, capacity, amount of fibre, switches, datacentres) in order to carry the traffic.
- EricBurnett 14y agoThat's only true to a point. In addition to the consumer-directed packets, large volumes of traffic for Google and Amazon never leave their networks. Shuttling data between datacenters for Google; moving data within the many cloud services of Amazon; or transferring between the two companies (e.g. GCS to S3). This means it's no longer a given that telcos must be larger. The closer we get to living "in the cloud", the more our traffic can be seen as a window into operations taking place within and between cloud services.
- donavanm 14y agoRelated, http://cloudscare.com http://cloudscare.com