6 ms·
Reddit is currently experiencing a malicious DDoS attack
- Achshar 13y agoCould this have something to do with reddit's co founder speaking against CISPA and calling out major tech companies? [1] Considering reddit played a big role in killing SOPA, CISPA backers feel threatened? [1] - https://news.ycombinator.com/item?id=5570670 https://news.ycombinator.com/item?id=5570670
- socillion 13y agoI think it's far more likely that someone decided to mess with the party all the Boston observers are having on Reddit. It's all idle speculation, though.
- Achshar 13y agoYes, reddit was up for a bit and I saw two (edit: now four) huge threads with 10k+ comments and live updates from the shoot out in Boston. So maybe they are indeed messing with the Boston live event updates thing on reddit. DDOSing reddit is no small feat, unless you have a botnet at your disposal. Should be more than just some "fun".
- mh- 13y agoI don't have data to back me up other than an anecdotal 'I seem to notice', but doesn't reddit often become unusable during exceptional usage spikes? the Obama AMA comes to mind. if you look at their numbers[1] for 2012, it's plausible that they are simply overwhelmed during these bursts and they've judged it worthwhile to let these aberrations play out. for many operations.. moving your availability from, say, 99.9% to 99.99% is simply not worth the cost. uptime is hard; GitHub has only maintained 99.96% for the past month[2][3] (and, IMO, they're actively trying to improve it) [1]: http://blog.reddit.com/2012/12/top-posts-of-year-and-best-of-2012.html http://blog.reddit.com/2012/12/top-posts-of-year-and-best-of... [2]: https://status.github.com/graphs/past_month https://status.github.com/graphs/past_month [3]: http://cl.ly/image/0O2S0L3O0l3J http://cl.ly/image/0O2S0L3O0l3J edit: clean up links edit2: learning \n
- Achshar 13y agoBut reddit confirmed it's malicious, so the idea that reddit DDOSed itself is out of the question.
- dmarti21 13y agoI would think it is a malicious attack in response to Reddit incorrectly identifying and popularizing the idea that Sunil Tripathi was one of the Boston Marathon bombers.
- alienth 13y agoWe're mostly recovered, at this time.
- sk3tch 13y agoHow certain are you guys that it wasn't the sheer levels of traffic due to the ongoing Boston situation?
- alienth 13y agoCertain beyond any shadow of doubt.
- jordn 13y agoWhat are the indicators that this is a malicious DDoS attack rather than just unprecedented traffic from interest in the Boston manhunt? Also, what reason is there for a DDoS attack on Reddit right now?
- Sayter 13y agohttps://news.ycombinator.com/item?id=5570670 https://news.ycombinator.com/item?id=5570670
- alienth 13y agoThey're slamming over 20x our normal bandwidth with URL containing things such as "boston", "your_gay", etc.
- salimmadjd 13y agoMaybe government doesn't want redditers countering their official narrative regarding the suspects
- windsurfer 13y agoSeems like you're still down...
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- stcredzero 13y agoFark is down too, 4:21 am Pacific time.
- wjamesg 13y agoI was on Reddit until 2am (EST) with no issues. Back on at 6:45am with no problem. Either they've been doing a wonderful job with mitigation, or I'm missing something (I suppose I did miss a few hours while sleeping...). If anything I figured they're getting hammered with EST sunrise/Boston incident traffic...but a simultaneous malicious DDoS attack "beyond any shadow of doubt"? Wow
- deleted 13y ago[deleted]
- throwaway1979 13y agoIs there a defense against DDoS attacks? CloudFlare? Incapsula? Does anyone have experience with how well these solutions work?
- the1 13y agoyah, put a swarm of raspberry pi attack reflectors in front.
- buro9 13y agoIn ultra-simple terms you need to have a network capacity greater than the attacker and to identify the attack requests and discard them whilst still honouring valid requests. That is basically what CloudFlare is. Add in things like caches to prevent even valid requests from getting to the backend (so you've now added a CDN), and many peers to your network so that an attacker cannot saturate one or two peers... and you've got the essence of CloudFlare (sans features like optimising content for speedy delivery). Ultimately the best defence to a DDoS is to be able to soak up the attack before it hits the backend, and to have enough spare capacity to keep serving regular traffic. You can cache and distribute everything save for the valid requests to a dynamic resource (but even those you can optimise). So the whole game from a defensive point of view is to let nothing but valid dynamic requests through to the backend. The attacker's side of a DDoS is about acquiring network capacity greater than your network capacity, identifying your weaker points (in an attempt to cause a domino effect, if they can take out a weaker peer then a stronger peer will need to do more work and itself becomes weaker). And then sending what appear to be valid requests without triggering an attack on themselves (having a 150 byte request respond with 100KB would wipe out the attackers). Bonus points for constructing requests that can get through to the dynamic resources on the site being attacked (as those are the weakest link).
- josteink 13y agoAs opposed to a non-malicious DDOS attack? Sorry about the snarky remark, but the headline does feel a tad redundant.
- duiker101 13y agoNon-malicious DDOS attacks might be considered those where the traffic is genuine, like a normal website reaching the frontpage of reddit or hn.
- manojlds 13y agoBy definition, DDOS, are malicious no? Otherwise, the site is just having high traffic that it cannot handle. If my blog goes down after being on the front page of HN, is that a DDOS?
- garethadams 13y agoI think it's more the term "attack" that indicates maliciousness. Getting Slashdotted or Hacker Newsed is definitely a distributed denial of service, but it's not so much an attack
- atc 13y agoIt's therefore NOT a DDoS if the traffic is from legitimate sources. DDoS is by definition malignant.
- criley 13y agoI don't think it's appropriate to use the DDoS acronym when not referring to an "attack". It's non-standard and will only create confusion. Every "source" online describing a DDoS uses it explicitly to refer to an attack.
- umsm 13y agoBy definition: "[DDos] is an attempt to make a machine or network resource unavailable to its intended users.". When I see "DDoS" I always thought it was malicious...
- officemonkey 13y agoBatten down the hatches, pg, here comes the redditors.
- radge 13y agoI hope this is a retaliation for the abhorrent behaviour of reddit users in blind smearing of innocent individuals in an attempt to prove the worth of social media/the internet/their "community". Information is dangerous when it is placed in the hands of these clowns and reddit needs to address their problems quickly before they ruin more lives. http://www.newstatesman.com/world-affairs/2013/04/reddit-boston-and-missing-student http://www.newstatesman.com/world-affairs/2013/04/reddit-bos...
- krcz 13y agoActually posts containing speculations about Sunil (missing student) were instantaneously deleted (as groundless and potentially harmful) , at least before name appeared on police scanner, at least on r/findbostonbombers. Info was spread somewhere else, because new people constantly were creating ones.
- GHFigs 13y agobefore name appeared on police scanner Is there a recording of this? Because it sounds a lot like it never happened.
- pmorici 13y agoIt didn't the student's name was mentioned by a friend of his on Twitter who after looking at the photos released by police said that they thought there was a resemblance between the suspect in the white hat and her friend who had been missing for a month after dropping out of school and becoming depressed. There were several articles about the individual already on the web predating the bombing because the FBI had been contacted by the guy's family to help find him. The name mentioned on Police scanners was a different person also incorrect.
- danso 13y agoNo, this happened. A purported classmate of Sunil's had tweeted about the resemblance to Suspect #2 about 14 hours ago: > @christiiinaaaxo @jaredleesmith @thejman218 Looks just like a kid from my area that went missing exactly a month and has yet to be found. > I mean maybe it's a total coincidence but I'm more than a little freaked out by the resemblance. #Boston pic.twitter.com/Qsd6rj5v5l At some point, the Internet ran with her speculation: > It makes me sad that people are going to the Tripathi family Facebook page and writing nasty things. That was never my intention And at around 4-5 am, the Boston police scanners said they were looking for Sunil. I remember this because I fell asleep at 5am thinking that this bizarre story involved Sunil and then woke up at 8 learning that two completely different suspects had been identified. From the twitterer: > So if what I'm hearing is correct, at 3 AM when the police scanners said they had their suspect and it was Sunil, I was wrong. The tweeter's account is now protected but she hasn't deleted her tweets. I think everyone, including her, has learned a little about making well-intentioned speculation on the Internet. But apparently, even the Boston police had been fooled (at least someone in the BPD was, which is why police scanners should not be taken as gospel)
- foob 13y agoReddit also got hammered pretty hard by legitimate traffic last night. There were many thousands of people in the Boston live update threads hitting refresh over and over all night. The admins actually locked the first update page because they said that so much traffic on an article with so many comments would crash the site. If there's a malicious DDOS attack then this surge in legitimate traffic likely compounded the problem. The update threads: [1] http://www.reddit.com/r/news/comments/1co395/live_updates_of_boston_situation_part_2/?sort=new http://www.reddit.com/r/news/comments/1co395/live_updates_of... [2] http://www.reddit.com/r/news/comments/1cnwms/mods_removed_thread_live_updates_of_boston/ http://www.reddit.com/r/news/comments/1cnwms/mods_removed_th... Where the updates moved when reddit went down: [3] https://twitter.com/JpDeathBlade https://twitter.com/JpDeathBlade
- alienth 13y agoThe traffic surge from the Boston incident is extremely marginal compared to the DDoS which we're facing right now. It is far and above any form of possibly being compounded, unfortunately. But I wish it was :) Compounding I can deal with, astronomical is harder.
- raulonkar 13y agowhat is impact of this "DDOS" attack on reddit?
- k__ 13y agohopefully that reddit is over and all reddit-users can leave the internet now ;)
- bjhoops1 13y agoI wonder if it would be possible to generate a DDoS attack by reporting that a site is experiencing a DDoS, causing people to flock to the site to see if it is down.
- nickpinkston 13y agoTotal speculation, but: perhaps the police / FBI would DDoS Reddit to prevent the suspect from gaining intel on their operations? The Reddit live stream was all over Twitter...
- swayvil 13y agoThe chinese are trying to censor reddit because of that article about china censoring the term "censorship".