6 ms·

Is it really this hard to fend off a DDOS? At the funding and staffing level Meetup is at, I find this a little hard to understand.

scurvy 13y ago
Not particularly. It just requires money, planning, and someone on staff who's old enough to remember the early 2000's when popular sites were routinely attacked. Seems like Meetup is lacking in at least one of those.
- ceejayoz 13y ago
  Popular sites are routinely attacked now too, with much larger attacks than any in the early 2000s.
  - scurvy 13y ago
    Thanks for making my point (even with all the -1's from the kids). Cue George Santayana quote.
ceejayoz 13y ago
CloudFlare recently posted about a 400 Gbps attack they saw. I can't imagine any reason Meetup would have that sort of bandwidth capacity lying around.
- scurvy 13y ago
  You don't need that kind of bandwidth capacity lying around if you plan ahead and work with DDoS mitigation services before you're attacked. It's akin to setting up an IDS/IPS before you get pwnt through sloppy PHP/MySQL injections.
  - ceejayoz 13y ago
    Pre-CloudFlare, those were expensive. I can't speak to the technical work needed to hook something like MeetUp with CloudFlare, but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now.
    - at-fates-hands 13y ago
      >> but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now. Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way? Of course knowing a lot of InfoSec guys, they can only tell them what they should have, it's up the owner's to make the call to get it in place. I don't know how many times one of them complained about doing a pen test on someone's site, making the recommendations and then one year later, they haven't fixed anything yet.
      - ceejayoz 13y ago
        > Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way? I'm not sure I'd classify being subject to DDOS as a security hole.
        dllthomas 13y ago
        It's a security hole, but not on their systems.
    - scurvy 13y ago
      Sounds like they should have hired a real ops guy instead of a devops hipster.
      - badman_ting 13y ago
        Thanks for posting!
  - stcredzero 13y ago
    plan ahead and work with DDoS mitigation services before you're attacked Where can I find more information about this? I've been thinking about exactly this issue with regards to running an MMO. Pretty much none of my functionality can be cached, so I don't think CloudFlare can help me. The best solution I've come up with is to run my MMO as a few servers on NFO, which hosts game servers and has a good reputation for "not just nullrouting you."
    - jgrahamc 13y ago
      Pretty much none of my functionality can be cached, so I don't think CloudFlare can help me. We have plenty of clients like that. They are using us for a variety of reasons, DDoS protection is one.
      - dllthomas 13y ago
        What does mitigation look like, in that kind of setup?
        sp332 13y ago
        The NTP attack is a simple example. No legitimate NTP traffic would be aimed at that site, so it can all be blocked at the firewall with no load on your servers. The problem with that attack was simply the bandwidth. Cloudflare's network helped to spread the load across many datacenters around the world.
      - stcredzero 13y ago
        We have plenty of clients like that. Curious: who is "we?"
    - scurvy 13y ago
      Game servers are tough with their latency requirements. Generic web traffic is much easier to mitigate with offsite services (Prolexic, Defense.net, Cloudflare, etc). If you're running game servers, your only good choice is to host with someone that has a really good onsite mitigation system. The offsite solutions add too much latency there.
- at-fates-hands 13y ago
  To be clear, it was one of CloudFlare's clients, it wasn't a DDOS on them directly: http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack http://blog.cloudflare.com/technical-details-behind-a-400gbp... "On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps." And yes, it did affect other parts of their network, but they were able to successfully mitigate it. "We saw attack traffic hitting every one of CloudFlare's data centers. While we were generally able to mitigate the attack, it was large enough that it caused network congestion in parts of Europe"

scurvy 13y ago

Not particularly. It just requires money, planning, and someone on staff who's old enough to remember the early 2000's when popular sites were routinely attacked. Seems like Meetup is lacking in at least one of those.

ceejayoz 13y ago
Popular sites are routinely attacked now too, with much larger attacks than any in the early 2000s.
- scurvy 13y ago
  Thanks for making my point (even with all the -1's from the kids). Cue George Santayana quote.

ceejayoz 13y ago

CloudFlare recently posted about a 400 Gbps attack they saw. I can't imagine any reason Meetup would have that sort of bandwidth capacity lying around.

scurvy 13y ago
You don't need that kind of bandwidth capacity lying around if you plan ahead and work with DDoS mitigation services before you're attacked. It's akin to setting up an IDS/IPS before you get pwnt through sloppy PHP/MySQL injections.
- ceejayoz 13y ago
  Pre-CloudFlare, those were expensive. I can't speak to the technical work needed to hook something like MeetUp with CloudFlare, but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now.
  - at-fates-hands 13y ago
    >> but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now. Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way? Of course knowing a lot of InfoSec guys, they can only tell them what they should have, it's up the owner's to make the call to get it in place. I don't know how many times one of them complained about doing a pen test on someone's site, making the recommendations and then one year later, they haven't fixed anything yet.
    - ceejayoz 13y ago
      > Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way? I'm not sure I'd classify being subject to DDOS as a security hole.
      - dllthomas 13y ago
        It's a security hole, but not on their systems.
  - scurvy 13y ago
    Sounds like they should have hired a real ops guy instead of a devops hipster.
    - badman_ting 13y ago
      Thanks for posting!
- stcredzero 13y ago
  plan ahead and work with DDoS mitigation services before you're attacked Where can I find more information about this? I've been thinking about exactly this issue with regards to running an MMO. Pretty much none of my functionality can be cached, so I don't think CloudFlare can help me. The best solution I've come up with is to run my MMO as a few servers on NFO, which hosts game servers and has a good reputation for "not just nullrouting you."
  - jgrahamc 13y ago
    Pretty much none of my functionality can be cached, so I don't think CloudFlare can help me. We have plenty of clients like that. They are using us for a variety of reasons, DDoS protection is one.
    - dllthomas 13y ago
      What does mitigation look like, in that kind of setup?
      - sp332 13y ago
        The NTP attack is a simple example. No legitimate NTP traffic would be aimed at that site, so it can all be blocked at the firewall with no load on your servers. The problem with that attack was simply the bandwidth. Cloudflare's network helped to spread the load across many datacenters around the world.
    - stcredzero 13y ago
      We have plenty of clients like that. Curious: who is "we?"
  - scurvy 13y ago
    Game servers are tough with their latency requirements. Generic web traffic is much easier to mitigate with offsite services (Prolexic, Defense.net, Cloudflare, etc). If you're running game servers, your only good choice is to host with someone that has a really good onsite mitigation system. The offsite solutions add too much latency there.
at-fates-hands 13y ago
To be clear, it was one of CloudFlare's clients, it wasn't a DDOS on them directly: http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack http://blog.cloudflare.com/technical-details-behind-a-400gbp... "On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps." And yes, it did affect other parts of their network, but they were able to successfully mitigate it. "We saw attack traffic hitting every one of CloudFlare's data centers. While we were generally able to mitigate the attack, it was large enough that it caused network congestion in parts of Europe"