8 ms·
Some great language there: framing it as an attack by criminals (gains sympathy from users), explains in plain-terms what a DDOS is (front door analogy), emphas
by swanson 13y ago
Some great language there: framing it as an attack by criminals (gains sympathy from users), explains in plain-terms what a DDOS is (front door analogy), emphasizes (twice!) that user data is safe, apologizes for the likely downtime, informs people where to get updates.
Probably worth bookmarking this for when you [hopefully never] have to deal with this same situation.
- deleted 13y ago[deleted]
- geetee 13y agoExplain please.
- valarauca1 13y agoThe problem he may have is its a bit to reassuring. They claim user data is safe while being under attack. This is conceptually very similar to teaching kids that if you duck and cover during an ICBM strike you'll be fine. >This is like a bunch of people blocking the front door and not letting you into your house. The contents of your house are safe -- you just can’t get in until they get out of the way. If this is truly 110% true, they couldn't even ssh into their servers (in before, "You don't ssh each into individual shards"). Which I'm betting they can, which means their are still attack vectors to exploit.
- kevinchen 13y agoNot sure that your missile analogy holds. Most DDoS attacks do not attempt to crack logins to servers, but rather try to flood the servers with as much garbage as possible. Besides, even if they were trying to crack the SSH password, a properly secured server (long passwords/public key auth + fail2ban) should be fine.
- valarauca1 13y agoOkay here is a better one. Just because people are blocking each other trying to run into your front door doesn't mean they (or somebody else) aren't cutting open your windows, picking the lock on your garage door, or trying to climb down your chimney.
- deleted 13y ago[deleted]
- samplonius 13y agoYes you do. Because DDoS, so like the service is down for users and attackers. I'm surprised that on a technical forum there is still this complete misconception of what a DoS is.
- valarauca1 13y agoThere are different types of DDoS attacks. Each level of the OSI model can be attacked in a DDoS, and its still of Denial of Service attack. I.E.: You can hold down a pre-2009 windows server with as little as 10-15 packets per second, totally less then a kilobyte per second. Yes if your have a 10/100/1000 nic and your getting 20Gb/s then yeah nothing's getting in. Or if you have a 10Gb/s router, then 20Gb/s will freeze the whole data center. But if you have a 100Gb/s router with a 4x bounded 10Gb/s nics. And your service is down, then it isn't your hardware, but your software. Your kernel, sockets.h, are still processing packets, you can still be attacked.
- wakaflaka 13y agoyes, quite strokes neckbeard
- jebus989 13y agoThey use "criminals" 5 times in that short statement. IMO the overuse of emotive language is unnecessary and belies the emotional state of the author. Stay professional and detached—it's a DDoS, I've no doubt it's frustrating but they happen. I prefer Github's recent response [0], clear and helpful but without the rhetoric. [0] https://github.com/blog/1796-denial-of-service-attacks https://github.com/blog/1796-denial-of-service-attacks
- shaneofalltrad 13y agoPersonally I would rather them show some emotion, as it shares their frustration and anger at these idiots. Also, "criminals" reiterates to the attackers and potential copy-cats, this really is a criminal act and you can be punished.
- mikeryan 13y agoGithub's response would be a whole lot of technical, unhelpful nonsense for most basecamp users. There's certainly a bit of knowing your audience here.
- Karunamon 13y agoRhetoric? You've got people who just attempted to blackmail you and then take your service offline when you refuse. The descriptive term "criminal", i.e. one who breaks laws, is perfectly valid IMO.
- belorn 13y agoWhile I agree, the term blackmailer or extortionist would had been better.
- mhurron 13y agoWhich are just specific types of criminals. I don't see the problem.
- pessimizer 13y ago
- jeremymcanally 13y agoYup, they're doing a great job in couching it in language that their customers can understand regardless of technical background. It's easy to forget that services like Basecamp service a huge swath of people who wouldn't necessarily understand what's going on without that sort of copy massage.
- forgottenpass 13y agoSome great language there It is. Only 4 words into the DDoS announcement and I rolled my eyes. I think that's a record for DHH.
- sosborn 13y agoSounds like your issue is with DHH and not necessarily the copy.
- forgottenpass 13y agoTotes true. His selection of words is in one of the bombastic veins that rubs me the wrong way. It goes beyond just one piece of writing, that does make my issue with the writer.
- deleted 13y ago[deleted]
- kristiandupont 13y ago>"His selection of words is in one of the bombastic veins" I am not completely sure what this even means, but I am sure there is irony in there!
- kd5bjo 13y agoI agree, though blackmail seems inaccurate. I've always understood blackmail to be a demand backed by a threat to reveal secret information[1]; this sounds more like an extortion racket[2]. [1] http://en.wikipedia.org/wiki/Blackmail#United_States http://en.wikipedia.org/wiki/Blackmail#United_States [2] http://en.wikipedia.org/wiki/Extortion_racket http://en.wikipedia.org/wiki/Extortion_racket
- bduerst 13y agoIt is extortion, not blackmail. While blackmail is a form of extortion, it's as you say - threats to reveal potentially damaging information.
- yogo 13y agoYea, extortion seems more apt here. It's like a square and rectangle. All blackmail involves extortion, but not all extortion is blackmail.
- deleted 13y ago[deleted]
- pdeuchler 13y agoI'm going to play devil's advocate and completely disagree with you here :) Customers, especially non-technical ones, don't give a crap. What they want to know is when the service will be back up, and what steps you're taking to prevent it happening in the future, although I'm sure a certain percentage would be interested in why this is happening in the first place (not as in the technical breakdown, but why you didn't have a contingency plan). If I'm a customer of Basecamp it looks to me like 37Signals is couching this as if they are the victims here, when really I am the victim. They're business isn't being disrupted... mine is! I pay them to abstract me away from the gory details... if I wanted to deal with that stuff I'd pay people to build it in house. My job as a customer isn't to sympathize with an outage, it's to move to a service that won't have one. After turning in a term paper a day late a wise professor once told me "It doesn't matter if your excuse is true, it's still an excuse." The basic facts are the job didn't get done, and the person to blame is the person who didn't get the job done. Any modern web service that doesn't take the simple effort to sign up for cloudflare or their ilk to reduce attack surface doesn't deserve my money. (Admittedly a harsh perspective to take, but one many do take)
- jagath 13y agoDisagree. Understanding the root cause helps even non-technical customers make the right decision. For example - "If I move to a different service (competitor of Basecamp), is there a chance that I will run into this issue there too? Answer is yes, based on how DHH explained the problem." Customers understand that shit happens. Particularly because many Basecamp users are business owners and can relate to shit happening in their business too. Explaining the root cause in plain language, and emphasizing that the user data is safe is a great way to deal with this situation.
- rgbrenner 13y agoNot sure why you got voted down (hopefully my vote will put it back at 1). I think it's a legitimate point of view. I can certainly imagine some company out there mad at 37signals because they can't get work done because of the attack, wasting thousands of dollars of labor.
- davidw 13y ago
- elwell 13y agoActually, I see the word 'attack' as an emotional trigger and maybe not ideal. I much preferred their analogy that assures non-technical users (on github???) and makes sense: > This is like a bunch of people blocking the front door and not letting you into your house. The contents of your house are safe -- you just can’t get in until they get out of the way.
- are_we_sure_yet 13y agoAre we sure it is actually a DDOS? I mean, this is a Rails app - it might just be more than three users hitting it at the same time, and it cannot cope with the load?
- teemo_cute 13y agoI agree that DHH is such a great writer. He used the metaphor of a people blocking down your house so that non-technical users can easily understand what he's saying.