3 ms·

I gotta say I'm finding it hard to accept their word that they're responsible for Facebook. I haven't paid much attention but I'm under the impression that they

by eridius 12y ago

I gotta say I'm finding it hard to accept their word that they're responsible for Facebook. I haven't paid much attention but I'm under the impression that they primarily just deal in DDoS's and other crude attacks, and I have a hard time imagining that they could cause a large enough DDoS to affect the massive juggernaut that is Facebook. Especially since Facebook just came back up and is now perfectly responsive and showing no signs of being under strain.

thrownaway2424 12y ago
Yeah, it doesn't seem like a DoS since facebook was reachable and serving error pages, and instagram was reachable and serving blank pages. It _does_ seem like an intrusion or other security incident though because I'd be surprised to learn that instagram shares lots of critical infrastructure with facebook. It seems more likely that someone hit the panic button for both sites.
- kevan 12y ago
  I wasn't even getting DNS resolution for any of the affected sites.
- eridius 12y ago
  Some sort of security incidence does seem more plausible than a DDoS, although I can't think of what would affect Facebook, Instagram, Tinder, Hipchat, and AIM simultaneously. I'm also having a hard time imagining what sort of security incident would result in Facebook deliberately shutting down their web presence, even for a few minutes. And all of the other potential attacks, such as DNS or CDN, seems like it a) wouldn't affect everyone simultaneously, and b) wouldn't even work because sites like Facebook don't have a single point of failure, there's always backups and backups for the backups.
  - hrrsn 12y ago
    Tinder uses Facebook's API heavily. It's not surprising it went down with Facebook
  - seanmofo 12y ago
    Instagram runs within the Facebook data centers. They had some challenging scaling issues within Amazon Web Services and moved their code base to Facebook's infrastructure.
blazespin 12y ago
Simple Bayesian analysis says it is them as they do not have a record of lying. Why would they? There is nothing to gain and everything to lose.
- eridius 12y ago
  Nothing to gain? Taking down Facebook seems like something that would bolster their rep significantly. If they think they can claim credit for it and get away with it, then there seems to be little reason why they wouldn't. I guess we'll just have to wait and see if Facebook makes any public statements as to what the cause of the outage was.
  - peteretep 12y ago
    > seems like something that would bolster their rep > significantly And then irretrievably kill it if they were shown to be lying.
    - akerl_ 12y ago
      Except that proving they didn't do it turns out to be much harder, because any amount of contrary announcement or evidence can be handwaved away as lies and misdirection. It's roughly akin to trying to talk to conspiracy theorists about 9/11.
- flexie 12y ago
  How does simple Bayesian analysis suggest that? :-)
  - nkozyra 12y ago
    It might, but with horrific confidence. Someone just felt like saying Bayesian analysis.
raverbashing 12y ago
Yeah, normal access patterns to FB are already pretty much as big as a DDOS on a regular website
- bostik 12y ago
  For their service infrastructure, certainly. Napkin math suggest that they have to sustain peak floods in the ballpark of 500M concurrent clients. Give or take 100M. However, if you could cripple DNS propagation/resolution from their systems to the next-hop upstreams, it would show up as services being very slow to respond. They do serve content from multiple domains. I'd be interested to know how Google's 8.8.8.8 infrastructure defends them from DNS level manipulation...
peteretep 12y ago
> they could cause a large enough DDoS to affect the > massive juggernaut that is Facebook You don't need to send Facebook more traffic than it normally gets, you simply need to nail a pain point, and cause an unusual traffic event. There's (I assume) no chance that it's been done using Slow Loris, but that's a good example of doing something unusual to deplete a resource in an unusual way. I would tend to agree that it's unlikely Facebook have simply been flooded off the internet, but there are many other ways to perform much more targeted DDoS attacks, and presumably Facebook haven't mitigated against _all_ of them.
- eridius 12y ago
  Good point. Although I'd say that any such attack like that is still unlikely to cause the entire site to become instantly unresponsive (or to serve static error pages as other people have suggested; personally, I just never got the site to load). And similarly, it would not be expected to come back to normal operating behavior a few minutes later. So yes, I'll grant you that you can DDoS even large sites without needing pure brute traffic, but it still doesn't seem particularly likely here.
sroerick 12y ago
Um, snowstorm?

by eridius 12y ago

thrownaway2424 12y ago

Yeah, it doesn't seem like a DoS since facebook was reachable and serving error pages, and instagram was reachable and serving blank pages. It _does_ seem like an intrusion or other security incident though because I'd be surprised to learn that instagram shares lots of critical infrastructure with facebook. It seems more likely that someone hit the panic button for both sites.

kevan 12y ago
I wasn't even getting DNS resolution for any of the affected sites.
eridius 12y ago
Some sort of security incidence does seem more plausible than a DDoS, although I can't think of what would affect Facebook, Instagram, Tinder, Hipchat, and AIM simultaneously. I'm also having a hard time imagining what sort of security incident would result in Facebook deliberately shutting down their web presence, even for a few minutes. And all of the other potential attacks, such as DNS or CDN, seems like it a) wouldn't affect everyone simultaneously, and b) wouldn't even work because sites like Facebook don't have a single point of failure, there's always backups and backups for the backups.
- hrrsn 12y ago
  Tinder uses Facebook's API heavily. It's not surprising it went down with Facebook
- seanmofo 12y ago
  Instagram runs within the Facebook data centers. They had some challenging scaling issues within Amazon Web Services and moved their code base to Facebook's infrastructure.

blazespin 12y ago

Simple Bayesian analysis says it is them as they do not have a record of lying. Why would they? There is nothing to gain and everything to lose.

eridius 12y ago
Nothing to gain? Taking down Facebook seems like something that would bolster their rep significantly. If they think they can claim credit for it and get away with it, then there seems to be little reason why they wouldn't. I guess we'll just have to wait and see if Facebook makes any public statements as to what the cause of the outage was.
- peteretep 12y ago
  > seems like something that would bolster their rep > significantly And then irretrievably kill it if they were shown to be lying.
  - akerl_ 12y ago
    Except that proving they didn't do it turns out to be much harder, because any amount of contrary announcement or evidence can be handwaved away as lies and misdirection. It's roughly akin to trying to talk to conspiracy theorists about 9/11.
flexie 12y ago
How does simple Bayesian analysis suggest that? :-)
- nkozyra 12y ago
  It might, but with horrific confidence. Someone just felt like saying Bayesian analysis.

raverbashing 12y ago

Yeah, normal access patterns to FB are already pretty much as big as a DDOS on a regular website

bostik 12y ago
For their service infrastructure, certainly. Napkin math suggest that they have to sustain peak floods in the ballpark of 500M concurrent clients. Give or take 100M. However, if you could cripple DNS propagation/resolution from their systems to the next-hop upstreams, it would show up as services being very slow to respond. They do serve content from multiple domains. I'd be interested to know how Google's 8.8.8.8 infrastructure defends them from DNS level manipulation...

peteretep 12y ago

> they could cause a large enough DDoS to affect the > massive juggernaut that is Facebook You don't need to send Facebook more traffic than it normally gets, you simply need to nail a pain point, and cause an unusual traffic event. There's (I assume) no chance that it's been done using Slow Loris, but that's a good example of doing something unusual to deplete a resource in an unusual way. I would tend to agree that it's unlikely Facebook have simply been flooded off the internet, but there are many other ways to perform much more targeted DDoS attacks, and presumably Facebook haven't mitigated against _all_ of them.

eridius 12y ago
Good point. Although I'd say that any such attack like that is still unlikely to cause the entire site to become instantly unresponsive (or to serve static error pages as other people have suggested; personally, I just never got the site to load). And similarly, it would not be expected to come back to normal operating behavior a few minutes later. So yes, I'll grant you that you can DDoS even large sites without needing pure brute traffic, but it still doesn't seem particularly likely here.

sroerick 12y ago

Um, snowstorm?