Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you handle DDoS attacks?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Ask HN: How do you handle DDoS attacks?

#71

Post by samplonius »

rootlocus wrote: post #70
DivineTraube wrote: post #67

We (Baqend) use an approach that is somewhat different from what has been proposed here so far: - Every one of our servers rate limits critical resources, i.e. the ones that cannot be cached. The servers autoscale when neccessary. - As rate limiting is expensive (you have to remember every IP/resource pair across all servers) we keep that state in a locally approximated representation using a ring buffer of Bloom fil…

I'm sorry, I know it's irrelevant, offtopic and I'm a horrible person but... "Baqend"? Who came up with this name? Was there some brainstorming involved and that was the best candidate? What does the branding say about your business? How is it pronounced?

It is actually a really good name for search engines, as it is completely invented word.

Re: Ask HN: How do you handle DDoS attacks?

#73

Post by ryanlol »

wesleytodd wrote: post #25

My startup's site gets DDOS'd about once a week. We have seen a huge range of attacks from UDP floods, to wordpress pingback attacks, to directed attacks on our services. We have many layers of protection: * We run iptables and an api we wrote on our ingest servers. We run failtoban on a separate set of servers. When fail2ban sees something, we have it hit the api and add the iptables rules. This offloads the cpu of…

Cloudflare doesn't help you against UDP floods if your backend is publicly accessible on the internet.

For example:

curl https://104.154.116.193 -H 'Host: www.stream.me' -v -k

Re: Ask HN: How do you handle DDoS attacks?

#74

Post by beachy »

rootlocus wrote: post #70
DivineTraube wrote: post #67

We (Baqend) use an approach that is somewhat different from what has been proposed here so far: - Every one of our servers rate limits critical resources, i.e. the ones that cannot be cached. The servers autoscale when neccessary. - As rate limiting is expensive (you have to remember every IP/resource pair across all servers) we keep that state in a locally approximated representation using a ring buffer of Bloom fil…

I'm sorry, I know it's irrelevant, offtopic and I'm a horrible person but... "Baqend"? Who came up with this name? Was there some brainstorming involved and that was the best candidate? What does the branding say about your business? How is it pronounced?

Fantastic name. I love it when you see a brand, mentally sound it out in your head, and then it delights you with its cleverness.

Re: Ask HN: How do you handle DDoS attacks?

#75

Post by cpncrunch »

kalleboo wrote: post #19
tombrossman wrote: post #9

I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…

Have you been DDoSed while on OVH? I've heard there are a bunch of providers who claim DDoS prevention, but what that means in practice is just "we'll take your site offline right away and not charge you for the incoming bandwidth!". Super helpful.

I've also been DDoSed while on OVH. It happened twice and was a non-event. I would never have noticed if they hadn't told me. Now the asshats don't seem to even bother DDoSing us any more.

On iWeb, however, they null-routed us for half a day.

Re: Ask HN: How do you handle DDoS attacks?

#76

Post by badminton1 »

benchaney wrote: post #57
badminton1 wrote: post #52

Earlier quoted context omitted.

Caching not necessarily means more speed. Sometimes it can make things slower. 1. Get from cache 2. Determine if cached value is valid 3. Query data store 4. Put data store value in cache 5. Return data Instead of just getting it directly. In order to be able to cache you need to think about good cache invalidation. And client side caching won't work against malicious users.

Those are problems the CDN solves for you.

CDN is only for static content and I was assumed all your static content would be already on a CDN... it's a standard practice.

Re: Ask HN: How do you handle DDoS attacks?

#77

Post by buro9 »

jaypaulynice wrote: post #69
buro9 wrote: post #38

I've faced DoS attacks for years as I run internet forums. The simple advice for layer 7 (application) attacks: 1. Design your web app to be incredibly cacheable 2. Use your CDN to cache everything 3. When under attack seek to identify the site (if you host more than one) and page that is being attacked. Force cache it via your CDN of choice. 4. If you cannot cache the page then move it. 5. If you cannot cache or mov…

Have you heard about cache busting? Someone just needs to request a page that's not cached and the request will always hit your web servers.

You'd be surprised how few attacks I've personally seen vary that much. But yes, it happens, and good applications put their identifiers in their paths and ignore the querystrings, most CDN/security providers allow the configuring of their layer to ignore querystrings entirely.

Of course, this is precisely the attack that works on a search page, hence the advice above to be ready to captcha that if you haven't.

Anything GETable cache, everything else you need to think about how to validate the good traffic (trivially computable CSRF tokens help) and captcha the rest.

404s, 401s, etc... they should cost the underlying server as little resource as possible and also cache their result at an applicable cache layer (404s at the edge and 401s internally, 403s at the edge if possible, etc).

Re: Ask HN: How do you handle DDoS attacks?

#78

Post by cpncrunch »

rmdoss wrote: post #43
tombrossman wrote: post #9

I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…

I do use OVH and recommend them from time to time. The main issue is that I lost a bit of faith in their support and reliability. vracks going down for hours with no updates. Connectivity issues. Servers disappearing. Besides that, their DDoS protection works well for l3 attacks, except that they force a TCP reset on every connection. So if you are picky about extra connect times and having your clients re-establish…

What kind of server, and which data center? I've been using a dedicated server at BHS for over a year with no problems at all.

Re: Ask HN: How do you handle DDoS attacks?

#79

Post by ryanlol »

tumdum_ wrote: post #61
DyslexicAtheist wrote: post #34

Earlier quoted context omitted.

You mean the biggest MiTM on the web?[0] The only reason why they're not constantly called out by serious infosec folk for their scam is because they hire guys also involved in DefCon/BlackHat planning (try to sneak a hostile talk against Cloudflare past REDACTED[2] who btw is also advising Mr. Robot). It's lobbying at its finest. [0] https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar... [1] https://blog.to…

Yes, I'm well aware that cloudflare is mitm, yet for my needs I've decided that this is not a problem. I can see that you are not happy with what they provide. Luckily theirs service is not forced on you. Neither do you have to use it, nor visit server that use it.

>Yes, I'm well aware that cloudflare is mitm, yet for my needs I've decided that this is not a problem.

You're not seeing the full picture here. Using cloudflare is the internet equivalent of dumping hazardous waste, it's not a problem for you but it's a problem for everyone.

>I can see that you are not happy with what they provide. Luckily theirs service is not forced on you. Neither do you have to use it, nor visit server that use it.

That's a fairly ridiculous argument given their prevalence.

Re: Ask HN: How do you handle DDoS attacks?

#80

Post by DivineTraube »

rootlocus wrote: post #70
DivineTraube wrote: post #67

We (Baqend) use an approach that is somewhat different from what has been proposed here so far: - Every one of our servers rate limits critical resources, i.e. the ones that cannot be cached. The servers autoscale when neccessary. - As rate limiting is expensive (you have to remember every IP/resource pair across all servers) we keep that state in a locally approximated representation using a ring buffer of Bloom fil…

I'm sorry, I know it's irrelevant, offtopic and I'm a horrible person but... "Baqend"? Who came up with this name? Was there some brainstorming involved and that was the best candidate? What does the branding say about your business? How is it pronounced?

It's pronounced "Backend" ;-)

And since we are in the Backend-as-a-Service market, the name is not all that unfitting. Although it cannot be denied that from time to time some people think we are French an spelled "Baquend".

Post reply on HN