Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS protection

wiki.hetzner.de

Post reply on HN
Print view View original

131–140 of 175 posts

Re: DDoS protection

#131

Post by easychris »

jwr wrote: post #87
fabian2k wrote: post #15

Earlier quoted context omitted.

You can get server grade hardware with the PX line at Hetzner, which is a bit more expensive of course. And an internal network is possible as well from what I read, though you have to pay for the Flexi pack because it counts as a modification of your server.

The main reason why we migrated our servers from Hetzner to OVH is Hetzner's hard drive policy. Basically, if one of your drives fails, they will swap it for… another failing drive. You will keep getting various refurbished or re-tested drives. Basically, if it passes their test, it is considered a good drive, even if SMART shows a history of errors. Obviously, these drives do not last very long, so you end up with h…

You can pay around €50 to get a new drive - and you can skip the proof that the drive failed or is failing. For us we always choose this option as soon as we see SMART problems arising. Even with occasional drive failures the overall costs are so much lower than cloud hosting or self-owned hardware.

Re: DDoS protection

#132

Post by Drdrdrq »

sgt wrote: post #98
comboy wrote: post #21

Earlier quoted context omitted.

Have you been using online.net for long? Their offer looks interesting except for availability rate 99.5%. That's almost 4 hours of downtime every month. within availability range.

So they're willing to provide a SLA with 4 hrs of downtime every month. This does not however mean that you will have 4 hrs of down-time per mont - it's a managed risk. Also, depending on the nature of your application, you can often get away with that kind of downtime. Something trivial (yet extremely popular) like Twitter had lots of down-time and it made the users love the service even more.

Huh, never heard of that. Care to explain how that happened?

Re: DDoS protection

#133

Post by vizzah »

Does it mean Hetzner won't pull the cable off your server now if/when it's under heavy DDoS? I read horror stories about customers being attacked and Hetzner disabling their servers. Never experienced it myself, but I host my playground server with them and chose OVH for a more serious project due to DDoS policies..

Re: DDoS protection

#134

Post by DisposableMike »

I wish that Hetzner would provide me with DDoS protection from THEIR users. I've blacklisted their entire IP space for several different customers because of the relentless onslaught of malicious and aggressive attacks originating from their networks. They have never responded to a single abuse notification.

Re: DDoS protection

#135

Post by jlgaddis »

stemuk wrote: post #91

What always strikes me is the amount of free traffic Hetzner includes in their plans, always 20TB and upwards. AWS charges a whooping 90$ per TB, it keeps me wondering why their traffic is SO much more expensive than Hetzner's...

I've never understood why AWS charges so much for network traffic, especially considering their connectivity and peering.

Re: DDoS protection

#136

Post by jlgaddis »

kuschku wrote: post #126
stemuk wrote: post #91

What always strikes me is the amount of free traffic Hetzner includes in their plans, always 20TB and upwards. AWS charges a whooping 90$ per TB, it keeps me wondering why their traffic is SO much more expensive than Hetzner's...

Simple, Hetzner directly buys at transit wholesale prices.

Amazon peers extensively, so they don't even pay for (most of) the traffic!

(Not on a recurring basis anyways -- yes, there's the one-time capital costs and such.)

Re: DDoS protection

#137

Post by rmdoss »

scrollaway wrote: post #32
majke wrote: post #19

Earlier quoted context omitted.

[disclaimer: I work for CF] CloudFlare also regularly speaks about attacks and mitigations, therefore is helping the community to build better defences. Other providers stay shy and never disclose their magic. We believe DDoS is an internet wide problem and one of the ways to solve it is to spread the mitigation know how. Examples: - DNS attacks https://www.youtube.com/watch?v=UcAygzNSxlI&t=2h13m20s - Iptables is gre…

Cloudflare gets so much undeserved hate on HN. You guys do amazing work, provide an incredible service and your writeups are awesome. Thank you.

I love CloudFlare, but understand the concern some people have.

With the amount of sites they have behind them, and the amount of visibility and data they can extract, it is actually a bit scary to think what will happen if they get compromised or "do evil".

But so far, they seem to take the open and ethical approach and actually follow the "do no evil" mantra. CloudFlare is another Google in the making and I hope they keep like that.

thanks,

Re: DDoS protection

#138

Post by deno »

Karunamon wrote: post #128
deno wrote: post #121

Earlier quoted context omitted.

You can put captchas where they belong—on comments etc. Instead, Cloudflare punishes people simply browsing; they nuke the 99.99999% of visitors that have zero intention of interacting with the page beyond doing few GETs. Oh and don’t forget they’ll even put the captchas on subdomains, like img.domain.tld. Go visit stackoverflow via VPN/TOR and watch how the site has no styling/images even if you do their stupid capt…

A few GETs spread out the right way and repeated often enough is a DDOS. There's a very good reason why Cloudflare does this. Cloudflare isn't "punishing" anybody, their job is to protect the people that use their service. Tor (or any other open proxy) is a massive source of bogus and/or abusive traffic.

Of course they’re punishing legitimate visitors. If there weren’t any humans getting captchas there wouldn’t be any need for captchas in the first place.

It wouldn’t be so bad, except Cloudflare doesn’t have any idea what they’re doing. Like the static.domain.tld issue I’ve mentioned—not even documented. This breaks websites in a very, very, bad way.

Next we have the lovely security setting called “Essentially-off.” Which does absolutely nothing to the captcha system. Apparently “essentially” means “not really,” according to Cloudflare.

Also forget VPN/Tor. I’m getting consistently captchad by Cloudflare just visiting mostly american-only websites from residential networks in Europe.

They’re either incompetent or just plain malicious. Right now I’m swaying towards the latter :/

Re: DDoS protection

#139

Post by ryanlol »

psynapse wrote: post #39

I host at Hetzner and have noticed reduced Fail2ban notifications and shorter Logwatch emails recently. If this has kicked it, I guess that might explain it.

That'd be somewhat worrying, DDoS protection shouldn't be dropping non DDoS packets. If the chinese bruteforcers can't get to your server there's a very good chance your users can't either.

Re: DDoS protection

#140

Post by dylz »

deno wrote: post #121
Karunamon wrote: post #85

Earlier quoted context omitted.

You're looking at it purely from the user side. Look at it from the admin side. Tor is basically a massive open proxy, and by blocking it or throwing up human checks like captchas, you eliminate a significant source of spam and abuse. There's not much to be done about this otherwise - a Tor user is sharing a network with a significantly higher than usual amount of the bad elements of the internet.

You can put captchas where they belong—on comments etc. Instead, Cloudflare punishes people simply browsing; they nuke the 99.99999% of visitors that have zero intention of interacting with the page beyond doing few GETs. Oh and don’t forget they’ll even put the captchas on subdomains, like img.domain.tld. Go visit stackoverflow via VPN/TOR and watch how the site has no styling/images even if you do their stupid capt…

I run a site (not behind CF), and Tor is used heavily to scrape our uncacheable and extremely heavy to render pages for abusive/content theft purposes.
Post reply on HN