Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS protection

wiki.hetzner.de

Post reply on HN
Print view View original

141–150 of 175 posts

Re: DDoS protection

#141

Post by deno »

corobo wrote: post #86
rickycook wrote: post #82

Earlier quoted context omitted.

that's a pretty poor excuse. why is privacy only available by submitting to a poor experience? privacy should be default, not a punishment

Using a massively shared IP space of any kind is only available by submitting to a poor experience. Nobody is saying "hey this guy has privacy, lets make this experience a pain in the arse". They're saying "Man this set of specific IPs are really hammering my system looking for WordPress exploits and we're not even running that". To treat Tor better than regular traffic would be to discriminate against Tor, which wou…

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

Re: DDoS protection

#142

Post by deno »

dylz wrote: post #140
deno wrote: post #121

Earlier quoted context omitted.

You can put captchas where they belong—on comments etc. Instead, Cloudflare punishes people simply browsing; they nuke the 99.99999% of visitors that have zero intention of interacting with the page beyond doing few GETs. Oh and don’t forget they’ll even put the captchas on subdomains, like img.domain.tld. Go visit stackoverflow via VPN/TOR and watch how the site has no styling/images even if you do their stupid capt…

I run a site (not behind CF), and Tor is used heavily to scrape our uncacheable and extremely heavy to render pages for abusive/content theft purposes.

All you just said is that your site is broken.

Re: DDoS protection

#143

Post by corobo »

deno wrote: post #141
corobo wrote: post #86

Earlier quoted context omitted.

Using a massively shared IP space of any kind is only available by submitting to a poor experience. Nobody is saying "hey this guy has privacy, lets make this experience a pain in the arse". They're saying "Man this set of specific IPs are really hammering my system looking for WordPress exploits and we're not even running that". To treat Tor better than regular traffic would be to discriminate against Tor, which wou…

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

Do many malicious entities have easy access to carrier-grade NATs?

Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/

Re: DDoS protection

#144

Post by nitrogen »

frandroid wrote: post #122
IntelMiner wrote: post #90

Earlier quoted context omitted.

Keep in mind, unless you're using your own personal VPN off a self-hosted machine, you're likely to be sharing your IP address with other (potentially) malicious actors trying to hide their tracks

Same as if being on an ISP though.

ISPs have a much larger pool of addresses, so less or no sharing.

Re: DDoS protection

#145

Post by deno »

corobo wrote: post #143
deno wrote: post #141

Earlier quoted context omitted.

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/

Sure they do. They’re called ‘botnets.’[1]

[1] https://luminati.io/

Re: DDoS protection

#146

Post by [deleted] »

corobo wrote: post #143
deno wrote: post #141

Earlier quoted context omitted.

So carrier-grade NATs should also be captchad to hell. Somehow, they aren’t. Very mysterious, indeed.

Do many malicious entities have easy access to carrier-grade NATs? Man just read up I'm essentially just summarising this anyway: https://blog.cloudflare.com/the-trouble-with-tor/

[deleted]

Re: DDoS protection

#147

Post by eeZi »

majke wrote: post #19
fivesigma wrote: post #12

Cloudflare is a major source of centralization. The more providers offer something like this, the merrier. I understand that this isn't a layer 7 solution, but that has it's downsides as well - Cloudflare (or any other reverse proxy) will MITM all your TLS traffic, for example. It's also time to address the elephant in the room: AWS. "Oops, you got DDOS'ed? Here, have a $50k invoice"

[disclaimer: I work for CF] CloudFlare also regularly speaks about attacks and mitigations, therefore is helping the community to build better defences. Other providers stay shy and never disclose their magic. We believe DDoS is an internet wide problem and one of the ways to solve it is to spread the mitigation know how. Examples: - DNS attacks https://www.youtube.com/watch?v=UcAygzNSxlI&t=2h13m20s - Iptables is gre…

I work for a hosting company. Can confirm that CloudFlare's posts help us building our own defenses and I'm grateful that they're sharing their knowledge.

So, thank you!

Re: DDoS protection

#148

Post by StanAngeloff »

latch wrote: post #116
StanAngeloff wrote: post #112

Earlier quoted context omitted.

It didn't come across in my comment – my amazement was regarding WordPress, etc. websites being run on commodity hardware without proper backups. E.g., get that ludicrous 128GB machine and run Apache on it with a single website for years. What could possibly go wrong? The most recent issue we had with Hetzner was when we requested a LARA remote console to connect to a failing machine. The standard keyboard on the rem…

Read-heavy APIs, which I like to setup as: A central location to take writes. Writes to this location go into a database and a durable, at-least-once, queue (writing to the queue is as important as writing to the database). Then you put your API servers in different geographies (and preferably different hosting vendors). They listen to the queue and update their own storage (which could itself be a full relational da…

Sounds like a well thought out CQRS system. Thank you for taking the time to reply.

Re: DDoS protection

#149

Post by eeeeeeeeeeeee »

jwr wrote: post #83
majke wrote: post #61

Earlier quoted context omitted.

This was never the intention. Part of the problem is inertion - cf operates large and complex application that was designed back when we had only a handful of customers. Part of the problem is technical - the privacy-centric anti-abuse technologies don't exist yet. Please do help us fix this. Report issues, help us understand when we have incorrect IP reputation. Help us find captcha accessibility problems. And maybe…

Problem is, your "incorrect IP reputation" concept is fundamentally flawed. As an example, I noticed that most VPN exit nodes have "incorrect IP reputation", which means if I want to browse the internet without my government spying on me, I have to wade through all your CAPTCHAs.

This is an inherent problem with numerous different people using the same IP addresses (VPN, Tor, etc). And might be a bigger problem than Cloudflare can resolve on their own. Cloudflare has to protect its network and its customers like a normal business, so VPN and Tor IP addresses will naturally be viewed with suspicion.

Also, I think the captcha solution is better than what most administrators do, which is to block those IPs outright.

Re: DDoS protection

#150

Post by deno »

rakoo wrote: post #76
CPLX wrote: post #70

Earlier quoted context omitted.

The letters stand for "man in the middle" which seems to me a quite literal description of what's going on. The word attack isn't used.

Except MiTM is used primarily, if not exclusively, in attack scenarios. Otherwise any third-party you use as a website owner is a MiTM.

If they’re stripping encryption and reapplying they’re MITM. Seems pretty straightforward.
Post reply on HN