Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

271–280 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#271

According to Fortune, Hacker News "reported" on the incident. Are we journalists now? "Popular tech site Hacker News reported many other sites were affected including Etsy, Spotify, Github, Soundcloud, and Heroku." -- http://fortune.com/2016/10/21/internet-outages/

If a headline says, "Users reported having bouts of explosive diarrhea", it doesn't make them medical journalists.

Re: DDoS Attack Against Dyn Managed DNS

#272
post #255
post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

Awesome! Is this available as software I can install on my network? Sorry, probably a dumb question.

Re: DDoS Attack Against Dyn Managed DNS

#273
post #249
post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

Historically, doing this has been a source of a truly awe-inspiring amount of pain.

Aw, don't leave us hanging like that. What problems did it cause?

Re: DDoS Attack Against Dyn Managed DNS

#274
post #256

Earlier quoted context omitted.

Yes, but: 1) Memory and disk are cheap. My caching DNS resolver can handle some stale records. 2) I suggested above that this behavior would continue until an administrator-specified and potentially quite generous maximum TTL expires. That is, I could configure my caching DNS resolver to fully purge expired records after, for example, 2 weeks.

> 1) Memory and disk are cheap. My caching DNS resolver can handle some stale records. The problem is not that it would require storage but that stale records can be outright wrong. That timeout would require configuration and DNS does not provide that. So sure, a new timeout could be introduced but that currently does not exist in DNS.

If a server goes away for good, at some point NS records will stop pointing to it. We could serve stale records as long as all of the stale record's authority chain is either still there or unreachable.

Re: DDoS Attack Against Dyn Managed DNS

#276
post #149

Earlier quoted context omitted.

> The usual thinking goes something like; well, the US created the internet so why would they want to take it down? To pin it on someone else? "17 Intelligence agencies told me Russia hacked our DNC thing" (Clinton). So maybe it is now "Oh look they took down the whole internet as well".

>To pin it on someone else? That's... kind of conspiratorial thinking? Would you cut off your own hand so you could blame it on someone else?

It's called a false flag operation, and does happen.

Re: DDoS Attack Against Dyn Managed DNS

#278

They should do it once a year and call it Friday without Internet Day.

Better yet, have one day a year that is "Red Team Day" where people hunt for vulnerabilities so that assessments can be done, and companies can later fix any issues noted. Like how earlier this week there was a statewide earthquake drill in California, local emergency sirens were sounded, schoolkids practiced hiding under desks, etc. The Internet needs periodic tests like that too.

I absolutely love this idea! Would be a bit tricky to implement, but would definitely improve security in the long run.

Re: DDoS Attack Against Dyn Managed DNS

#280
post #68

I'm a GitHub employee and want to let everyone know we're aware of the problems this incident is causing and are actively working to mitigate the impact. "A global event is affecting an upstream DNS provider. GitHub services may be intermittently available at this time." is the content from our latest status update on Twitter ( https://twitter.com/githubstatus/status/789452827269664769 ). Reposted here since some peo…

I love how the White House & GH posted a statement on Twitter.. that we can't access since its down.
Post reply on HN