Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Network Performance Issues in multiple locations

cloudflarestatus.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: Network Performance Issues in multiple locations

#31

Post by pyvpx »

eeeeeeeeeeeee wrote: post #25
Afforess wrote: post #18

Earlier quoted context omitted.

I love a good pitchfork and torch session as much as the next rabble-rouser, but let's remember Cloudflare got popular because they _solved*_ a hard problem: how to deal with a DDOS, as a small or medium size website. Cloudflare's essentially a for-profit insurance pool for bandwidth. No individual site has enough bandwidth to handle a DDOS, nor can afford it, but pooled together, many sites can afford a service that…

Exactly. You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal. Centralization was absolutely the best answer to that problem and will be for a long time. Almost nobody but fortune 500 companies would be able to survive a DDoS otherwise.

Akamai has had and continues to have more capacity than Cloudflare.

Re: Network Performance Issues in multiple locations

#32

Post by bdcravens »

rckrd wrote: post #15

Why is this on the front page? It seems like whatever happened had nothing to do with cloudflare. Can a mod remove this, as a status page is not news?

I'm inclined to agree, but if it's being voted up it's "news". It's as much news as "Github Down" when the submitted link times out.

Re: Network Performance Issues in multiple locations

#33

Post by pyvpx »

DocG wrote: post #28

More general question, as similar situation has happened multiple times where we are not sure: 1) did we break our client server 2) did our internet provider die 3) did the service die What are recommended ways of finding out fast and reliably in these cases where the fault is.

uhh, monitoring those things? you can monitor your internet provider a number of ways. something like smokeping allows for an exceedingly simplistic test: ping stuff on the internet.

logs will tell you if a client server or individual service has died. that are literally hundreds of solutions for these.

Re: Network Performance Issues in multiple locations

#34

Post by corobo »

DocG wrote: post #28

More general question, as similar situation has happened multiple times where we are not sure: 1) did we break our client server 2) did our internet provider die 3) did the service die What are recommended ways of finding out fast and reliably in these cases where the fault is.

Pro-active monitoring rather than reactive diagnosis.

Zabbix is an example piece of software, probably overkill for most but I haven't used anything else in the last 5 or so years so don't have any better suggestions.

Re: Network Performance Issues in multiple locations

#35

Post by pyvpx »

Sir_Cmpwn wrote: post #8

Idea: let's proxy half the internet through a private, proprietary service! We can get people to give us valid SSL certificates for their sites, too, and let's fuck up Tor while we're at it. We can totally handle it, right? Oh, and we need to pay for it somehow, so let's go the venture capital approach and just pretend we won't eventually hit a growth cap and ruin our company Twitter-style when we get there. The craz…

Telia ate it, not CF.

Telia eats it quite regularly, but not often at this magnitude.

Re: Network Performance Issues in multiple locations

#36

Post by VA3FXP »

Thaxll wrote: post #9
ShakataGaNai wrote: post #6

Anyone have more concrete information on where the routing issues are and/or who's affected?

Lot of routing in Europe is done through Telia.

It looks like Telia is apparently the issue.

Our CDN's are having problems all over the place. No indications of what shit the bed, but this is more then Cloudflare

Re: Network Performance Issues in multiple locations

#37

Post by jwineman »

pyvpx wrote: post #31
eeeeeeeeeeeee wrote: post #25

Earlier quoted context omitted.

Exactly. You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal. Centralization was absolutely the best answer to that problem and will be for a long time. Almost nobody but fortune 500 companies would be able to survive a DDoS otherwise.

Akamai has had and continues to have more capacity than Cloudflare.

Source?

Re: Network Performance Issues in multiple locations

#38

Post by phailhaus »

ComputerGuru wrote: post #19

Obligatory comment that I (and others) make every single time: can we please for 's sake stop centralizing everything? We are literally throwing away all the benefits of a mostly-decentralized internet for the sake convenience.

Do you have a viable alternative to protecting small websites from DDOS attacks?

Re: Network Performance Issues in multiple locations

#39

Post by nojvek »

Sir_Cmpwn wrote: post #23
Afforess wrote: post #18

Earlier quoted context omitted.

I love a good pitchfork and torch session as much as the next rabble-rouser, but let's remember Cloudflare got popular because they _solved*_ a hard problem: how to deal with a DDOS, as a small or medium size website. Cloudflare's essentially a for-profit insurance pool for bandwidth. No individual site has enough bandwidth to handle a DDOS, nor can afford it, but pooled together, many sites can afford a service that…

>solved "worked around" is more appropriate, and introduced huge problems with their workaround. The correct solution is to punish ISPs that permit this behavior to continue unchecked. We need offense, not defense. Any ISP that doesn't detect and kill DDoS participants needs to be severely throttled by other ISPs. Organizations like the FCC should be tackling this and levying fines against US-based ISPs for non-compl…

It's really hard to know what constitutes DDOS traffic at times. Suppose a Netflix show got really popular, do you cut it off. Let's make an exception for Netflix. What if a new competitor blahflix got popular quickly, Does its traffic get blocked?

Oh wait now blahflix needs to pay $$$ to get special privileges. Shit gets hairy real quick.

Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked?

ISPs should remain dumb pipes. You really don't want to give comcast more power.

Re: Network Performance Issues in multiple locations

#40

Post by Afforess »

Sir_Cmpwn wrote: post #23
Afforess wrote: post #18

Earlier quoted context omitted.

I love a good pitchfork and torch session as much as the next rabble-rouser, but let's remember Cloudflare got popular because they _solved*_ a hard problem: how to deal with a DDOS, as a small or medium size website. Cloudflare's essentially a for-profit insurance pool for bandwidth. No individual site has enough bandwidth to handle a DDOS, nor can afford it, but pooled together, many sites can afford a service that…

>solved "worked around" is more appropriate, and introduced huge problems with their workaround. The correct solution is to punish ISPs that permit this behavior to continue unchecked. We need offense, not defense. Any ISP that doesn't detect and kill DDoS participants needs to be severely throttled by other ISPs. Organizations like the FCC should be tackling this and levying fines against US-based ISPs for non-compl…

The solution can't be to hurt innocent traffic because a malicious user has some of the bandwidth. I agree some ISPs are complicit in the situation, but tit-for-tat approaches ultimately will hobble ISPs and create an irate and a distrustful internet. Even if you do create a magical technical solution that solves all the challenges without hurting bystanders, then you face an even bigger challenge: the status quo.

There is no way to get from our current situation to the world you propose - there will be never be a quorum from ISPs (or governments) on this sort of standard. It's a tragedy of the commons and no single participant has enough leverage or interest in a new status quo.

Post reply on HN