Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare's new DNS attracting 'gigabits per second' of rubbish

zdnet.com

Post reply on HN
Print view View original

191–200 of 206 posts

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#191

Post by always_good »

jsjohnst wrote: post #186
walrus01 wrote: post #130

Earlier quoted context omitted.

There is no spoofing involved there. We're talking about typos of 192.168 (private space) typed as 192.68 which is "real" space. It is not like ISPs are leaking rfc1918 IP space.

Very true that it is a typo, which I had noticed, and thanks for calling out. Still doesn’t invalidate my point though. My theory is that a lot of that traffic is likely coming from spoofed IPs as I doubt there would be substantial sustained legitimate, but improperly directed, traffic. My guess is a lot of it is shoddily written malicious traffic.

Also, outbound traffic needs to be expensive, not free like it is now.

There simply shouldn't exist the scenario where a household is unaware that their hijacked toasters has been saturating their upload for months.

It seems unfair, but these are solutions that actually work. Waiting for things to fix themselves clearly isn't. We're quickly entering a reality where everyone will be using Cloudflare instead of just most of us.

It's pretty incredible how far naive decentralization got us, though. Soon we're going to be looking back in awe.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#192

Post by [deleted] »

walrus01 wrote: post #71
jakeogh wrote: post #69

Earlier quoted context omitted.

I canceled my decade old COX account last time that happened. Even asked nicely not to "help" by editing traffic, the runaround was fun. At the end they offered to take my ~$90/mo to ~$70; re-confirming they had no idea what I was unhappy about.

A $12/hour call center customer retention worker in rural TN has no idea what you're complaining about, their job is simply to meet some retention metrics on a weekly basis. Even if you can actually reach the people who run the ASN of your ISPs, if it something big like Cox, charter, Shaw, etc, they'll be politically unable to confirm or deny anything, and won't want to talk to you. You might get a straight answer if…

[deleted]

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#193

Post by Macha »

reaperducer wrote: post #164
sli wrote: post #153

Earlier quoted context omitted.

Same here. Devs can't even mount thumbdrives. Which is fine for us, we don't need them, but it prevents some funny business should one of our laptops get stolen.

Ditto. No flash drives except for special ones distributed by the IT department, and even then it takes a few months of reviews to get one. But we go one further — no development on the LAN. Develop on another server at a different hosting company, and only deploy on the production host when thoroughly vetted.

> no development on the LAN

Does this just mean staging/shared servers are not deployed on machines inside the corporate network, or that developers can't have their dev environment locally and instead remote in to some other machine to do their work?

I've heard of the latter in a few companies and it's always the kind of thing that makes me nope out of every applying to them.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#194

Post by reaperducer »

Macha wrote: post #193
reaperducer wrote: post #164

Earlier quoted context omitted.

Ditto. No flash drives except for special ones distributed by the IT department, and even then it takes a few months of reviews to get one. But we go one further — no development on the LAN. Develop on another server at a different hosting company, and only deploy on the production host when thoroughly vetted.

> no development on the LAN Does this just mean staging/shared servers are not deployed on machines inside the corporate network, or that developers can't have their dev environment locally and instead remote in to some other machine to do their work? I've heard of the latter in a few companies and it's always the kind of thing that makes me nope out of every applying to them.

Devs do most of their work on localhost. Changes are pushed to an independent server on an independent network in another city. Once those changes are vetted, then the work is mirrored to production.

Each dev has his own cellular connection for internet on his development box. Again, no LAN access. Corporate e-mail and cross-department file servers are on another box on each dev's desk.

The downside is massive over-usage charges for each dev's cell data (40-50 GB/month/dev over). The upside is that devs are effectively airgapped from the company, which I assume is the primary goal of all this.

Also, chat is banned. There have been efforts in the past to bring in tools like Slack, but the honchos believe that it makes the company better as a whole if we speak to each other like human beings, especially cross-department. Even if that means slowing down a project. And even if that means having to walk across campus, or occasionally driving to another part of town to another building. Phones are largely only used when off-site, or we need to talk to someone in another city.

It all sounds tremendously inefficient, but I try to think of it as being like working at IBM or Sperry in the 60's. It seems to work. The company is profitable and expanding, and has been for 40+ years.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#196

Post by jsjohnst »

walrus01 wrote: post #188
jsjohnst wrote: post #187

Earlier quoted context omitted.

> But it is highly decentralized Isn’t that the entire point of a CDN, to have decentralized POPs scattered globally? Yes, they may max out at 100gb per public IX in most cases, but they still have lots of 100gb peers all over the globe.

Yes, it's exactly the point. What I was saying is I am not off by an order of magnitude, I know exactly how big they are. Two ASes I do engineering work for peer directly with cloudflare.

> I am not off by an order of magnitude, I know exactly how big they are.

Your post implied a total of 200-400gb, the real number is 10x that (otherwise known as “order of magnitude”). I’m not disputing your knowledge or experience, but the post as written has issues.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#197

Post by [deleted] »

walrus01 wrote: post #71
jakeogh wrote: post #69

Earlier quoted context omitted.

I canceled my decade old COX account last time that happened. Even asked nicely not to "help" by editing traffic, the runaround was fun. At the end they offered to take my ~$90/mo to ~$70; re-confirming they had no idea what I was unhappy about.

A $12/hour call center customer retention worker in rural TN has no idea what you're complaining about, their job is simply to meet some retention metrics on a weekly basis. Even if you can actually reach the people who run the ASN of your ISPs, if it something big like Cox, charter, Shaw, etc, they'll be politically unable to confirm or deny anything, and won't want to talk to you. You might get a straight answer if…

[deleted]

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#198

Post by bradknowles »

jsjohnst wrote: post #186
walrus01 wrote: post #130

Earlier quoted context omitted.

There is no spoofing involved there. We're talking about typos of 192.168 (private space) typed as 192.68 which is "real" space. It is not like ISPs are leaking rfc1918 IP space.

Very true that it is a typo, which I had noticed, and thanks for calling out. Still doesn’t invalidate my point though. My theory is that a lot of that traffic is likely coming from spoofed IPs as I doubt there would be substantial sustained legitimate, but improperly directed, traffic. My guess is a lot of it is shoddily written malicious traffic.

Google for “BCP 38”.

This pain has been known for many, many years.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#199

Post by ptaipale »

croshan wrote: post #177
ptaipale wrote: post #89

Earlier quoted context omitted.

8.8.8.8 goes pretty well in the Chinese market. (8 being a popular number.) I think 1.1.1.1 is not such a hit.

Eh, I don't think it goes as well as you think, considering it's been banned for years [0]. [0]: https://www.reddit.com/r/sysadmin/comments/2komqe/china_bloc...

True for access from mainland China, though the scope of Chinese culture is a bit larger.

And just knowing that Google has that number is a bit like them owning a license plate or phone number with pure eights...

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#200

Post by walrus01 »

jsjohnst wrote: post #196
walrus01 wrote: post #188

Earlier quoted context omitted.

Yes, it's exactly the point. What I was saying is I am not off by an order of magnitude, I know exactly how big they are. Two ASes I do engineering work for peer directly with cloudflare.

> I am not off by an order of magnitude, I know exactly how big they are. Your post implied a total of 200-400gb, the real number is 10x that (otherwise known as “order of magnitude”). I’m not disputing your knowledge or experience, but the post as written has issues.

no, my post was quite specifically about a single IX point in one geographical location, and was accurate. You confused me talking about interface sizes and counts at one IX point with cloudflare as a whole.
Post reply on HN