Mitigating a DDoS on Mastodon
coffee-and-dreams.uk
Mitigating a DDoS on Mastodon
1–10 of 67 posts
Re: Mitigating a DDoS on Mastodon
#2on my own instance of Mastodon
Re: Mitigating a DDoS on Mastodon
#3Great write-up. As someone unfamiliar with the legal side of this, would it be worth the author contacting law enforcement of some kind?
Re: Mitigating a DDoS on Mastodon
#4On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".
Re: Mitigating a DDoS on Mastodon
#5On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".
That's an interesting side topic. What do services like Shodan do in an ipv6 world? Dumb brute force scanning seems unlikely.
Re: Mitigating a DDoS on Mastodon
#6Also a good idea to have more than one DNS server, from separate providers denoted as authoritative for your domain. Assuming your CDN will let you.
Re: Mitigating a DDoS on Mastodon
#7Great write-up. As someone unfamiliar with the legal side of this, would it be worth the author contacting law enforcement of some kind?
If you want to just have a piece of official documentation, why not. And if you know Putin and Xi personally maybe you even have a chance to get the DDOSer.
Re: Mitigating a DDoS on Mastodon
#8Is a federated system like Mastodon not setup in a way that users have access lists and if one server is down they simply connect to the next? I would expect to just limit the access to my server in a way that no illegal content is added to its storage and I don't have to pay horrendous fees for the network traffic and then just let the DDOS happen. At some point it needs to stop since the DDOSer will find nicer targets and the source of your problem will not have enough funds left. And then your service simply continues.
That's at least how I think a federated system should work. Not sure if reality matches that.
Re: Mitigating a DDoS on Mastodon
#9Is a federated system like Mastodon not setup in a way that users have access lists and if one server is down they simply connect to the next? I would expect to just limit the access to my server in a way that no illegal content is added to its storage and I don't have to pay horrendous fees for the network traffic and then just let the DDOS happen. At some point it needs to stop since the DDOSer will find nicer targ…
No, accounts are instance-bound, you can't just log into another instance in the federation.
Re: Mitigating a DDoS on Mastodon
#10Is a federated system like Mastodon not setup in a way that users have access lists and if one server is down they simply connect to the next? I would expect to just limit the access to my server in a way that no illegal content is added to its storage and I don't have to pay horrendous fees for the network traffic and then just let the DDOS happen. At some point it needs to stop since the DDOSer will find nicer targ…
From my understanding of Mastodon, you register an account with an instance and that's where your account and data are stored. You then get an address which is something like me@instance.tld. Federated instances can then connect together to read and exchange information, but for the most part your data doesn't leave your instance. I imagine the idea behind this is you can choose (or host) where your data sits, but still interact with a large network of individuals. That said, my understanding of Mastodon is limited.