21–30 of 112 posts
> privacy-first analytics solution [...] The only downside of this is that we need to keep access logs (IP & User-Agent, no browsing history) for 24 hours
Keeping IPs don't make you super privacy friendly.
PHP Laravel on Amazon Lambda to count pageviews? Are you sure it's not just a regular customer and not a DDOS? > privacy-first analytics solution [...] The only downside of this is that we need to keep access logs (IP & User-Agent, no browsing history) for 24 hours Keeping IPs don't make you super privacy friendly.
* We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping
* With zero access logs, there was no way to find patterns in the attack, and we had no way to block it
* Our service was going offline during these attacks
* We introduced access logs that are auto-deleted after 24 hours. We redacted all information about the site/page/activity etc. but keep IP & User Agent for pattern matching
* We were then able to identify a pattern and block the attack on Saturday
* Without access logs (even redacted ones), this wasn't possible
I was hoping a more senior engineer on Hacker News would comment and I can't wait to hear how you'd do it. I have no experience in DDoS protection at all, and this seems like the only possible way. Even rate limiting requires storing IP addresses. But if you know a more privacy-focused way to block these attacks, I'm sure I'll buy you a few beers when we hang out.
I don't fully get how you can DDOS this service as it seems you need to give your credit card to sign up. Can't they block the API keys with issues and be done with it?
PHP Laravel on Amazon Lambda to count pageviews? Are you sure it's not just a regular customer and not a DDOS? > privacy-first analytics solution [...] The only downside of this is that we need to keep access logs (IP & User-Agent, no browsing history) for 24 hours Keeping IPs don't make you super privacy friendly.
Awesome, I'd love some advice if you're willing. So here's our situation. * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping * With zero access logs, there was no way to find patterns in the attack, and we had no way to block it * Our service was going offline during these attacks * We introduced access logs that are auto-deleted after 24 hours. We redacted all information…
Earlier quoted context omitted.
Awesome, I'd love some advice if you're willing. So here's our situation. * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping * With zero access logs, there was no way to find patterns in the attack, and we had no way to block it * Our service was going offline during these attacks * We introduced access logs that are auto-deleted after 24 hours. We redacted all information…
I would probably start by looking for third-parties to help manage to problems, at least unless they all end up at the application layer. Throw it beyond Cloudflare and talk to them, and if they're not the right fit, try someone else.
PHP Laravel on Amazon Lambda to count pageviews? Are you sure it's not just a regular customer and not a DDOS? > privacy-first analytics solution [...] The only downside of this is that we need to keep access logs (IP & User-Agent, no browsing history) for 24 hours Keeping IPs don't make you super privacy friendly.
Awesome, I'd love some advice if you're willing. So here's our situation. * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping * With zero access logs, there was no way to find patterns in the attack, and we had no way to block it * Our service was going offline during these attacks * We introduced access logs that are auto-deleted after 24 hours. We redacted all information…
I've read the full blog post, I am not convinced it's a DDoS attack. Traffic patterns for web analytics will come from over the place and will look like a DDoS when it's not. For example, a customer misplacing their analytics in a JS loop and having a moderate traffic blog will generate billions of requests from all over the globe. Event tracking can be billions of requests as well by themselves. Never attribute to malice that which is adequately explained by simpler means.
> * With zero access logs, there was no way to find patterns in the attack, and we had no way to block it
It's a loss of time and energy. Your system should be able to handle these billions of requests.
> * We were then able to identify a pattern and block the attack on Saturday
Was it specific accounts?
> * Without access logs (even redacted ones), this wasn't possible
You can one-way hash the IP. So you can still look for pattern but you've lost the actual IP. And same one-way hash IP can block whichever IP seems devious in your firewall. (like md5 can be enough.)
> But if you know a more privacy-focused way to block these attacks, I'm sure I'll buy you a few beers when we hang out.
Haha no need to. But come say hi if you ever in Austin. julien _at_ serpapi.com.
What would the motivation be for such an attack? Any thoughts on who could be behind it?
What would the motivation be for such an attack? Any thoughts on who could be behind it?