71–80 of 112 posts
I get why they don't want to use Cloudflare but reading that gave me faith in why we offer the free DDoS service we do. The expense and hassle of dealing with a DDoS and then the expense and hassle of dealing with AWS looks awful.
I'm currently still on your free tier, but would be happy to pay when I need to.
Just wanted to say, thank you!
Earlier quoted context omitted.
Awesome, I'd love some advice if you're willing. So here's our situation. * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping * With zero access logs, there was no way to find patterns in the attack, and we had no way to block it * Our service was going offline during these attacks * We introduced access logs that are auto-deleted after 24 hours. We redacted all information…
> * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping I've read the full blog post, I am not convinced it's a DDoS attack. Traffic patterns for web analytics will come from over the place and will look like a DDoS when it's not. For example, a customer misplacing their analytics in a JS loop and having a moderate traffic blog will generate billions of requests from all over…
Potentially, but then customers don’t see a ton of spam on their dashboard. Just a lot of repeated requests.
They don’t come in random waves either. Valid traffic is pretty well spaced out.
> Your system should be sble to handle these billions of requests
Potentially, but you really don’t want to pay for them. The only real way to go about stopping it is blocking offending ips.
What would the motivation be for such an attack? Any thoughts on who could be behind it?
I did a quick check for usefathom.com though, the only somewhat interesting keyword would be "google analytics alternative", but fathom ranks on page 2, which imo would not really justify an attack. Maybe there is some other long-tail keyword with a high enough value though where usefathom.com pushed small niche players out of the top positions.
Also a DDoS is obviously bad for the user experience of paying customers, nobody wants their analytics service to be down or have missing data bc of downtime etc.
Earlier quoted context omitted.
> * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping I've read the full blog post, I am not convinced it's a DDoS attack. Traffic patterns for web analytics will come from over the place and will look like a DDoS when it's not. For example, a customer misplacing their analytics in a JS loop and having a moderate traffic blog will generate billions of requests from all over…
> You can one-way hash the IP. So you can still look for pattern but you've lost the actual IP. And same one-way hash IP can block whichever IP seems devious in your firewall. The plaintext space (amount of possible IPs, even more so for IP blocks) is so small that that you can try all the possible plaintexts within seconds, essentially reversing the hash.
Could you salt the hash with something way less predictable that gets discarded when the next one is generated? Assuming you only kept logs for a day for example you could regenerate it daily and store $salt somewhere only the most senior of senior techs can access it (if anyone at all)
I think they need to take notes.
I get why they don't want to use Cloudflare but reading that gave me faith in why we offer the free DDoS service we do. The expense and hassle of dealing with a DDoS and then the expense and hassle of dealing with AWS looks awful.
How do they even know it was "a lonely nerd"? In fact, it's much more likely that it was carried out by a well-socialized team of shady professionals, on a commission from competitors.
It's 2020, people, can we drop it with the "Hack3rs" stereotypes...?
I am the co-founder of a SaaS in the higher-ed-tech sector (universities, 300+ of them). Going to make sure we implement support for Fathom (in addition to GA, GTM, Matomo) and reach out to our customers. Hope it helps a bit. Our users would also benefit from stuffing less data to G.
Earlier quoted context omitted.
> * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping I've read the full blog post, I am not convinced it's a DDoS attack. Traffic patterns for web analytics will come from over the place and will look like a DDoS when it's not. For example, a customer misplacing their analytics in a JS loop and having a moderate traffic blog will generate billions of requests from all over…
> You can one-way hash the IP. So you can still look for pattern but you've lost the actual IP. And same one-way hash IP can block whichever IP seems devious in your firewall. The plaintext space (amount of possible IPs, even more so for IP blocks) is so small that that you can try all the possible plaintexts within seconds, essentially reversing the hash.