Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

blog.cloudflare.com

Post reply on HN
Print view View original

141–150 of 151 posts

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#141

Post by _rdvw »

IYasha wrote: post #110
SketchySeaBeast wrote: post #102

Earlier quoted context omitted.

What "obsolete" software and hardware are you using that's somehow blocked by Cloudflare?

NetFront on the phone, IceCat mobile (never gets updates) or internal WebView browser on a smartpone, some unknown browser on samsung tv, Firefox 50 on a Linux laptop, but using others often doesn't help. For a while on these I get "screw yourself" message right away, while on others it's 5-30 captcha solving (AI feeding) sessions. And not only me. People with stock android 7 and older browsers have this too. And use…

The latest Firefox 110 for Android supports 5.0+.

The latest Chromium 110 for Android supports 7.0+.

Any device sold with the Android branding running 7.0+ will even have the latest Google/Chrome WebView updated out of band via Play. 5/6 will be stuck on version 105(?).

You should consider switching from IceCat to Fennec F-Droid, see my comparison table here: https://divestos.org/pages/browsers

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#142

Post by BenjiWiebe »

themoonisachees wrote: post #55
traceroute66 wrote: post #39

Earlier quoted context omitted.

> I get most of the attacks from US servers. Often times Google cloud or AWS. Yup. The block $insert_country IP range "solution" is an outdated mentality that should have died off in the 90's. These days most attacks originate from US/Western cloud and other rent-a-box providers. They are a gift to attackers because they can hop around at the click of the button and they know the victims can't block the IP ranges bec…

I agree that cloud providers are a blessing to attackers, but blocking russian, chinese and even generally SEA ip space is still a very effective way of stopping the bottom 70% of all attacks. Sure, they're trying such outdated methods that there is very little chance of them suceeding, but honestly when just banning china reduces sshd logs by 50% you wonder why you didn't do it sooner.

An even quicker way to clean up SSH logs is to listen on a non standard port.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#143

Post by markonen »

blibble wrote: post #22
TimWolla wrote: post #17

Earlier quoted context omitted.

71M requests per second gives you about 14ns per request. WolframAlpha says that's about 4 times the latency of a L2 cache access and 0.8 times the latency of a Mutex lock / unlock: https://www.wolframalpha.com/input?i=1+second+%2F+71+million . So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your…

> So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your budget. fortunately it's no longer 2000 and I have more than one core, and my NIC has more than one queue generating requests is a lot less CPU intensive than parsing requests how much CPU do I have to spend to get a pre-formed 100 byte reque…

These were HTTP/2 requests, not connections, so no per-request TCP negotiation. I'd say it's very easy to generate a huge number of requests like this, even if it's over TLS.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#144

Post by ranguna »

dustedcodes wrote: post #98

I took off all my properties from Cloudflare many years ago because I got increasingly more uncomfortable with a single US company who I know nothing about to sniffing the entire internet's traffic through their servers and ironically my properties had much less issues overall. Whatever value Cloudflare was supposedly adding to us, it couldn't be noticed or quantified in any measurable metric that we could see. The o…

How do you handle attacks now?

I tried to move one of my personal services off of cloudflare and it got DDoSed a few weeks later, mind you it's not even a popular services, just for internal use of mine and a few friends.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#145

Post by grishka »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

> Letting russia and china on the internet was a massive security mistake we should rectify.

Letting people like you manage servers was a massive mistake we should rectify.

As an innocent Russian, my hate for this shit burns like a thousand suns. Sometimes I'd follow some link, and I'd be greeted with a 403 for no good reason. For a get request. I'd have to turn my VPN on just to look at the damn thing.

At this point, I kinda wish it was technically impossible to deduce the country from an IP address.

> The world spends literally BILLIONS because chinarussia are frankly assholes online.

And? This is just money. Nothing irreplaceable.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#146

Post by Maxious »

sammy2255 wrote: post #20
omgomgomgomg wrote: post #10

Cloudflare ddos mitigation is overrated. First they force you to upgrade your plan, if that does not help, anotyer upgrade, if that fails, chances are you will get a termination notice.

>First they force you to upgrade your plan I don’t think that’s true, would you care to share more about that experience?

Cloudflare recently admitted that while their policy wasn't officially to force upgrades, some employees had taken it upon themselves to do so

> This throttle should not have happened. In addition, there is and was no need for the customer to upgrade to some other plan level.

https://blog.cloudflare.com/how-cloudflare-erroneously-throt...

This came about from this HN thread https://news.ycombinator.com/item?id=34639212

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#147

Post by LinuxBender »

traceroute66 wrote: post #71
rixrax wrote: post #66

Earlier quoted context omitted.

>> The block $insert_country IP range "solution" is an outdated mentality that should have died off in the 90's. Maybe so. But it works really well. After blocking certain countries IP ranges / ASes, >70% of abuse we had to deal with just vanished. Also there are other reasons to block: since the russians attacked Ukraine, business I work with no longer does business with russia, belarusia and few other countries as…

> After blocking certain countries IP ranges Alright, can we just put this one to bed ? When RIPE/APNIC/ARIN allocate a range of IPs, there is NOTHING in the terms and conditions that says "you can only use this in this geography". The legal range holder must be in the geography, but where they announce it is nobody's business. The range is held by a range holder who are listed on the relevant database. But there is…

When RIPE/APNIC/ARIN allocate a range of IPs, there is NOTHING in the terms and conditions that says "you can only use this in this geography"

That is not true, at least not any more. RIPE and ARIN specifically will cancel a companies account and remove their ASN if they announce the allocated CIDR blocks in the wrong region. We can very close to it at a former company. It was an honest mistake that someone was unaware of and it was reverted quickly. I can't speak for APNIC. There are probably people that have done this and not been caught for a while but they are much more vigilant now. I assumed because of a shortage of ipv4 blocks but there are probably other reasons.

Of course anyone can announce any networks but that is a good way to get blocked by peers. It has happened. I remember the PSINet debacle and a handful of others.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#148

Post by IYasha »

_rdvw wrote: post #141
IYasha wrote: post #110

Earlier quoted context omitted.

NetFront on the phone, IceCat mobile (never gets updates) or internal WebView browser on a smartpone, some unknown browser on samsung tv, Firefox 50 on a Linux laptop, but using others often doesn't help. For a while on these I get "screw yourself" message right away, while on others it's 5-30 captcha solving (AI feeding) sessions. And not only me. People with stock android 7 and older browsers have this too. And use…

The latest Firefox 110 for Android supports 5.0+. The latest Chromium 110 for Android supports 7.0+. Any device sold with the Android branding running 7.0+ will even have the latest Google/Chrome WebView updated out of band via Play. 5/6 will be stuck on version 105(?). You should consider switching from IceCat to Fennec F-Droid, see my comparison table here: https://divestos.org/pages/browsers

It's quite more complicated. But thanks. GMS/gapps or whatever are long gone for me anyway )

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#149

Post by IYasha »

SketchySeaBeast wrote: post #120
IYasha wrote: post #110

Earlier quoted context omitted.

NetFront on the phone, IceCat mobile (never gets updates) or internal WebView browser on a smartpone, some unknown browser on samsung tv, Firefox 50 on a Linux laptop, but using others often doesn't help. For a while on these I get "screw yourself" message right away, while on others it's 5-30 captcha solving (AI feeding) sessions. And not only me. People with stock android 7 and older browsers have this too. And use…

Unfortunately the internet moves fast, and if you're using a smart TV (prime for DDOS) or (in internet years) old tech it's the same as trying to drive a model t on the highway - sure it's a perfectly serviceable vehicle but you're probably going to get pulled over more often because you're a danger to yourself and others.

That's why I hate proprietary sh*t. A great TV with no way to update it or make it usable (no, I won't plug it into another computer). A great smartphone/toaster/anything else with the same problem...

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#150

Post by iptrans »

themoonisachees wrote: post #57
iptrans wrote: post #41

Earlier quoted context omitted.

I’m interested to hear how you 1) block 2 Tbps of attack traffic 2) save $500k per month in bandwidth charges since blocking at the border means you have to pay for the incoming bandwidth

Supposedly the traffic being blocked would have generated more outgoing traffic, costing more. Also, GP is managing their connections at the bgp level, meaning the requests don't ever hit their firewall, they just are unroutable from these countries ips.

BGP doesn’t work that way.

You cannot control who your prefix is announced to, unless you control all the paths on the Internet.

Post reply on HN