Earlier quoted context omitted.
The silence is actually already giving it away then, one of four options.
Enumerate, please.
I assume China, Iran, North-Korea or Russia (in alphabetical order).
The largest DDoS attack to date, peaking above 398M rps
41–50 of 487 posts
Re: The largest DDoS attack to date, peaking above 398M rps
#42The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.
A spamhaus-like blacklist for botnet IPs is an interesting idea. What if Google and Cloudflare collectively reverse-DoSed all the infected IPs, not by sending them any traffic, but simply by refusing to accept any connections from them to any part of their infrastructure? Whoever is on those IPs will suddenly find that half the internet doesn't work anymore. Which is probably a good enough incentive for them to repla…
Google already does this. "Something on your network is causing unusual traffic, please fill in this captcha to continue".
And then you have to fill in a new captcha every 5 minutes or so just to keep using google maps/gmail/search.
It's kinda annoying, and usually the culprit is someone else who shares my IP, not me (ie. a school, university, workplace, open wifi).
Re: The largest DDoS attack to date, peaking above 398M rps
#43The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.
A spamhaus-like blacklist for botnet IPs is an interesting idea. What if Google and Cloudflare collectively reverse-DoSed all the infected IPs, not by sending them any traffic, but simply by refusing to accept any connections from them to any part of their infrastructure? Whoever is on those IPs will suddenly find that half the internet doesn't work anymore. Which is probably a good enough incentive for them to repla…
> In many parts of the world, landline IP allocations tend to be stable enough for this to have a real effect.
And what about CGNAT?
Re: The largest DDoS attack to date, peaking above 398M rps
#44Re: The largest DDoS attack to date, peaking above 398M rps
#45The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.
For a side-hobby of mine (writing), I imagine what would happen if current trends would continue. Thus, big caveat, it's all just thought experiments, not realistic predictions of any kind.
For this particular scenario, the public Internet would get so bad ("enshitified") that people would tend to leave it alone. For essential public services, governments would set up their own networks disconnected from the Internet, where all devices and their connections must be authenticated to a person or corporation[^1]. Maybe something equivalent would exist for corporations and to enable e-commerce.
[^1] China works like this already, to a high degree.
Re: The largest DDoS attack to date, peaking above 398M rps
#46How does DDoS mitigation work? When people say "I put my website behind Cloudflare to mitigate DDoSes", what does it mean exactly? Is it only about having a large enough ingress pipe that you can weather however many Gb/s you are being bombarded with, and still having some spare capacity for legitimate traffic?
When the ddos attack is volumetric, the only way to mitigate it is to have a fat enough network to handle the traffic while you work with ISPs to start blocking the traffic upstream. Not all ddos attacks are based on volume though, some are exploiting native features of a protocol, like the slow loris attack https://www.cloudflare.com/learning/ddos/ddos-attack-tools/s...
that's not the only way.
The way we used to do it is have "filter boxes" with a real anycast IP address's which reverse connect to your origin.
This helps a lot because it keeps a lot of traffic localised instead of allowing it to collect in one place. Anycast should also mean you have a failover mechanism; but if it fails then you're only down in one section of the world where the most bots are anyway, which is usually not as bad as being down globally.
Re: The largest DDoS attack to date, peaking above 398M rps
#47The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.
> pay Google, Amazon or Cloudflare a protection tax.
Just FYI: hetzner has free DDoS https://www.hetzner.com/unternehmen/ddos-schutz
I'm sure other hosting companies also offers it.
Re: The largest DDoS attack to date, peaking above 398M rps
#48The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.
A spamhaus-like blacklist for botnet IPs is an interesting idea. What if Google and Cloudflare collectively reverse-DoSed all the infected IPs, not by sending them any traffic, but simply by refusing to accept any connections from them to any part of their infrastructure? Whoever is on those IPs will suddenly find that half the internet doesn't work anymore. Which is probably a good enough incentive for them to repla…
We don't need to share a block-list, but yes, blocking all traffic from open proxies (which nearly all the large attacks of the 2020s have used) is definitely part of the long-term plan. Any legitimate users of those proxies will experience some short-term pain, but they'll patch and life will go on.
Re: The largest DDoS attack to date, peaking above 398M rps
#49Earlier quoted context omitted.
Sure, I’ll spill the beans. Some people think it’s related to Gaza or Ukraine but it’s not. We just really don’t like Google, we are trying to shut it down so we can bring back Altavista.
Made me wonder - if Google wasn't there and Altavista was the incumbent, would it be any different, or was the enshittification of search inevitable?
There is a reason Google’s first office was right next door to DEC WRL and Alta Vista. There is so much cross contamination between the two that it’s impossible to say.
Re: The largest DDoS attack to date, peaking above 398M rps
#50Earlier quoted context omitted.
A spamhaus-like blacklist for botnet IPs is an interesting idea. What if Google and Cloudflare collectively reverse-DoSed all the infected IPs, not by sending them any traffic, but simply by refusing to accept any connections from them to any part of their infrastructure? Whoever is on those IPs will suddenly find that half the internet doesn't work anymore. Which is probably a good enough incentive for them to repla…
> In many parts of the world, landline IP allocations tend to be stable enough for this to have a real effect. And what about CGNAT?
In that scenario, it's on the ISP to clean their network of abuse, the same thing they would need to do if Gmail had blacklisted their IPs for spamming. After all, an ISP that can't connect to YouTube isn't going to stay in business for long.
People have been begging ISPs for ages to do a bit of egress filtering, for example, to prevent source address falsification. They've demonstrated time and again that they don't give a crap unless it affects their bottom line.