Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

191–200 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#191

Post by starcraft2wol »

starcraft2wol wrote: post #161
gchamonlive wrote: post #69

Earlier quoted context omitted.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

> Let's go back to username and password. 2FA forces scammers to up their game. Let's do it. It works for the website you're using right now. 2FA was in large part motivated by limiting bot accounts and getting customers phone number. I can't imagine how much productivity the economy loses every day due to 2FA.

To add, password managers provide great coverage of almost every problem 2FA is. supposed to solve and it improves the workflow your grandma already know (writing passwords on a sheet). The only difference is Google doesn't get any money when you run a script on your own computer.

Re: The largest DDoS attack to date, peaking above 398M rps

#192

Post by jacquesm »

justaman wrote: post #120
RandomLensman wrote: post #67

Earlier quoted context omitted.

We could also treat it as a public security threat and act accordingly.

I think this is the key take away. Unfortunately world leaders are not tech savvy enough to even consider this a threat.

Yet. But we're getting there.

Re: The largest DDoS attack to date, peaking above 398M rps

#193

Post by gchamonlive »

rglullis wrote: post #178
gchamonlive wrote: post #157

Earlier quoted context omitted.

> 2FA and password managers didn't make us heavily reliant on massive companies. Retool: https://arstechnica.com/security/2023/09/how-google-authenti... Lastpass: https://news.ycombinator.com/item?id=34516275

If Google Authenticator goes away, people will still be able to use 2FA (I for one use Aegis, it's available on F-droid and does everything I need, including encrypted backups) If Lastpass goes away, people will still be able to use keepass or any of the large number of open source password managers, some of them even with browser integrations. If I have a website that is frequently attacked by botnets and Cloudflare…

I am sorry, but if your password manager goes away and you have no disaster recovery scenario planned you might not be able to just move to a competitor:

https://news.ycombinator.com/item?id=31652650

My response was to illustrate how insidious big companies are.

Of course nothing compares to the backbone of the web going down. If AWS North Virginia suffers widespread downtime to all its availability zones, much of the web will just go dark, no question about it.

Re: The largest DDoS attack to date, peaking above 398M rps

#194

Post by zapdrive »

dudeinjapan wrote: post #33
falcor84 wrote: post #24

Earlier quoted context omitted.

Made me wonder - if Google wasn't there and Altavista was the incumbent, would it be any different, or was the enshittification of search inevitable?

Was at Tokyo Disneyland today and taught my girlfriend the word “enshittification”. (i.e. making your customers pay via your stupid app to do literally anything in your park, and not even providing wi-fi.)

[flagged]

Re: The largest DDoS attack to date, peaking above 398M rps

#195

Post by lostmsu »

turminal wrote: post #83
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

It's worth noting that features like the one that enabled Rapid Reset are pushed into standards by the exact same companies, because they are needed for performance at their scale. So in a way this was partially caused by the existence of insanely big tech companies that need such features.

Either I misunderstood the issue, but it sounds like rapid reset was not the cause.

Re: The largest DDoS attack to date, peaking above 398M rps

#196

Post by H8crilA »

Aissen wrote: post #18
dduarte wrote: post #7

Same attack on Cloudflare https://blog.cloudflare.com/zero-day-rapid-reset-http2-recor...

The technical article (linked in the post) has more interesting details: https://blog.cloudflare.com/technical-breakdown-http2-rapid-...

This should be the top comment.

TL;DR: HTTP/2 is internally concurrent, can handle multiple streams. It is possible in HTTP/2 to send a nasty request that looks like so:

  - GET x1
  - GET x2
  - GET x3
  - ...
  - GET x100
  - Actually, cancel all of the above (uses multiple RST_STREAM frames)
  - GET x101
  - GET x102
  - (...)
  - GET x200
  - Actually, cancel all of the above (uses multiple RST_STREAM frames)
  - (...)
This can be repeated a lot of times. The problem is that the endpoint, which typically is a reverse proxy, might start dispatching the requests before it reads about their cancellation. And sure it will cancel them, but by the time of cancellation it will already have resulted in some resource usage downstream. Such requests are accepted because at no point the client has opened more than 100 streams, which is the typical concurrency limit. The example from the blog manages to squeze in a single packet 1000 GETs (i.e. 1000 HEADERS) correctly interleaved with RST_STREAM.

Maybe it's just me, but it's always fun to see such creative and simple abuses of protocols/code.

Re: The largest DDoS attack to date, peaking above 398M rps

#197

Post by master-lincoln »

starcraft2wol wrote: post #161
gchamonlive wrote: post #69

Earlier quoted context omitted.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

> Let's go back to username and password. 2FA forces scammers to up their game. Let's do it. It works for the website you're using right now. 2FA was in large part motivated by limiting bot accounts and getting customers phone number. I can't imagine how much productivity the economy loses every day due to 2FA.

Is this sarcasm? If not please provide some more details on why you think "2FA was in large part motivated by limiting bot accounts and getting customers phone number". I never used a phone number for 2fa. Mostly TOTP. Bots could do that too. I don't see the connection.

>I can't imagine how much productivity the economy loses every day due to 2FA.

Is it really that much? Every few days I have to enter a 6 digit number I generate on a device I have with me all the time. Writing this comment took me as much time as using 2fa for a handful of services for a month.

Re: The largest DDoS attack to date, peaking above 398M rps

#198

Post by [deleted] »

Egrodo wrote: post #162
codedokode wrote: post #75

Such attacks are possible because ISPs do not want to adopt a protocol that would allow any host to send a special packet to block malicious traffic on the upstream provider or even at the source network. In this case networks like Cloudflare would become unnecessary.

If it becomes this easy to block traffic couldn't malicious applications really mess up a user by spamming out reject packets for common IP?

[deleted]

Re: The largest DDoS attack to date, peaking above 398M rps

#199

Post by dmd »

spacephysics wrote: post #188
_ea1k wrote: post #147

Earlier quoted context omitted.

But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inability to stop attacks at the source and heavy overreliance on massive cloud providers to do it for us. 2FA and password managers didn't make us heavily reliant on massive companies.

A similar analogy can be made with the likes of westward expansion in the continental US. Back then, you got a piece of land, and really could do what you wanted with it. Build a business, farm, etc. some government taxes but nothing crazy. But you had to deal with criminals, lack of access to medical care, and lack of education. Now to do the same, you have a slew of building codes, regulations, zoning laws, and are…

> home owners can still just have an egg or vegetable stand at the end of their driveway

No you can't. That is illegal without a "cottage food" license, training, and labeling in most of the US.

https://www.pickyourown.org/CottageFoodLawsByState.htm

Re: The largest DDoS attack to date, peaking above 398M rps

#200

Post by bombcar »

dmd wrote: post #199
spacephysics wrote: post #188

Earlier quoted context omitted.

A similar analogy can be made with the likes of westward expansion in the continental US. Back then, you got a piece of land, and really could do what you wanted with it. Build a business, farm, etc. some government taxes but nothing crazy. But you had to deal with criminals, lack of access to medical care, and lack of education. Now to do the same, you have a slew of building codes, regulations, zoning laws, and are…

> home owners can still just have an egg or vegetable stand at the end of their driveway No you can't. That is illegal without a "cottage food" license, training, and labeling in most of the US. https://www.pickyourown.org/CottageFoodLawsByState.htm

Child-run lemonade stands are technically illegal in most states (some have actually carved out exemptions for them because of overzealous policing).

Garage sales often have a specific carve out, also, and limitations on numbers of time per year, etc.

Most areas nobody cares at all until it becomes a nuisance somehow.

Post reply on HN