Cloudflare is the simplest solution, but for the sake of treating this like a system design exercise, can you reasonably assume that there is not an infinite supply of devices with which to conduct the attack, fingerprint the devices, and block them?
Ask HN: How to survive indefinite DDoS attack?
11–20 of 62 posts
Re: Ask HN: How to survive indefinite DDoS attack?
#12Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it). Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out. If checking the auth is expensive enough to cause problems, require…
That's "building your own cloudflare".
> Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic
The traffic is from compromised devices, so it's very cheap.
Re: Ask HN: How to survive indefinite DDoS attack?
#13Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.
Doesn't it bring you a tiny bit of concern that this is only current answer people can give?
There are others e.g. ddos-guard, akamai.
Re: Ask HN: How to survive indefinite DDoS attack?
#14I work for a company in the DDoS mitigation space and there is not nearly enough information in your question for anyone to offer any kind of sensible response for your particular situation.
What is your business? How much traffic "normal" do you get? What is the size of the attack? What is the bandwidth of your upstream connection? Who are your customers? Where is it hosted? What are your acceptable thresholds for false negatives and positives? Do you know who is attacking you and why?
Most every hosting provider will have some sort of DDoS monitoring and mitigation on their networks already. Their response to sustained or repeated attacks might range from scrubbing the bad traffic before it gets to you and not notifying you at all, to reaching out to you to work with you on both ends of the issue, to cancelling your account.
If you just have a fairly simple website that you host yourself, Cloudflare likely a fine option. If you have more advanced needs, you should talk to a more comprehensive DDoS solution vendor.
Re: Ask HN: How to survive indefinite DDoS attack?
#15Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.
I hate that this is the right answer. I hate that I use it too. I hate that I don't have time/cash to explore alternatives.
because alternatives usually cost several thousands $/months..
what has the internet become?
Why not create blacklists (even on a timed basis) with the IPs to block at BGP level? and these blacklists managed by bodies,
- okay they are bodies..., but at least they can be open foundations to which it is not mandatory to join (as in the case of cloudflare)-
available to BGP backbones and routed on a network, castrate the blacklisted traffic?
maybe even at host level be able to make one IP available for normal traffic and possibly one for blacklist traffic using BGP routings to which the blacklist tables are applied?
Re: Ask HN: How to survive indefinite DDoS attack?
#16Cloudflare is the simplest solution, but for the sake of treating this like a system design exercise, can you reasonably assume that there is not an infinite supply of devices with which to conduct the attack, fingerprint the devices, and block them?
Depending on the weight of DDoS, you may simply find it saturates your upstream router so very little valid traffic even reaches you. Or your ISP kicks in their own protection and drops all your traffic.
Edit: https://www.cloudflare.com/learning/ddos/famous-ddos-attacks... largest ever seems to have been about 180k devices. Getting your upstream to accept that many firewall entries is a big problem.
Re: Ask HN: How to survive indefinite DDoS attack?
#17People mention Cloudflare. Google Cloud Armor is another option (we looked into both).
A colleague was DDoS attacked and was able to move the service behind Cloud Armor in a few hours, effectively ending a ridiculous barrage of network requests. I think CA charges a minuscule amount per request, and can be capped with a fix monthly cost which limits the DDoS liability.
Re: Ask HN: How to survive indefinite DDoS attack?
#18Cloudflare is the simplest solution, but for the sake of treating this like a system design exercise, can you reasonably assume that there is not an infinite supply of devices with which to conduct the attack, fingerprint the devices, and block them?
The first "D" in "DDos" means "distributed," which means there _effectively is_ an infinite supply of devices with which to conduct the attack. It's a hard problem, which is why DDoS attacks are so prevalent and difficult to defend against without sophisticated mitigation devices and services. You have to block the "bad" traffic by some characteristic and many DDoS attackers have gotten _very_ good at making their attack traffic look almost identical to legitimate traffic.
Re: Ask HN: How to survive indefinite DDoS attack?
#19Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it). Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out. If checking the auth is expensive enough to cause problems, require…
That sounds fun for an engineer but if it’s a business then you should focus on your core business and not trying to become a anti-ddos service.
Re: Ask HN: How to survive indefinite DDoS attack?
#20Pay couple of $ for Cloudflare be done with it. https://www.cloudflare.com/ddos/ Don't forget to have a fresh IP before doing the move so that your origin is unknown.
ever since cloudflare went political and started kicking off customers for their opinions, i never touched that service and never will. and i have a very long memory. but alternatives are welcome.