Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastie.org host pulls hosting after DDoS attack

pastie.org

Post reply on HN
Print view View original

41–50 of 90 posts

Re: Pastie.org host pulls hosting after DDoS attack

#41

Post by jsprinkles »

dknecht wrote: post #17
heliostatic wrote: post #7

Perhaps an opportunity for Cloudflare to offer support?

We would love to help, and have offered.

I'm looking at the "Compare Plans" page; is DDoS Mitigation part of another feature that I missed, or is it implicit in the service (i.e., a side effect of having a good CDN)? I can ask that an easier way: if my site takes a 10 Gbps hit, which plan would mitigate it? Enterprise? Do you bill for the transfer that you eat?

Genuinely curious and haven't really looked around the site much, and you guys hit my radar when you took on Lulzsec. Can't imagine the plethora of nasties directed at their gear.

Re: Pastie.org host pulls hosting after DDoS attack

#44

Post by kijin »

jsprinkles wrote: post #18
postfuturist wrote: post #5

DDOS attacks are a fact of life, nice to know that Rails Machine will throw you under the bus when one happens. Doesn't seem to fit their homepage description: "You write Rails apps. We deploy, manage, support, monitor, and scale them. Done."

So if someone throws multiple tens of gigabits at your customer, and your upstream threatens to turn off your entire hosting company, you would respond "no way, we're going the extra mile for our customer"? Rails Machine was, in all likelihood, compelled to act to either (a) preserve its relationship with is upstream or (b) preserve its relationship with its other paying customers that do not attract DoS attacks. You…

> paying customers that do not attract DoS attacks

A little off topic, but I've always felt a slightly uneasy about the concept of "attracting" DDoS attacks. Sure, if you knowingly piss off a bunch of script kiddies, you're attracting attacks. But it seems that nowadays, any site that hosts user-generated content is at risk of being attacked for any random reason. And yet, a lot of people talk about "customers who attract attacks" as if those customers are to blame. It almost sounds like blaming women who wear certain types of clothes for attracting sex crime.

Of course, the fact that you didn't do anything to provoke an attack might be irrelevant when your upstream faces a choice between cutting you loose and eating hundreds of thousands of dollars. People need to do what they need to do to protect their networks. Nonetheless, I'm curious what you guys think about the concept of "attracting attacks". If you blame the victim even a little bit, does that affect your judgment about what should be done in the case of an attack?

Re: Pastie.org host pulls hosting after DDoS attack

#45

Post by avree »

nicksergeant wrote: post #43

FWIW, apparently Rails Machine's CEO thinks some of Pastie's users are not-so-great: https://twitter.com/bradleyktaylor/status/194937146153508864

Uh, he's not talking about all of Pastie's users, he's stating that Pastie has some bad users who use it maliciously and threaten the provider.

Re: Pastie.org host pulls hosting after DDoS attack

#46

Post by prg318 »

saurik wrote: post #39
jsprinkles wrote: post #36

Earlier quoted context omitted.

Dropping UDP is a start, because most of these attacks randomize the UDP source address. The real problem is AS operators who let forged UDP addresses escape their network. If your outgoing edge ACL is not dropping source addresses that do not belong to you, you are doing it wrong . Period. Full stop. If the packets are random UDP sources, then there's not really much you can do on the receiving end except strategies…

Okay, but then why null route the entire machine, as opposed to dropping just the UDP packets going towards it? If you already have routing infrastructure that can disseminate "attempts to access this IP address will fail" it does not seem a stretch to disseminate "attempts to access this IP address over UDP will fail; over TCP there is no issue". Are "upstream bandwidth providers" really that impotent against that k…

The issue with dropping UDP is that DNS uses UDP in most implementations. Unless you have no need for DNS on your network, you might want UDP packets to be not dropped completely.

Re: Pastie.org host pulls hosting after DDoS attack

#47

Post by nicksergeant »

avree wrote: post #45
nicksergeant wrote: post #43

FWIW, apparently Rails Machine's CEO thinks some of Pastie's users are not-so-great: https://twitter.com/bradleyktaylor/status/194937146153508864

Uh, he's not talking about all of Pastie's users, he's stating that Pastie has some bad users who use it maliciously and threaten the provider.

Sorry, worded that wrong. Fixed.

Re: Pastie.org host pulls hosting after DDoS attack

#48

Post by Jare »

jsprinkles wrote: post #35
postfuturist wrote: post #31

Earlier quoted context omitted.

Any given site might not experience a DDoS attack, but if you run a hosting company, it will happen. The frequency depends on how many customers you have, how popular they are, etc. If a DDoS attack catches you by surprise, then you are very ill-prepared. One possible strategy is to throw the targeted customer under the bus and call it a day. For hosts of a certain size, that may be reasonable, as long as you clearly…

> I've seen these attacks mitigated single-handedly by an experienced fellow with no access to fancy equipment. I believe it went something like this, change the DNS to point at some EC2 instances to do front-end load balancing with some scripts that detect and drop connections from attacking IP addresses and do severe rate limiting. You can proxy legitimate requests back to the original servers. That isn't how it wo…

I understood the original comment about EC2 as a mitigation strategy so the hosting company's infrastructure doesn't receive the brunt of the DDoS gigabits (EC2 will) and it can still service all their other clients. In that case, even if the DDoS'd site will still be flooded and unavailable, its hosting plan doesn't need to be canceled outright. I suppose they could just skip EC2 and null-terminate the DNS until the DDoS stops, but I don't know if this has further implications.

In any case, thank you for a very informative post.

Re: Pastie.org host pulls hosting after DDoS attack

#49

Post by adrianpike »

seanp2k2 wrote: post #26
pestaa wrote: post #6

I can not understand these attacks. Why block a service that is free of charge, useful and did no harm? Unless of course this DDoS was not targeted, which makes even less sense to me. Also, why did Rails Machine throw out the site so quickly? If I choose to sponsor someone out of my free will, I'd do so without distinction from paying customers.

@everyone who doesn't work in hosting.... >"why did Rails Machine throw out the site so quickly?" If you run a datacenter, you pay for an uplink. That uplink has limited capacity. 4gbit, 10gbit...whatever. A big attack can saturate that link completely, so even with the biggest most expensive "mitigation device" on the market (some of this gear can get into the hundreds-of-thousands-of-dollars for /one/ device, mind…

A question about null routing - would the upstream provider or the datacenter do that?

Wouldn't one have to be dropping the packets at the upstream level in order to keep the pipe clear? At larger scales, is it common for the datacenter to own/control a router upstream, or would that be something that they would have to get in touch with their upstream provider to make happen?

Re: Pastie.org host pulls hosting after DDoS attack

#50

Post by jsprinkles »

kijin wrote: post #44
jsprinkles wrote: post #18

Earlier quoted context omitted.

So if someone throws multiple tens of gigabits at your customer, and your upstream threatens to turn off your entire hosting company, you would respond "no way, we're going the extra mile for our customer"? Rails Machine was, in all likelihood, compelled to act to either (a) preserve its relationship with is upstream or (b) preserve its relationship with its other paying customers that do not attract DoS attacks. You…

> paying customers that do not attract DoS attacks A little off topic, but I've always felt a slightly uneasy about the concept of "attracting" DDoS attacks. Sure, if you knowingly piss off a bunch of script kiddies, you're attracting attacks. But it seems that nowadays, any site that hosts user-generated content is at risk of being attacked for any random reason. And yet, a lot of people talk about "customers who at…

> It almost sounds like blaming women who wear certain types of clothes for attracting sex crime.

I completely stopped reading this comment here, when you wrote this, because that was a completely off-base comparison and has absolutely nothing to do with the topic at hand. Worse, you probably know it; I wouldn't assume you to be stupid. And that was a mountainously stupid comment.

In hosting, there are customers that attract DoS attacks. Period. Ask anybody who does hosting. IRC servers are a canonical example and are DoS magnets. Torrent trackers are another. Pastebin sites, like Pastie, are becoming another (look who uses pastebin.com a lot: Anonymous). Hell, Facebook and Google probably takes several DoS attacks a day just by nature of being well-known.

Don't even conflate my argument with an undertone of sexism.

Post reply on HN