Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastie.org host pulls hosting after DDoS attack

pastie.org

Post reply on HN
Print view View original

61–70 of 90 posts

Re: Pastie.org host pulls hosting after DDoS attack

#61

Post by jsprinkles »

moe wrote: post #59
jsprinkles wrote: post #57

Earlier quoted context omitted.

> Pulling the plug immediately is definitely not normal. Nulling immediately is. You're also assuming that this is Pastie's first DoS attack, which we don't know based on the information presented to us.

Nulling immediately is. For serious accounts (in the 6 digits/year) absolutely not, unless the attack is large enough to affect other customers. Admittedly RailsMachine looks very small, in all likelihood their pipe was rather easily clogged and they simply didn't have the choices that larger ISPs have.

> For serious accounts (in the 6 digits/year) absolutely not, unless the attack is large enough to affect other customers.

If it doesn't affect other customers, a hosting company won't act or even be aware, in most cases. They'll just send you a bill for the transfer. If someone attacks you and it impacts other customers, you get nulled. I'm aware of 7 digits/year and 8 digits/year accounts through industry anecdotes that have had machines nulled. The engineer operating the null doesn't say, "oh, that's X, maybe I shouldn't fix the network for my other customers".

I don't understand what you're disagreeing with.

Re: Pastie.org host pulls hosting after DDoS attack

#62

Post by tedunangst »

kijin wrote: post #44
jsprinkles wrote: post #18

Earlier quoted context omitted.

So if someone throws multiple tens of gigabits at your customer, and your upstream threatens to turn off your entire hosting company, you would respond "no way, we're going the extra mile for our customer"? Rails Machine was, in all likelihood, compelled to act to either (a) preserve its relationship with is upstream or (b) preserve its relationship with its other paying customers that do not attract DoS attacks. You…

> paying customers that do not attract DoS attacks A little off topic, but I've always felt a slightly uneasy about the concept of "attracting" DDoS attacks. Sure, if you knowingly piss off a bunch of script kiddies, you're attracting attacks. But it seems that nowadays, any site that hosts user-generated content is at risk of being attacked for any random reason. And yet, a lot of people talk about "customers who at…

Not all user generated content is the same. Some of it attracts more attention, some of it less. The site operators have a great deal of influence in determining what shows up. You could use HN as a pastie if you wanted. But I imagine if it started causing trouble, pg would enact measures to discourage such use.

I admire the people willing to fight the good fight, but it doesn't seem like the guy running pastie.org has any skin in the game. It's easy to decide you're going to run a laissez faire type site when you don't pay the bills.

Re: Pastie.org host pulls hosting after DDoS attack

#63

Post by moe »

jsprinkles wrote: post #61
moe wrote: post #59

Earlier quoted context omitted.

Nulling immediately is. For serious accounts (in the 6 digits/year) absolutely not, unless the attack is large enough to affect other customers. Admittedly RailsMachine looks very small, in all likelihood their pipe was rather easily clogged and they simply didn't have the choices that larger ISPs have.

> For serious accounts (in the 6 digits/year) absolutely not, unless the attack is large enough to affect other customers. If it doesn't affect other customers, a hosting company won't act or even be aware, in most cases. They'll just send you a bill for the transfer. If someone attacks you and it impacts other customers, you get nulled. I'm aware of 7 digits/year and 8 digits/year accounts through industry anecdotes…

I'm disagreeing with your black/white record.

There's a bit of middle ground between "sending a bill" and nulling.

I've been hit by two larger attacks in the past (GBit/s range) and the respective ISPs were both extremely supportive, switching our IPs while they tightened their filters. Neither billed us a dime despite our ingress spike making quite a bump in their charts and a lot of handholding over 2-3 days.

Re: Pastie.org host pulls hosting after DDoS attack

#64

Post by saurik »

prg318 wrote: post #46
saurik wrote: post #39

Earlier quoted context omitted.

Okay, but then why null route the entire machine, as opposed to dropping just the UDP packets going towards it? If you already have routing infrastructure that can disseminate "attempts to access this IP address will fail" it does not seem a stretch to disseminate "attempts to access this IP address over UDP will fail; over TCP there is no issue". Are "upstream bandwidth providers" really that impotent against that k…

The issue with dropping UDP is that DNS uses UDP in most implementations. Unless you have no need for DNS on your network, you might want UDP packets to be not dropped completely.

Ah, that a web host might want to host their own DNS in house (maybe for ease or cost) is not something I considered (I outsource DNS as it is sufficiently performance sensitive you really want to AnyCast it against numerous networks, and there are people that specialize in that). As a client you can just use TCP for DNS. (Again: I am not a host ;P. Thanks!)

Re: Pastie.org host pulls hosting after DDoS attack

#65

Post by marshray »

jsprinkles wrote: post #36
saurik wrote: post #32

Earlier quoted context omitted.

As someone who does not work in hosting, I am somewhat surprised that "upstream bandwidth providers" don't have mediation strategies for DDoS attacks. It is my understanding that most of the asshats out there aren't sitting on Stuxnet: they have well under a hundred machines that they are able to flood traffic at you with (which is certainly more than enough). It seems like there are network-level mechanisms you can…

Dropping UDP is a start, because most of these attacks randomize the UDP source address. The real problem is AS operators who let forged UDP addresses escape their network. If your outgoing edge ACL is not dropping source addresses that do not belong to you, you are doing it wrong . Period. Full stop. If the packets are random UDP sources, then there's not really much you can do on the receiving end except strategies…

That's assuming the AS operator is not actually sponsoring the DDoS attack.

Re: Pastie.org host pulls hosting after DDoS attack

#66

Post by sauteedbiscuits »

wrecked wrote: post #60

I'd like to apologize to those who have been negatively impacted by my decision to pull support for Pastie (especially Josh). To understand why I made the decision to pull our support after 9 hours of multiple DDOS attacks, I'd like to share some background and our ops philosophy. It is important to understand that I put our existing customers that pay us to manage and scale their high growth revenue-generating web a…

You should edit your post to remove the 6th paragraph. Not your place to be calling pastie a increasing malware/virii distribution site. In fact, Not only is it libelous, but its not even appropriate to share with us. There is a reason companies dont get to comment on every bad thing that gets pointed their way.

IMO, your response does more damage to you than trying to explain it away. Doesnt matter if the guy is not paying you or not. In fact, your privacy policy says you wont do this and you just did.

I am not sure whats worse when you get hosted with you:

Is it when they disconnect you for having a incoming attack, or the public post afterwards where they air your dirty laundry?

Wow, its even worse on twitter:

https://twitter.com/#!/bradleyktaylor/status/194937146153508...

Re: Pastie.org host pulls hosting after DDoS attack

#67

Post by sha90 »

datums wrote: post #13

This behavior of unplugging the destination of the DDoS is common with smaller hosts. They don't have the capital to spend on expensive mitigation devices. There are times when these attacks affect their entire network (bad design), so their quick and fast solution is to null route you at their cores.

The issue isn't unplugging, I don't think anybody here thinks that it is unreasonable if they were to do this. The issue is that they kept the site unplugged for good because a single DDoS attack. My analysis based on the official response is that they used this incident as an excuse to drop the site because it was too much of a hassle to deal with the takedown notices.

Re: Pastie.org host pulls hosting after DDoS attack

#68

Post by wrecked »

sauteedbiscuits wrote: post #66
wrecked wrote: post #60

I'd like to apologize to those who have been negatively impacted by my decision to pull support for Pastie (especially Josh). To understand why I made the decision to pull our support after 9 hours of multiple DDOS attacks, I'd like to share some background and our ops philosophy. It is important to understand that I put our existing customers that pay us to manage and scale their high growth revenue-generating web a…

You should edit your post to remove the 6th paragraph. Not your place to be calling pastie a increasing malware/virii distribution site. In fact, Not only is it libelous, but its not even appropriate to share with us. There is a reason companies dont get to comment on every bad thing that gets pointed their way. IMO, your response does more damage to you than trying to explain it away. Doesnt matter if the guy is not…

The pastes that we receive complaints about are publicly viewable and searchable by anyone. The increase in these kinds of pastes is also publicly observable.

If a YouTube employee said that some naughty YouTube users post copyrighted videos, it wouldn't be private information or libellous as such videos are publicly viewable.

I'll edit to clarify that the overwhelming number of Pastie users are "using it for good" as Josh politely requests on the site.

Re: Pastie.org host pulls hosting after DDoS attack

#69

Post by sha90 »

jsprinkles wrote: post #40
saurik wrote: post #39

Earlier quoted context omitted.

Okay, but then why null route the entire machine, as opposed to dropping just the UDP packets going towards it? If you already have routing infrastructure that can disseminate "attempts to access this IP address will fail" it does not seem a stretch to disseminate "attempts to access this IP address over UDP will fail; over TCP there is no issue". Are "upstream bandwidth providers" really that impotent against that k…

That's what most providers (certainly the one I've worked at) do, in fact, do, is null route the entire machine. Rather than leave you nulled in the router for weeks waiting for the attack to subside, eventually, they'll just cut you loose. That's the typical form these things take. It would be tempting to blackhole UDP, but it's just as easy to flood a pipe with TCP. You don't need an established connection to get p…

"You mess with my customers"? So, pastie.org was asking for it by hosting a free-form data pasting site? Again, this is you acting like pastie.org is the one at fault and is responsible for a bunch of idiots deciding to saturate the line.

It seems as though you're skewing the issue here. And I think the real issue has nothing to do with whether pastie.org was a paying customer. I'd be interested to know if RM would do the same thing if there was no sponsorship arrangement and it was paying regular bills. My hypothesis is they'd throw them under that same bus -- and that's really what this comes down to. It's hard to be sympathetic with a company that gives up on its customers (paying or not) after "9 hours". Given that they had been hosted for 3 years prior, a night of DDoSing seems like a really isolated incident, and no reason to drop them permanently. Of course, we don't know if there were other DDoSes, but given that wrecked was so eager to share the piracy concerns and didn't mention any other DDoSes, I don't think there are any.

Post reply on HN