Earlier quoted context omitted.
What's the actual cost to me of my blog being offline for a few hours? Basically nothing. Certainly less than the couple of bucks someone might spend on a DDoS service
What's the cost for someone to put their blog behind cloudflare, besides a few minutes of setup?
Do not put your site behind Cloudflare if you don't need to
201–210 of 391 posts
Re: Do not put your site behind Cloudflare if you don't need to
#202Earlier quoted context omitted.
Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.
That’s like saying you should buy car insurance after you wreck your car
Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.
Re: Do not put your site behind Cloudflare if you don't need to
#203> For your small blog with one hundred visitors per month, it's probably the same: "no one will burn their DDoS capabilities on you!" If this is their core argument for not using CDN, then this post sounds like a terribly bad advice. Hopes and prayers do not make a valid security strategy. Appropriate controls and defenses do. The author seems to be completely missing that it takes only a few bucks to buy DDoS as a s…
People act as if outages are some solvable problem and each outage should never have happened and we need to act (cloud no cloud, firewall rules, and so on) each time.
Rather I think history has shown this stuff happens and if the impact is terrible ... fine.
Re: Do not put your site behind Cloudflare if you don't need to
#204Earlier quoted context omitted.
You keep saying stuff like "the fallout" and "the repercussions" but then the only example you can provide is talking to customer service to bring your stuff back online. Is that it? Honestly speaking, not being sarcastic at all.
So the internet is a series of pipes, or tubes, whatever. This quintessential personal blog website is hosted somewhere in this inter connected mess of things. There’s a hierarchy of these pipes/tubes, and they all have some ever diminishing capacity as they head from a mythical center to the personal blog website. When the bad guys want to DDoS the personal blog website they don’t go and figure out the correct amoun…
See: BGP Blackhole Community (usually 65535:666).
Re: Do not put your site behind Cloudflare if you don't need to
#205Re: Do not put your site behind Cloudflare if you don't need to
#206Earlier quoted context omitted.
> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't…
Not may area, so forgive me. How does taking the site down stop the DDOS attack? Isn't the host network still being bombarded by garbage packets, even if there isn't anything there listening? Or is routing the destination IP to /dev/null enough to blunt the attack? I know there are different kinds of attacks (e.g. some that are content based, impacting the individual server), but I thought most of them were just "leg…
Internet packets have to travel through many routers between the source and the attack and the server they're attacking, at each step the routers usually get smaller. the smaller routers are less able to withstand the amount of traffic destined for one server, which means they can't route traffic to all the other servers that are not under attack. a common strategy is to drop the traffic at a much farther away server, thus protecting the smaller routers, thus protecting all the other servers.
The host Network would definitely still be affected by the DDOS, which is why the strategy is often to "blackhole" the traffic farther away from the individual server racks.
I see people say route traffic to /dev/null All the time, but I personally try to reserve that for the individual servers or the nearest router, just to avoid your exact confusion.
depending on how well designed, any specific network is the "hug of death" which has taken down many sites would also degrade the performance of the peers next to that server. Which is why many ISP are quick to block the traffic farther away. To protect not you but their other customers.
To be fair (pedantic), if it's part of a DDOS, it's not a legit request. Depending on the capabilities of the attackers, they will either choose obviously invalid requests because those take longer to process or exclusively valid requests which take longer to process. it is generally speaking much easier to send valid well-formed requests because that's what most libraries exist to do. you're often writing custom code if you want to send an invalid request because that is a bug in other cases.
A good example of an invalid request is setting up TLS transmitting a partial packet and then closing the connection (or leaving the TCP open), This one can be particularly expensive and much harder to detect.
> How does taking the site down stop the DDOS attack?
When people say take the site down, in this context, they often mean one of two things, either changing the DNS configuration to point to a different IP address (or none at all), or "null routing" traffic to the under attack IP, at an edge router, edge in this case meanthing their upstream ISP or other network peer. (farther from the victim server) I object to both uses because the specificity is important. When I say take down the server, I almost always mean quit [nginx] or power off the box.
Re: Do not put your site behind Cloudflare if you don't need to
#207Re: Do not put your site behind Cloudflare if you don't need to
#208If you have a blog with 100 visitors per month why would you worry about being hit by an 4-8 hours outage once every year or two? I like Cloudflare because it is easy to setup and manage and because the amount of value you get for free or just a few bucks per month can’t be matched by any other company. Sure, if my income depends on my website/service uptime then I would probably consider other options. I think for m…
Re: Do not put your site behind Cloudflare if you don't need to
#209I dislike CloudFlare for their extremely hostile stance against VPNs and for collecting a near autocratic control of a large part of the “world wide” web. I think that there are very valid concerns regarding that. And yes, that power is given to them by service providers, however also essential services use it and as a user I can not choose to not use your service without CF, so it’s still very much asymmetric.
Re: Do not put your site behind Cloudflare if you don't need to
#210Which is more likely, a DDOS attack on your site or a Cloudflare outage? I think that for most sites the DDOS attack is more likely.