Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are under attack

en.greatfire.org

Post reply on HN
Print view View original

181–190 of 283 posts

Re: We are under attack

#181

Post by wheaties »

cpncrunch wrote: post #91
iolothebard wrote: post #42

Earlier quoted context omitted.

Wow, I haven't done dedicated hosting in a long time, the prices are insane there! https://www.ovh.com/us/dedicated-servers/enterprise/2014-MG-... Thanks for posting :-) I've been looking for provider possibilities for my next failed startup. I'm not sure how they can deliver for that price but who am I to complain!

I think the reason they can offer it so cheap is a combination of scale, cheap electricity, and tax breaks. iWeb is also in Quebec, so I figured there must be some tax break. Lo and behold there is one heck of a tax break: http://www.investquebec.com/quebec/en/financial-products/smb... Basically the Quebec government pays 24% of your company's wages, up to $83,333 per employee!

Hmmm... now if there were a place to start a business...

Re: We are under attack

#182

Post by jldugger »

cookiecaper wrote: post #173
unethical_ban wrote: post #160

Earlier quoted context omitted.

I feel it shouldn't be unreasonable to expect AWS/Cloudflare/Akamai to have policy-based routing to blackhole a lot of these source subnets. Of course it's complex, but these are some of the largest hosting providers in the world.

I've found this is a common thing to say with AWS employees. One of them insisted that Amazon's ridiculous ephemeral storage policy (immediate, permanent, and irrevocable deletion on any halt or stop event, making accidental data loss a real possibility) had to be that way because it would just take too much hardware to allow a cooldown period before the drives were wiped. There's no way I believe that. I think Amazo…

I've had RAID 6 fail. It should be extremely rare, but isn't. And at AWS's scale, It's not hard to imagine servers going offline regularly. Ephemeral storage as a policy makes sense to me in the sense that you can separate out that what's important from that which is ephemeral, and provide cheaper storage than a more HA solution like ganeti.

Re: We are under attack

#183

Post by datashovel »

It seems a little hypocritical to me that AWS will create a service for every technology known to man, but will not create a service to help companies who rely on their infrastructure to deal with DDoS.

Re: We are under attack

#184

Post by saywhst »

cookiecaper wrote: post #173
unethical_ban wrote: post #160

Earlier quoted context omitted.

I feel it shouldn't be unreasonable to expect AWS/Cloudflare/Akamai to have policy-based routing to blackhole a lot of these source subnets. Of course it's complex, but these are some of the largest hosting providers in the world.

I've found this is a common thing to say with AWS employees. One of them insisted that Amazon's ridiculous ephemeral storage policy (immediate, permanent, and irrevocable deletion on any halt or stop event, making accidental data loss a real possibility) had to be that way because it would just take too much hardware to allow a cooldown period before the drives were wiped. There's no way I believe that. I think Amazo…

if you need persistant storage, use EBS. Ephemeral is self-defined.

Re: We are under attack

#185

Post by [deleted] »

at-fates-hands wrote: post #51
qeorge wrote: post #36

Earlier quoted context omitted.

CloudFlare is probably not a good choice. They recently blocked access to a similar service, Lantern, per the linked WSJ article. "CloudFlare, which offers content-delivery network services, said last week it cut off Lantern’s use of the service, saying it was unauthorized. “We don’t do anything to thwart the content restrictions in China or other countries,” said Matthew Prince, chief executive of CloudFlare. “We’re…

This is actually pretty eye opening to me considering they tout themselves as a top notch defense against DDoS attacks. I might have to reconsider mine and my clients choice of providers for this very purpose.

[deleted]

Re: We are under attack

#186

Post by [deleted] »

cookiecaper wrote: post #173
unethical_ban wrote: post #160

Earlier quoted context omitted.

I feel it shouldn't be unreasonable to expect AWS/Cloudflare/Akamai to have policy-based routing to blackhole a lot of these source subnets. Of course it's complex, but these are some of the largest hosting providers in the world.

I've found this is a common thing to say with AWS employees. One of them insisted that Amazon's ridiculous ephemeral storage policy (immediate, permanent, and irrevocable deletion on any halt or stop event, making accidental data loss a real possibility) had to be that way because it would just take too much hardware to allow a cooldown period before the drives were wiped. There's no way I believe that. I think Amazo…

[deleted]

Re: We are under attack

#187

Post by TrevorJ »

dreamins wrote: post #99

No one likes DDOSes from China. One can plead Amazon as much as one wants. Pay or get booted, there are probably 2 engineers paid 6 figures a year by Amazon getting paged for this DDOS, someone must pay for the time they spend tuning DDOS protection instead of their primary project to make attacked website accessible for everyone else. Source: worked for AWS, was oncall during similar attacks. Nasty things with those…

I'm pretty sure they don't make 30k a day though.

Re: We are under attack

#188

Post by neurotixz »

rprime wrote: post #29
cpncrunch wrote: post #17

Move to OVH -- they offer free DDoS protection as standard, and unlimited bandwidth. I just moved to OVH after getting DDoSed. I'm paying $109/month for a quad core 3.7Ghz Xeon, 64GB RAM, dual 2TB software RAID. It's a pretty sweet deal, and I haven't had any problems so far.

Unrelated to the story at hand. Have you been recently DDoSed on OVH? I know that (at least some time ago) they just null-route/deactivate your account on spot with no notification on anything that looks like a DDoS.

They are using Arbor in their core network, and auto mitigate attacks on customers now. I am working with Arbor systems as well as others for DDoS protections where I am working now, and I can confirm that it works quite well.

Takes about 5 mins to kick in once an attack has started, which is very good.

Re: We are under attack

#189

Post by iopq »

MichaelGG wrote: post #156
baby wrote: post #153

Earlier quoted context omitted.

Why not redirect to a CAPTCHA to prove that the user is not a BOT?

So now you DDoS the captcha system. For companies not operating with massive bandwidth and computing power, you can just overwhelm their defenses. Cloudflare can get away with it, because they explicitly set out to be able to "service" those super huge number of requests. I was working on an anti DDoS system for SIP, a UDP-based protocol. Basically the options were: 1. lockdown, just whitelist known good customers, a…

Good luck DDoSing ReCAPTCHA, I'll wait

Re: We are under attack

#190

Post by [deleted] »

powertower wrote: post #126
dreamins wrote: post #99

No one likes DDOSes from China. One can plead Amazon as much as one wants. Pay or get booted, there are probably 2 engineers paid 6 figures a year by Amazon getting paged for this DDOS, someone must pay for the time they spend tuning DDOS protection instead of their primary project to make attacked website accessible for everyone else. Source: worked for AWS, was oncall during similar attacks. Nasty things with those…

Why don't providers just set up a system that creates a country-level null route for a given destination IP? And have a UI with a checkbox for the user to do it, for any selected country. It would mitigate the issue, and once it's over, the user can un-restrict traffic / or just keep blocking if it's a non-valuable source. I know you can do this on the server, using many different techniques. But this does not help a…

[deleted]
Post reply on HN