Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are under attack

en.greatfire.org

Post reply on HN
Print view View original

201–210 of 283 posts

Re: We are under attack

#201

Post by shaneofalltrad »

sbov wrote: post #162
dreamins wrote: post #99

No one likes DDOSes from China. One can plead Amazon as much as one wants. Pay or get booted, there are probably 2 engineers paid 6 figures a year by Amazon getting paged for this DDOS, someone must pay for the time they spend tuning DDOS protection instead of their primary project to make attacked website accessible for everyone else. Source: worked for AWS, was oncall during similar attacks. Nasty things with those…

You mean more than I already am paying them? The two colo centers we've hosted in have always helped us with DDOS issues free of charge. Maybe that's not normal, but even a former employee telling us to GTFO looks bad on Amazon to me.

Interesting when your product can be spiked, and make significant increases in profit. This looks like numbers that could potentially knock a business out of business. Reminds me of old phone bills.

Re: We are under attack

#202

Post by [deleted] »

Sanddancer wrote: post #94
toaskaquestion wrote: post #61

Out of curiosity, who pays more -- the attacker or the victim? Purely from a monetary perspective. Edit: never mind, figured it's obvious. Aren't DDoS requests pretty much simple GET requests? Is it not possible to determine which requests to serve and which ones to ignore?

These days, DDoSes are not just lots of GET requests, because, as you said, they're fairly easy to mitigate. These days, the most common attacks are various UDP-based attacks, like NTP reflection [1]. You send a spoofed header to a server that speaks over UDP, and they send a huge amount of traffic to the victim. https://blog.cloudflare.com/understanding-and-mitigating-ntp...

[deleted]

Re: We are under attack

#203

Post by lucaspiller »

Sanddancer wrote: post #94
toaskaquestion wrote: post #61

Out of curiosity, who pays more -- the attacker or the victim? Purely from a monetary perspective. Edit: never mind, figured it's obvious. Aren't DDoS requests pretty much simple GET requests? Is it not possible to determine which requests to serve and which ones to ignore?

These days, DDoSes are not just lots of GET requests, because, as you said, they're fairly easy to mitigate. These days, the most common attacks are various UDP-based attacks, like NTP reflection [1]. You send a spoofed header to a server that speaks over UDP, and they send a huge amount of traffic to the victim. https://blog.cloudflare.com/understanding-and-mitigating-ntp...

Couldn't something like that be blocked at a firewall level with AWS though, i.e. drop everything except TCP port 80?

Re: We are under attack

#204

Post by simonebrunozzi »

dreamins wrote: post #99

No one likes DDOSes from China. One can plead Amazon as much as one wants. Pay or get booted, there are probably 2 engineers paid 6 figures a year by Amazon getting paged for this DDOS, someone must pay for the time they spend tuning DDOS protection instead of their primary project to make attacked website accessible for everyone else. Source: worked for AWS, was oncall during similar attacks. Nasty things with those…

I used to work at AWS too. Where were you? Seattle / support?

Re: We are under attack

#205

Post by cortesoft »

anon808 wrote: post #157
eastdakota wrote: post #93

Earlier quoted context omitted.

Thanks for the feedback. In the case of Lantern, they were taking advantage of a bug in our system. Specifically, they were setting the SNI field (outside the encrypted packet) of a request to look like it was going to an actual CloudFlare customer (e.g., news.ycombinator.com) and then setting the host header inside the encrypted request to point to some restricted site. The bug was that we did not check that the SNI…

That's a fair response to that case. Still curious about this quote: “We don’t do anything to thwart the content restrictions in China or other countries,” said Matthew Prince, chief executive of CloudFlare. “We’re a tech company and we comply with the law.”" So if Lantern were a customer, would the outcome still have been the same?

Well, if Lantern were a customer, then China could just block them like they do for any CF customer they want to block. The reason the bug was allowing people to get around the firewall was because they were pretending to access a site that wasn't blocked, but actually receiving content that was blocked.

Re: We are under attack

#206

Post by lucaspiller »

ramigb wrote: post #200
ramigb wrote: post #23

I think they need to use something similar to this ... http://en.wikipedia.org/wiki/Coral_Content_Distribution_Netw...

I would appreciate it if people who down voted my comment explained to me if it's because i'm wrong or because they don't understand what i am trying to say or just for the heck of it :).

The issue is your comment doesn't really add any value. Anyone can paste a random link saying "you should use this" but it takes effort to explain why it would be useful to them. HN comments are about fostering discussion, so say something to be discussed :-)

Re: We are under attack

#207

Post by ramigb »

lucaspiller wrote: post #206
ramigb wrote: post #200

Earlier quoted context omitted.

I would appreciate it if people who down voted my comment explained to me if it's because i'm wrong or because they don't understand what i am trying to say or just for the heck of it :).

The issue is your comment doesn't really add any value. Anyone can paste a random link saying "you should use this" but it takes effort to explain why it would be useful to them. HN comments are about fostering discussion, so say something to be discussed :-)

Thank you for your input, but 1. this is not a random link, 2. the explanation is all inside the link i posted, so why to be redundant? anyways, if i didn't care for a discussion i wouldn't post it at the first place and i wouldn't later ask why was i downvoted, thank you again for your opinion lucaspiller.

Re: We are under attack

#209

Post by DrStalker »

cookiecaper wrote: post #173
unethical_ban wrote: post #160

Earlier quoted context omitted.

I feel it shouldn't be unreasonable to expect AWS/Cloudflare/Akamai to have policy-based routing to blackhole a lot of these source subnets. Of course it's complex, but these are some of the largest hosting providers in the world.

I've found this is a common thing to say with AWS employees. One of them insisted that Amazon's ridiculous ephemeral storage policy (immediate, permanent, and irrevocable deletion on any halt or stop event, making accidental data loss a real possibility) had to be that way because it would just take too much hardware to allow a cooldown period before the drives were wiped. There's no way I believe that. I think Amazo…

Why isn't the persistent data put onto an EBS volume?

If ephemeral storage is a drive local to the virtual machine's host (which I think is the case) then having a cool down period would mean holding the hardware that used to be used by you in reserve until the grace period expired.

It's possible but it's a lot of work to solve a problem that can be better solved by not relying on ephemeral storage persisting.

Re: We are under attack

#210

Post by dreamins »

sbov wrote: post #162
dreamins wrote: post #99

No one likes DDOSes from China. One can plead Amazon as much as one wants. Pay or get booted, there are probably 2 engineers paid 6 figures a year by Amazon getting paged for this DDOS, someone must pay for the time they spend tuning DDOS protection instead of their primary project to make attacked website accessible for everyone else. Source: worked for AWS, was oncall during similar attacks. Nasty things with those…

You mean more than I already am paying them? The two colo centers we've hosted in have always helped us with DDOS issues free of charge. Maybe that's not normal, but even a former employee telling us to GTFO looks bad on Amazon to me.

I am not telling anyone to GTFO, nor, I believe, Amazon does. It depends on a DDOS, there are a lot of smaller-scale DDOSes are just absorbed. Some are stupid filtered easy enough that no one is notified, some are serious enough. My first oncall at Amazon I got ddosed from 3 VPS machines, easy enough, a month after same attacker started to shift machines inside VPS, then a month after attacker started to spoof ips within narrow range of ips, in just a half a year (yes! they can last THAT long) attack was coming from a range of spoofed IPs with a traffic that followed no pattern except for destination they wanted to go down at many gigabits per second.

In this case - 700k QPS (gigabits of ingress) of well engineered HTTP/HTTPS DDOS traffic is not something an average colo can or even will be willing to handle at all. I'm assuming a hot-potato DDOS, when a customer comes along with a long tail of colos and providers that already booted him. All that traffic, servers and ultra expensive engineer time. Everyone wants it for free, but ALAS.

Post reply on HN