Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode launches free DDoS protection

linode.com

Post reply on HN
Print view View original

121–130 of 182 posts

Re: Linode launches free DDoS protection

#121

Post by buro9 »

stavros wrote: post #120
buro9 wrote: post #89

Earlier quoted context omitted.

> Now we see Linode offering DDOS (maybe saving you money from paying CloudFlare)? I work for Cloudflare, and we do not charge you money for our DDoS protection. It's free and included on every plan level including our free level, and the protection you get is equal to the protection our enterprise customers get. In other product features we have we also work hard to make sure we do not charge you for any bad traffic…

As a very satisfied CloudFlare customer (read "leech", since I'm using the free tier), I have seen your dashboard serve 300 GB of data for me some days, which never reached my server because of caching. It would be nice to be able to see a list of the ten most bandwidth-using URLs for a period, so I can maybe save you some bandwidth in case it's an attack or something similar. Currently, since I use caching, I never…

Consider that a feature request heard, I'll make sure the product and engineering managers who do the HTTP and cache analytics know about it.

Mind if I put them in touch with you?

And hey again, long time no speak... if you're in London let me know. Otherwise one day I'll make it to wherever you are in the world now.

Re: Linode launches free DDoS protection

#122

Post by bberenberg »

buro9 wrote: post #100
rmdashrfstar wrote: post #99

Earlier quoted context omitted.

Do you publish metrics on “attacks prevented” (or access to logging and monitoring) for customers?

Yes. For HTTP customers there are full SIEM logs under Firewall > Overview on our dashboard, and for paid tiers there are drill-down analytics in addition to the full SIEM logs. There is also log push to receive near real-time full HTTP logs into Google or AWS for your own analysis and these show if a firewall feature touched the request or if it was served from cache. In addition for HTTP customers we show graphs of…

These are great examples of technical details, but they're difficult to translate into impact and business value.

Would 100k SYN floods have slowed me site down? Would it have taken it offline? Would it have caused the site to remain up but corrupt data on the backend for some reason?

Off the top of my head, I would think about offering a "replay attack against your staging infra" feature on higher tier plans. The price point should help prevent someone leveraging you as an attack platform, and customers will be able to understand the value that you're bringing to the table in a much more practical way.

Re: Linode launches free DDoS protection

#123

Post by OrgNet »

buro9 wrote: post #92
regecks wrote: post #2

I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers. and then: >We are no longer able to detect any attack o…

> I never need to do anything, but I don't think these attacks are real anyway What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure? I ask as the engineering manager for DDoS protection at Cloudflare, and we stop a lot of attacks. But I feel this tension in the communication and product offering... if we do our job well enough that a…

Maybe describe how big the attack was in a communication with the customer? ie: how many connections per second, bandwidth used, etc? If you could trace the attacker and prosecute them, that you be a lot better, of course (and possibly the way that would gain the most confidence). In other words, if any of your claims could be confirmed by a third party, it would be good. Or you could propose to them to be hit by the attack for a set amount of time before you move in.

Re: Linode launches free DDoS protection

#124

Post by [deleted] »

buro9 wrote: post #89
djsumdog wrote: post #23

Earlier quoted context omitted.

You start using GCP/AWS/Azure, you're going to start using managed databases, security groups, etc. These are really nice. They can save you a lot of time as a startup. ... They are incredibly difficult to migrate. If you use terraform, it does support GCP/AWS/Azure/DO/Vultr, but you'll have to rewrite everything for each provider. For really simple providers (just a VM; in AWS, just EC2) you can still write all your…

> Now we see Linode offering DDOS (maybe saving you money from paying CloudFlare)? I work for Cloudflare, and we do not charge you money for our DDoS protection. It's free and included on every plan level including our free level, and the protection you get is equal to the protection our enterprise customers get. In other product features we have we also work hard to make sure we do not charge you for any bad traffic…

[deleted]

Re: Linode launches free DDoS protection

#125

Post by skrebbel »

diftraku wrote: post #112

Is it free [1], free* [2] or "free" [3]? [1]: free as in free beer, at no direct cost to users [2]: terms and conditions apply, free until you hit certain conditions (for example, constant barrage) [3]: free as in the customers pay for the (mandatory) DDoS protection via increased prices (similar to how I remember OVH handling their "free" DDoS protection)

I don't understand the difference between 1 and 3.

Re: Linode launches free DDoS protection

#126

Post by vld »

This isn't on the level of some other providers, they'll still null route you if you go over an unspecified amount of traffic. IIRC they use Juniper and Corero.

This is the reply I got from their support, just a few days ago:

>In short, our DDoS protection works by filtering out DoS-like traffic and is applied via the Linode network, so all Linodes are automatically protected. If your server were to be on the receiving end of a larger attack that impacts the Linode's host, we would need to prevent your server from receiving traffic until the attack ends. If you're concerned that you might be the target of a large DoS attack, there are a number of third-party DDoS mitigation services that you can use alongside your Linode.

>We aren't able to provide specific numbers since effects can vary depending on the attack. If you wanted to be sure your Linode is protected, we would recommend utilizing a third-party DDoS protection service overtop of your Linode's included protection. You also have the option of waiting to apply third-party protection until a null route is found to be necessary.

Re: Linode launches free DDoS protection

#127

Post by wielebny »

regecks wrote: post #2

I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers. and then: >We are no longer able to detect any attack o…

I've been using OVH services to host game servers for several years now, and their "VAC" is a godsend. Other providers would prefer to terminate my account or offer some kind of protection for thousand of dollars.

Re: Linode launches free DDoS protection

#128

Post by tomxor »

thrwaway69 wrote: post #25
pm90 wrote: post #10

Serious question: why would I want to use Linode over GCP or AWS? Asking as someone who hasn’t really dabbled with smaller cloud providers. Is it cost? Support? Developer tooling?

Cost and ease of development by not throwing thousand of options in front of your screen. Last time, I checked GCP costed me $26 (+ hidden charges) for the same I could get on many other places for $7. Some of them provide instant customer support too and are better because it's not an outsourced customer center in India or other places. Check out: vultr: https://www.vultr.com Scaleway: https://www.scaleway.com/en/ O…

> ease of development by not throwing thousand of options in front of your screen.

This! i don't want to spend my life navigating the maze of options and hidden costs of AWS et al, this is important to most projects for two reasons - time and cognitive load... Until things get truly massive scale, it's not worth the brain drain and time is more precious. Navigating the interface of Linode is actually pleasant and takes minimum effort.

If anyone needs a reason not to use AWS for your boss in a nutshell: employee sanity.

Re: Linode launches free DDoS protection

#129

Post by diftraku »

skrebbel wrote: post #125
diftraku wrote: post #112

Is it free [1], free* [2] or "free" [3]? [1]: free as in free beer, at no direct cost to users [2]: terms and conditions apply, free until you hit certain conditions (for example, constant barrage) [3]: free as in the customers pay for the (mandatory) DDoS protection via increased prices (similar to how I remember OVH handling their "free" DDoS protection)

I don't understand the difference between 1 and 3.

I may have used "free as in free beer" in a wrong way, what I meant with 1 was there are no additional costs to the current or new users (the rates for the services on offer stay the same).

For 3 (as was in the example), the cost of the DDoS protection service is directly added to the rates of services on offer.

OVH was quite blatant in this, as it had offered an optional DDoS protection service for a fixed rate of 3€/mo (this was a few years ago, exact details might be hazy). After they had a large network overhaul (with major interruptions), they simply raised the prices by 3€ and advertised the new, "free" DDoS protection service which was included in all of the services.

Re: Linode launches free DDoS protection

#130

Post by zzzcpan »

buro9 wrote: post #92
regecks wrote: post #2

I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers. and then: >We are no longer able to detect any attack o…

> I never need to do anything, but I don't think these attacks are real anyway What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure? I ask as the engineering manager for DDoS protection at Cloudflare, and we stop a lot of attacks. But I feel this tension in the communication and product offering... if we do our job well enough that a…

You are looking at it as if DDoS protection provides some additional value to customers they don't comprehend, but not as a basic necessity for hosting providers to ensure competitive quality of service they can offer customers, which is how it is in competitive markets. Trying to convince customers about attacks to fake perceived value is the same as trying to convince customers of edge nodes failing over to other nodes, but you don't do that, don't you? Think about why you don't do that. Faking perceived value is AV companies level of shadiness.
Post reply on HN