[deleted]
Fastmail, Runbox, and Posteo under DDoS extortion attack
121–130 of 130 posts
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#122Earlier quoted context omitted.
The general quality of DDoS scrubbing services has dramatically improved in the last 10 years. I work for a large tech company and Silverline has protected us from 100G+ attacks.
What about 250, 500, 1tbps. Hell 2.5 is possible now 100gbps is basically trivial test for a new botnet
Cloudflare is the most well-known, but there are lots of providers now that provides these level of service, from the old guys like Akamai's Prolexic to new ones like Imperva to tier-1 ISPs like Telia's.
Additionally, depending on the exact service, you can certainly firewall traffic - close to the source.
The specific problem here is that mail servers, since that is not the target of DDoS until now, which means that there are few companies who do provide mail exchange-specific DDoS protection, which means larger companies (Verizon/Yahoo, Microsoft/Outlook, Google/Gmail) just operate servers well beyond what they really need, and I don't think that they can just run to Cloudflare and violate their privacy promise in the process.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#123Coincidentally, the app password that I've used for Fastmail's CalDAV service for years suddenly started causing 403's today. I wonder if that's related (but can't think of how it could be)
(I work for Fastmail.) One of our attempts at doing some mitigation of the attack caused this; we fixed it about 16:00 US Eastern this afternoon. Sorry about that! Without getting into too much detail: we were limiting some HTTP methods, but unintentionally blocked REPORT, which DAV clients use to see what’s changed.
All good now. Thanks!
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#124Earlier quoted context omitted.
Urbit solves both of these issues in a clever way with how it handles identity on the network.
Doesn't urbit use the generic "pay to join" identities? I don't think it is a scalable solution for general applications.
Only the initial identity is non-zero cost (and there are free IDs, but they're more likely to get banned for spam).
The point of the cost is that it's cheap but non-zero. It makes spam uneconomical, creates pseudonyms for accruing reputation and makes it trivial to moderate (IDs are permanent).
Applications built on the platform can take advantage of this ID system and none of them need to rebuild auth or handle networking across the web. This means application devs can just focus on their apps and distribution is trivial.
The modern web is a nightmare of complexity for people trying to build applications, you basically need to raise VC and have a SaaS in order to be able to hire the armies of people required to build anything.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#125Well that explains it, I literally switched from gmail to fastmail 2 days ago and it was going amazingly until last night when I couldn't load it. "Oh great, an unreliable service I just paid a year for" -- this makes me want to support them even more. Their customer support was fantastic. I didn't inquire about the outage, instead a dns issue I'd created. If you're a heavy gmail user you should read this story of my…
I feel like I hear more and more of these horror stories. I’ve been looking to migrate my custom domain away from Google for a while and was also looking at Fastmail. I use an @gmail.com for everyday things because it’s widely recognised and easy to communicate to people over the phone or even face to face in a shop for a digital receipt.
If you keep verbal communication in mind when picking a domain it’s fine. Get a five character one and it’s five syllables instead of gmails two.
Doing the thing where you try to sign up to services using servicename@yourdomain.com confuses people though. I stopped doing that after having to explain to people I receive emails to any address sent to my domain a few times.
I could see using uncommon top level domains being a problem as well.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#126Earlier quoted context omitted.
Doesn't urbit use the generic "pay to join" identities? I don't think it is a scalable solution for general applications.
Only the initial identity is non-zero cost (and there are free IDs, but they're more likely to get banned for spam). The point of the cost is that it's cheap but non-zero. It makes spam uneconomical, creates pseudonyms for accruing reputation and makes it trivial to moderate (IDs are permanent). Applications built on the platform can take advantage of this ID system and none of them need to rebuild auth or handle net…
But Urbit is "overlay OS" -- which means it still uses all the existing stuff (Linux, filesystems, UDP, TCP, HTTP, Javascript, web browsers for frontend) but adds a whole bunch more stuff on top of it [0]. So you are not reducing complexity, but increasing it.
And it's identity management is based to Ethereum, so maybe just attach "Sign-in with Ethereum" component to the Mastodon instance, and you get something with same featureset as Urbit, but somewhat simpler and vastly more supportable. And as an extra, you get nice features like multi-machine scaling and live encrypted backups.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#127Earlier quoted context omitted.
Only the initial identity is non-zero cost (and there are free IDs, but they're more likely to get banned for spam). The point of the cost is that it's cheap but non-zero. It makes spam uneconomical, creates pseudonyms for accruing reputation and makes it trivial to moderate (IDs are permanent). Applications built on the platform can take advantage of this ID system and none of them need to rebuild auth or handle net…
But Urbit is "overlay OS" -- which means it still uses all the existing stuff (Linux, filesystems, UDP, TCP, HTTP, Javascript, web browsers for frontend) but adds a whole bunch more stuff on top of it [0]. So you are not reducing complexity, but increasing it. And it's identity management is based to Ethereum, so maybe just attach "Sign-in with Ethereum" component to the Mastodon instance, and you get something with…
Overlay OS is a strategy (worked well for the web), long term it'd be nice to run directly on the metal but that's obviously a ways off.
You can have simplicity with the proper abstractions and design to get there over time then you can fix it bit by bit. This is the only way a massive rewrite of the stack like this has any hope of success.
Mastodon is mostly a twitter clone - with a lot of effort you could probably tie server creation to eth IDs and resolve that bit at least (make it easier to spin up servers), but you don't solve the issue with updating servers to match versions and the fall out from all of that other stuff. You also don't solve application creation or distribution. Urbit's OS is designed as a deterministic function of its inputs - this is necessary to make it trivial to run/update the nodes. It's more than there being no distinction between users and nodes (though that's a big part).
I'd bet against any other federated system long term. Urbit is still a long shot, but if it wins - it wins big.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#128Earlier quoted context omitted.
I feel like I hear more and more of these horror stories. I’ve been looking to migrate my custom domain away from Google for a while and was also looking at Fastmail. I use an @gmail.com for everyday things because it’s widely recognised and easy to communicate to people over the phone or even face to face in a shop for a digital receipt.
If you keep verbal communication in mind when picking a domain it’s fine. Get a five character one and it’s five syllables instead of gmails two. Doing the thing where you try to sign up to services using servicename@yourdomain.com confuses people though. I stopped doing that after having to explain to people I receive emails to any address sent to my domain a few times. I could see using uncommon top level domains b…
I’m open to ideas! My poor imagination often seems to stumble across domains already taken :)
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#129Earlier quoted context omitted.
If you keep verbal communication in mind when picking a domain it’s fine. Get a five character one and it’s five syllables instead of gmails two. Doing the thing where you try to sign up to services using servicename@yourdomain.com confuses people though. I stopped doing that after having to explain to people I receive emails to any address sent to my domain a few times. I could see using uncommon top level domains b…
I’m open to ideas! My poor imagination often seems to stumble across domains already taken :)
I went first initial, middle initial, first three letters of last name. If that doesn’t work for you I’d just try different combinations of your names letters until you get something available.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#130Earlier quoted context omitted.
If you keep verbal communication in mind when picking a domain it’s fine. Get a five character one and it’s five syllables instead of gmails two. Doing the thing where you try to sign up to services using servicename@yourdomain.com confuses people though. I stopped doing that after having to explain to people I receive emails to any address sent to my domain a few times. I could see using uncommon top level domains b…
I’m open to ideas! My poor imagination often seems to stumble across domains already taken :)
Mine is firstname@firstnameLastinitial.dev and it makes people stumble, especially the .dev, also it's kind of rare nowadays but some sites don't think thats a TLD.