Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mitigating a DDoS on Mastodon

coffee-and-dreams.uk

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Mitigating a DDoS on Mastodon

#21

Post by philpem »

wlkr wrote: post #3

Great write-up. As someone unfamiliar with the legal side of this, would it be worth the author contacting law enforcement of some kind?

Unlikely. From past experience (a 4-year-long online harassment and dirty-tricks campaign!) the police are generally clueless to online matters. The most common responses I've had were "we don't police the Internet", "there's no evidence" or "there's nothing we can do".

Unless you're, yanno, EMI Records, Sky TV or someone with political sway.

The most productive (best outcome) way of handling it tends to be to turn your OPSEC up to eleven and put all your XP into defence. Again, based on experience.

Re: Mitigating a DDoS on Mastodon

#22

Post by judge2020 »

tyingq wrote: post #6

Also a good idea to have more than one DNS server, from separate providers denoted as authoritative for your domain. Assuming your CDN will let you.

Cloudflare I believe will remove the site if other nameservers are added. Simply using a non-CF registrar and having a backup authoritative nameserver will suffice.

Re: Mitigating a DDoS on Mastodon

#23

Post by buro9 »

ekimekim wrote: post #4

On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".

Cloudflare EM for DDoS Protection here.

If a customer wants to hide their IP then the best way to do it:

1. Onboard onto Cloudflare

2. Audit your app and ensure you aren't leaking your IP (are you sending email directly? making web calls directly? - make adjustments to use APIs of other providers, i.e. send emails via Sendgrid API, etc)

3. Change your IP (it was previously public knowledge in your DNS records)

At this point your IP should be unknown, so...

4. Use `cloudflared` and https://www.cloudflare.com/en-gb/products/argo-tunnel/ to have your server call us, rather than us call you (via DNS A / AAAA records)

Because this connects a tunnel from your server, you can configure iptables and your firewall to close everything :)

Here's the help info: https://developers.cloudflare.com/argo-tunnel/quickstart/

PS: to the OP I tried to contact you via keybase, feel free to ping my email. We are working to improve the DDoS protection for attacks in the range you were impacted by and the product manager would enjoy your feedback if you're willing to share them in the new year.

Re: Mitigating a DDoS on Mastodon

#24

Post by dredmorbius »

koroshitekure wrote: post #11

hey, i'm the author of the article really... surprised it got submitted here incidentally i'm running pleroma, not mastodon. minor detail but you know

I'm quite active on Mastodon and HN, thought this might be of interest.

Would you prefer the title were modified? The mods can do that. I thought that specifying what the DDoS mitigation was applied to would be helpful, though my presumption of Mastodon was in error, apologies.

Re: Mitigating a DDoS on Mastodon

#26

Post by dredmorbius »

rehasu wrote: post #8

Is a federated system like Mastodon not setup in a way that users have access lists and if one server is down they simply connect to the next? I would expect to just limit the access to my server in a way that no illegal content is added to its storage and I don't have to pay horrendous fees for the network traffic and then just let the DDOS happen. At some point it needs to stop since the DDOSer will find nicer targ…

As others have noted: accounts are instance-bound.

Other Fediverse protocols -- I believe either Friendica or ... I think Hubzilla? -- have some level of account portability.

There's a fairly long-standing request for Mastodon to support this. For now, you can have accounts on other instances forwarded to your primary.

While you can export and import your own follows, followers of your account won't automatically redirect to the new home.

Masodon content however will syndicate across the Fediverse, and even some of my posts from a now-dead instance can (occasionally) be found.

Re: Mitigating a DDoS on Mastodon

#27

Post by dredmorbius »

pferde wrote: post #18

It just boggles my mind how petty and vindictive people can be.

Also: how much just one asshole can screw things up for everyone.

Unfortunately, this is probabalistically likely as any community grows. Equivalent raging occured fairly early in the life of other social networks such as Usenet and The WELL.

Re: Mitigating a DDoS on Mastodon

#29

Post by bloopernova »

buro9 wrote: post #23
ekimekim wrote: post #4

On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".

Cloudflare EM for DDoS Protection here. If a customer wants to hide their IP then the best way to do it: 1. Onboard onto Cloudflare 2. Audit your app and ensure you aren't leaking your IP (are you sending email directly? making web calls directly? - make adjustments to use APIs of other providers, i.e. send emails via Sendgrid API, etc) 3. Change your IP (it was previously public knowledge in your DNS records) At thi…

Is cloudflare affordable for an open source and low-funds project? (I honestly don't know the pricing, this isn't meant to be argumentative)

Re: Mitigating a DDoS on Mastodon

#30

Post by wlkr »

philpem wrote: post #21
wlkr wrote: post #3

Great write-up. As someone unfamiliar with the legal side of this, would it be worth the author contacting law enforcement of some kind?

Unlikely. From past experience (a 4-year-long online harassment and dirty-tricks campaign!) the police are generally clueless to online matters. The most common responses I've had were "we don't police the Internet", "there's no evidence" or "there's nothing we can do". Unless you're, yanno, EMI Records, Sky TV or someone with political sway. The most productive (best outcome) way of handling it tends to be to turn y…

Thank you for your insight. As you point out, it's no alternative to a robust defence, I was just curious as to whether it would ever actually be investigated. I would probably report it still just for accountability (e.g. insurance). Especially now you can report online.
Post reply on HN