211–220 of 352 posts
Out of curiosity, would Cloudflare be able to sustain the amount of inbound requests they're handling?
Github can solve this problem with CloudFlare to the same extent that Github's product can be replaced with a hundred nginx servers with 10Gbit uplinks, large RAM caches, and effectively zero CPU time spent on each request.
I wonder what happened if Google put Baidu Ad javascript into the Safe Browsing list...
Browsers and all safe browsing software should treat any traffic through the Great Firewall of China as malicious and show a scary warning in your browser asking to confirm before going there.
The drop of traffic to Chinese servers and therefore customers would create such a big outcry it might make them stop.
Earlier quoted context omitted.
SYN Flood is already mitigated a long time ago with SYN cookies. The rest ..... well, it's basically just packets. I see this latest development as good news. The Javascript MITM trick was very clever because forcing github to render and serve a page is a lot more resource consuming than just firing packets at servers that ignore them (like a UDP or SYN flood). The latter can saturate network links until the sources…
> well, it's basically just packets Is "DNS flood" a DNS reflection attack though?
There are generally two types of floods against DNS infrastructure:
- Flood of "valid" requests, to a large number of open DNS recursors. To avoid caching they usually contain random prefix. Flood against large number of open DNS recursors basically causes the recursors to not work, and many authoritative servers to be overwhelmed.
- Flood directly against authoritative servers, to fill the network or use up all the CPU.
Traditional reflections aren't that popular any more.
Earlier quoted context omitted.
"Bully" is rather too weak a label for the perpetrator. This attack is criminal. If carried out by a sovereign nation, perhaps an act of war. We don't allow foreign raiding parties to enter our country to loot private businesses. Neither should we treat this attack as a simple act of "bullying". GitHub should get the full support of federal law enforcement, if not the military.
> perhaps an act of war > GitHub should get the full support of federal law enforcement, if not the military. Are you sure you wanna go there? Think it through ;) Don't let me stop you though. Den Haag is lovely this time of year and I have this thing I want to talk over with you guys anyway.
Does anyone have any data on that?
Why are there so many condescending comments about "saving the Chinese people". Ask yourselves, are you really qualified to judge the Chinese people? Have you been to China? Have you been to different parts of China? What are the main sources that you obtain news? Are you reading the "assumptions" over and over again until they are "assumed" as facts? I liked this place when it used to be just about technologies.
Out of curiosity, would Cloudflare be able to sustain the amount of inbound requests they're handling?
Anyway, even assuming the traffic is infinite, (to my understanding) most of the flooding IP's are from china. If that's the case it would most likely only affect the datacenter handling Chinese traffic. So even if it's really bad, only a (relatively small)[1] part of the world would notice.
[1] relatively small in terms of the size of internet, not number of people
From looking at the Javascript injection code ( http://www.theregister.co.uk/2015/03/27/github_under_fire_fr... ) it seems like the quality of the script is pretty amateur. They inject jQuery not once, but twice, and only use jQuery to make a simple XHR request. Perhaps they are worried about one instance of jQuery being taken down or made unavailable to them, but they really don't need jQuery at all for something th…
As for jQuery being unnecessary for this job; agreed, but hey, it got the job done.
Earlier quoted context omitted.
Nullifying DDOS doesn't take ingenuity, it takes a big wallet, which Github no doubt has, but let's not pretend that its some engineering feat. If it was, a small company being ddosed would have a chance at fending it off all the same, but that's just simply not the case.
I'm not well-versed in the technical details of defending from DDOS, but unless it's a mathematical NP-complete problem, they have a chance.
Large scale DDOSes are usually the most damaging when they're high bandwidth (Layer 7 attacks can usually gradually be mitigated by well written firewall rules placed on the proximity of the network). When a DDOS is just maxing out the bandwidth coming into your network or sometimes even data center, no amount of clever algorithms can make your pipes bigger. For that, you need money.
*edit fixed a minor typo
Earlier quoted context omitted.
Nullifying DDOS doesn't take ingenuity, it takes a big wallet, which Github no doubt has, but let's not pretend that its some engineering feat. If it was, a small company being ddosed would have a chance at fending it off all the same, but that's just simply not the case.
I'm not well-versed in the technical details of defending from DDOS, but unless it's a mathematical NP-complete problem, they have a chance.