That's why it wasn't so fast today.
Fastmail.com suffering DDOS attack
31–40 of 43 posts
Re: Fastmail.com suffering DDOS attack
#32As an avid fastmail user I did notice slight loading delays, but I attributed them to my wifi/iphone. I mean... It's mail, not live SCADA telemetry...
Re: Fastmail.com suffering DDOS attack
#33Not many alternatives: 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. 2.) Use gmail or Google Apps. Things just work. Cede control to Google.
#2 is generally true of FastMail as well. In 2 years as a customer, it's been close to bulletproof.
Used Microsoft/Google/Fastmail in parallel for my company for 6 months. Fastmail won.
Re: Fastmail.com suffering DDOS attack
#34Earlier quoted context omitted.
A ~1 hour response time from identifying to mitigating the DDoS isn't exactly bad. I'd say their engineers did a pretty good job.
Security really isn't my strong suit, but isn't it standard practice to automate DDoS mitigation strategies?
DoS is a threat from identifiable source, like Russia. DDoS looks just like normal users, like terrorist sleeping cells.
Re: Fastmail.com suffering DDOS attack
#35Something i'm realizing more and more... What the hell do I really need remotely hosted mail for? We all know mail is insecure. Unless you look really really hard , you aren't sure if the mail you received was spoofed or modified, a child can spoof mail and any MitM can modify it. So in general you can't trust your mail anyway, even if it's received by a reputable company. Sending mail is almost just as subjective...…
> format + protocol like Git > distributed decentralized peer-to-peer network > a unique address system > personal crypto keys Funny. You just described a perfect fit for Urbit.
Open to flood poisoning.
Re: Fastmail.com suffering DDOS attack
#36Not many alternatives: 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. 2.) Use gmail or Google Apps. Things just work. Cede control to Google.
Rackspace Mail hosts 3 million paid mailboxes, and comes with a 100% availability SLA and 24/7/365 support. Google's not the only game in town.
Sure, but I know nothing about Rackspace and refuse to trust them as a result. Plus I doubt they have anything that can compete with Fastmail's web interface, powered by the JMAP protocol they authored.
So here's what I know about Fastmail that I want to know about any provider I host with:
- I know Fastmail will refuse any requests from the US govt to access data because they're Australian and legally the request has to come from an Australian court
- I know Fastmail's servers use encrypted storage
- I know the specs of Fastmail's servers (they post them on their Help/FAQ)
- I know Fastmail's actually trying to make email better, obvious by their invention of the JMAP protocol
- I trust Fastmail to be able to recover from any serious issues because they actually have on staff developers of Cyrus, the open source IMAP software they use. This means their admins have actual recourse when Bad Things^TM happen, vs the usual when an admin runs out of options, eg, "let's just post on mailing lists and hope we can find an answer"
- I know the fine details of how their spam filtering works, because it's publicly documented. (and it's quite well integrated with some tricks I couldn't employ at my last ISP job as I didn't have developers to assist)
- I know their infrastructure is primarily hosted in NYI with the backup in Iceland.
- I know they are serious about security, as they've been proponents of full SSL/TLS vs STARTTLS which could be MITM and downgraded (yes, many MTAs will let you require STARTTLS, but there are always possibilities of client bugs that could be exploited when you let an attacker intercept plaintext and inject data before the upgrade to a validated TLS session)
- I know how their backups work, because it's documented and I also have the ability to undelete emails which almost no provider gives the end user.
- I know their support is responsive and competent, as they've actually fixed Webmail bugs and put them into production for me within 48 hours
- Fastmail does PUSH email on iOS, while GMail, Rackspace, and most other providers don't offer this because it requires custom integration with Apple's Push Notifications service.
tl;dr yeah, the average provider might promise the moon but can they actually deliver when the shit hits the fan? will they actually strive to please their users and make the internet a better place? probably not.
Re: Fastmail.com suffering DDOS attack
#37Given the timeframe, I commend them for keeping the notices open and public. It's nice to see. When I went through the A(zure)pocolypse a few years back, didn't see anything for about 15-20 minutes... though admittedly if I weren't in the middle of testing something may have not noticed for a while either.
All said, you can't mitigate all DDoS easily, and it's nice to see that they were pretty responsive and open... Also, while email can be very important, it shouldn't be eminently critical.
Re: Fastmail.com suffering DDOS attack
#38Not many alternatives: 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. 2.) Use gmail or Google Apps. Things just work. Cede control to Google.
Don't do #1 if you want to reliably accept or send mail. Fun for experimenting/learning, though. Also, you can buy your own domain, and have Google merely act as the SMTP relay and temporary storage. They can also forward your mail to another server for you.
I'm gonna disagree with you. I've run my own mail server for my primary email for years and very rarely have any issues.
Re: Fastmail.com suffering DDOS attack
#39Is this part of a more general attack on Internet infrastructure today in the U.S.? http://downdetector.com/ has been showing many sites with issues (Google, Outlook, etc.)
Does Google ever have DDOS problems?
Just going off the public numbers for one of google's ASNs[0], with the amount of public peers they have (and likely far more private peers, and I'm just assuming google doesn't buy transit and ignoring that), it's unlikely that a DDoS would ever cause an outage for more than a small subset of people. You may be able to saturate a link or two, but that's not difficult to route around generally.
That is of course only for network saturation DDoS, I'm sure there are ways google could be ddosed at the application or server level, but they likely have enough infra in place to be able to eat the attack without anyone outside of google noticing.
Re: Fastmail.com suffering DDOS attack
#40Not many alternatives: 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. 2.) Use gmail or Google Apps. Things just work. Cede control to Google.
Don't do #1 if you want to reliably accept or send mail. Fun for experimenting/learning, though. Also, you can buy your own domain, and have Google merely act as the SMTP relay and temporary storage. They can also forward your mail to another server for you.
While there are pain points when it comes to hosting your own mail, it isn't nearly as difficult as you make it.
It gets more difficult if you are providing a service that has to have uptime guarantees or are providing mail to many users but if you take the time to learn and educate yourself on current standards, hosting your own mail for fun and for profit is a doable thing that more developers and admins should do.
We are at a time when we actually have relatively easy to use software to managing mail servers, so us it.
For what it is worth, I have not had problems with Google, Microsoft, Yahoo, or domains that use their services whether it comes to sending or receiving. Sometimes a server is stuck in an SPAM prevention queue or I might have to whitelist a particularly silly server, but that doesn't happen very often.