Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode is suffering on-going DDoS attacks

status.linode.com

Post reply on HN
Print view View original

81–90 of 186 posts

Re: Linode is suffering on-going DDoS attacks

#81

Post by devicenull »

jsmthrowaway wrote: post #74
devicenull wrote: post #60

Earlier quoted context omitted.

> The main reason DDOS attacks exist is poor security and lack of cooperation between ISPs. Lack of adequate security on desktops (usually Windows) makes it possible to build large bot networks. These days it's the hundreds of thousands of misconfigured NTP servers, recursive DNS servers, and various other protocols being abused for reflection attacks. Granted, it still requires that the attacker have the ability to…

BCP 38 is like herd immunity with immunization, and much like anti-vaccine folks, networks that don't follow it are knowingly choosing to infect people for any number of reasons. Despite your claim, it is extremely easy to implement and has been a known best practice, with accompanying educational Web sites devoted to the topic[0], for many years. There are nearly zero reasons for your AS to transmit forged packets,…

I'd argue that the end networks really aren't the best place to be implementing this. If the big transit providers (Level3, NTT, etc) started enforcing it, it would significantly reduce the effectiveness of spoofed traffic pretty much overnight.

Re: Linode is suffering on-going DDoS attacks

#82

Post by antsar »

scurvy wrote: post #75
mwcampbell wrote: post #24

Earlier quoted context omitted.

I have a hard time imagining how supporting multiple providers would cost millions of dollars per year. I think it's a worthwhile way to make your software and infrastructure more resilient. And it protects you from vendor lock-in. As long as you keep things simple and don't use features that are only implemented by one provider, VMs are basically interchangeable.

Do you run Postgresql, MySQL, or something else? What led you to your choice? Because one is inherently better than the others for what you want to do? That's why you stick with a single cloud provider. You want the vendor lock-in. You go whole hog into using everything that they provide. Once you start mixing and matching the best of breed across cloud providers, you've lost. Once you start coding to the least commo…

> They sure did learn their lesson.

Is there any relevant reading material? I would have assumed diversification to be a good idea for such critical infra.

Re: Linode is suffering on-going DDoS attacks

#83

Post by jsmthrowaway »

devicenull wrote: post #81
jsmthrowaway wrote: post #74

Earlier quoted context omitted.

BCP 38 is like herd immunity with immunization, and much like anti-vaccine folks, networks that don't follow it are knowingly choosing to infect people for any number of reasons. Despite your claim, it is extremely easy to implement and has been a known best practice, with accompanying educational Web sites devoted to the topic[0], for many years. There are nearly zero reasons for your AS to transmit forged packets,…

I'd argue that the end networks really aren't the best place to be implementing this. If the big transit providers (Level3, NTT, etc) started enforcing it, it would significantly reduce the effectiveness of spoofed traffic pretty much overnight.

It might seem that way, but they can't scale that, as you might know. It's tougher for DFZ transit to do it because they must know, and programmatically configure, all downstream space to be whitelisted. Now you have a similar conversation to BGP filtering when downstream networks change space, and that's huge administrative overhead (which is why announcements are just trusted without filtering at the higher levels, to avoid this overhead for the larger AS). Your end network is a better place because you know your assigned space better, as well as how you number it; you might be holding half an /18 and not assigning it, whereas your peer would whitelist it all, for example.

If the technicals of the Internet were programmatically available in a sane way (PeeringDB doesn't count here, since it just automates manual work), the Tier 1s could potentially automate against their downstream AS' space and enable your (mostly correct) point. However, we pretty much fly blind in this respect and rely on emails and ticketing and decentralized systems to manage the control plane of the Internet. Which honestly continues to shock me, even though it makes sense since the Internet is designed as "decentralized" despite being anything but in usage.

Edit: While in the car, I realized that Paul Vixie's paper on this discusses the CPE source-filtering angle in great detail, which might illustrate my opinion a little better for you than I ever could: https://queue.acm.org/detail.cfm?id=2578510

Re: Linode is suffering on-going DDoS attacks

#84

Post by thrownaway2424 »

frik wrote: post #80
thrownaway2424 wrote: post #37

I would like to correlate the comments in this thread with past comments on every single article about AWS or GCE of the form "this is so expensive / complicated I run my boxes on Linode for half the price". DDoS protection is one of the things you pay for on the big clouds.

you mean discussions like this (2 days ago), first comment sub-thread: https://news.ycombinator.com/item?id=10794951

Exactamente.

Re: Linode is suffering on-going DDoS attacks

#85

Post by thrownaway2424 »

scurvy wrote: post #65
thrownaway2424 wrote: post #37

I would like to correlate the comments in this thread with past comments on every single article about AWS or GCE of the form "this is so expensive / complicated I run my boxes on Linode for half the price". DDoS protection is one of the things you pay for on the big clouds.

What DDoS protection does AWS provide? The only thing mentions on their webpage is autoscaling, more nodes, etc. In other words, AWS' DDoS protection strategy is to open up your wallet. About 6 months ago they did hire Jeff from BlackLotus. Given that timeline, I'd expect them to announce some sort of DDoS protection offering in the next few quarters. Edit to be more specific: AWS gets hit with a lot of DDoS attacks.…

I don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.

Re: Linode is suffering on-going DDoS attacks

#86

Post by secstate »

jsmthrowaway wrote: post #74
devicenull wrote: post #60

Earlier quoted context omitted.

> The main reason DDOS attacks exist is poor security and lack of cooperation between ISPs. Lack of adequate security on desktops (usually Windows) makes it possible to build large bot networks. These days it's the hundreds of thousands of misconfigured NTP servers, recursive DNS servers, and various other protocols being abused for reflection attacks. Granted, it still requires that the attacker have the ability to…

BCP 38 is like herd immunity with immunization, and much like anti-vaccine folks, networks that don't follow it are knowingly choosing to infect people for any number of reasons. Despite your claim, it is extremely easy to implement and has been a known best practice, with accompanying educational Web sites devoted to the topic[0], for many years. There are nearly zero reasons for your AS to transmit forged packets,…

Given my ignorance of much of these issues, I probably shouldn't be commenting (take my comment with a huge grain of salt). But the idea of depeering networks on the Internet for misapplication of a voluntary protocol seems like the beginning of the end of a free Internet (if ever such a thing existed).

If BCP38 is critical to the success of the Internet, I think rather than ranting about those not implementing it, energy would be better spent petitioning to have it made a requirement of running a peer on the Internet to begin with.

Perhaps I'm off base or starting some sort of network guru flamewar. If that's the case, down vote me and I'll go away ;)

Re: Linode is suffering on-going DDoS attacks

#87

Post by X-Istence »

MichaelGG wrote: post #58
deno wrote: post #55

Earlier quoted context omitted.

OVH offers very comprehensive DDoS protection with all but the most budget servers: https://www.ovh.com/us/anti-ddos/

Comments from people seem to indicate their anti DDoS was "we blackhole you if you draw an attack". Has that changed?

Their Anti-DDoS setup is amazing. Once they detect an attack it goes through their VAC setup, and legitimate traffic will still reach you, but illegitimate traffic won't.

Got hit with a DDoS to my DNS servers, I didn't see any external service disruption thanks to OVH's setup. I have several of their cheaper SoYouStart servers, and it's awesome.

Re: Linode is suffering on-going DDoS attacks

#88

Post by scurvy »

antsar wrote: post #82
scurvy wrote: post #75

Earlier quoted context omitted.

Do you run Postgresql, MySQL, or something else? What led you to your choice? Because one is inherently better than the others for what you want to do? That's why you stick with a single cloud provider. You want the vendor lock-in. You go whole hog into using everything that they provide. Once you start mixing and matching the best of breed across cloud providers, you've lost. Once you start coding to the least commo…

> They sure did learn their lesson. Is there any relevant reading material? I would have assumed diversification to be a good idea for such critical infra.

I don't know if there is any reading material. I heard the story from someone who was on the front lines in the outage, directly dealing with the situation.

Vendor diversification is a bad thing for critical infrastructure when interoperation is required. "It's a Cisco problem!" says the Juniper rep. "It's a Juniper problem!" says the Cisco rep. You're stuck in the middle. It's terrible. You can only hold one vendor's feet to the fire and they won't care at all if you're in a heterogeneous environment.

Remember all the middleware products and companies from the late 90's? Neither do I.

Re: Linode is suffering on-going DDoS attacks

#89

Post by [deleted] »

thrownaway2424 wrote: post #85
scurvy wrote: post #65

Earlier quoted context omitted.

What DDoS protection does AWS provide? The only thing mentions on their webpage is autoscaling, more nodes, etc. In other words, AWS' DDoS protection strategy is to open up your wallet. About 6 months ago they did hire Jeff from BlackLotus. Given that timeline, I'd expect them to announce some sort of DDoS protection offering in the next few quarters. Edit to be more specific: AWS gets hit with a lot of DDoS attacks.…

I don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.

[deleted]

Re: Linode is suffering on-going DDoS attacks

#90

Post by akerl_ »

secstate wrote: post #86
jsmthrowaway wrote: post #74

Earlier quoted context omitted.

BCP 38 is like herd immunity with immunization, and much like anti-vaccine folks, networks that don't follow it are knowingly choosing to infect people for any number of reasons. Despite your claim, it is extremely easy to implement and has been a known best practice, with accompanying educational Web sites devoted to the topic[0], for many years. There are nearly zero reasons for your AS to transmit forged packets,…

Given my ignorance of much of these issues, I probably shouldn't be commenting (take my comment with a huge grain of salt). But the idea of depeering networks on the Internet for misapplication of a voluntary protocol seems like the beginning of the end of a free Internet (if ever such a thing existed). If BCP38 is critical to the success of the Internet, I think rather than ranting about those not implementing it, e…

To be clear: having the networks that make up the internet agree to depeer networks that don't implement a protocol is roughly the same as "making it a requirement", and the petitioning you'd need to do is "convince all the networks to agree to do it".

Because the internet is "free", more or less, there isn't much in the way of enforcement of which RFCs and practices must be followed to be part of it, which is a big part of the reason that BCP38 is so underutilized today.

Post reply on HN