Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode launches free DDoS protection

linode.com

Post reply on HN
Print view View original

91–100 of 182 posts

Re: Linode launches free DDoS protection

#91

Post by EugeneOZ »

nine_k wrote: post #31
pm90 wrote: post #10

Serious question: why would I want to use Linode over GCP or AWS? Asking as someone who hasn’t really dabbled with smaller cloud providers. Is it cost? Support? Developer tooling?

Egress traffic cost is massively higher on both AWS and GCP. Instances of comparable power are somehow more expensive on both AWS and GCP. Also, simplicity; AWS IAM is mightily complicated, things like Cloud Formation are totally non-trivial, etc. You can get going more easily with simple and moderately complex setups on Linode or DO. Of course, AWS, GCP, and Azure have much bigger infrastructure, several availabilit…

At some level of evolution of your company you want complicated thing like AWS IAM, because manual management of access becomes much more complicated.

Re: Linode launches free DDoS protection

#92

Post by buro9 »

regecks wrote: post #2

I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers. and then: >We are no longer able to detect any attack o…

> I never need to do anything, but I don't think these attacks are real anyway

What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure?

I ask as the engineering manager for DDoS protection at Cloudflare, and we stop a lot of attacks. But I feel this tension in the communication and product offering... if we do our job well enough that a customer's system does not see the attack, how does a customer see and feel the value?

An example is that as a reverse HTTP proxy we are implicitly also a full TCP proxy for HTTP traffic and so we receive significantly large SYN or ACK floods. We stop these 100% by virtue of being the terminating TCP proxy, but also by using connection tracking, anycast, XDP + eBPF, and so forth... you won't see a single one of these SYN or ACK packets hitting your infrastructure... so what would we have to communicate to convince you that the attack existed?

Re: Linode launches free DDoS protection

#93

Post by luckylion »

latch wrote: post #87
ryanlol wrote: post #65

Earlier quoted context omitted.

How is Linode “much cheaper than OVH”? Their margins are probably way higher.

Linode's origin is as a VPS provider. OVH's is as a dedicated server provider. OVH's top server is twice the cost of Linode's and their cheapest is 5x the price (10 vs ~50).

Comparing prices for bare metal with prices for shared infrastructure is pretty much useless though.

Re: Linode launches free DDoS protection

#94

Post by EugeneOZ »

ryanlol wrote: post #66
pm90 wrote: post #10

Serious question: why would I want to use Linode over GCP or AWS? Asking as someone who hasn’t really dabbled with smaller cloud providers. Is it cost? Support? Developer tooling?

Perhaps you like problems? https://news.ycombinator.com/item?id=3654110 Compromised Linode, thousands of BitCoins stolen (2012) https://news.ycombinator.com/item?id=3655137 Linode Manager Security Incident (2012) https://news.ycombinator.com/item?id=5552756 Linode hacked, CCs and passwords leaked (2013) https://news.ycombinator.com/item?id=7086921 An old system and a SWAT team (2014) https://news.ycombinator.com/item…

Comparison with dedicated servers is comparing apples to oranges, but except that line your comment has a pretty strong point.

Re: Linode launches free DDoS protection

#95

Post by loh »

ksec wrote: post #43

Nice. Apart from the security incident that took place long time ago, are there any reason why everyone is going straight to DO instead of Linode? For a long time Linode has had better features, performance and bandwidth. It wasn't until recently DO had Managed DB and many other additions. Linode's High Memory Plan also has much better Memory : CPU Ratio. Still waiting for their CDN, ( Not sure why they are not expos…

Marketing goes a long way. It makes me wonder how many products/services are out there which are actually much better than the well-marketed ones, but we just don't hear about them because they don't have the same level of marketing.

I actually don't use DO, but I've used their articles many times after searching for how to setup some things on Linux. Their tutorials are excellent and have saved me a ton of time. I'd imagine those articles alone drive a lot of traffic to them.

Re: Linode launches free DDoS protection

#96

Post by nickjj »

Well done Linode.

I wonder how quickly DigitalOcean will add this to remain competitive.

It's a huge win to have your hosting provider handle this and it's also nice to not be "forced" into using Cloudflare for such an important feature.

Re: Linode launches free DDoS protection

#97

Post by EugeneOZ »

tomrod wrote: post #3

Fascinating! I learned about fail2ban this week as well as how to search for bad SSH actors -- I was amazed at the traffic requests my Linode was getting decked with. Having this as a default seems good.

I was on this step. After some time you'll hate fail2ban. Big part of attacks comes from hacked "regular desktops", by blocking their IP permanently you will block access for legitimate (and non-hacked) users - providers often change user's IP.

Re: Linode launches free DDoS protection

#98

Post by mike_d »

pqdbr wrote: post #88

I wish they had a datacenter in Brazil.

Bandwidth in South America is approximately 8x the cost of North America or Europe. There are almost no carrier neutral datacenters or peering where you can exchange traffic with other in-country networks without paying for transit. Most countries will strong arm you in to buying "local" for your hardware - which means using in country re-sellers that drastically mark up prices for foreign businesses.

Next to Moscow it is one of the most difficult places I've tried to put servers.

Re: Linode launches free DDoS protection

#99

Post by rmdashrfstar »

buro9 wrote: post #92
regecks wrote: post #2

I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers. and then: >We are no longer able to detect any attack o…

> I never need to do anything, but I don't think these attacks are real anyway What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure? I ask as the engineering manager for DDoS protection at Cloudflare, and we stop a lot of attacks. But I feel this tension in the communication and product offering... if we do our job well enough that a…

Do you publish metrics on “attacks prevented” (or access to logging and monitoring) for customers?

Re: Linode launches free DDoS protection

#100

Post by buro9 »

rmdashrfstar wrote: post #99
buro9 wrote: post #92

Earlier quoted context omitted.

> I never need to do anything, but I don't think these attacks are real anyway What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure? I ask as the engineering manager for DDoS protection at Cloudflare, and we stop a lot of attacks. But I feel this tension in the communication and product offering... if we do our job well enough that a…

Do you publish metrics on “attacks prevented” (or access to logging and monitoring) for customers?

Yes.

For HTTP customers there are full SIEM logs under Firewall > Overview on our dashboard, and for paid tiers there are drill-down analytics in addition to the full SIEM logs. There is also log push to receive near real-time full HTTP logs into Google or AWS for your own analysis and these show if a firewall feature touched the request or if it was served from cache.

In addition for HTTP customers we show graphs of SYN floods, etc for the IPs your web properties are advertised on.

For L4 customers via Magic Transit we also have Network Analytics showing what we received at our edge network and a log of attacks detected and mitigated.

There is still lots of room for improvement... that's really what I'm asking, what does the ideal system look like for someone where they see and understand the data and trust it.

For example, is it valuable to see the attack landscape and what is happening across our systems even when you are not the target? Would that help give perspective to attacks that do target you, and also increase faith that this system exists and is stopping attacks when attacks do not target you?

Post reply on HN