Hacker News Reader

Comment by mwcampbell | Hacker News Reader

What about DigitalOcean? Its pricing is comparable to Linode's, yet DigitalOcean is now the second largest web host in the world according to Netcraft. Do you still think that AWS, Google Cloud Platform, and Microsoft Azure offer better protection?

View on HN

Here's the email I received (many times) when someone sent a smallish 1Gbit/s DDoS to my digitalocean server:

> Our system has automatically detected an inbound DDoS against your droplet named xyz with the following IP Address: xx.xx.xx.xx

> As a precautionary measure, we have temporarily disabled network traffic to your droplet to protect our network and other customers. Once the attack subsides, networking will be automatically reestablished to your droplet. The networking restriction is in place for three hours and then removed.

> Please note that we take this measure only as a last resort when other filtering, routing, and network configuration changes have not been effective in routing around the DDoS attack.

> Please let us know if there are any questions, we're happy to help.

This happened mere seconds after the DDoS begun! Therefore they lied about having tried to mitigate the attack.

No amount of contacting support got me un-blackholed before the 3 hour mark, and when I popped back into the network, I was blackholed again for another 3 hours...

I moved to a $3.50/mo OpenVZ VPS at OVH, and OVH's VAC system soaked up the DDoS just fine.

I've received the same type of email multiple times from DigitalOcean and its extremely frustrating.

With even the smallest of traffic spikes, DigitalOcean will detect it as a DDoS and immediately cut off your server for 3 hours.

If even a typical (< 100Mbit) broadband-cable connection hits your server with a spike of traffic for less than 5 minutes, your server will be taken offline for 3 hours minimum.

I've used multiple VPS providers and dedicated-server providers and DO is absolutely the worst when it comes to DDoS policy.

That's why DigitalOcean isn't ready for production (unless hiding ip address behind, lets say, cloudflare is an option in your case) and that's why I decided not to use their services anymore.

Just curious, what do you use instead?

If you even have the slightest inkling that your site will be attacked by a DDOS (either targeted or randomly) please reconsider DigitalOcean. Their method of handling a DDOS is basically "your node is being attacked, so we're disconnecting it from the network for a few hours. Try to figure out why someone is attacking you." Then, the machine gets reconnected three hours later and the attack cycle continues. Not to mention that since the machine is offline, there is no way of logging in to check access logs, modify firewalls, etc. I've never dealt with a company like DO before. Switched to AWS last year and, even when I was getting extreme traffic, AWS never just shut down access without notice.

OVH offers very comprehensive DDoS protection with all but the most budget servers:

https://www.ovh.com/us/anti-ddos/

Comments from people seem to indicate their anti DDoS was "we blackhole you if you draw an attack". Has that changed?

Yes. This hasn’t been true for a long time. OVH runs a huge network and they invested in tools to mitigate and neutralize DDoS attacks[1]. Of course an attack can still saturate your servers’ NICs but they won’t drop you anymore.

At their scale they are basically forced to handle big attacks on regular basis. The fact that they offer this protection in their basic package is what makes them a great host[2].

They don’t get a fraction of the love Cloudflare gets, but they should.

[1] https://www.ovh.com/us/anti-ddos/hoovering-up.xml

[2] https://www.ovh.com/us/news/articles/a1171.protection-anti-d...

Good to see OVH getting some recognition here. I am a happy customer of both OVH and DigitalOcean but my usage has become strongly weighted towards OVH. The OVH web interface could be improved (I've had to open support tickets for basic things like activating auto-renewal), that's the only downside with them really. Range of products, network, disk speed and responsiveness are all consistently very good. Their new 2016 'Cloud' VPSs have markedly better disk speed than DigitalOcean's SSDs, which are already pretty fast.

For a quick side project I still like DigitalOcean's hourly billing and user interface, but any machine I plan on using for a month or more are all with OVH by default.

Their Anti-DDoS setup is amazing. Once they detect an attack it goes through their VAC setup, and legitimate traffic will still reach you, but illegitimate traffic won't.

Got hit with a DDoS to my DNS servers, I didn't see any external service disruption thanks to OVH's setup. I have several of their cheaper SoYouStart servers, and it's awesome.

Yes. We moved an IRC server that was under attack (and being dropped from DO/Linode) there, and it ate it fantastically well for the price. I've never seen anyone else do it that well for that cheap, to be honest.

Why is ovh so cheap compared to linode and DO, whats the catch?

Yea, throw money at Netcraft and you can be batman of the internet. The numbers being provided to the public are not accurate in any way.

Reply on news.ycombinator.com