Hacker News Reader

Comment by ryanlol | Hacker News Reader

Heard of nullroutes?

(Edit: how is it that perfectly valid technical solutions get downvoted?)

I didn't downvote, but there's one thing to keep in mind. You must request RTBH functionality with every peer I've ever worked with. It's free, but they don't set it up automatically. You need to request it during provisioning or wait 3-5 days for someone to activate it.

If you don't already have it enabled....well, good luck mate.

As of a few years ago Linode got transit from the facilities they are in and almost all of them had RTBH set up with a capacity of 5 or 10 routes. It would be incredibly foolish to operate a hosting provider without it.

Wait, you're saying that Linode uses facility transit? Like, they buy bandwidth from Savvis and TelX? Well that would be the problem right there.

From what I can tell, Linode doesn't even have their own AS for customer traffic? It appears that they have an AS for some internal use, but not for customers?

Just because they purchase transit doesn't mean they don't have their own AS.

Everyone has to purchase transit at some point. Transit != AS.

Where did I say that purchasing transit relates to an AS? I was speaking out them separately. "House bandwidth" in most colos is pretty garbage, and you don't have much control over it.

I'm a lot less impressed with Linode after this thread than I was before.

That's correct. They use facility transit everywhere except their newest datacenters (Singapore and maybe Frankfurt), where they operate their own AS and use blended transit.

I don't know if I'd outright call it a problem, per se, since in a couple facilities (say, Fremont) it's a good thing given how good the provider (say, Hurricane Electric) is at providing transit. So in the datacenters where the provider is better at transit than facilities (say, Fremont), the equation breaks in their favor.

When I left they also didn't really have the staff to run a proper NOC for a full-on AS; one extremely talented network engineer who has since left mostly owned all the "running a grown-up network" stuff, like running down an ASN, working RTBH with the facilities, well-designed uplink strategy at Linode's edge, and lobbying for anycast infrastructure for DNS and so on. They had just hired another purebred networking wonk as I moved on who probably owns it now, and likely has help. So punting a lot of the typical NOC work upstream to a facility with whom you're already working anyway made a bit of resource-related sense at the time, since staffing a NOC for a network of that scale is a significant challenge and they like to operate lean.

That's changing now (I didn't know this and learned it from agwa's comment), which is probably reflective of growth on the resource front.

Real talk: it's not that hard to run your own network. It sounds like Linode was skirting by on not making the infrastructure investment both in hardware and people. It's finally come back to bite them. No excuses and no pity for them.

Also, I wouldn't run around saying that having HE in house is a great thing.

I didn't downvote, but I can tell you almost certainly it was because of the snark.

Attackers shift to a new target on the same net as IP's are null routed, until the entire network has null routed itself which achieves the same result as DDoS'ing the network. So I'm not sure I agree that removing target IP's from your network is a great solution.

I would hope it is obvious based on the extent and duration of the attacks that RTBH is not an option in this case.

Reply on news.ycombinator.com