Hacker News Reader

Comment by kyledrake | Hacker News Reader

I strongly believe it's not possible to safely run a site without DDoS protection for all servers anymore. Anyone with $20 can take down anything on Digital Ocean, Linode, Hetzner, and many others. Or they can run up a huge bill for you on AWS. I would love to use Cloudflare but I can't afford $6000/mo for DDoS protection on my servers with the wildcard requirements we need. Linode may have solved their DDoS problems with their own stuff, but what about their customers' VPSes?

I really wish people would start taking DDoS more seriously. It's really not something we can just null route servers for anymore. It's becoming a very serious problem. It's not going away, it's amplifying and getting far worse.

I'm also not sure how effective it would be, but it would be nice to see the FBI, NSA or whomever spend at least as much time fighting these DDoS warlords as they did persecuting whistleblowers and trying to shove backdoors into cryptography.

View on HN

I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders.

IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen?

>I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders.

The importance of spoofed traffic to attackers is greatly exaggerated, I could personally easily send 500+ Gbit (probably terabit) sized attacks by spending a couple of weeks building a router botnet. No need to spoof IPs and at that point diminishing returns would make amplification attacks useless. Not only that, but most amplified attacks are particularly inexpensive to filter.

>IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen?

Who would penalize them? Why?

And I'm not entirely sure if you understand what RFCs are, that RFC (which hasn't even been around for very long) is - most other RFCs - completely meaningless.

In practice, most volumetric attacks have spoofed IPs- amplified UDP reflection attacks and even SYN floods with no amplification.

Getting rid of UDP amplification reflection attacks will get rid of 90% of volumetric attacks.

We had volumetric attacks every day much before reflection attacks became common, the biggest attacks these days aren't reflected but from router nets.

And you simply cannot solve IP spoofing without rebuilding the entire internet, not to mention the fact that it does have legitimate use cases.

Also, if IP spoofing is making filtering difficult for you then you're doing filtering wrong.

How big were the volumetric attacks that you saw that involved real IPs? The amplification factor is 1x for the real IPs. With NTP reflection and DNS reflection, you get 50x amplification, so 1Gbps botnet (trivial bandwidth) will cause a 50Gbps DDos (non-trivial bandwidth). This is why filtering is desirable.

I saw a 500Mpps SYN flood just last week, followed by about 500Gbps of UDP packets. All from real IPs.

Botnets have far surpassed amplification attacks at this point.

>This is why filtering is desirable.

Come up with a way to implement it that actually works and doesn't break legitimate use cases. spamsolutions.txt is starting to seem relevant here.

We work with Verisign that specializes in DDoS mitigations, they have state of the art scrubbing centers on four continents and they are leading mitigation provider to the banks and schools. They told me they almost never see anything above 300gig. You must be special.

Yes, I would imagine I have far more experience dealing with large attacks than verisign.

>they are leading mitigation provider to the banks and schools

We are careful to operate by that security RFC and have BGP filters for every customer to prevent the possibility of spoofed traffic and DDoS originating from my network. It really is the responsibility of the network operators go be diligent in this. TWC - Business Class Fiber

Of all the DDoS protection solutions you could spend $6000/mo on CloudFlare is probably the worst choice, hell Voxility will give you better service for $600 a month (And on top of that, they don't give the NSA unfettered access to your all of your traffic).

Don't buy CloudFlare for just DDoS protection, their pricing and products are far from competitive.

our you can host your server where DDoS protection is included by default

OVH for example

https://www.ovh.com/us/news/articles/a1171.protection-anti-d...

You get what you pay for, in the case of OVH they'll do a decent job tanking volumetric attacks, but fall short for anything that doesn't involve tons of bandwidth.

Kinda...

I used OVH in the past and they rely on TCP resets/disconnects for large syn floods, making your servers pretty much unusable while being attacked.

I found it better to hide the server behind Sucuri or Incapsula if you are worried about ddos.

Take a look at Incapsula or Sucuri:

https://incapsula.com

https://sucuri.net/website-firewall/

Both a lot cheaper and do a great job protecting against ddos.

Not really. Incapsula is useless for DDoS mitigation unless you want to pay for their enterprise plans, starting at $15,600 a year and offers 4 Gbps of protection.

http://i.imgur.com/NUnQqlS.jpg

My site was DDoS'd for 2 Gbps, according to Incapsula's charts. Incapsula demanded me sign up for a $15.6k annual contract.

Cloudflare got back to me in 15 minutes and told me they will gladly host me on their $20/mo plan, which includes 'light DDoS protection'. 2 Gbps is light for cloudflare.

I'm curious, why not a "real" DDoS protection service? On Incapsula you'll be screwed if your other infra gets hit.

Also, for the love of god don't use sucuri. They've had a plenty of opportunities to fully ditch linode but apparently still haven't.

They don't use Linode for their DDoS service. I think only some of their blog is in there.

Of course they don't, but it gives a good idea about their approach to security.

If it's <3000 records you could just use the API to generate DNS entries, no need for wildcard.

Reply on news.ycombinator.com