Hacker News Reader

Comment by delroth | Hacker News Reader

> it is not their fault

I don't understand this line of reasoning. It's not like DDoS attacks are some kind of 0-day failure mode that nobody has seen before.

Would you also say "it is not their fault" if their uplink provider had a fiber cut and they didn't have redundant uplinks? I'm guessing not: it's well understood that has a service provider you need to plan for this kind of unavailability and pay more money for redundant links. So it seems really weird to have this double standard for a different kind of availability failure mode.

Just like network availability or datacenter power availability, you need to invest technical and financial resources into DDoS defenses if you want to be resilient to incidents. If you don't do that as a hosting provider, I definitely won't feel sad for you.

View on HN

There are a handful of environments that can sustain a large, coordinated DDOS attack. Can you sink 10-20Gb/s of traffic forever? Not cost effectively.

If you live in 2002, nah. In 2016? Yes. Bandwidth is cheap and linode has high margins.

Infrastructure to service requests is not (comparitively). Rarely is it trivial to distinguish DDoS traffic from legitimate traffic.

Usually it is and according to linode it is so in this case too.

Edit: Not sure what alternate reality the downvoter lives in, but vast majority of the attacks these days are just "dumb" packet floods or even easier to filter reflection attacks. (Linode clarified this to be a mix of dns and ntp traffic on IRC)

But hey, go on and find me a layer 7 attack that'll take down entire datacenters :)

One difference between Linode and providers like AWS is that the typical deployment architecture on Linode still exposes customer VPSes to direct L3 internet traffic whereas on a best-practices AWS deployment that is almost never the case.

I'd imagine it's easier to filter out bogus L3 traffic when the vast majority of your target IP space comes with explicit configuration as to what sort of L7 application traffic is acceptable.

You can't really compare aws to linode. Aws have hundreds of Gb of transit bandwidth so they can easily absorbe big attacks. They also have a backbone network which allows them to increase the surface area of attacks which increases the available bandwidth.

It's actually not that easy to Filter "bogus" traffic. In the hosting world, especially cloud, you have thousands of customers doing whatever they want. Who knows what is bogus or not. And even if you can filter it at your edge routers your transit links are still going to be getting slammed. The filtering needs to be done upstream in the ISP network. This is usually a manual process as no one supports BGP FlowSpec at the moment.

RTBH is the best way to defend if you don't have the bandwidth to absorbe.

Block DNS/NTP in the security group => Problem solved (unless it only filters traffic at the instance input)

Put an ELB in front of the services, the ELB only listening to port 80/443, roll out the ELB publicly, roll out new instances only accessible privately, kill old instances being DDoSed => Problem solved => Repeat for all other services, they shouldn't be publicly accessible in the first place.

Ain't saying it's easy but there are some options to help mitigate the attack.

Stolen credit cards are cheap, and they buy a lot of GCE/AWS resources.

source: been on the receiving end of a several hundred gigabit L7/HTTP DDoS from the aforementioned providers.

Bandwidth is cheap but attacks are cheap too.

Which is exactly why you need to be prepared for them?

It wouldn't be 10-20g. That should be easy to handle for most hosting providers. Attacks these days are commonly over 100g. That becomes challenging

At work, my www servers get short ddos on a regular basis; on our 10g hosts, 10g+ attacks are livable (outgoing TCP throughout goes down because incoming acks are part of the traffic that's getting dropped when total inbound is above the Nic capacity). We have some newer boxes with 2x10g, I'd imagine those should be able to handle 20g of attack, but I haven't noticed. (I usually only check for a ddos if external monitoring shows an unexpected failure)

That's for volumetric attacks (udp reflection), tls handshaking can eat all the CPU way before we run out of network :(

I hate to blame the victim. I do not know enough about the circumstances, or the industry in general, to call negligence on Linode.

Reply on news.ycombinator.com