Network Performance Issues in multiple locations
cloudflarestatus.com
cloudflarestatus.com
Check out the dip in requests to Reddit: http://www.redditstatus.com/
Fastly was on top of it and routed around the issue quickly.
I absolutely hate people who claim Cloudflare is their only solution for mitigation/protection, because it simply isn't true, and Cloudfare does some rather shady stuff.
With car insurance, the insurance company has incentive to mitigate their risk, (they don't want to shell out more than they need to,) charging more if you are higher risk. They don't want to take more risk than they have to. Key point, they evaluate risk on a case by case basis.
DDoS mitigators however, they already have invested in the risk by getting the hardware to handle the bandwidth. They don't care if you are attacked or not. Nothing then stops them from playing dirty. This kind of stuff frequently happened with Minecraft servers (what feels like) ages ago. Mitigating services would go out and attack servers, and competitors to get customers to switch to them.
But you still get attacked, but it's like a frame around you, so you don't hurt or damaged. (Here's an example of how Incapsula mitigates DDoS attacks - https://www.incapsula.com/ddos/ddos-mitigation-services.html)
Only if there's no overcharge when an attack happens. If there is, you are in the conflict of interest situation the GP was talking about.
I don't know what is CloudFare billion policy.
The crazy thing is people actually bought it.
Centralization was absolutely the best answer to that problem and will be for a long time. Almost nobody but fortune 500 companies would be able to survive a DDoS otherwise.
1) are way more expensive than Cloudflare
2) suck at DDOS mitigation (there's a lot more to it than just bandwidth)
3) don't care much about DDOS mitigation (it is a side business from their actual business, which is edge caching)
4) drop customers who actually get hit with big DDOS attacks (see #3 above--they will always prioritize caching customers over DDOS customers)
EDIT- oh and I forgot to say that if your site is HTTPS, you will have to give Akamai your keys, just like you do with Cloudflare.
> You don't solve a DDoS problem by having less capacity than your attacker and most individual companies can never afford the amount of bandwidth that is at Cloudflare's disposal.
You can have less capacity than Akamai (many excellent providers have less) and still serve this purpose.
"worked around" is more appropriate, and introduced huge problems with their workaround.
The correct solution is to punish ISPs that permit this behavior to continue unchecked. We need offense, not defense. Any ISP that doesn't detect and kill DDoS participants needs to be severely throttled by other ISPs. Organizations like the FCC should be tackling this and levying fines against US-based ISPs for non-compliance and lobbying for foreign policies that punish foreign ISPs.
Oh wait now blahflix needs to pay $$$ to get special privileges. Shit gets hairy real quick.
Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked?
ISPs should remain dumb pipes. You really don't want to give comcast more power.
Well, presumably companies have arrangements with their ISPs for expected usage and such. There can be a grace period as well, when you hit up the user and say "hey, you're using a lot of bw, is all well?" You also combine this with abuse reports from the victims if a DDoS is in fact underway. I don't think it's bad for an ISP to establish trust with a customer, either, this already happens with things like DMCA requests.
>Suppose DDOS happens from iot devices. One of this is an important medical device that got hacked. Do you auto shut it down and block it's traffic. What about the life critical device under same IP through NAT that is secure also getting blocked?
Life critical devices aren't exposed to the internet. IoT users should get throttled and receive a comminication from their ISP telling them they have a malicious device on their network with advice on how to fix the problem.
If someone puts "an important medical device" on a network directly accessible from the internet, or on the same network as other IOT crap devices, they should be banned from ever working with computers.
If you are under attack and nobody is forging their origin, it's only a matter of you talking with your ISP to block the offenders.
You're proposing that I protect my site by rewriting the rules for internet across the entire planet and punishing every single visitor (thousands upon thousands!!) who doesn't play by some new arbitrary rules that we then have to get everyone to agree on.
No, the ISPs should not be made to correct this kind of behavior, because it will be an eternal game of cat and mouse, and we've proven that the attackers can get around said blocks quite easily. Heck, often the "attackers" are grandma and grandpa types that clicked on a bad link and didn't know any better. Instead, we're taking the right approach here: identify bad incoming traffic at the destination, and drop it before it hits the backing servers. That's a solution we can actually reasonably apply.
I don't agree with a lot of what Cloud Flare is doing, and I really wish we had more than one service like it that was as popular as they are, but they are doing good work. They're solving a huge need within the industry. I believe there should be more competition in the space, but I refuse to believe that the overall approach is inherently bad when it obviously works.
There is no way to get from our current situation to the world you propose - there will be never be a quorum from ISPs (or governments) on this sort of standard. It's a tragedy of the commons and no single participant has enough leverage or interest in a new status quo.
Centralization comes with risks, but I think the risk is absolutely acceptable in this case until we come up with a better, decentralized approach to attacks that normal people can afford.
I love them very much.
If they fuck up too often i can stop using them in 5 minutes, this is just perfect.
Telia eats it quite regularly, but not often at this magnitude.
That being said, I agree that centralization sucks, and I'm thinking about symbolically moving my tiny blog off Cloudflare for this reason. The ridiculous thing is that the origin is on GitHub Pages, so I'll have to move off there as well to be coherent.
Our CDN's are having problems all over the place. No indications of what shit the bed, but this is more then Cloudflare
Instead, you pay Cloudflare a regular, small amount of money† to reduce the risk of having to pay a large sum of money in case you're targeted. This sounds almost exactly like insurance to me.
† Sometimes the marginal cost is actually $0!
1) did we break our client server
2) did our internet provider die
3) did the service die
What are recommended ways of finding out fast and reliably in these cases where the fault is.
1) UptimeRobot [0] - use to monitor various client websites. The free plan checks every 5 minutes, which should be enough. Notifications can be sent to email, slack, sms and many others. If you think there may be a problem only from some locations make a fast check with [1]. If you suspect DNS issues [2] or [3].
2) Again use UptimeRobot for monitoring device publicly accessible from your network. Moreover, if you are in control of your office network, using pfSense [4] notifications when a network gateway goes down works well (still, that works only if you have 2 or more ISPs). Or use a dedicated monitoring device/service like Zabbix.
3) Using to Twitter to Slack notification, subscribe for updates from both services that you use and major services responsible for Internet backbone. An example is, that using GitLab, comes with multiple time when the service dies (even that they are improving) - seeing the message in Slack that something is WIP currently by all team members (in a dedicated channel), helps to skip unnecessary debugging [5] :)
Not affiliate with any of the service. Still - met the UptimeRobot guys some ago - they are a small startup based in Malta, are very cool and have very stable service :)
[1] http://www.super-ping.com/
[2] https://www.whatsmydns.net/
[4] https://doc.pfsense.org/index.php/Gateway_Settings#Gateway_S...
Zabbix is an example piece of software, probably overkill for most but I haven't used anything else in the last 5 or so years so don't have any better suggestions.
logs will tell you if a client server or individual service has died. that are literally hundreds of solutions for these.