FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

It really depends, the calls to their database wouldn't be direct, it'd be through a REST API which then communicates with a DB. That REST API likely has some sort of DDOS protection, like for example how cloudflare protects ALL requests to the domain.

But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection.

"While I suspect the DDOS was fabricated, the linked reddit comment is flawed."

I too think that the DDOS is bollocks but I wouldn't go so far as to describe the reddit comment as flawed - MNGrrl presents quite a lot of additional evidence alongside the Akamai assertion. If you have some spare time it is worth reading/skimming the rest of the reddit thread. Whilst you are at it, look at the posting history of the highly rated commentators for some contextual bias hints. Follow links as well and lose a lot of time 8)

On balance the official story really does not stack up and I think a fully tooled up investigative journo could tear the FCC to pieces if given enough time and motivation to dot the Is and cross the Ts. The keyword there is motivation ...

Like a dude in a Starbucks on free wifi and a script?

Exactly my thoughts: Don't assume malice when stupidity is an adequate explanation.

https://en.m.wikipedia.org/wiki/Hanlon%27s_razor

There was most definitely an automated (fraudulent) effort, if you doubt it go and see [1] if submissions were made in members of your family's name. I have no idea if it's Comcast doing it, my impression is that's just a catchy name for the site.

There is a complex regex search that the site uses to find copies of "the comment" – I was shocked how many of my family members (not with their actual addresses, but names of actual members of my family) filed brief comments that start out "The unprecedented regulatory power the Obama Administration imposed on the internet is smothering innovation, damaging the American economy and obstructing job creation."

Presumably the text is varied in order to hamper the efforts of people like Comcastroturf that are trying to help quantify the number of these fraudulent comments that were filed.

I have no idea if the volume of these type of comments are enough to constitute a "DoS" attack, let alone DDOS, but the scale is quite grand.

I was shocked how few names I had to try before I found copies of "the comment" in filings in the names of many members of my family. Maybe about 50% hit rate. Higher with a common name.

[1]: http://www.comcastroturf.com

Not really; no. DDOS mitigation is actually a pretty standard bag of tricks. Cloudflare describes their setup in pretty deep detail via engineering docs. Technically you might have to talk to their sales people to get them, but that's more to fill their sales pipeline than anything.

I'm by no means a networking professional, so maybe take this with a grain of salt, but no, your only two options are to handle the traffic or not. At low DDOS level you can offload certain traffic like dropping packets from certain IPs before your web layer gets to deeper inspection, but if there is enough traffic to overwhelm your layer 3 devices, you'll drop packets on the floor.

Alternatively you can usually let Akamai or similar advertise your IPs, and let them help with the load, but ultimately that's just distributing traffic to more devices so you can still check IPs against a blacklist.

Since we're talking about the availability aspect of security, there is hopefully no obscurity involved (confidentiality on the other hand is nothing but obscurity). And really, an obscurity technique like using alternate ports won't even help you much because that still hits your firewall and requires processing on each packet.

As far as I can tell (as someone in the networking field but not a DDoS or HA expert), the standard for DDoS mitigation is basically "be bigger": too many POPs/routes, too much capacity to eat packets and establish TCP connections, capacity to serve cached responses, etc. such that even a huge attack simply can't exhaust your resources. To even think about classification and filtering means that you're somehow ingesting and processing this stuff; DDoS becomes threatening exactly when you lack the capacity to do that.