AWS said it mitigated a 2.3 Tbps DDoS attack

These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.

So your account is all active, but you don't have the proxy-through-CF part.

As a result all the traffic goes directly to the origin (as a side-effect, your origin IP address is revealed to the attacker).

You receive the email "Sorry, CF offers limited DDoS Protection, call our Enterprise team for help".

From your blog post I understand you don't do it anymore, which is good. Really, it was quite bad to see the DDoS protection failing you when you need it the most :|

vs

https://www.cloudflare.com/plans/pro/

for example

From what I've been told, you're right. DDOS attacks can routinely expose information through failure modes the ops team never prepared for. What happens when your failsafes fail? If they didn't test for it and put mitigations in place then it's rather likely that sensitive error messages or service details, or whatever, is being exposed over the wire. So aws mitigated this attack. Does aws know for a certainty that they revealed nothing sensitive in the process? Maybe, maybe not. If the attacker is good, and 2.3tbps is pretty fing good, then could the victim even be positioned to know what to look for? In uncharted territories the attacked is always down from the attacker.

That used to be the case, but with the popularity and widespread use of IoT devices it won't hold true for long. If you can hack home appliances you could hold an attack for hours, if not days.

There was a Windows vulnerability that came out in 2010-2011ish, when I was working there, that I had to deal with. I ran an nmap scan of the entire network looking for the bug, and accidentally BSOD'd half the office...

ISP infrastructure is symmetric fiber. A single fiber can do 100 Gbps without troubles. And when you have to bulldozer the road to lay the fiber, you don't put a single fiber but a pack of a hundred. There is no crosstalk between fibers unlike with copper, so one has interest to put as many as possible.

Also, even cable is capable of Gigabit speeds. I briefly had 1.2Gbps via cable, downgraded to 400Mbps as it became cheaper.