Hacker News Reader

Comment by cryptoz | Hacker News Reader

When Anonymous attacked Visa and Mastercard via DDoS (in retaliation to them cutting off Wikileaks donations), Anonymous did actually succeed in stopping the online verification systems for both companies (SecureCode, or something, and Verified by Visa). In that case, the DDoS attacks did more than just take the site down; they financially hurt their target, which was probably the aim to begin with.

I'm not justifying the attacks and I agree that they are the wrong way to go about this business, but it would be naive to suggest that the DDoS attacks are a minor inconvenience.

View on HN

DDoS's have a monetary impact, yes. However, what the parent is saying is that all infrastructure has limits in terms of bandwidth, etc. The point is that it's not the same class of "attack" vs. finding an exploit. The latter is more in line with the "strive for more secure sites". The former, not so much.

Then we need to fix the infrastructure so that the current generation of attacks don't work. To just say, "oh, well bandwidth is limited so there's always going to be an attack" is not useful. Think of ways you can structure the infrastructure so that it can do filtering further out, or detected spoofed connections, or detect anomalous request patterns. There are solutions, we need to find them and implement them, not just tell people not to do it or claim it's a "weak" attack. It's a strong attack if it takes minimal effort to cause maximal damage. In the real world, that's what matters. There's the idea that we're playing a game and that there are behaviors that are good form or bad form. However, when it comes down to it, what works is what works.

They can certainly protect against this but it's not a good idea.

I pay US taxes and I don't want the cia.gov site to be on the same type of hardware as say Google just to be DDoS "proof".

They shouldn't be connected with a 33.6 modem but to ask all sites to upgrade everything to prevent DDoS is insane.

Who could afford to start a web site if they had to lay out all of that cost?

Might that be another advantage of cloud computing? To spread the cost of DDoS defense infrastructure across many websites?

You'd still have to pay for all the computing time to remain available during the attack. Its probably not worth it to try to stay up in that kind of storm.

mentat, I wasn't saying don't protect ourselves against this. However, harnessing a big enough bot network you can always overcome these measures. Finding an exploit is different, and especially for financial institutions inexcusable to a certain level.

It also led to Paypal allowing Wikileaks to retrieve the money they already had before they suspended their account.

Is phillijw another false positive of HN spam detectors?

Maybe. Look back through his(?) comment history, and you'll see that the point where he was autokilled/hellbanned (around nine pages back) was, while a very downvoted (and nonsensical) comment, not actually malicious. Before that, he had a few comments which were downvoted maybe two or three times (you can tell by the color). It's probable that he was autokilled/hellbanned because those caused his average comment karma to drop too far, as well as making his karma negative, though I am not aware of the exact criteria.

At this point, he seems like a false positive based on his recent comments. It's a pity that there's no real procedure for being unhellbanned, even if the user discovers that they are, other than starting a new account.

Even starting a new account doesn't work (at least it didn't in a previous instance where I notified a false positive). You also need to use a proxy. So to phillijw, email PG or start a new account using a proxy :)

Reply on news.ycombinator.com