Hacker News Reader

Comment by robbiet480 | Hacker News Reader

Who would DDOS GitHub and for that matter, why?

extortionists.

There's a growing band of pirates (the web kind) who hold sites to ransom via their massive botnets, in exchange for payment -- 'protection money'.

But why Github? Wouldn't a less tech-savvy business be much more likely to cave in, and have a better cash flow? (e.g., porn and gambling sites?)

Uptime is very valuable to github. For example, I can't easily deploy to my site when githubs down. I suspect many others have bought into its availability too.

I had a very slow deploy earlier this week; if it had gotten canceled in the middle of it that would have been pretty bad. Maybe the deployment script should copy the repo head to one of my own servers and continue from there? What do people do?

Random thoughts but:

- Github are obviously very successful and may have money - their clients are reacting quickly on twitter so attackers might think they have an edge in terms of pressuring

Not in that line of business but I'd expect any porn and gambling site with half-decent cash flow to be quite tech-savvy when it comes to securing it from all the DDOSers, fraudsters and other hostile entities they have to deal with daily.

Sure, which is why you attack them too.

Do any of these extortionists have a reputation for actually stopping the attack once they get paid? I certainly wouldn't trust some random group that's currently DDOSing me enough to pay them.

My thoughts exactly. I'm inclined to believe with another commenter that they just picked GitHub as testing grounds.

Especially depending on the sum of money demanded, I can imagine it being cheaper to either spin up more servers to handle the load, or hire a DDoS specialist to help you out, or make it someone else's problem by moving behind a thirdparty CDN.

Wouldn't it be in their favor to stop? No one would pay them if they had a reputation of continuing the attack after being paid. It also seems like it'd be a waste of their resources to keep going.

Unless they changed their mind and decide since you paid so easily, you might have a little more. There's no reputation to maintain in this activity.

Fool me once, shame on you. Why would they pay out again, if the attackers have made it clear that there's no reward for paying?

Would you want to have an identifiable reputation if you're DDoSing people?

Your logic is sound - why trust a criminal?

But it's not like there's a better business bureau from organized crime.

It reminds me of the Vikings. They would plunder throughout Europe including modern day France. It got so bad that the coasts ended up practically abandoned.

The rich and weak Frank empire, a bad combination, resorted to the disastrous policy of bribing the invaders to leave. It only served to mark the Franks as a good target and emptying the treasury. The Vikings would leave, plunder some other place and come back for more.

In the end, the Franks ended up giving part of their land on the coast : Normandy. This served to settle the invaders down while making THEM have to protect their newly acquired territory against other vikings.

or just bored kiddies, happens quite a lot

Besides reasons mentioned, it could benefit their competitors. Remember that sourceforge was under heavy ddos not even a year ago.

I'm not saying 37signals did it, but I bet someone who read this post did: http://37signals.com/svn/posts/3099-benchmarking-basecamps-u...

I'm sure it was tempting more than a few people with the resources.

Edit: just to be clear I meant any reader of signal vs. noise could have seen that (and Jesse's #1 comment and the jokes about DDOS in the comments) and decided to pull a prank. 37signals would never do that to anybody.

This seems a bit far fetched.

My wife is pretty convinced I brought this upon myself with my comment on that post. Lol, you never know.

I guess I didn't display my 37signals fanboy card prominently enough.

Reply on news.ycombinator.com