How LulzSec kept itself safe during the summer of 'lulz'

I found this pretty interesting:

> "but we also saw very specific attacks targeted at vulnerabilities in the routers we used on our network. That's pretty clever; you would have to spend quite a bit of time investigating the topology in order to figure out what routers we were using."

I agree. I was hoping for some investigative reporting, but the entire story is an advertisement.

Yes, it was a vendor interview piece with a linkbait-and-switch title. (Cloudfare didn't keep Lulzsec "safe", they kept their website up.)

But NewScientist's primary audience is not web hosting specialists. So for their audience I expect it was mildly educational.

Yes, they didn't do a particularly good job of keeping themselves safe, did they?

Here's our internal data on this. Based on page view data (values below are page views) and using the statistics from Google DoubleClick Ad Planner (http://www.google.com/adplanner/static/top1000/) we have the following for the last 30 days:

    Wikipedia.org    6,000,000,000
    Twitter.com      5,900,000,000
    Amazon.com       4,900,000,000
    Aol.com          5,400,000,000
    Zynga.com          460,000,000
    Total           22,660,000,000

Then looking at our own internal network for the last 30 days we see:

    CloudFlare      27,066,719,054								

So we did about 4.4B more page views than the combined sites above which would actually leave us room to add LinkedIn and Flickr to the list.

While I don't have any statistics, I do not doubt their claim. CloudFlare is a CDN, and as such will handle an enormous amount of traffic. As an example of this, Akamai, a large CDN, handles approximately 20% of the total traffic on the internet. In fact, many sites, such as Wikipedia, Twitter, even Amazon and Google, actually host static content through Akamai. All this content adds up to significant amounts of traffic.

EDIT: Link -- http://www.akamai.com/html/technology/dataviz3.html

My understanding is that CloudFlare runs a CDN delivering content for thousands and thousands of sites. This means it basically has to handle all the traffic for all of its customers. I'm sure that adds up really quickly.

It doesn't seem that surprising. Just digging around in the passive DNS database at work, I see CloudFlare has their name servers in the NS records of several 10's of thousands of domains. I'm fairly sure that given the scope of the sources of this data, that list is nowhere near complete.

Hi,

We only force a site direct if the attack is too large & starts to impact other customers as well. If the attack doesn't impact other customers, then we won't force the site direct (we generally only force a few sites direct per week & these are monster attacks).

Also:

Clarifying that forcing direct does not mean a null route. Forcing direct = going direct to the site's server (we still resolve the DNS).

Yes. This happened to our site as well. Cloudflare buckled and sent a "sorry, can't handle it" email.

This is very true as I saw it first hand around the very same time.

I've used it on a few small websites.

I think it's a great service if you don't want to spend money on a cdn.

I've used it a few times and it works well, it certainly didn't hurt. It's interesting to look at the stats they give and see how much bad traffic is being blocked. They definitely curbed the amount of comment spam on a test Wordpress blog I was using for awhile.

I wish I had more exact, measurable, information to provide but I used it only out of curiosity.

I tried them out for a bit, mostly because of their always-on claim but it didn't work for my sites for some reason so I switched to Amazon.

Their interface is nice, but I don't like the fact that you have to switch your DNS over to them and then re-enter data like MX records. With amazon I just point the parts of my domains I want to use to them and the rest remains with my primary DNS hosting.