Hacker News Reader

Comment by Aissen | Hacker News Reader

Interesting to learn the reason HN was down:

> You may have noticed that Hacker News was down on January 10th; we believe that was ultimately due to Cogent’s heavy handed approach to mitigating the DDoS targetting SourceHut (sorry, HN, glad you got it sorted).

It was also in https://news.ycombinator.com/item?id=38939532 but I did not see it earlier.

View on HN

i’m confused; is he saying that Cogent black-holed sourcehut’s IP addresses and that somehow affected HN’s IP addresses? they’re in completely separate IP allocations and ASNs...

to be fair, you reach a certain point when the only options left for DDoS protection are Remote Triggered blackholing on your edge.

This results in an entire /24 network not being routed to your network and being dropped by your peer instead.

Which is a totally reasonable way of going about the problem, of course. /s

Nobody has ever accused Cogent of being reasonable or competent.

That's not true. I work for a company that sells DDoS mitigation products to large network operators like Cogent for helping them deal with exactly these kinds of attacks in a much more sane manner than, "oy, just blackhole the destination and head out to lunch."

Either Cogent didn't buy our product (or a competitor's equivalent), or they have a network op who's a fresher and only knows how to blackhole things. Either way, it's a bad look for Cogent.

That is not a new look for cogent.

I remember at one point back in 2009 or so I wasn’t able to download from one of SourceForge’s mirrors. Turned out the reason for that was that Cogent had cut off my ISP (Telia) for some weird reason. IIRC Cogent and Telia hadn’t agreed on a peering policy, so Cogent just said whatever, we’ll cut you off (:

We were a Cogent customer for years. Blackhole was there one and only tool for DDoS. Eventually we just left.

Are there upstream providers in the US or EU that are known to deal with this kind of attacks in a more thoughtful way?

For a blackhole /32 (single IP) I believe is allowed in most ISP/INP.

Many ISP also have DDOS mitigation using bgp flowspec to block dirty traffic only and let valid traffic pass through.

Surprised he put that shout out in, considering he doesn't like Hacker News.

Likewise for the reach out to CloudFlare given their reverse proxy is actively blocked from source hut and anyone using source hut pages.

Only DD knows, but I guess even if he dislikes HN, he still might not wish for them to be blackholed.

Reply on news.ycombinator.com