Hacker News Reader

Comment by phyzome | Hacker News Reader

If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger?

I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

View on HN

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

Have you experienced a targeted DDoS attack on your personal site? I have. I too had this attitude like yours when I didn't know how nasty targeted DDoS attacks can get.

If you're not too worried about someone DDoSing your personal site, then your host taking your website down and then you having to run circles around their support staff to bring back the website up again, then I guess, you don't have a problem. It's nice that you don't care. (Honestly speaking. Not being sarcastic at all.)

Personally, I wouldn't mind DDoS on my personal site if the problem was just the DDoS. Unfortunately, mostly it isn't. A DDoS has other repercussions which I don't want to deal with exactly because it's a personal site. I just don't want to spend time with customer support staff to find out if and when I can bring my website back up again. DDoS on my personal website by itself isn't all that bad for me. But having to deal with the fallout is a pain in the neck.

> then your host taking your website down and then you having to run circles around their support staff to bring back the website up again

These are very different situations. With a DDoS the disruption ends when the attack ends, and your site should become available without any intervention. Your host taking down your site is a whole different matter, you have to take action to have this fixed, waiting around won't cut it.

> These are very different situations.

It is obvious those two are very different situations. I'm not sure I understand your point. Yeah, nobody will be bothered by a short 15 minute DDoS attack. I prolly wouldn't even notice it unless I'm actively checking the logs. Sure, nobody is going to be bothered by that. But what if someone's DDoSing persistently with a purpose? Maybe they're just pissed at you.

My point is... a sustained DDoS attack will just make your host drop you. So one situation directly leads to another and you are forced to deal with both situations, like it or not.

> It is obvious those two are very different situations. I'm not sure I understand point.

Your host taking down the site and forgetting to bring it back up after a DDoS attack isn't a common thing with any host, unless it's the kind that does this routinely even without a DDoS. And then you should look long and hard at your choice of hosting.

Either you suffer from a DDoS attack and come back when it's over, or you have a host that occasionally brings your site down and fails to bring it up until you chase them. But one does not follow the other without a lot of twisting.

DDoS attacks are frequently shorting than 15 minutes. We've seen plenty of attacks last less than a minute.

> a sustained DDoS attack will just make your host drop you

I'd love to see someone suing the host for damages. The contract binds them as much as it binds you.

Sounds like a good way to have your next gaming rig financed.

I'm pretty sure in every webhost terms of service I've ever read they leave language in to kick you out if you are degrading the service for others. Turns out a prolonged DDoS attack is degrading the service for others. The bigger cloud providers are drastically less likely to drop you but now you're paying a premium on hosting.

Not may area, so forgive me.

How does taking the site down stop the DDOS attack?

Isn't the host network still being bombarded by garbage packets, even if there isn't anything there listening?

Or is routing the destination IP to /dev/null enough to blunt the attack?

I know there are different kinds of attacks (e.g. some that are content based, impacting the individual server), but I thought most of them were just "legit" requests storming through the door that the server can't keep up with.

Having the site taken down after the fact, as a "risk to infrastructure" that the host can't afford, that's a different issue.

Forgiveness not necessary, these are good questions.

Internet packets have to travel through many routers between the source and the attack and the server they're attacking, at each step the routers usually get smaller. the smaller routers are less able to withstand the amount of traffic destined for one server, which means they can't route traffic to all the other servers that are not under attack. a common strategy is to drop the traffic at a much farther away server, thus protecting the smaller routers, thus protecting all the other servers.

The host Network would definitely still be affected by the DDOS, which is why the strategy is often to "blackhole" the traffic farther away from the individual server racks.

I see people say route traffic to /dev/null All the time, but I personally try to reserve that for the individual servers or the nearest router, just to avoid your exact confusion.

depending on how well designed, any specific network is the "hug of death" which has taken down many sites would also degrade the performance of the peers next to that server. Which is why many ISP are quick to block the traffic farther away. To protect not you but their other customers.

To be fair (pedantic), if it's part of a DDOS, it's not a legit request. Depending on the capabilities of the attackers, they will either choose obviously invalid requests because those take longer to process or exclusively valid requests which take longer to process. it is generally speaking much easier to send valid well-formed requests because that's what most libraries exist to do. you're often writing custom code if you want to send an invalid request because that is a bug in other cases.

A good example of an invalid request is setting up TLS transmitting a partial packet and then closing the connection (or leaving the TCP open), This one can be particularly expensive and much harder to detect.

> How does taking the site down stop the DDOS attack?

When people say take the site down, in this context, they often mean one of two things, either changing the DNS configuration to point to a different IP address (or none at all), or "null routing" traffic to the under attack IP, at an edge router, edge in this case meanthing their upstream ISP or other network peer. (farther from the victim server) I object to both uses because the specificity is important. When I say take down the server, I almost always mean quit [nginx] or power off the box.

Ok, thanks.

I was thinking more things being done to the actual machine the site was hosted on.

Starting without ddos protection and installing ddos protection IF you get attacked sounds like a reasonable strategy to me.

That’s like saying you should buy car insurance after you wreck your car

That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident.

Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?

Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.

> If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare).

That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.

Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare.

This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.

But you can just download a new car.

Unless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.

No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances

It's more like buying the plug-in version after the battery dies...

You already experienced the downtime, so if not having downtime was a goal you already failed. If avoiding downtime is not important then there's no reason to add anti-downtime capability to your system. The most charitable modeling of this approach is that the downtime incident may prompt one to realize that avoiding downtime actually is an important property for their system to possess.

The actual charitable model is that you expect close to zero attacks, but if you actually get hit your expected rate of future attacks goes up by an order of magnitude or two. And it's that change in expectations that gets you to buy protection.

You don't care about going down once, you do care about frequent outages. And you know this from the start, you don't realize it later.

I'm not so sure. The risk of future attacks hasn't actually increased, your initial risk assessment was just incorrect.

Yes, the original assessment was wrong. Such things happen all the time to reasonable people.

The person you were describing in your "most charitable" version above was not being reasonable. They didn't just underestimate the petty anger of the internet, they were being fundamentally foolish about their own desires. That's why I replied, to show you a different way someone could end up in this position.

How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?

That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.

Not if you live in a desert, which most blogs do.

That continues the analogy -- it doesn't rain often in the desert, but almost all deserts receive rain. And since it rains so rarely, you're certainly not going to find an umbrella during the rainstorm.

So again, if staying dry in the rain is important to you, buy an umbrella before the rain, if you don't care about getting wet from time to time, then no need for the umbrella.

While the personal blog owner may not care about DDoS related downtime, he may face extra usage charges due to higher bandwidth, CPU usage, etc that he'd like to avoid.

The people you see in a desert with umbrellas are not using it for the rain, but for shade, the rain is the least of their problems.

Even in a desert, people still use umbrellas for protection from the rain:

https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-b...

And the rain still causes problems, even (or maybe especially in) a desert:

https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain...

1 person using an umbrella, 4 are not. I'm starting to doubt if you're even human given that normal people don't go throughout their entire lives always carrying an umbrella wherever they go, even when it might rain.

Oh man. The corner shop around me has a wheeled cart stuffed to the gills with umbrellas, they roll it out to the entrance area when it rains.

Similarly Cloudflare has a giant button marked “I’m Under Attack!” in its signup flow, if I remember correctly…

My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked.

It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.

I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.

If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.

>or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS

Why? with cloudflare it's very easy, just put your site behind a reverse proxy, change the dns and disable direct access. Am I missing something?

Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured.

Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.

It's like saying you should buy volcano insurance after you get hit by a volcano

Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.

This strategy requires you to be "on-call" for personal stuff. Honestly, I don't want to spend more time on pet projects than I already do. Or cutting some of it away on support instead of spending more on things I would actually be interested in.

And resulting downtime might be even bigger than that with cloudflare.

in the cloud you should be able to turnkey this quite easily. i think in a DC this can be a bit more tricky because you will still be getting traffic from the DOS to your network interface after you have flipped the switch to cloudflare. This traffic will cause both you and your provider a problem. but i think the idea is you would have two sets of IPs one for the normal public hosting, and one for cloudflare proxy then when you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare. i presume if BGP stops advertising the IPs then eventually you will stop getting the DOS traffic.

> When you become under DOS attack you have a process in place for BGP to stop advertising the normal public hosting IPs and you switch to cloudflare.

You think people hosting personal sites are going to even have the access to manage their IPs with BGP? It's not something I've seen offered at that scale / pricing.

If I wasn’t running my own personal site at home on a proxmox vm, why would I choose a hosting provider that doesn’t do DDOS protection themselves?

You keep saying stuff like "the fallout" and "the repercussions" but then the only example you can provide is talking to customer service to bring your stuff back online. Is that it? Honestly speaking, not being sarcastic at all.

So the internet is a series of pipes, or tubes, whatever. This quintessential personal blog website is hosted somewhere in this inter connected mess of things. There’s a hierarchy of these pipes/tubes, and they all have some ever diminishing capacity as they head from a mythical center to the personal blog website.

When the bad guys want to DDoS the personal blog website they don’t go and figure out the correct amount they need to send to fill up that pipe/tube that directly connects the personal blog website, they just throw roughly one metric fton at it. This causes the pipes/tubes before the personal blog website to fill up too, and has the effect of disrupting all the other pipes/tubes downstream.

The result is your hosting provider is pissed because their infrastructure just got pummeled, or if you’re hosting that on your home/business ISP they also are pissed. In both cases they probably want to fire you now.

This is incorrect. Any decent host/ISP will instead (automatically, sometimes) emit a blackhole request for the given target IP address to their upstreams, causing the traffic to be filtered there (at the 'larger pipe'). In turn, these upstreams can also pass on the same blackhole request further up if necessary. This means the target is down from the point of view of the Internet, but there is no collateral damage.

See: BGP Blackhole Community (usually 65535:666).

Interesting, I didn't realise blackholes were special-cased to allow BGP announcements of /32 instead of the usual /24 or larger. I'd just assumed (like the GP) that the traffic ended up on the target's closest network to the source and only then was it filtered.

How is that even legal? Is that my fault if some random guy got upset about what I posted online?

What do you think would make it illegal?

It can be really bad, especially if the enemy deliberately attacks when you really need your site and/or makes you look evil.

My hoster wouldn't take me down though.

Instead it will protect me for free:

https://www.hetzner.com/unternehmen/ddos-schutz

In my experience hetzner DDoS protection doesn't work

As long as the hoster doesn’t actively make things worse by disconnecting you, any further help is just a happy accident. The bar is very low.

Yeah I suppose by "doesn't work" I should clarify that maybe it is doing something and preventing some attacks, and that it doesn't take down my server. With that being said, it has certainly failed to mitigate attacks on numerous occasions that cf would've.

I'm less scared of the hoster pulling down your site - not the end of the world - then decided to charge you bandwidth fees for all the MS-DOS attacks. The former presumably has no financial impact, the latter, potentially brutal

This!! Everyone seems to "really need" that unlimited scalability of AWS & Co - but they'll happily scale your compute and the bill for you.

Sure maybe you'll get lucky and they waive it.

But sometimes going down is a feature if you're not a multi m/billion dollar business

Off-topic, but there are six different people using the word "hoster" in this thread. I've never heard that word used instead of "host" or "hosting service" before, and yet here it's somehow prevalent. I feel like I'm having a stroke, or I just stepped into an alternate universe. Where did you all pick up that word?

That's just English being irregular. One that hosts websites should be called a hoster in principle :)

Host is both a noun and a verb. (The host can host a party.)

Hoster is new to me too.

But I get it as a pattern. (If you dine at the party then you are a diner.)

This happens often in comment threads, one comment uses an uncommon word and the entire thread goes along with it.

Considering there are probably near-zero MS-DOS machines online these days, I expect their attacks wouldn't cost very much.

On the other hand, based on supply v. demand I'd expect an MS-DOS attack to be pretty expensive these days :)

What is an MS-DOS attack?

Has anybody made a benchmark of different cloud providers and how they respond to DDOS?

That's not making things worse - that's just what the DDoS achieved anyway, but without harming anyone else.

In either case you just wait for the attacker to reach daddy's credit card limit and then your site is back up.

No, in the cases 'throwaway150 and I are talking about, your site is not back up. You (hopefully) got an email in your inbox saying your hosting provider has decided to take your website offline because of anomalous traffic or whatever, and after the attack ends you’ve got at least a couple of days of back and forth with support ahead of you before your downtime is actually over.

So until daddy's credit card runs out, plus two days. A shame, but it still doesn't cause meaningful harm.

Or get a different provider. Some are faster to respond. I had a false positive DDoS detection from netcup once (I was scraping an FTP site in active mode) and they automatically routed my IP through a DDoS scrubbing service, and automatically stopped that when an attack was no longer detected. I don't know what they have set up to be able to reroute a single IP globally like that - they agreed with some of their upstreams, to allow the occasional /32 for DDoS protection purposes.

this is too naive sorry, Hetzner will disconnect (and ban you if DDoS is too long), same as OVH. It works mostly for brutal UDP flooding but sophisticated attacks such as swarm of Puppeteers hosted on infected machines by the millions will not be protected, those "new DDoS mode" are offered by most DDoS providers.

evidence?

Handled hundred of dedicated servers for different projects over the last 20 years. Yes, OVH literally does ban accounts, and Hetzner nullroute your service at first if it's an elaborated attack.

Cloudflare will disconnect you from their free plan just as quickly.

Especially when you are facing "infected machines by the millions".

Except that Cloudflare is geared towards ddos protection - i.e. you can monitor, get alerts, turn on temporary protection, etc. It can do this because that's it's main business. It's not possible to have the same expectations from infra providers like Hetzner.

I don't think Cloudflare's main business is DDoS protection.

Likely true, but now you can go back to the original statement: the issue isn't really that the service isn't available for a while... It's that the hoster will remove your server.

Your server will keep existing if cloudflare just drops their free service, effectively going down for the ddosrs but still available for your own access directly

Citation needed. I know folks using the free plan that have gotten ddos’d and cloudflare kept them online. Can you point me to an article where cloudflare disconnected someone for getting attacked

They definitely used to do this ca. 2011-2012, any bigger attack and they'd drop you right away if you were on a free plan (and slightly slower if you weren't). But well, that was almost 15 years ago.

that's ddos protection....

It's funny because Hetzner was infamous for null routing on the slightest DoS back in the day. Have they improved?

This is mostly scaremongering, not all hosting providers take your site down just because someone you pissed off decided to DDoS you.

In Russia (I have nothing against Russia - I just know this info about “Дождь ТВ”), some news websites have been targeted by state-baked DDoS attacks, but I highly doubt most people are in this category.

Did they put it back up when the DDoS ended? If so, they're not hurting you since it's no worse than the DDoS itself, and they're actually helping you by preventing themselves from having a reason to ban you to save the rest of their sites.

A forum I manage was DDoSed, but I think it was by (AI) content scrapers as no one expressed any issues or anger towards the forum.

I temporarily got around it by blocking the subnet of their IPs.

I have since put it behind Cloudflare.

It sounds like OP is describing a situation where someone persistently DDOS's them as long as it works. In which case DDOS time trivially dominates cloudflare outage time. Note that OP is posting, even now, from an anon account.

This is a good essay: https://inoticeiamconfused.substack.com/p/ive-never-had-a-re...

> Note that OP is posting, even now, from an anon account.

Lol I didn't even notice that my submission reached the front page. What is your evidence for that claim?

Oh sorry, not you. The OP in the chat thread, they were DDOS'ed by someone and are commenting anonymously. Maybe grandparent is the correct word for it, in any event this is the comment I was referring to when I said OP, not your article: https://news.ycombinator.com/item?id=45966683

I have my personal site behind CF because I'm hosting it locally. Wouldn't a DDoS like....affect my internet?

For our SaaS, the uptime probably isn't much different but the cost definitely is. If any of your stack has usage based billing, things can get very expensive quickly.

> I'm not too worried about someone DDOSing my personal site. Yeah, they could do it. And then what? Who cares?

Your host, assuming you're hosting your site on a VPS. Many of them have a policy of terminating clients who get DDoSed.

and if you're hosting on your home network, a DDoS means connectivity problems for your home.

Not just your home, it means connectivity problems for your neighbors. In turn your ISP will shut you down if they figure out what is happening.

My blog was constantly going down for unknown reasons, with nothing obvious in the logs. I migrated it to CloudFlare and was able to track down the root-cause of the issue.

I also blocked all the AI crawlers after moving to CloudFlare and have stopped a huge amount of traffic theft with it.

My website is definitely much more stable, and loads insanely faster, since moving to CloudFlare.

I need SponsorBlock for HN, this is ridiculous.

I don't give a penny to CloudFlare to be clear, and I would definitely not pay for those services for my blog.

It's not because it's not a criticism that it's a sponsored post.

I happen to have multiple sites that use the same technology (WordPress, with the same few plugins and the same theme) running on the same server, with one behind CloudFlare and one not. Left value is with CloudFlare, right is without:

- First Contentful Paint: 0.4s - 0.7s

- Largest Contentful Paint: 0.8s - 0.9s

- Total Blocking Time: 0 ms - 0 ms

- Cumulative Layout Shift: 0 - 0

- Speed Index: 0.4s - 8.9s

The difference is quite staggering, and I'm located pretty close to my server (a Hetzner VPS), I can't imagine the difference for someone that lives across the world.

Sure, but your post reads like an infomercial, hence the snark.

NARRATOR:

- "Has THIS ever happened to you?"

CUT TO:

Black-and-white. Some guy stares in frustration and confusion at a terminal. Output of 'cat /usr/bin/gcc | xxd' or whatever scroll by.

NARRATOR:

- "Introducing CloudFlare™!"

CUT TO:

Full color. Sunlight. The same guy now sprawled on grass at a park. Two dogs tackle him with adoration. His kids hand him ice cream.

NARRATOR:

- "Stop debugging. Start living."

That's a lot of projection. They are just sharing their experience. Anecdotes are not ads for something.

Projection? It hasn't even been filmed yet!

> Sure, but your post reads like an infomercial, hence the snark.

Re-reading it you're right, but ultimately the last sentence aims at directly answering this question from the parent:

> If you added up all the outage time caused by DDOS and all the outage time caused by being behind auxiliary services that have their own outages... I wonder which would be larger?

I'm quite sure something else is going on here. Adding another hop generally shouldn't improve performance, especially if you are close by to the server.

What are the response times of requests between CF and accessing them directly?

There's no CF magic here. If you're improving from 0.4s to 8.9s that means you're not doing basic caching on your side and you could achieve this in your local nginx/whatever as well. The 0.3s saving on first paint is nice, but could be achieved with putting your assets in any kind of distributed provider, not just CF.

I never said the contrary, but there's a lot of "basic" things you need to setup on your own and that CloudFlare (or any equivalent) does out of the box: caching, SSL certificate, basic analytics, filtering bots, etc.

Add all this together and you have an extremely not basic setup at all anymore.

There are two companies on HN which get massive amounts of support from poster fanboys - cloudflare and tailscale.

It used to be apple.

The tides are turning against CF it seems.. they used to have a lot of HN support, but lately every thread about them is just a mess of MITM accusations and "too much of the internet is behind them".

Then who cares if your site is down for a few hours once in a blue moon because the auxiliary service in front of it is down?

The downtime cause by DDoS. It's now an endemic problem in the modern internet. Even relatively tiny communities suffer from it, because it's so damn easy to do.

It's like insurance. If you add up everyone's medical expenses, it's less than we all pay for insurance. But if you're the one getting hit, it matters a lot.

I mean I'm not worried about it either, but I've been on the internet long enough that I know some of the people I used to know will probably do it just to do it. Gamers can be quite toxic.

Reply on news.ycombinator.com