Hacker News Reader

Comment by dymk | Hacker News Reader

That’s like saying you should buy car insurance after you wreck your car

How? Isn’t it more like the difference between carrying an umbrella every day and ducking into the corner shop to buy one when you notice it’s raining?

That's a good analogy since the corner shop is going to be sold out of their small stock of umbrellas during the rain storm so you won't be able to buy one until the rainstorm is over but at least you'll have protection for the next storm. If staying dry is important to you, you should buy the umbrella before the rain.

Not if you live in a desert, which most blogs do.

That continues the analogy -- it doesn't rain often in the desert, but almost all deserts receive rain. And since it rains so rarely, you're certainly not going to find an umbrella during the rainstorm.

So again, if staying dry in the rain is important to you, buy an umbrella before the rain, if you don't care about getting wet from time to time, then no need for the umbrella.

While the personal blog owner may not care about DDoS related downtime, he may face extra usage charges due to higher bandwidth, CPU usage, etc that he'd like to avoid.

The people you see in a desert with umbrellas are not using it for the rain, but for shade, the rain is the least of their problems.

Even in a desert, people still use umbrellas for protection from the rain:

https://lasvegassun.com/news/2016/jan/19/fast-moving-storm-b...

And the rain still causes problems, even (or maybe especially in) a desert:

https://nypost.com/2022/07/29/las-vegas-braces-for-more-rain...

1 person using an umbrella, 4 are not. I'm starting to doubt if you're even human given that normal people don't go throughout their entire lives always carrying an umbrella wherever they go, even when it might rain.

Oh man. The corner shop around me has a wheeled cart stuffed to the gills with umbrellas, they roll it out to the entrance area when it rains.

Similarly Cloudflare has a giant button marked “I’m Under Attack!” in its signup flow, if I remember correctly…

Depends on the distribution of accidents and the distribution of costs. If P(ddos) * Cost(ddos) < P(no ddos) * P(cloudflare outage) * Cost(cloudflare outage) then you would be better off not using Cloudflare.

This is not considering other issues with Cloudflare, like them MITM the entire internet and effectively being an unregulated internet gatekeeper.

My site being down for a couple days is not an unacceptably large loss, unlike an uninsured car being wrecked.

It also isn't a good analogy because insurance doesn't apply retroactively to wrecks that happened before start of term, and is event-based rather than providing continuous value.

I thought that's why it's a good analogy - DDoS protection doesn't apply retroactively to prior attacks (or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS). If you want protection from DDoS, you need it before the DDoS. If you want to insure your car in case of accident, you need to insure it before the accident.

If the incident lasts for more than a few hours you could still set up ddos protection and rotate ips though.

>or even current attacks, it's hard to apply DDoS protection while your site is down due to DDoS

Why? with cloudflare it's very easy, just put your site behind a reverse proxy, change the dns and disable direct access. Am I missing something?

Unless your server literally starts on fire because of DDoS, no it isn't. Your things will be just fine after an attack, it isn't that serious.

Sounds reasonable if the car insurance could magically and near instantly fix your car, undo all the property damage and no one could get injured.

Insurance for physical things is different for services, they don't map as an analogy. A better one would be, Because you buy a new car every hour, it's like buying insurance for every car after someone steals your 700th car. That prevents your car from getting stolen.

Insurance protects you from big expenses. What's the big expense here? Oh, my site's down for a bit.

But you can just download a new car.

That's like saying my personal blog going down is as impactful to my health and finances as getting into an automobile accident.

Assume a "personal" blog or site is not making money for the owner, and they have backups of the site to restore if the VM gets wiped or defaced. Why spend money on DDoS protection if it is unlikely to ever occur, much less affect someone monetarily?

Depending on the host, you may get charged a big bill for traffic. If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare). When it comes to DDoS, most providers are quick to blackhole, and slow to unfreeze, without getting the run around.

> If you're hosting at home, your ISP may blackhole all traffic to your residence (affecting your day job and being a nightmare).

That's a very big stretch. Worst case you need to stretch to wifi tethering from you phone, which isn't much more than mildly annoying.

No its like saying you should buy a new battery after your battery dies. Yeah, its nice to have a spare battery around i guess but its not like your battery dying will significantly ruin your finances

It's more like buying the plug-in version after the battery dies...

You already experienced the downtime, so if not having downtime was a goal you already failed. If avoiding downtime is not important then there's no reason to add anti-downtime capability to your system. The most charitable modeling of this approach is that the downtime incident may prompt one to realize that avoiding downtime actually is an important property for their system to possess.

The actual charitable model is that you expect close to zero attacks, but if you actually get hit your expected rate of future attacks goes up by an order of magnitude or two. And it's that change in expectations that gets you to buy protection.

You don't care about going down once, you do care about frequent outages. And you know this from the start, you don't realize it later.

I'm not so sure. The risk of future attacks hasn't actually increased, your initial risk assessment was just incorrect.

Yes, the original assessment was wrong. Such things happen all the time to reasonable people.

The person you were describing in your "most charitable" version above was not being reasonable. They didn't just underestimate the petty anger of the internet, they were being fundamentally foolish about their own desires. That's why I replied, to show you a different way someone could end up in this position.

It's like saying you should buy volcano insurance after you get hit by a volcano

Reply on news.ycombinator.com