Hacker News Reader

Comment by 6thSigma | Hacker News Reader

It's surprising that there still isn't a sure-fire defense against a DDOS attack.

That's a bit like asking for a truck-proof bicycle.

Not quite. There's one sure protection from DDOS actually: scale. For example, Facebook or Google are practically immune from DDOS, since you cannot really overwhelm an infrastructure of that size, even with 100,000s of bots. If you have 10,000s of servers, IP anycast to multiple datacenters, multiple 10Gbps uplinks, you are immune from most DDOSs- they are simply handled like normal traffic fluctuations.

To extend the metaphor; Google and Facebook have 1000000 bicycles, and you can't take them all down with a single truck.

Your second metaphor ain't correct. Google and FB's normal way of executing doesn't consist in sending regular trafic to a bicycle (server) until it crashes and then re-dispatching that legit trafic to non-crashed servers.

Sure a server does crash once in a while but it's not because they purposefuly did overload it.

The DDoS attempt trafic is dispatched left and right just like regular trafic and doesn't affect the normal behavior.

It's more like the single truck can hit any of the 1000000 flying bycicles.

: )

Are you saying that Google and Facebook respond to DDoS attacks by just having enough capacity to serve all the attacking requests, all the way to rendering the pages as though they were requests from legit users? And if so, do you have first-hand knowledge to back that up?

Consider the fact that each of those companies has many services, which can vary widely in usage and capacity.

That's like the episode of South Park where the cure for AIDS is massive piles of cash.

There's never a sure-fire anything in this world, but here are some tips:

* http://stackoverflow.com/a/14599129/178651

* http://stackoverflow.com/a/1029613/1395668

http://en.wikipedia.org/wiki/Static_web_page

Reply on news.ycombinator.com