Hacker News Reader

Comment by codinghorror | Hacker News Reader

Is it really this hard to fend off a DDOS? At the funding and staffing level Meetup is at, I find this a little hard to understand.

View on HN

CloudFlare recently posted about a 400 Gbps attack they saw. I can't imagine any reason Meetup would have that sort of bandwidth capacity lying around.

To be clear, it was one of CloudFlare's clients, it wasn't a DDOS on them directly:

http://blog.cloudflare.com/technical-details-behind-a-400gbp...

"On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps."

And yes, it did affect other parts of their network, but they were able to successfully mitigate it.

"We saw attack traffic hitting every one of CloudFlare's data centers. While we were generally able to mitigate the attack, it was large enough that it caused network congestion in parts of Europe"

You don't need that kind of bandwidth capacity lying around if you plan ahead and work with DDoS mitigation services before you're attacked.

It's akin to setting up an IDS/IPS before you get pwnt through sloppy PHP/MySQL injections.

plan ahead and work with DDoS mitigation services before you're attacked

Where can I find more information about this? I've been thinking about exactly this issue with regards to running an MMO. Pretty much none of my functionality can be cached, so I don't think CloudFlare can help me. The best solution I've come up with is to run my MMO as a few servers on NFO, which hosts game servers and has a good reputation for "not just nullrouting you."

Pretty much none of my functionality can be cached, so I don't think CloudFlare can help me.

We have plenty of clients like that. They are using us for a variety of reasons, DDoS protection is one.

We have plenty of clients like that.

Curious: who is "we?"

What does mitigation look like, in that kind of setup?

The NTP attack is a simple example. No legitimate NTP traffic would be aimed at that site, so it can all be blocked at the firewall with no load on your servers. The problem with that attack was simply the bandwidth. Cloudflare's network helped to spread the load across many datacenters around the world.

Game servers are tough with their latency requirements. Generic web traffic is much easier to mitigate with offsite services (Prolexic, Defense.net, Cloudflare, etc).

If you're running game servers, your only good choice is to host with someone that has a really good onsite mitigation system. The offsite solutions add too much latency there.

Pre-CloudFlare, those were expensive. I can't speak to the technical work needed to hook something like MeetUp with CloudFlare, but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now.

>> but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now.

Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way?

Of course knowing a lot of InfoSec guys, they can only tell them what they should have, it's up the owner's to make the call to get it in place. I don't know how many times one of them complained about doing a pen test on someone's site, making the recommendations and then one year later, they haven't fixed anything yet.

> Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way?

I'm not sure I'd classify being subject to DDOS as a security hole.

It's a security hole, but not on their systems.

Sounds like they should have hired a real ops guy instead of a devops hipster.

Thanks for posting!

Not particularly. It just requires money, planning, and someone on staff who's old enough to remember the early 2000's when popular sites were routinely attacked. Seems like Meetup is lacking in at least one of those.

Popular sites are routinely attacked now too, with much larger attacks than any in the early 2000s.

Thanks for making my point (even with all the -1's from the kids).

Cue George Santayana quote.

Reply on news.ycombinator.com