Hacker News Reader

Comment by valarauca1 | Hacker News Reader

The problem he may have is its a bit to reassuring. They claim user data is safe while being under attack. This is conceptually very similar to teaching kids that if you duck and cover during an ICBM strike you'll be fine.

>This is like a bunch of people blocking the front door and not letting you into your house. The contents of your house are safe -- you just can’t get in until they get out of the way.

If this is truly 110% true, they couldn't even ssh into their servers (in before, "You don't ssh each into individual shards"). Which I'm betting they can, which means their are still attack vectors to exploit.

View on HN

Not sure that your missile analogy holds. Most DDoS attacks do not attempt to crack logins to servers, but rather try to flood the servers with as much garbage as possible. Besides, even if they were trying to crack the SSH password, a properly secured server (long passwords/public key auth + fail2ban) should be fine.

Okay here is a better one. Just because people are blocking each other trying to run into your front door doesn't mean they (or somebody else) aren't cutting open your windows, picking the lock on your garage door, or trying to climb down your chimney.

Yes you do. Because DDoS, so like the service is down for users and attackers.

I'm surprised that on a technical forum there is still this complete misconception of what a DoS is.

There are different types of DDoS attacks.

Each level of the OSI model can be attacked in a DDoS, and its still of Denial of Service attack. I.E.: You can hold down a pre-2009 windows server with as little as 10-15 packets per second, totally less then a kilobyte per second.

Yes if your have a 10/100/1000 nic and your getting 20Gb/s then yeah nothing's getting in. Or if you have a 10Gb/s router, then 20Gb/s will freeze the whole data center. But if you have a 100Gb/s router with a 4x bounded 10Gb/s nics. And your service is down, then it isn't your hardware, but your software. Your kernel, sockets.h, are still processing packets, you can still be attacked.

Reply on news.ycombinator.com