Hacker News Reader

Comment by Caelish | Hacker News Reader

I actually sent an email offering to help (I have a lot of experience mitigating DDoS attacks) but never received a reply. I imagine they must already have something in the works to resolve this.

View on HN

I think a lot of people already did this (including me) and they're probably flooded with offers. Thanks for the support though, I'm sure they're happy about any they get. It's about time to demolish the great firewall of China. :-)

Just curious, how are DDoS attacks mitigated?

Depends on the attack and how sophisticated it is. For most layer 7 attacks like this one, you can filter e.g. specific user agents or protocols. One thing that often works (but has some false positives with simpler search engines) is dropping all HTTP/1.0 traffic, because any remotely modern browser uses HTTP/1.1. Essentially you block anything that's unusual, like specific user agents (reflected attacks from user agents containing 'Wordpress' and 'PHP' come to mind a lot especially), HTTP headers, and so forth. Ideally as far upstream as possible, but it can be done on the server level as long as you have enough horsepower to throw at iptables or the web server, and your connection doesn't get saturated. The right IP blacklists can help a lot as well.

It does not work in this case, rogue states like China are using national backbone internet as DDoS tool.

You can find research papers back in 2001 about GFW. The DNS spoofing "service" can be easily used as a x3 amplification tool by anyone.

The implication in the article seems to be it's a GET/POST flood though, not DNS-based. Granted, for DNS amplification, having big enough pipes starts to matter a lot more, which is where providers like OVH shine because of how much network capacity they have, but it's not like DNS traffic can't be filtered. I haven't read the research papers you're referring to though, so I may be overlooking something obvious.

Reply on news.ycombinator.com