john37386

I'm in the same situation as many people here. Started as a small personal email projects many years ago just to learn. I really enjoyed it, reading all the specs and making it always better year after year. Dmarc felt like a total achievement.

I started to host emails to many friends, small businesses and even a SaaS I developed. The subscription needs an email validation and I'm aware that the activation email ends up in the Spam folder for the new customers using Google emails. This activation email has everything from dkim, spf, dmarc, to unsubscribe link, full physical address of the business, etc and still I can't hit a good enough score.

I was thinking to start using Google service to send the activation link and hosting my personal domains, but seeing that I am not alone, I will continue to improve my little email projects.

Thanks all for cheering me up on this. I'm sure we can come up with a solution and I would be happy to help. When do we start?

Quic is secure and doesn't allow spoofing.

But, since it runs on UDP, a hacker could attack few DNS servers and amplify a UDP attack toward a Quic server. This is true for all reflection and amplification attacks.

Hence, Quic is vulnerable to receive huge amplification attacks +100Gb and soon 1Tbps. It will not make internet a safer and better place.

Even video game companies used to use UDP and they move away because UDP is too dangerous. They now use TCP with a kind of websocket techno to not allow UDP.

Many big enterprises don't allow UDP toward their critical infrastructure.

Most of the deadliest DDoS attacks happen over UDP. Spoofing, reflection and amplification just to name a few. Many businesses just deny UDP to protect themself against the on going DDoS threats.

I feel this move won't make internet a better and safer place, but let's see.

"Backups? Forget it. This is the Dark Web. Winzen told ZDNet that there ain’t no such thing as backups on Daniel’s Hosting, by design:"

I'm wondering why encrypted backup is not an option for them?

I come from a similar background as you and I've done CISSP from (ISC)2. I always thought it would be useless as I thought that I can't learn new stuff because I am sysadmin/SRE/shitty dev.

What I observed from a sysadmin/SRE perspective vs pure security team is that we speak 2 different languages. We often clashed with them and it brought frustrations on both sides.

The material cover in CISSP is very broad and not deep. I've done it on my own and I saved $6K. The book costs 80$ and it takes 3 to 6 months to complete. The exam is a real bitch though! Be sure to be very prepared.

In the end, it's the best moved that I've done in my career and I can now speak with the Security mafia.

Some /24 are more critical than other. There is a price to security and for sure advertising only /24 is probably not viable.

The article mentionned that some networks within the /19, in this incident, were critical. So yes, I believe that every businesses should advertise /24 for their highly critical infra. They can advertise /19, /20 and so on for the less important networks. No need to use /24 for everything.

If google advertised several /24 for these ip networks instead of /19, this would have not happenned.

Maybe these social networks could be manage by the community. A bit like HN. Here if you post crap, people can downvote your crap to the bottom so that no one can see it.

If you want to be seen and red, you need to post quality and gain reputation. People with bad reputation will slowly lose visibility.

It might not work, but clearly it seems that quality is a prime factor on HN and it's one of the reason why I trust more HN than any other social network.

Was iptables running? Maybe they hit a conntrack limit

I'm sure that your ruby can hold +100k connctions with enough RAM.

Yep I mistaken Security groups with Network Acl. Thanks. It's in the best practices to not track dns for big systems.

From powerdns https://doc.powerdns.com/recursor/performance.html

EC2 throttles everything by default and PPS is no exception.

What can you do when your system needs more bandwidth, cpu, ram or any other kind of resources?

You can either scale vertically... which is not bad at beginning of a project, but sooner or later you will hit the ultimate limit.

Or

You can scale horizontally. Which means that you have enough nodes or instances to bypass those limits and make sure your projects grow well over time.

Netflix runs on EC2 and they probably generate billions of PPS from Amazon. For sure it's several millions PPS a d they seem to not hit the limits mentionned in the article.

By default, Amazon uses stateless firewall. It means that by default it's not tracking connections.

So this afect only apache? Anyone have any thoughts on nginx, IIS and other web servers like tomcat, websphere?

Will it rollover smoothly? Feel free to report any issue here:

Really nice place here. I read it daily and constantly learn new technos and trends. Thanks Paul

Cool stuff, I would personally enforce the "count" packet to 100 or 1000 by default. This way, you make sure that no one crashes this powerful device. If someone knows what is doing, then he could just disable it.

Sniffing at +10Gbps can be tricky sometimes.

I always load test my webpages with https://ddostest.me/load-test/ before advertising them on HN. Strangely, I often find a little something missing.

Nice article worth reading even though I got a few 504. It looks more professional when the webpage loads in a second on first try.

Sha is a cryptograpic algo used for secure hashing hence the name SHA. The main goal of hashing is confirming the integrity of an object. This mean the object you read now is the same object as when it was stored. The goal was never to encrypt even if its possible to do so.

All hashing functions have the same weakness which is vulnerable to rainbow table attack. I agree with the OP that sha is dangerous if used in the wrong way.

I use zabbix a lot with PG database and there are 2 tables that grow indefinitely. The zabbix housekeeper lags a bit when the tables become +200GB. I tried the autopartitioning and the housekeeper becomes irrelevant. I can now easily keep 1 year of data for my +200k monitored items. I like my critical alerts to keep 3 months at 60 seconds interval. Pg partitioning is really awesome

Like you said it's a good starting point. I wouldn't take all that is written for granted, but hey! We are at least 2 that agree that there is something to start your introspection in there. It's very easy to read also.

Maybe you can start from scratch with the root foundation of your personnality. Sometimes we don't understand why we react to some situations.

So, I did this Myer Brigg online test at 16personalities.com

I red the description of my personality and it was like reading in my head.

I bought the longer version and it really helped me better understand myself.

Hope it can help you too.

ENTP

I would like to read this article but, the website doesn't load. I guess it's not optimized to front page HN.

May I suggest to loadtest your website or article before posting it?

https://ddostest.me/load-test/

Well BSD kernel will also choke at more or less the same limits as linux kernel.

The key point here is that a netmap driver bypass the kernel and therefore open the door to many millions packets per seconds or millions requests per seconds. Not many Gbps

Many people don't understand how or why the linux kernel is the bottlebeck at speed higher than 10 Gbps.

The problem is that the linux kernel can't process many simultaneous small connections.

Just to be clear: - linux can easily transfer at 40 Gbps - linux chokes at around 1M packet per second per cpu socket.

Thats right.

So linux can easily transfer at 40 Gbps one or few simultaneous flows

But! It can't transfer several flows at 40 Gbps.

The bottlebeck is the number of packets per seconds it can inspect.

So if you are sending 100 big transfers, you will reach 40 Gbps.

If you send 5M small transfers, linux will die.

This is why netmap is handy.

It offloads the packets from linux directly to the app

Bbc is sending xM small requests per second, hence millions packets per seconds.

In conclusion, netmap is good if you need a lot of small simultaneous connections.

I reached 40M connections on chelsio 40 Gbps nic using netmap on FreeBSD 11.

It makes sense because Cloud is very expensive. You should try to Dev/Test/Qa in a cheap cloud. Usually they are very stable.

Then, with your CI/CD pipelines you should use a more stable and potentially more expensive cloud for PROD or a live environment. Your branch should be in always ready to deploy in the live environment.

If you already layer your startup to easily move from 1 cloud to another, then your startup should instantly benefit from the cheap cost to develop and stability for your clients. Also, at a later point you will be already ready to use multiclouds in the live environment.

If you want to embrace DevOp culture, where it comes from, why is it important and the reality of medium big businnesses, then you definitely want to read the Phoenix project

In the second paragraph we read this: The problem effects all systems, regardless of visualization or not.

Could it be that the author wanted to write virtualization?