> And in other words, nobody should be writing anything in C. Ever.
And in other words, nobody should be listening to thrownaway2424. Ever.
820 karma · joined July 26, 2013
And in other words, nobody should be listening to thrownaway2424. Ever.
Normal businesses when their costs go down: since we're in a competitive market, we'll use this as a competitive advantage and lower our prices to match
Telecoms in the same: "we're sorry, but we've lowered our costs by $X. Unfortunately now we have the expense of handling all this new cash, so I regret to inform you we have to increase your bill by the same $X."
I don't know about that. Comcast doesn't seem to have any problem robbing its customers right now.
I use Linux on servers, but I've always found the options lacking in some way for desktop.
I like elementaryOS, but it really doesn't feel as polished as OS X. Things like their choice of font don't help IMO.
Nah, no need to make it illegal. He's referring to AT&T's "GigaPower" gigabit service in Austin... the same service that's available from 2 other providers for the same, or cheaper, as what AT&T's charging for their data-mined bullshit.
AT&T will have a fun time getting customers when Google and Grande point that out in their attack ads. :D
It's possible the Solarflare NICs could be better at some metric like latency, by a matter of microseconds (only speculating here), but I can't see how they'd consider that worth the extra money for HTTP servers.
I wish OS developers saw this as a problem. There is no reason kernel stacks should be so slow for tasks where all processing is done in the kernel. (For packets destined to userspace, you've got the syscall overhead to deal with.)
I recently tested the Linux network stack's PPS performance with an Intel X520 10GbE NIC. I used Debian testing, with the 3.12 kernel. My destination machine was an i7-3930K at stock speed. I wrote a simple kernel module adding an NF_IP_PRE_ROUTING hook returning NF_DROP with no processing, which would be the simplest possible code path. For a packet generator, I used another older machine with another X520, using the "pfsend" tool included with PF_RING, and the card in PF_RING DNA mode. That was easily able to saturate the link at line rate (14.8M PPS).
The result: the kernel was only able to sustain about 2.8M PPS.
I then loaded the DNA driver on the destination machine, used the included "pfcount" tool, and no packet drops - it was receiving the full 14M PPS.
I tested DPDK recently and had similar results.
I also modified the Linux ixgbe driver ixgbe_clean_rx_irq() function, and added a step in between the "fetch packets from RX ring" and "put packet in SKB and send to network stack" functions. Even when I added a bunch of useless comparisons for each packet, I was able to get ~12-13M PPS. I could get line rate by just dropping and not doing any processing.
I don't see the cost of CloudFlare's service as a problem. In fact, free DDoS mitigation is great. The problem is that they're willing to provide service to booters/DDoS-for-hire services.
Reputable providers prohibit this kind of activity in their AUPs, and there aren't that many companies with their own large networks capable of DDoS mitigation (many are just resellers). If CloudFlare stopped supporting such services, it would immediately put a large dent in the entire booter market because the kids would take care of shutting each other down, and individual booters would find it difficult to find a provider who can mitigate attacks and is willing to provide service to them. (In other words, let them fend for themselves. Screw them.)
> Maybe you'd feel differently if you were the target of some of these attacks.
I agree, and I think this is why a few of us (you and me, in particular) have different views compared to others.
(I have talked to you on WHT recently. Not under this name, but you might have an idea.)
Publishing research papers about DDoS attacks is one thing. Selling a service that performs them (i.e. DDoS-for-hire) is completely different, IMO.
Reputable hosts use uRPF or at least an ACL at their edge to drop any outbound traffic with a source address that isn't in their network.
People buy servers from Ecatel because they're one of the few that (intentionally) do not have such measures in place.
I don't have a problem with CloudFlare offering multiple service levels. That's just smart business. They are one of the relatively few companies with their own network that can mitigate attacks. And that's where the problem lies - they are using that capability to prop up booters (DDoS attack services, if you weren't familiar with the term). As others have said, booters would be largely uneconomical to operate without the cheap assistance of CloudFlare, because the booter "market" is similar to drug gangs - it's a "war" with the booter owners all trying to take out their competition. (So this makes DDoS attacks less easily available, a good thing for the rest of the Internet.)
The problem is that CloudFlare is choosing to allow them to operate, while offering protection services at the same time. This is the very definition of a racket. It is no different from "wouldn't it be a shame if your shop burned down, you should pay us money."
Now, I'm not saying that _all_ DDoS would instantly go away if CloudFlare stopped this. It wouldn't. It would make a significant difference though, IMO. Services like this make it easy for anyone with little skill to launch attacks, and with amplification techniques (NTP, DNS, SNMP, chargen, etc.) the booter needs very little hardware and bandwidth to launch massive attacks.
Also, CloudFlare is not an essential service nor are they a monopoly. So if CloudFlare goes too far with something, it's not a problem for their customers to leave them.
This is called racketeering. Create the problem indirectly and offer protection. Sound familiar?
Having sent multiple abuse complaints to CloudFlare regarding booters, I have found them difficult to work with. As we've established, they will not censor anything; instead, if they determine your complaint to have some level of validity, they will send you to the actual host.
In one instance, the booter site had no information on registration or what was offered, so I gave them the hackforums thread where the service is being sold. I realize this is basically hearsay and not sufficient evidence to actually shut a site down, but remember that they won't shut a site down in any case. They did not consider this acceptable enough to release information about the host. They wanted me to register an account there and provide it to them for verification. Luckily, I could register without actually paying anything, providing me a nice UI with a big "launch attack" button, and this was sufficient for them.
More recently, they will not even release the site's IP address. All they will do is tell you to email the abuse department of [host] and ask the abuse department to contact them for details. This is ridiculous.
CloudFlare purports to be against DDoS attacks, yet has no problem providing service to admitted DDoS attack services. In other words, CloudFlare is a racketeering operation. They create the problem, indirectly, and offer services to solve it. (I realize they offer a free tier, but their advanced mitigation features are only available on paid tiers.)
Ecatel is the big one here. I don't know what it will take for their upstreams to shut them down, but it needs to happen. Do that and many of these reflected attacks will stop.
I run (as a hobby) some game servers and have handled several DDoS incidents. Out of all of them, I think there's only been one that I couldn't find real-life details for. When this occurs and the perpetrator is a minor, and I can find details for them, I give the parents a friendly call and let them know. Usually this can be easily resolved in a peaceful manner and without any mention, threats or use of legal action.
Why not just have an income tax and sales tax, or maybe only one (I've heard arguments for both sides, but don't want to get into that debate) to cover all this?
It's the same thing with all the ridiculous fees governments charge for various things. For example, registering a vehicle at the DMV. Why does this cost anything? After all, your taxes already pay the salary of the person at the DMV, their office, etc. and the sales tax (in states that have it) paid on a vehicle purchase should take into account that the new owner will need to register it.
It's just a ridiculous way of "not really increasing" taxes.