rmdoss

Details on why it happened here:

https://groups.google.com/forum/#!msg/mozilla.dev.security.p...

Good read on what not to do.

I have been a big OVH advocate (cheap prices + free DDoS protection + good hardware) and have been using them for years.

However, I am really frustrated by the lack of communication during this incident. All I had was the tweets from the founder, while their status page was down and I had no other place to reach out to them (phone + ticket system down).

What is worse is that they treat the individual SBGs (SBG1, SBG2, etc) as individual availability zones, when they truly are not. I had an application using their vrack on different SBGs availability zones and they all went down.

Anyway, glad they are fixing it, and glad for the clarification that they don't have real availability zones. Will design my applications better next time.

Me too. But easier sad, than done. At least for us.

Those are very annoying and dangerous. Glad Youtube is doing something.

If you have young kids, be careful on what you allow on their devices (ipads, xbox, iphones, etc).

Just the other day, I noticed a young kid (~9yo) watching some type of porn on an iPad, while the parents were paying attention the other kid play softball. I told the mom and she freaked out.

What I am doing for my own kids lately:

-Enable Parental control on their devices, so they can't install, delete or modify any the apps.

-Force a Family Filter through DNS: OpenDNS, Norton, CleanBrowsing ( Lately I have been using CleanBrowsing - https://cleanbrowsing.org - as it enforces SafeSearch + Safe Youtube by default.

-Disable Flash & Java.

-Install an adblocker.

-Check their browser histories from time to time to see whats up. They are all pretty young (under 10), so didn't learn how to clear history yet. I wish there was a way to prevent cleaning up history on the ipad.

Any other things I might be missing?

Yep, those are annoying. What I found useful is to force Safe Search + Youtube Kids across our house via DNS.

Similar to this: https://cleanbrowsing.org/articles/configuring-google-safe-s...

But for www.youtube.com and m.youtube.com (it is actually the same IP).

Why forking, btw? Curious why you chose that route.

That's an interesting concept. Do you do only the design/mockups or you build the frontend (HTML/CSS) as well?

I will forward the link to a friend that was looking for something similar.

OVH is one of the few hosting providers that used to offer DDoS protection for free to everyone - and a good one.

The issue is that it became a refugee for sites that could not stay online on other providers due to DDoS - so they were getting hit often.

The price change is not too bad considering how cheap they are. Still use and recommend them.

Too much content without addressing the real problem with most startups:

They do not solve a customer problem.

Solve their problem, make their life better and you will do well.

I recommend watching this video by Fast.ly on some real metrics comparing HTTP/2 and HTTP/1:

https://www.youtube.com/watch?v=0yzJAKknE_k

Overall, the performance gain is not as much (if any) compared to the hype we hear.

That's from a CloudFlare DNS Engineer -- someone that knows and likely handles DDoS on a daily basis.

I can see that. I just tend to engage on threads about ddos/security where I share what I do and tools I use.

I love CloudFlare, but understand the concern some people have.

With the amount of sites they have behind them, and the amount of visibility and data they can extract, it is actually a bit scary to think what will happen if they get compromised or "do evil".

But so far, they seem to take the open and ethical approach and actually follow the "do no evil" mantra. CloudFlare is another Google in the making and I hope they keep like that.

thanks,

Because I am not. Just like their service and use it along with CloudFlare (which I always recommend).

That's a great move by Hetzner. Glad to see that OVH is not the only main player doing it anymore.

The only issue with both is that they don't handle l7 DDoS, which seems to be getting more common. I also don't like that they leverage TCP rst's for syn floods, but I guess thats better than going down.

But so far, for l7 attacks you still need ddos mitigation strategies or something like CloudFlare.com or https://sucuri.net in front of your site.

thanks,

Fun read. If you ever get hacked, I recommend just destroying the server and starting from scratch and a clean backup.

If you try to find all backdoors and left over rootkits, you will end up forgetting one and being re-compromised.

Depending on the size of the syn flood or HTTP flood, there is no way you can handle it locally.

Some syn floods can generate millions of packets per second, which is way more than a dedicated linux server can handle.

Good video on the topic:

https://www.youtube.com/watch?v=pCVTEx1ouyk

Yep, we suffered through it.

To be fair, they all have some downtimes from time to time.

To summarize the discussion here so far:

1- For small attacks you can optimize your stack, cache your content and use a provider that allows you to quickly scale and add more servers to handle the traffic. Do not use Linode or Digital Ocean as they will null route you.

OVH, AWS and Google are the ones to go with.

2- Use a DDoS mitigation / CDN provider that will filter the attacks and only send clean traffic back to you.

The ones recommended so far:

https://cloudflare.com

https://sucuri.net

https://incapsula.com

I do use OVH and recommend them from time to time.

The main issue is that I lost a bit of faith in their support and reliability. vracks going down for hours with no updates. Connectivity issues. Servers disappearing.

Besides that, their DDoS protection works well for l3 attacks, except that they force a TCP reset on every connection. So if you are picky about extra connect times and having your clients re-establish their connections, they are great.

Surprised to see anyone mention defense.net.

How has been your experience with it?

That's a good point. CloudFlare, Sucuri and friends only handle HTTP/HTTPS/DNS traffic.

If you have custom protocols, you have to get a full /24 mitigation and so far nobody can beat Arbor into it. Very expensive, but works well if you have BGP.

We need to divide DDoS here in two categories:

-DDoS you can handle (small ones). That anything up to 1 or 2Gbps or 1m packets per second.

-DDoS you can not handle. Anything higher than that.

For the smaller DDoS attacks, you can handle it by adding more servers and using a load balancer (eg. ELB) in front of your site. Both Linode and DigitalOcean will null route your IP address if the attack goes above 100-200Mbps, which is very annoying. Amazon and Google will let you handle on your own (and charge you for it), but you will need quite a few instances to keep up with it.

For anything bigger than that, you have to use a DDoS mitigation service. Even bigger companies do not have 30-40Gbps+ capacity extra hanging around just in case.

I have used and engaged with multiple DDoS mitigation companies and the ones that are affordable and good enough for HTTP (or HTTPS) protection are CloudFlare, Sucuri.net and Incapsula.

-CloudFlare: Is the most popular one and works well for everything but l7 attacks (in my experience). You need to get their paid plan, since the free one does not include ddos protection - they will ask you to upgrade if that happens.

-Sucuri.net: Not as well known as CloudFlare, but they have a very solid mitigation. Have been using them more lately as they are cheaper overall than CloudFlare and have amazing support.

-Incapsula: I used to love them, but their support has been really bad lately. They are on a roll trying to get everyone to upgrade their plans, so that's been annoying. If you can do stuff on your own, they work well.

That's been longer than what I anticipated, but hope it helps you decide.

thanks,

Very good article with the unnecessary click bait headline.

Yep, agree 100% very short sighted view of security. Their grades doesn't mean anything, other than confuse people thinking they are secure.

Their description doesn't really match what they do:

"Observatory by Mozilla is a project designed to help developers, system administrators, and security professionals configure their sites safely and securely. "

All they check is if you have a few security headers and consider that "secure".

There is a LOT more to website security than adding a few extra headers and HTTPS to your site. Even if you get an A, it doesn't mean anything.

To give an example, Google gets a D, CloudFlare a D, Youtube a C+, etc..

Thanks, mis-read it.

Ah, good point. Thanks for the info.

Don't think their numbers are right.

I manage 3 different sites with AAAA and A records.

site 1: tech site: 12% of the traffic is via IPv6

site 2: mixed/funny site: 7% is IPv6

site 3: company site: 9% is IPv6

I asked around a few friends and all of them with IPv6-enabled sites have around 5-15% of their traffic via IPv6.

Even Google sees 14%:

https://www.google.com/intl/en/ipv6/statistics.html

Can't believe this 50% number.

PagerDuty is the kind of cool company that I am surprised haven't been bought yet.

After Atlassian acquired StatusPage, I can see them going after PagerDuty (or similar) to complete their devops solution.