Enh. I try to be positive in my comments as much as I can. Whenever the subject of DDoS mitigation by cloudflare comes up, and it seems like they're always tooting their own horn, I struggle to be impressed. By their own info, they have approximately 330 global locations [0]. 3800Gbps divided roughly (remember, anycast, and if their upstreams are well mixed, they're going to see pretty consistent splitting) equally across 330 locations is 'only' ~11.5 Gbps each location. I'm guessing within each PoP is more than a handful of machines dedicated to DDoS mitigation. So sure, they're doing computation on each bit of all of that, but it still doesn't seem all that significant. Toss half a cabinet at mitigation and continue on with your day. These capabilities are available at such commodity prices nowadays it's hardly worth the effort of a full page blog post.
And ok, I'll give some leeway in those numbers looking at the map on the linked page, 35% or so of source traffic is clustered over five countries so that distribution skews and some pops around those source countries are going to be hit harder than others. Still, maybe add an order of magnitude and I'll be a little less dismissive.
The amount of work required to stand up 330 well connected locations and then operate infrastructure to filter traffic at that scale profitably is more than "tossing" cabinets at problems.
Nah, not really. I know the amount of work standing up even 5% of that requires because I've been there, done that, have the sheet metal scars to prove it. It's a lot of effort. It's just not -hard-. After a while it's a copy-paste problem with it bottle-necking around the human: signing documents, waiting for tickets and whatnot, and it's pretty disingenuous to suggest it's not.
And ooh, ooh, I can flippantly dismiss a comment by calling back to that infamous comment as well! [0] You're actually posting this as a former VP? Geez dude, lighten up, they're not paying you anymore.
Meanwhile, it’s going on two weeks that a large volumetric amplification attack has been coming from CF itself against systems I manage.
Ironically, their abuse report does validate the domain being used to route traffic is a registered customer domain. But the abuse report and even Slack pings have yet to affect the traffic. It’s incredibly frustrating because you’d expect a company like Cloudflare, which positions itself as a defender against DDoS and similar threats, to take action much more quickly when they’re part of the problem.
That is weirdly short.
Maybe just a test? Someone proving they could do it as part of a threat? Someone accidently pressed the "Go" button accidently? Someone showing off?
Enh. I try to be positive in my comments as much as I can. Whenever the subject of DDoS mitigation by cloudflare comes up, and it seems like they're always tooting their own horn, I struggle to be impressed. By their own info, they have approximately 330 global locations [0]. 3800Gbps divided roughly (remember, anycast, and if their upstreams are well mixed, they're going to see pretty consistent splitting) equally across 330 locations is 'only' ~11.5 Gbps each location. I'm guessing within each PoP is more than a handful of machines dedicated to DDoS mitigation. So sure, they're doing computation on each bit of all of that, but it still doesn't seem all that significant. Toss half a cabinet at mitigation and continue on with your day. These capabilities are available at such commodity prices nowadays it's hardly worth the effort of a full page blog post.
And ok, I'll give some leeway in those numbers looking at the map on the linked page, 35% or so of source traffic is clustered over five countries so that distribution skews and some pops around those source countries are going to be hit harder than others. Still, maybe add an order of magnitude and I'll be a little less dismissive.
[0] https://www.cloudflare.com/network/
The amount of work required to stand up 330 well connected locations and then operate infrastructure to filter traffic at that scale profitably is more than "tossing" cabinets at problems.
This is on the level of BrandonM's famous comment on Dropbox. https://news.ycombinator.com/item?id=9224
Nah, not really. I know the amount of work standing up even 5% of that requires because I've been there, done that, have the sheet metal scars to prove it. It's a lot of effort. It's just not -hard-. After a while it's a copy-paste problem with it bottle-necking around the human: signing documents, waiting for tickets and whatnot, and it's pretty disingenuous to suggest it's not.
And ooh, ooh, I can flippantly dismiss a comment by calling back to that infamous comment as well! [0] You're actually posting this as a former VP? Geez dude, lighten up, they're not paying you anymore.
[0] https://news.ycombinator.com/item?id=40814123
> and it seems like they're always tooting their own horn
It’s called marketing.
Meanwhile, it’s going on two weeks that a large volumetric amplification attack has been coming from CF itself against systems I manage.
Ironically, their abuse report does validate the domain being used to route traffic is a registered customer domain. But the abuse report and even Slack pings have yet to affect the traffic. It’s incredibly frustrating because you’d expect a company like Cloudflare, which positions itself as a defender against DDoS and similar threats, to take action much more quickly when they’re part of the problem.
65 second attack? Very suspicious. This attack must have had some very specific goal.
Why keep running an attack that didn't even work? Every second probably causes a loss of some bots up to a point..
That is weirdly short. Maybe just a test? Someone proving they could do it as part of a threat? Someone accidently pressed the "Go" button accidently? Someone showing off?
I worry that CF has perverse incentives