[gentoo-user] [way OT but interesting] Massive recent DDOS attack

[gentoo-user] [way OT but interesting] Massive recent DDOS attack

[walt]

Any of you admin types out there have any grumpy thoughts about this
article? :)  Is it really just marketing BS from cloudflare, or is it
solid stuff?

http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Alan McKinnon]

On 01/04/2013 01:12, walt wrote:
> Any of you admin types out there have any grumpy thoughts about this
> article? :)  Is it really just marketing BS from cloudflare, or is it
> solid stuff?
> 
> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
> 
> 



A quick scan of the article seems to be solid stuff.

Yes, they are of course trying to make themselves look good (who
wouldn't?) but they also seem to be sticking to the facts as well.

-- 
Alan McKinnon
alan.mckinnon@gmail.com

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Michael Mol]

[-- Attachment #1: Type: text/plain, Size: 2537 bytes --]

On 03/31/2013 07:12 PM, walt wrote:
> Any of you admin types out there have any grumpy thoughts about this
> article? :)  Is it really just marketing BS from cloudflare, or is it
> solid stuff?
> 
> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
> 
> 

Can't tell one way or another. Certainly the bulk of the events
described are true. Certainly, it's in CF's interest to describe how
they're thwarting a massive DDOS.

And, certainly, they'd lose virtually all credibility if they were
blowing smoke. Lose credibility, and they'd lose a ton of business.

Frankly, I'm *inclined* to believe their description of events on that
basis alone. But that's not absolute.

It's also worth noting who they're protecting, and who the aggressor is.
The organization they're protecting is a high-profile target. The
organization they're protecting against is one whose businesses are
heavily impacted by the latter, *and* who don't share a positive
reputation among most.

That said, when someone in here linked to a spamhaus page a few days
ago, my local CloudFlare cache didn't have a copy of it, so I suspect
spamhaus hasn't been weathering the storm particularly well.

I'm also using CloudFlare for my site (they have a free tier which is
frankly wonderful), and I've observed that whatever means I put in place
to protect myself through them, it's not possible to get 100% coverage;
for CF to work for you, you need to have a public IP address their
servers can query. So long as you have a public IP address, you can be
targeted; it's just a matter of discovering what that IP is. That IP
could be discovered any of a variety of ways, particularly if someone is
able to induce your server to send data outbound. (i.e. an email where
the origin exists in the message headers.)

For at least a couple weeks now, I've been a direct target of some kind
of attack by someone who holds some kind of weird grudge. Originally, it
was a simple SYN flood, but it's lately taken to be a flood of RST
packets claiming to be from a particular CloudFlare IP; the attacker is
trying to disrupt service by terminating proxied connections.

Anyway, if you don't need SSL, I highly recommend CloudFlare's free
tier. If you do need SSL, they have tiers which support that...but I
don't have a budget to spend on it. (OTOH, it's nice enough that my
average page load times have plummeted...and I now have a free global
proxy cache network, despite my only having one backend server...)



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[staticsafe]

On 3/31/2013 19:12, walt wrote:
> Any of you admin types out there have any grumpy thoughts about this
> article? :)  Is it really just marketing BS from cloudflare, or is it
> solid stuff?
> 
> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
> 
> 

Some other good reads:
http://cluepon.net/ras/gizmodo
http://instituut.net/~job/cb3rob-spamhaus-hijack-21-mar-2013.txt
https://greenhost.nl/2013/03/21/spam-not-spam-tracking-hijacked-spamhaus-ip/


-- 
staticsafe
O< ascii ribbon campaign - stop html mail - www.asciiribbon.org
Please don't top post - http://goo.gl/YrmAb
Don't CC me! I'm subscribed to whatever list I just posted on.

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Volker Armin Hemmann]

Am 01.04.2013 01:12, schrieb walt:
> Any of you admin types out there have any grumpy thoughts about this
> article? :)  Is it really just marketing BS from cloudflare, or is it
> solid stuff?
>
> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
>
>
>
and since pretty much every technological site PLUS a lot of mainstream
news sites reported that attack days ago, it is really great to see
ANOTHER thread spawned by this non-news.

[gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[walt]

On 03/31/2013 06:00 PM, Volker Armin Hemmann wrote:
> Am 01.04.2013 01:12, schrieb walt:
>> Any of you admin types out there have any grumpy thoughts about this
>> article? :)  Is it really just marketing BS from cloudflare, or is it
>> solid stuff?
>>
>> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
>>
>>
>>
> and since pretty much every technological site PLUS a lot of mainstream
> news sites reported that attack days ago, it is really great to see
> ANOTHER thread spawned by this non-news.

Thanks Volker.  You haven't yelled at me for ages and I was beginning to
worry about you ;p

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[Volker Armin Hemmann]

Am 03.04.2013 02:35, schrieb walt:
> On 03/31/2013 06:00 PM, Volker Armin Hemmann wrote:
>> Am 01.04.2013 01:12, schrieb walt:
>>> Any of you admin types out there have any grumpy thoughts about this
>>> article? :)  Is it really just marketing BS from cloudflare, or is it
>>> solid stuff?
>>>
>>> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
>>>
>>>
>>>
>> and since pretty much every technological site PLUS a lot of mainstream
>> news sites reported that attack days ago, it is really great to see
>> ANOTHER thread spawned by this non-news.
> Thanks Volker.  You haven't yelled at me for ages and I was beginning to
> worry about you ;p
>
it's my guinea pigs. They make me non-grumpy.

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[Raymond Jennings]

[-- Attachment #1: Type: text/plain, Size: 911 bytes --]

Do guinea pigs work better or worse than tribbles at calming you?


On Tue, Apr 2, 2013 at 5:54 PM, Volker Armin Hemmann <
volkerarmin@googlemail.com> wrote:

> Am 03.04.2013 02:35, schrieb walt:
> > On 03/31/2013 06:00 PM, Volker Armin Hemmann wrote:
> >> Am 01.04.2013 01:12, schrieb walt:
> >>> Any of you admin types out there have any grumpy thoughts about this
> >>> article? :)  Is it really just marketing BS from cloudflare, or is it
> >>> solid stuff?
> >>>
> >>> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
> >>>
> >>>
> >>>
> >> and since pretty much every technological site PLUS a lot of mainstream
> >> news sites reported that attack days ago, it is really great to see
> >> ANOTHER thread spawned by this non-news.
> > Thanks Volker.  You haven't yelled at me for ages and I was beginning to
> > worry about you ;p
> >
> it's my guinea pigs. They make me non-grumpy.
>
>

[-- Attachment #2: Type: text/html, Size: 1520 bytes --]

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[J. Roeleveld]

[-- Attachment #1: Type: text/plain, Size: 1255 bytes --]

Raymond Jennings <shentino@gmail.com> wrote:

>Do guinea pigs work better or worse than tribbles at calming you?
>
>
>On Tue, Apr 2, 2013 at 5:54 PM, Volker Armin Hemmann <
>volkerarmin@googlemail.com> wrote:
>
>> Am 03.04.2013 02:35, schrieb walt:
>> > On 03/31/2013 06:00 PM, Volker Armin Hemmann wrote:
>> >> Am 01.04.2013 01:12, schrieb walt:
>> >>> Any of you admin types out there have any grumpy thoughts about
>this
>> >>> article? :)  Is it really just marketing BS from cloudflare, or
>is it
>> >>> solid stuff?
>> >>>
>> >>>
>http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
>> >>>
>> >>>
>> >>>
>> >> and since pretty much every technological site PLUS a lot of
>mainstream
>> >> news sites reported that attack days ago, it is really great to
>see
>> >> ANOTHER thread spawned by this non-news.
>> > Thanks Volker.  You haven't yelled at me for ages and I was
>beginning to
>> > worry about you ;p
>> >
>> it's my guinea pigs. They make me non-grumpy.
>>
>>

Please don't top-post.

Tribbles don't keep people calm indefinitely. At some point they all die from starvation and humans would follow soon after.... :)
-- 
Sent from my Android phone with K-9 Mail. Please excuse my brevity.

[-- Attachment #2: Type: text/html, Size: 2083 bytes --]

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 469 bytes --]

On Wed, 03 Apr 2013 05:46:07 +0200, J. Roeleveld wrote:

> >Do guinea pigs work better or worse than tribbles at calming you?

> Tribbles don't keep people calm indefinitely. At some point they all
> die from starvation and humans would follow soon after.... :)

AFAIR guinea pigs don't last forever either...


-- 
Neil Bothwick

Processor: (n.) a device for converting sense to nonsense at the speed
           of electricity, or (rarely) the reverse.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[J. Roeleveld]

On Wed, April 3, 2013 11:09, Neil Bothwick wrote:
> On Wed, 03 Apr 2013 05:46:07 +0200, J. Roeleveld wrote:
>
>> >Do guinea pigs work better or worse than tribbles at calming you?
>
>> Tribbles don't keep people calm indefinitely. At some point they all
>> die from starvation and humans would follow soon after.... :)
>
> AFAIR guinea pigs don't last forever either...

True, but they don't eat ALL the food first ;)

--
Joost

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[Volker Armin Hemmann]

Am 03.04.2013 13:16, schrieb J. Roeleveld:
> On Wed, April 3, 2013 11:09, Neil Bothwick wrote:
>> On Wed, 03 Apr 2013 05:46:07 +0200, J. Roeleveld wrote:
>>
>>>> Do guinea pigs work better or worse than tribbles at calming you?
>>> Tribbles don't keep people calm indefinitely. At some point they all
>>> die from starvation and humans would follow soon after.... :)
>> AFAIR guinea pigs don't last forever either...
> True, but they don't eat ALL the food first ;)
>
> --
> Joost
>
>
>
indeed. They never showed any interest for my pizzas.

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Philip Webb]

130331 walt wrote:
> Any of you admin types out there have any grumpy thoughts about this ?
> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet

There was a good story in 'Guardian' :

  http://www.guardian.co.uk/commentisfree/2013/mar/29/cyberwar-spun-shoddy-journalism

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Michael Mol]

[-- Attachment #1: Type: text/plain, Size: 820 bytes --]

On 03/31/2013 10:00 PM, Philip Webb wrote:
> 130331 walt wrote:
>> Any of you admin types out there have any grumpy thoughts about this ?
>> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
> 
> There was a good story in 'Guardian' :
> 
>   http://www.guardian.co.uk/commentisfree/2013/mar/29/cyberwar-spun-shoddy-journalism
> 

The Gizmodo article that Guardian article lauds irritated the hell out
of me. Certainly it was unlikely for the global Internet to collapse.
However, from the details I've read, there was a risk of one or two IXs
failing, and that would have *serious* regional effects.

Whether a chunk of Europe dropping offline qualifies as "breaking the
Internet" is an interesting question. The answer probably depends on
whether or not you're on that continent...


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[luis jure]

on 2013-03-31 at 23:05 Michael Mol wrote:

> On 03/31/2013 10:00 PM, Philip Webb wrote:
> > 
> > There was a good story in 'Guardian' :
> > 
> >   http://www.guardian.co.uk/commentisfree/2013/mar/29/cyberwar-spun-shoddy-journalism
> > 
> 
> The Gizmodo article that Guardian article lauds irritated the hell out
> of me. [...]
> Whether a chunk of Europe dropping offline qualifies as "breaking the
> Internet" is an interesting question. 


i don't live in europe. i live in a small country in south america. i don't
read the press and i don't have tv. i'm mostly uncontaminated by the
debris produced by journalism.

today i asked my girlfriend if she had also noted that the internet has
been very slow for the last week or so. perhaps it was a problem with my
connection. it was she who told me that the problem with the internet had
been mentioned in the news (unlike me, she does watch tv and read the
news).

i'm glad for all the people who weren't affected. but whatever it was, i've
been suffering the consequences. so i'm more than irritated by the
assholes minimizing the problem, or treating this as "non-news". 

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Dale]

luis jure wrote:
> on 2013-03-31 at 23:05 Michael Mol wrote:
>
>> On 03/31/2013 10:00 PM, Philip Webb wrote:
>>> There was a good story in 'Guardian' :
>>>
>>>   http://www.guardian.co.uk/commentisfree/2013/mar/29/cyberwar-spun-shoddy-journalism
>>>
>> The Gizmodo article that Guardian article lauds irritated the hell out
>> of me. [...]
>> Whether a chunk of Europe dropping offline qualifies as "breaking the
>> Internet" is an interesting question. 
>
> i don't live in europe. i live in a small country in south america. i don't
> read the press and i don't have tv. i'm mostly uncontaminated by the
> debris produced by journalism.
>
> today i asked my girlfriend if she had also noted that the internet has
> been very slow for the last week or so. perhaps it was a problem with my
> connection. it was she who told me that the problem with the internet had
> been mentioned in the news (unlike me, she does watch tv and read the
> news).
>
> i'm glad for all the people who weren't affected. but whatever it was, i've
> been suffering the consequences. so i'm more than irritated by the
> assholes minimizing the problem, or treating this as "non-news". 
>
>
>

Until this thread popped up, I hadn't heard about it either.  I hadn't
noticed any slowness but I wouldn't have known it happened either unless
Walt posted it or someone else did.

Me, I read the article.  Also thought is was neat and sort of learned
something too. 

Thanks Walt. 

Dale

:-)  :-) 

-- 
I am only responsible for what I said ... Not for what you understood or how you interpreted my words!

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 1543 bytes --]

On Monday 01 Apr 2013 04:37:50 luis jure wrote:
> on 2013-03-31 at 23:05 Michael Mol wrote:
> > On 03/31/2013 10:00 PM, Philip Webb wrote:
> > > There was a good story in 'Guardian' :
> > >   http://www.guardian.co.uk/commentisfree/2013/mar/29/cyberwar-spun-sho
> > >   ddy-journalism
> > 
> > The Gizmodo article that Guardian article lauds irritated the hell out
> > of me. [...]
> > Whether a chunk of Europe dropping offline qualifies as "breaking the
> > Internet" is an interesting question.
> 
> i don't live in europe. i live in a small country in south america. i don't
> read the press and i don't have tv. i'm mostly uncontaminated by the
> debris produced by journalism.
> 
> today i asked my girlfriend if she had also noted that the internet has
> been very slow for the last week or so. perhaps it was a problem with my
> connection. it was she who told me that the problem with the internet had
> been mentioned in the news (unlike me, she does watch tv and read the
> news).
> 
> i'm glad for all the people who weren't affected. but whatever it was, i've
> been suffering the consequences. so i'm more than irritated by the
> assholes minimizing the problem, or treating this as "non-news".

I can't say I had noticed any slowness, more than the usual, but I did notice 
that I could no longer reach a number of websites, like this:

  http://www.nslu2-linux.org

This lasted a day or two and coincided with this 'news' about DDoS, but I 
wasn't aware of it at the time.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[walt]

On 03/31/2013 08:37 PM, luis jure wrote:

> i'm more than irritated by the
> assholes minimizing the problem, or treating this as "non-news". 

Of course I don't know exactly which irritating people you mean, but
there is one senior poster in this mailing list who (very rarely) lapses
into posting insulting replies -- and then suddenly returns to his usual
pattern of providing very helpful and wise advice.

I've wondered if perhaps he has a seizure disorder or maybe a problem with
alcohol that overcomes him periodically.

In any case, I always heed his advice when he offers it, and have found no
reason to regret it -- yet :)

Re: [gentoo-user] Re: [way OT but interesting] Massive recent DDOS attack

[luis jure]

on 2013-04-02 at 17:58 walt wrote:


> On 03/31/2013 08:37 PM, luis jure wrote:
> 
> > i'm more than irritated by the
> > assholes minimizing the problem, or treating this as "non-news". 
> 
> Of course I don't know exactly which irritating people you mean,

i was referring specifically to the guardian article cited in the post i
replied to, as i think should be clear from the part of the thread i quoted
above my own post.

most of what the author says about journalism is right. unfortunately it
all applies to her, in reverse (i think to remember the author was a
woman, i don't care to read it again to check).

i'm sorry if people agreeing with the article feel offended by my harsh
epithet, it was not my intention. but that's my opinion of the ideas in
the article, nevertheless. 


best,


lj

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Volker Armin Hemmann]

Am 01.04.2013 05:37, schrieb luis jure:
>
> i'm glad for all the people who weren't affected. but whatever it was, i've
> been suffering the consequences. so i'm more than irritated by the
> assholes minimizing the problem, or treating this as "non-news". 
>
if you meant me - it is none-news. Or, it became none-news. Because:
everybody already reported it. Spamhaus was hit hard. But at no point
was 'the internet in danger'.  London exchange had a bit surplus traffic
which resulted in some irregularities - for a whole hour. Frankfurt
didn't measure anything outside of the usual statistical noise.
http://www.de-cix.net/about/statistics/

But somebody had to blow it up. And even more people jumped on it. Boohoo.

So the next time you start insulting people, base your findings on more
than a blog written by those guys who have an economical interest to
blow the whole mess out of proportion.

300gbit/s sounds like a lot. London exchange does 1tbit/s on a normal
day. Frankfurt 1.5tbit/s on average.

And they have reserves.

Of course, those responsible - all those guys with unpatched boxes whose
little zombies took part in this attack, need a good kicking. But that
is no excuse for spamming mailing lists with something the media already
abused to no end.

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[luis jure]

on 2013-04-03 at 03:33 Volker Armin Hemmann wrote:


> if you meant me - 

read my previous post(s). 

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Kevin Chadwick]

On Wed, 03 Apr 2013 03:33:17 +0200
Volker Armin Hemmann <volkerarmin@googlemail.com> wrote:


> But somebody had to blow it up. And even more people jumped on it.
> Boohoo.

> So the next time you start insulting people, base your findings on
> more than a blog written by those guys who have an economical
> interest to blow the whole mess out of proportion.

> Of course, those responsible - all those guys with unpatched boxes
> whose little zombies took part in this attack, need a good kicking.
> But that is no excuse for spamming mailing lists with something the
> media already abused to no end.

Yeah because it is all their fault. You know the cleaner down the road
and not Microsoft (linux is beginning to follow a similar road awayfrom
it's secure fs based and modular approach with polkit), Adobe or the
IETF who though warned turned 3gbit/s into 300gbit/s.

Hmmm, imagine a worm red now and with ntp so prevalent too.

Blown out of proportion, really?, maybe this particular instance? I can
understand the list spam argument though.

Re: [gentoo-user] [way OT but interesting] Massive recent DDOS attack

[Volker Armin Hemmann]

Am 01.04.2013 01:12, schrieb walt:
> Any of you admin types out there have any grumpy thoughts about this
> article? :)  Is it really just marketing BS from cloudflare, or is it
> solid stuff?
>
> http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet
>
>
>
well, it was bad for spamhaus and London's inet traffic was higher than
normal - and that was it. No danger, no slowdowns (apart from LINX)....
but the media made a huge fuss about it.

If it helps to take down spammer friendly hosters, it was worth it.