Ask HN: How do you handle DDoS attacks?

Re:Ask HN: How do you handle DDoS attacks? by dineshp2 on Sunday August 28, 2016 @10:19AM (#12376612)

The paid plan, yes. But the commonly used free plan does not do much to prevent DDoS or DoS attacks.

[ Parent | on HN ]

Re:Ask HN: How do you handle DDoS attacks? by _nalply on Sunday August 28, 2016 @11:07AM (#12376794)

Source?

[ Parent | on HN ]

Re:Ask HN: How do you handle DDoS attacks? by dineshp2 on Sunday August 28, 2016 @11:14AM (#12376820)

https://www.cloudflare.com/plans/

Look at the "Advanced security" section.

I also used Siege to flood a site behind Cloudflare's free plan and brought it down.

[ Parent | on HN ]

Re:Ask HN: How do you handle DDoS attacks? by _nalply on Sunday August 28, 2016 @11:24AM (#12376865)

There's the option for free plans: Basic DDOS protection with the following blurb:

Built-in security measures automatically protect your website against DDoS attacks. CloudFlare's service allows your legitimate traffic to reach your website, while stopping illegitimate traffic at the edge, before it hits your server.

So Cloudflare promises least a minimal protection for free plans.

As for Siege, I assume Cloudflare is optimized to protect from botnets. A single machine running Siege is not a realistic test case. Perhaps it also depends whether your website is mostly static, then Cloudflare can do a lot of caching.

[ Parent | on HN ]

Re:Ask HN: How do you handle DDoS attacks? by mirashii on Sunday August 28, 2016 @11:21AM (#12376854)

That page argues against your point, even the basic plan does quite a bit to fend of DDOS. In particular, the most common and effective type of DDOS, which is volumetric and based on reflected UDP traffic, is defended against, even on their free tier.

Using a tool like Siege to bring a site behind Cloudflare down doesn't mean it's not protected. A layer 7 attack against a site which can't handle incoming HTTP requests is still possible. Cloudflare, or any other service, can't magically make a site scale.

[ Parent | on HN ]

Re:Ask HN: How do you handle DDoS attacks? by dineshp2 on Sunday August 28, 2016 @11:39AM (#12376926)

> That page argues against your point, even the basic plan does quite a bit to fend of DDOS. In particular, the most common and effective type of DDOS, which is volumetric and based on reflected UDP traffic, is defended against, even on their free tier.

Maybe I'm missing something here, where does it mention that the free plan protects against UDP floods?

> Using a tool like Siege to bring a site behind Cloudflare down doesn't mean it's not protected. A layer 7 attack against a site which can't handle incoming HTTP requests is still possible.

Flooding a site using Siege from a single IP falls under the layer 7 attack (correct me if I'm wrong), which is protected against in the Business plan.

> Cloudflare, or any other service, can't magically make a site scale.

Where did I mention that I expect Cloudflare to magically scale a site? A POST or GET flood falls under layer 7 protection, which Cloudflare offers in paid plans.

If it was not clear, the point was that layer 7 protection is offered in the paid plans(Business and Enterprise), but not in the free plan.

[ Parent | on HN ]