Is Akamai's DDoS protection tiered? That's not how it works for e.g. CloudFlare: you pay a flat fee and (they claim) they'll keep you up no matter the size or frequency of the attack. If Krebs simply wasn't signed up for a high enough tier than I guess Akamai did the right thing, but if they charge a flat fee for protection and make similar claims to CF then they deserve to be raked over the coals for this.

That's not how CF works either, they'll force you to a custom plan if you get hit enough.

If it wasn't clear, Krebs wasn't paying Akamai a penny. I'd assume their cheapest solutions start around 10k a month, hard to justify for a journo.

Ok, I did not see Krebs' latest tweet that he was getting free service (https://twitter.com/briankrebs/status/779111614226239488), that's a lot more justifiable. You'd think a netsec journalist would be the first to find it worth it to get on the paid plan.

>You'd think a netsec journalist would be the first to find it worth it to get on the paid plan.

How much do you think a solo netsec journalist with only a couple of ads on his site earns?

Krebs' reporting (now, after leaving the Washington Post under whatever circumstances -- cost cutting? -- on his own "blog"), has for years now shone a very useful, researched insight into various matters of important technological vulnerability.

He provides a real service. Which is probably why Akamai offered him their services for free, in the first place.

Krebs shines a light on shadows that very much don't want to be seen, much less outed. The years long level of escalating attacks against him and his site reflect this.

The "pro bono" part reads to me like Akamai offered him something he'd normally have to pay for for free, so he probably had a "paid plan" equivalent.

Still understandable that Akamai dropped that after while, despite the PR damage, especially if it affected their work for paying customers.