Re:Dyn Statement on 10/21/2016 DDoS Attack
by buro9 on Sunday October 23, 2016 @04:23AM
(#12772575)
> For DNS, make sure you are using multiple DNS providers.
In this case, that would have made it worse.
If your domain CNAMEs off another provider (as nearly all SaaS solutions do, as do mapping to AWS servers, etc) then you would have been affected by the attack on Dyn regardless of whether you could change your nameserver in time and have multiple providers at that level.
If you don't have any CNAMEs, then I think the better choice is to go same-origin same-provider for everything.
Which may sound bizarre... my personal sites (a lot of forums) would either be up or down. I would argue that availability having a binary nature is a lot better for end users than a constantly broken half-state that is frustrating or impossible to use at any time even though a graph might show partial availability. A hard sudden failure shows up better in monitoring, triggers end user feedback faster, and is in many ways easier to debug and solve.
With so much CNAME'd, and SaaS still growing, replicating and failing over DNS that sits above those wouldn't buy you anything.
A lot of sites lost Zendesk (their support.), Statuspage (their status.), Pagerduty (hey, they were quiet because no-one could let them know). They couldn't even help the end users having a bad time.
In this case, that would have made it worse.
If your domain CNAMEs off another provider (as nearly all SaaS solutions do, as do mapping to AWS servers, etc) then you would have been affected by the attack on Dyn regardless of whether you could change your nameserver in time and have multiple providers at that level.
If you don't have any CNAMEs, then I think the better choice is to go same-origin same-provider for everything.
Which may sound bizarre... my personal sites (a lot of forums) would either be up or down. I would argue that availability having a binary nature is a lot better for end users than a constantly broken half-state that is frustrating or impossible to use at any time even though a graph might show partial availability. A hard sudden failure shows up better in monitoring, triggers end user feedback faster, and is in many ways easier to debug and solve.
With so much CNAME'd, and SaaS still growing, replicating and failing over DNS that sits above those wouldn't buy you anything.
A lot of sites lost Zendesk (their support.), Statuspage (their status.), Pagerduty (hey, they were quiet because no-one could let them know). They couldn't even help the end users having a bad time.