Their Pages hosting feature uses Fastly -- I would assume they use the same service across their infrastructure.

Cloudflare is a very popular choice.

Very popular among consumers. I think large organizations are more likely to pay someone like http://www.prolexic.com/

I have seen the folks from prolexic at work and they service/platform is impressive.

On their spare time they take down botnets: http://www.prolexic.com/knowledge-center-ddos-vulnerability-...

http://arstechnica.com/security/2012/08/ddos-take-down-manua...

Shameless plug for hackmiami, if anyone is interested in learning how its done up and close they run frequent talks/meetups locally: http://hackmiami.org/

I read this as 'prilosec.com' and was like "Yeah, if I worked for a really visible organization, I'd probably have an anti-heartburn medication habit."

Yes, but if you largely deal with non-web protocols - like git - Cloudflare's much less effective.

We have solutions that would definitely work for GitHub. :)

It is not CloudFlare, but I would be fascinated to learn some more technical detail of these attacks as I work on systems to block this type of Layer 7 attack.

$ dig origin.github.com +short

github.map.fastly.net.

199.27.76.133

That's not really a valid test. If they're talking about dynamically rerouting traffic through the DDOS protection system, they're almost certainly using someone who starts announcing their IPs, then feeds the clean traffic back to them via a tunnel.

If that's indeed what they're using, the only way to tell would be to look at BGP announcements when they're actually under attack.

That's what I thought they were using, because of this:

"A simple Hubot command can reroute our traffic to their network which can handle terabits per second. They're able to absorb the attack, filter out the malicious traffic, and forward the legitimate traffic on to us for normal processing."

Anyone with a Renesys account can tell us who they used. Anyone want to shed some light here?