Using Facebook Notes to DDoS any website

Re:Using Facebook Notes to DDoS any website by ama729 on Friday April 25, 2014 @06:07PM (#7649335)

> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality.

Why not just limit the number of request per site and per user? Ie. John Smith can only make X request (let say 1000) to www.google.com.

Doesn't seem too hard.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by eyeareque on Friday April 25, 2014 @06:09PM (#7649341)

They state that 400-800 mbit/s == consumer grade sites? really?

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by mscarborough on Friday April 25, 2014 @06:47PM (#7649540)

When you're as totally awesome and uncaring about your customers as Facebook, you can toss out words like "consumer grade" to describe people affected by your fuck-ups.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by silentOpen on Saturday April 26, 2014 @10:48AM (#7651526)

Download fast and break (other people's) things.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by MichaelGG on Friday April 25, 2014 @07:46PM (#7649794)

Outbound traffic. That's only serving up a few large images a second. It's entirely IO bound on network output. Getting a 1Gbps connection is not a big deal.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by michaelt on Saturday April 26, 2014 @12:39PM (#7651956)

Serving 1Gbps of traffic from Amazon S3 would cost $250,000 a year.

Maybe that's not a big deal to you, but it would be to me!

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by iancarroll on Friday April 25, 2014 @09:49PM (#7650082)

I don't know what your setup is like but a connection != the requests my webserver can handle.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by MichaelGG on Friday April 25, 2014 @10:35PM (#7650176)

I know, it was two separate comments. A: It's "just" IO, performing probably the most heavily optimized IO pattern in the world (serving static files) and B: buying a 1Gbps uplink is trivial.

[ Parent | on HN ]

Re:Using Facebook Notes to DDoS any website by chr13 on Saturday April 26, 2014 @09:13AM (#7651258)

>"buying 1Gbps uplink is trivial"

1 Gbps dedicated uplink is not trivial everywhere in the world. You also need more quota. Facebook easily crawled more than 1 TB of data during an hour. The more the better may not be best solution here. The higher the uplink, faster Facebook may crawl. So instead of transfering 1 TB in an hour for a 1 Gbps uplink, the transfer will be 10 TB if you have 10 Gbps. This will also depend how much bandwidth they allow their crawler, there must be an upper limit though.

[ Parent | on HN ]