Today, like the past few days, we have had some downtime. Apparently some script kids are enjoying themselves by targeting our server (and others). Sorry for the inconvenience.

Most of these 'attacks' are targeted at the database, but some are more ddos-like and can be mitigated by using a CDN. Some other Lemmy servers are using Cloudflare, so we know that works. Therefore we have chosen Cloudflare as CDN / DDOS protection platform for now. We will look into other options, but we needed something to be implemented asap.

For the other attacks, we are using them to investigate and implement measures like rate limiting etc.

you are viewing a single comment's thread
view the rest of the comments

[–] drmoose@lemmy.world 17 points 1 year ago (3 children)

I hope lemmy.world can avoid using Cloudflare which goes against the spirit of Fediverse as it's just an objectively evil company.

[–] ruud@lemmy.world 22 points 1 year ago

Agreed. This is an emergency fix. Will look for final solution later.

[–] phar@lemmy.ml 16 points 1 year ago (1 children)

Can you give some insight to this?

[–] drmoose@lemmy.world 11 points 1 year ago* (last edited 1 year ago) (4 children)

There are thousands of reasons from centralizing internet, abusing their market power, implementing barriers on web automation that can only be bypassed by the priviledged to fingerprinting and tracking users across the whole internet. It's a major for-profit market capture corporation - it's evil by design.

[–] Carighan@lemmy.world 26 points 1 year ago (2 children)

What would the alternative be? DDOS protection inherently benefits from a centrally controlled network for defense, and also from a single entity handling as many of the defenses as possible so they can see them all being used.

I guess I could trivially see the need for a not-for-profit version of this, but that'd still be a central entity, just mandated by law and funded from taxpayer money or something.

But back to the question, what is the alternative? There's a good reason everyone goes with Cloudflare, it's about defending from DDOS attacks, and they do it better than others.

[–] mean_bean279@lemmy.world 16 points 1 year ago (1 children)

The real alternative is super simple. It requires just a little bit of knowledge. All we would need is to have someone who is an enterprise grade sysadmin with nothing but free time and a willingness to do something they will barely get paid for, if not lose money on. Then we also need to hire out a dedicated network and security engineer as well as a dedicated network traffic monitor. Then we would need to implement and setup our own hosting, as well as servers and configure our own databases. Of course all of this has to be done as cheaply as possible by people who are so good at multiple different sectors of IT and could easily be making more money doing work, but obviously out of the kindness of their hearts want to progress the fediverse and Lemmy rather than realizing they could be making 200k+ doing the same thing for a private company rather than a hobby.

In short: we need a network engineer, a security analyst, a sysadmin (or maybe 2?) all of whom work 24/7 for free and then purchase all of the physical hardware with the knowledge and capacity to set it up and maintain it to nearly break even just so we can shitpost rather than those people working and making 200k+ a year.

[–] KairuByte@lemmy.world 1 points 1 year ago

Ngl, you got me with the first sentence.

[–] drmoose@lemmy.world 1 points 1 year ago

The problem is not the service is that Cloudflare is a mega corporation. Having anti-ddos service which does nothing else is perfectly fine. Having one that also fingerprints everyone and does who-knows-what with all that absurd amount of data and control is a different issue entirely.

[–] spookedbyroaches@lemm.ee 8 points 1 year ago (1 children)

Then you give them an effective DDoS protection measure instead of posting things without evidence.

[–] AphoticDev@lemmy.dbzer0.com 2 points 1 year ago (2 children)

Well, it's not without evidence, we have plenty of that through the years. Unfortunately, we also don't have any real alternatives either, so the choice is take the DDoS or get Cloudflare. Not much of a choice.

[–] eros@lemmy.world 2 points 1 year ago

There are alternatives. Akamai has a similar product. It's not free, but it works. Also doesn't require all traffic to go through them all the time, you can repoint your traffic at them on the fly and have them mitigate by scrubbing the unwanted traffic until the attack ends and then switch back, and this can be automated. My ISP at work uses this as they have large swaths of public IP address space to protect for vulnerable members.

[–] spookedbyroaches@lemm.ee 1 points 1 year ago

Well, it’s not without evidence I mean without providing evidence. Dr. Moose said that Cloudflare abuses their market power without showing anything. I think we should do better than that. If you think that someone is doing a bad thing you can either refer back to the article that you read it from or at least google something that supports your claim. I don't like being a part of a community that just believes things because they sound real.

Honestly, if anything, Cloudflare uses their power too little. Where they allow just about anyone to use their services unless they get a complaint from the government. You can read here about how they don't shut down websites from their services unless they are breaking the law. I would assume that abusing market power is something like disallowing services because they criticize Cloudflare or some other arbitrary reason. I think that a good example of abusing your market share is Amazon where they forced merchants to keep their prices on other stores higher. But don't take my word for it, you can read all about it here.

[–] luis123456@mastodon.social 3 points 1 year ago

@drmoose @ruud agree.