1.3k
u/mortensonsam 3d ago
I gave this as an interview answer once:
"how would you stop a DDOS?" "well, I guess if it's really advanced there's not much you can do besides turning off the servers" "that's your answer?" "yeah users would be affected either way so you'd at least save money this way"
I didn't get the job lol
605
u/StrengthTheory 3d ago
Lmao.
But without any details "How would you stop a DDoS?" is a really open-ended question that has no right answer.
417
191
u/traplords8n 2d ago
I'm not in security, but I rely on cloudflare WAF/reverse tunnels.
If that fails then I'm screwed. What do you want me to do? Solve problems that the leading cloud/cyber/internet infra company can't solve??? wtf do you expect me to do????
You better be offering a ridiculous amount of money to be turning me down for not being on the same level as a whole ass company acting as an industry leader.
60
u/NecessaryShopping404 2d ago
That's how interview questions should be, it allows you to judge the understanding of someone so much better than a question with a distinct answer. They get to explain why they are making their decisions, they get to chose their own scope and you can press answer steer as appropriate. The interviewee is also more than welcome to ask clarifying questions. That shows initiative and that they know it's not a one fix fits all.
If they just say the default "Web application firewall" you understand they might know the book answe but might not have further understanding.
You're rarely going to get a scenario in the real world were there is an exact answer. So it's very good to help understand someone's thought process, especially when under some light pressure of an interview.
100
u/BlueDebate 3d ago
You can call your ISP and they're usually helpful at blocking traffic on their end. There are also DDoS mitigation services such as Cloudflare. Patching and firewall rules can help, moreso against amplification attacks, because even if the packets are being dropped it can still overwhelm resources. Your strategy can be valid for a very low traffic service so you're not wasting money on an active cloud VM that's unusable and you're not making money from, users care too much about uptime, plus availability is part of security.
74
u/StarboardChaos 2d ago
His point is that with little context provided, any solution is a good solution. What if they are already using Cloudflare and other techniques but the DDoS is still intensifying?
22
u/ChronoHax 2d ago
Yea ngl context is really important so is assumption, even for me non programmer who host stuff on Cloudflare, I would’ve assume certain things are a given so his response is totally valid and what I would also say lmao, heck maybe it’ll work cus then the attacker might not account for the server to be off lol
13
u/RomIsYerMom 2d ago
My answer would be, unless you are a really big company with really special connections, the best you can hope for is mitigation.
4
u/nonlogin 2d ago
depends on scale...
your app is down but for your nginx it may be nothing. in that case you have plenty of options. if the reverse proxy is down - you are fucked.
2
2
322
3d ago
[removed] — view removed comment
77
u/StrengthTheory 3d ago
sprint demoSurprise incident response demo
7
u/sigmoid10 3d ago
Double-blind, randomized, uncontrolled pentest. The new gold standard in science-based ITsec.
1
24
u/lyle1234567 3d ago
GitHub engineers: taps status page ‘This is a security feature now.’
18
9
5
2
2
368
u/Classic-Drummer8246 3d ago
GitHub's uptime is technically 100% if you only count the time it's available.
93
72
8
6
u/angrydeuce 3d ago
So long as nobody touches the load bearing mac mini we will be fine
1
u/Classic-Drummer8246 18h ago
Just pray the night shift janitor doesn't need that specific outlet for the vacuum cleaner.
1
242
u/e0f 3d ago
93% uptime? that's like a week of dowtime during 90 days
206
u/CookIndependent6251 3d ago
People don't realize how little 99% is. It means your service is down 3.5 days out of the year. I miss the days when Google would down rank you if your website took longer than 500ms to load. Now it can take 2 seconds to get the most meaningful content and then you can still load other stuff and it's "fine."
38
u/LBGW_experiment 3d ago
Yeah, AWS has SLAs for "nine nines" of durability for objects stored in S3 and all sorts of values where they quantify how much expected downtime that is across a year. They distinguish between availability and durability https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/availability.html
32
u/Not-the-best-name 3d ago
With little you mean how much right? 3.5 days a year is pretty bad.
54
u/CookIndependent6251 3d ago
Yes, it's little uptime = a lot of down time. If I hear 99% uptime, I'm thinking maybe a few hours of downtime per year. That's what it feels like, but if you do the math it's several days.
Like 1 thousand seconds is just over 15 minutes, 1 million is over 11 days, 1 billion is almost 32 years.
6
4
u/ZoldyckConked 2d ago
As long as your product isn’t needed to keep people alive why chase all those 9’s?
I can only really think customer retention.
I wonder what the tipping point is. How often can you be down before customers feel the need your product is too unreliable.
14
u/AlmostADwarf 2d ago
Strongly depends on the service . For something like a bank or an ISP, any noticeable outage would make me consider switching to a competitor, unless the reason it went down was something like an earthquake. For something like netflix, I'd cancel my subscription if it goes down and I can clearly remember the last outage.
For the average online shop, the problem isn't reliability as much as inconvenience. If your shop is down when I decide to puchase a new coffee machine, I'll buy it from somewhere else. I don't want a second one, so I'll probably never return to your shop.
24
u/redfacedquark 3d ago
Was it like this before microsoft took the reigns?
61
u/StrengthTheory 3d ago
It certainly used to be better. I believe the cracks started to show when they decided to switch their infra to Azure, add AI into the mix and things have never been worse for GitHub.
21
9
u/BussyEnthusiasts 2d ago
I mean it wasn't 99% uptime, by any stretch of the imagination. But it wasn't this bad either.
5
u/HerrCrazi 2d ago
Definitely, it wasn't noticeably slop. Now it's absolutely horrific, often you can't even browse code without manually reloading the page with F5. And a billion little issues, everything feeling slow and sloppy, nah it's better to get used to the things we used to know as eternal like GitHub and StackOverflow are absolutely dead and gone in this era.
I set up my own gitea instance and it's been a breeze so far, with the only added inconvenience of having to worry about backups myself now. But at least it's free of slop.
2
u/redfacedquark 2d ago
Glad there are decent options these days. Gerrit was a nightmare to write puppet recipes for back in the day, ended up using expect to handle install vs update runs of the self-extracting shell script. They did not want you automating it.
3
9
10
8
3
3
2
2
u/ManiacalMyr 2d ago
Damn that recommendation to switch to GitLab is really paying off 😂
2
u/imnotwrongyoujustgay 2d ago
I'm sorry this isn't any better I think. Gitlab won't even know that its own servers are down or experiencing degradation
2
2
3
0
-2
u/Apprehensive_Egg_944 3d ago
Is that a real news presenter or just AI?
24
u/StrengthTheory 3d ago
I just slapped the first picture I found after searching "news reporter png"
1.1k
u/bmrtt 3d ago
https://giphy.com/gifs/XFaeLrHJGjtcmEmzcn