3864
Comments (240)
sorted by:
You're viewing a single comment thread. View all comments, or full comment thread.
82
MAGASpaceCat 82 points ago +82 / -0

It is only a matter of time until Cloudflare and Co. buckle to the far-left (as they will eventually get violent), so TD and Gab should prepare and start building their own DDoS protection.

36
AussieTrumpSupporter [S] 36 points ago +37 / -1

You need many hosts scattered around using Anycast. It gets tricky but it's doable.

24
mintscape 24 points ago +24 / -0

Anycast is not at all tricky, it can just get expensive as you really want your own AS number and would need your own address block. Used to be that anything less than a /19 was rejected by the backbone carriers and I highly doubt /19s are easy to get these days, especially for non-service providers.

I highly doubt T_D is taking any real advantage of anycast, scripts and other static things like images on their own CND URLS sure, but the main site is server created.

DDOS protection doesn't use Anycast anyway, it's a TCP reverse proxy, Cloudflare's meaty servers on huge pipes validate incoming connection attempts, they throw away the invalid sessions and pass the valid ones on to T_D servers.

14
AussieTrumpSupporter [S] 14 points ago +14 / -0

For the larger DDoS attacks you'd struggle without Anycast as your ISP links could flood if you can't segregate the traffic out. For basic ones it's pretty easy dependent on the level.

Expensive and tricky is much the same unless the donations flood in. Granted it's much easier to work with a site like TD than Gab given how much dynamic content is on Gab.

10
mintscape 10 points ago +10 / -0

Anycast is just advertising the same route out of multiple locations, it's an old trick for faster DNS response and for CDNs with static content and was in use long before it got the name Anycast.

For a dynamic service like T_D that operates on a single database, anycast can just not work. You would need to lock and synchronize the databases for every write from every location. It's impossible to maintain state without a huge impractical overhead that would make things unusable.

This why even places like Reddit handle their platform with load balancers on the front end and a huge database cluster.

I used to work for Cisco, I have done a huge amount of networking and worked on ios for them, I know what I am talking about my pede.

I get the feeling you actually don't know how Anycast works, it's just advertising the same route from different locations, nothing more. I'll explain.

Say I have a site in San Fran and I have a server 8.8.8.8, I advertise to my BGP peers 8.8.8.0/24. So there exists a single route to that server in the global routing table. Now people in Australia are using my server but complain it is too slow, so I add a new server with the same content and same IP address in Australia and I also advertise 8.8.8.0/24 from my Australian site to my BGP peers there.

So what happens? The global routing table ends up with two destinations to 8.8.8.8, what's the next hop? The route with the lowest cost. So Routers closer to Australia will pick the path to the Australian 8.8.8.8 server and those closest to San Fran will pick the path to the San Fran server. If one of those sites has a power outage, then I also get fail over automatically to the next closest server. I can keep adding locations and 8.8.8.8 servers all over the world if I like.

That's it, that's Anycast. It should now be clear why that can only work with sites or data that is static or gets updated very infrequently. It should be obvious that something like a dynamically built forum with hundreds of writes per minutes isn't suitable for Anycast. It is very common for reverse proxies to be on anycast addresses, this is what has people confused, as a reverse proxy just sends traffic to the real server.

3
47urOFH3d 3 points ago +3 / -0

Wasn't IPv6 going to make address blocks easily available? Has anything happened with that in the last 10 years? (In case you happen to know).

6
mintscape 6 points ago +6 / -0

You are right, IPv6 was meant to solve the address depletion issue but it is extremely hard to get people to move to it. IPv4 is just what everyone knows and understands so they are trying to cling to it as long as they can. The main reason is addressing.

An IPv4 address looks like this 192.168.45.10, I guess you know that. An IPv6 address looks like this: 2607:f0d0:1002:0051:0000:0000:0000:0004

I can be shorted so the zeros are removed but it still looks like this:

2607:f0d0:1002:51::4

Then there is the problem of interconnecting Ipv4 to IPv6 networks, IPv6 is not backward compatible with IPv4 so you need to translate between the two and run both stacks on every router.

So people have spent effort in to delaying it, for example many mobile carriers run NAT between the mobile network and the Internet. If they didn't we would have been out of IPv4 addresses years ago because of smart phones.

So has anything happened in the last 10 years? Kind of, service providers are almost all running IPv6 in their core networks and many will give out IPv6 addresses on request but you generally need to ask for it. In the corporate world, mostly the same as things were 10 years ago, it's seen as an unnecessary change and I doubt many will even bother.

2
twopoint71 2 points ago +2 / -0

Yeah, IPv6 is basically free. The trouble is adoption is still not that great. I think all major wireless carriers use it now for mobile devices, so that should be good enough for most of us.

0
SirPokeSmottington 0 points ago +1 / -1

Used to be that anything less than a /19 was rejected by the backbone carriers

That's when we were running out of address space. I think they've eased up now.

2
mintscape 2 points ago +2 / -0

The problem was the size of the global routing table, it got to the stage where the mid tier carrier class routers were getting close to running out of memory even when upgraded to max memory. So carriers refused to accept anything that wasn't summarized to at least a /19.

Likely changed now, those routers should be long retired by now.

18
Deadline 18 points ago +19 / -1

Bizarre that we have a faction in this country that can just...get violent when it suits them, and no one can do anything about it.

9
Proudly_Deplorable 9 points ago +9 / -0

They're being allowed to be violent for a purpose. Not only allowed, but financed by the left which moves them around as desired to achieve their terroristic needs.

1
airgag 1 point ago +1 / -0

aka brownshirts

4
pinchitony 4 points ago +5 / -1

If they haven't entertained the idea yet (and blocking them is a very clear "no, fuck you" sign), I see it not happening at least on ideological grounds. And unless we give them legal reasons to stop the service, I think we will be fine for the time being.

5
MAGASpaceCat 5 points ago +5 / -0

Communists are already harrassing Cloudflare on twitter.

It will happen sooner than later.

4
pinchitony 4 points ago +5 / -1

yes, but blocking the Sleeping Giant is kind of indicative.

3
whippeat 3 points ago +3 / -0

Yep. They’ll cave eventually.

Thing is, it isn’t cloud fare’s duty to police content of sites. They’re not endorsing it. They’re just providing a service. As long as Gab or TDW or whoever pays, it’s none of their business.

This is just more leftist activism to prevent us from being able to talk to each other.

1
brother_red 1 point ago +2 / -1

As a self-described "free speech absolutist", Cloudflare's CEO Matthew Prince, in a blog post, vowed never to succumb to external pressure again and sought to create a "political umbrella" for the future.

0
SirPokeSmottington 0 points ago +1 / -1

As a self-described "free speech absolutist", Cloudflare's CEO Matthew Prince, in a blog post, vowed never to succumb to external pressure again and sought to create a "political umbrella" for the future.

and then he fucked 8chan.

1
brother_red 1 point ago +1 / -0

This quote was about 8 chan and some stormer site.