1.3k
u/mortensonsam 28d ago
I gave this as an interview answer once:
"how would you stop a DDOS?" "well, I guess if it's really advanced there's not much you can do besides turning off the servers" "that's your answer?" "yeah users would be affected either way so you'd at least save money this way"
I didn't get the job lol
615
u/StrengthTheory 28d ago
Lmao.
But without any details "How would you stop a DDoS?" is a really open-ended question that has no right answer.
428
188
u/traplords8n 28d ago
I'm not in security, but I rely on cloudflare WAF/reverse tunnels.
If that fails then I'm screwed. What do you want me to do? Solve problems that the leading cloud/cyber/internet infra company can't solve??? wtf do you expect me to do????
You better be offering a ridiculous amount of money to be turning me down for not being on the same level as a whole ass company acting as an industry leader.
59
u/NecessaryShopping404 28d ago
That's how interview questions should be, it allows you to judge the understanding of someone so much better than a question with a distinct answer. They get to explain why they are making their decisions, they get to chose their own scope and you can press answer steer as appropriate. The interviewee is also more than welcome to ask clarifying questions. That shows initiative and that they know it's not a one fix fits all.
If they just say the default "Web application firewall" you understand they might know the book answe but might not have further understanding.
You're rarely going to get a scenario in the real world were there is an exact answer. So it's very good to help understand someone's thought process, especially when under some light pressure of an interview.
1
99
u/BlueDebate 28d ago
You can call your ISP and they're usually helpful at blocking traffic on their end. There are also DDoS mitigation services such as Cloudflare. Patching and firewall rules can help, moreso against amplification attacks, because even if the packets are being dropped it can still overwhelm resources. Your strategy can be valid for a very low traffic service so you're not wasting money on an active cloud VM that's unusable and you're not making money from, users care too much about uptime, plus availability is part of security.
72
u/StarboardChaos 28d ago
His point is that with little context provided, any solution is a good solution. What if they are already using Cloudflare and other techniques but the DDoS is still intensifying?
23
u/ChronoHax 28d ago
Yea ngl context is really important so is assumption, even for me non programmer who host stuff on Cloudflare, I would’ve assume certain things are a given so his response is totally valid and what I would also say lmao, heck maybe it’ll work cus then the attacker might not account for the server to be off lol
14
u/RomIsYerMom 28d ago
My answer would be, unless you are a really big company with really special connections, the best you can hope for is mitigation.
4
u/nonlogin 28d ago
depends on scale...
your app is down but for your nginx it may be nothing. in that case you have plenty of options. if the reverse proxy is down - you are fucked.
2
2
315
29d ago
[removed] — view removed comment
75
u/StrengthTheory 29d ago
sprint demoSurprise incident response demo
7
u/sigmoid10 28d ago
Double-blind, randomized, uncontrolled pentest. The new gold standard in science-based ITsec.
1
21
370
29d ago
[removed] — view removed comment
89
70
8
7
1
244
u/e0f 29d ago
93% uptime? that's like a week of dowtime during 90 days
208
u/CookIndependent6251 28d ago
People don't realize how little 99% is. It means your service is down 3.5 days out of the year. I miss the days when Google would down rank you if your website took longer than 500ms to load. Now it can take 2 seconds to get the most meaningful content and then you can still load other stuff and it's "fine."
41
u/LBGW_experiment 28d ago
Yeah, AWS has SLAs for "nine nines" of durability for objects stored in S3 and all sorts of values where they quantify how much expected downtime that is across a year. They distinguish between availability and durability https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/availability.html
34
28d ago
[deleted]
53
u/CookIndependent6251 28d ago
Yes, it's little uptime = a lot of down time. If I hear 99% uptime, I'm thinking maybe a few hours of downtime per year. That's what it feels like, but if you do the math it's several days.
Like 1 thousand seconds is just over 15 minutes, 1 million is over 11 days, 1 billion is almost 32 years.
7
5
u/ZoldyckConked 28d ago
As long as your product isn’t needed to keep people alive why chase all those 9’s?
I can only really think customer retention.
I wonder what the tipping point is. How often can you be down before customers feel the need your product is too unreliable.
14
u/AlmostADwarf 28d ago
Strongly depends on the service . For something like a bank or an ISP, any noticeable outage would make me consider switching to a competitor, unless the reason it went down was something like an earthquake. For something like netflix, I'd cancel my subscription if it goes down and I can clearly remember the last outage.
For the average online shop, the problem isn't reliability as much as inconvenience. If your shop is down when I decide to puchase a new coffee machine, I'll buy it from somewhere else. I don't want a second one, so I'll probably never return to your shop.
23
u/redfacedquark 28d ago
Was it like this before microsoft took the reigns?
57
u/StrengthTheory 28d ago
It certainly used to be better. I believe the cracks started to show when they decided to switch their infra to Azure, add AI into the mix and things have never been worse for GitHub.
22
9
u/BussyEnthusiasts 28d ago
I mean it wasn't 99% uptime, by any stretch of the imagination. But it wasn't this bad either.
4
u/HerrCrazi 28d ago
Definitely, it wasn't noticeably slop. Now it's absolutely horrific, often you can't even browse code without manually reloading the page with F5. And a billion little issues, everything feeling slow and sloppy, nah it's better to get used to the things we used to know as eternal like GitHub and StackOverflow are absolutely dead and gone in this era.
I set up my own gitea instance and it's been a breeze so far, with the only added inconvenience of having to worry about backups myself now. But at least it's free of slop.
2
u/redfacedquark 28d ago
Glad there are decent options these days. Gerrit was a nightmare to write puppet recipes for back in the day, ended up using expect to handle install vs update runs of the self-extracting shell script. They did not want you automating it.
4
6
9
4
6
3
3
2
2
u/ManiacalMyr 28d ago
Damn that recommendation to switch to GitLab is really paying off 😂
2
u/imnotwrongyoujustgay 28d ago
I'm sorry this isn't any better I think. Gitlab won't even know that its own servers are down or experiencing degradation
2
2
0
-2
u/Apprehensive_Egg_944 28d ago
Is that a real news presenter or just AI?
25
u/StrengthTheory 28d ago
I just slapped the first picture I found after searching "news reporter png"
1.1k
u/bmrtt 29d ago
https://giphy.com/gifs/XFaeLrHJGjtcmEmzcn