Fabio Manganiello on Nostr: the problem is that nowadays it's very easy to take down services that don't have ...

the problem is that nowadays it's very easy to take down services that don't have enough buffer to absorb traffic shocks. It's not just about Cloudflare's marketing-through-fear strategy.

It's not just a matter of "my service is too important to have downtime". It's that renting botnets capable of at least couple of Gbps of traffic has become very cheap, and all it takes is for you to publish something on your site/instance that annoys someone motivated enough to make you pay for it, and you can forget your service coming back online any time soon.

And I'm also in the situation where most of my services literally run in my utilities room. My home network connectivity can barely handle someone pulling a container image or a Nextcloud video, let alone a Russian botnet pouring 100 Gbps on my humble BananaPi router. Many other Fediverse admins are in situations similar to mine. All it takes is some random dude who spends $1000 to rent a botnet from the darkweb for a couple of hours, and most of the small/medium instances on the Fediverse can literally crumble like sand. And those who host services on AWS or Vercel clouds, or any alternative cloud provider, will probably just get a monthly bill of a couple of thousands of bucks.

And, besides all this, there's also an environmental factor in DDoS attacks that often slips from the conversation. DDoS attacks can push network, CPU and memory usage of thousands physical machine through the roof for hours or days. The earlier they are caught, the less the flood propagates through the network, the better.

I'm definitely not a fan of CF, but it's undeniable that the product that they sell is something that the Internet needs. People's privacy is as important as the integrity of the infrastructure, especially if you have attacks that impact people's own connectivity or monthly bills. And nobody said that in order to preserve the integrity of the infrastructure you need to compromise people's privacy.

Cloudflare's business isn't that hard to replicate. It's just a huge nginx server optimized to handle zillions of concurrent requests, combined with iptables rules and a sprinkle of basic machine learning to detect anomalous connectivity patterns. Just take this simple idea, buy enough machines and network equipment to scale it up to the point where it can absorb 3.5 Tbps attacks with billions of packets per second, and you can compete with them. I wonder why, instead of ignoring the pressing demand for a shield against the increasingly cheaper bots and DDoS attacks, we as a community don't advocate for more competitors against CF's monopoly - or, better, get to the whiteboard and come up with solutions and protocols to build such a network in a way that is open, scalable and distributed.