Hacker News Reader

Comment by falcolas | Hacker News Reader

Amazon absolutely can survive a DDOS attack. But can your wallet? AWS published a white paper on how to survive a DDOS on AWS that amounted to "out scale the attack." Doing that could very well be a business ending proposal right there.

Sure, your website never went down, but now you have an infrastructure bill you'll have do do another round of funding just to pay off.

View on HN

I was more thinking of the DNS amplification and UDP flood type of attacks that are transparently handled by a cloud provider, but even for an application attack, you still have a choice to let your site go down rather than scale up infinitely. (You can cap the scaling.)

They do manage those - though mainly for protecting themselves, not the point customer being attacked. In AWS the people I've talked to recently as well as historically say you'll get pretty uniformly rate-limited? vs. actually doing per /32 DDoS mitigation type limiting. Has your experience been different (for volumetric attacks)?

Our experience has been that the "collateral damage to us" DDoS attacks vanished entirely from the "set of things we think about" which was not at all true in some of the colo's we were in.

In terms of application-specific attacks, we have used proxies in AWS to mitigate attacks against our colocated servers from time to time. AWS handles some of the volume and some of the types of attack traffic, and we scale and cache to handle others. This was much cheaper and easier than some of the Prolexic type solutions.

Agree that they aren't doing anything specific on a host or customer basis, but just inherent in protecting all of their customers, some of the specific problems also go away.

Absolutely agree that collateral damage vs many small-mid-sized hosting providers is 0 in Amazon, though you do still have to deal with the normal 'noisy neighbor' problem by re-creating instances in a different neighborhood.

Reply on news.ycombinator.com