"... and they tend to scrape by just barely exceeding 99.90% [uptime]"
Wow. That sentence makes 99.9% uptime sound really shitty.
Wow. That sentence makes 99.9% uptime sound really shitty.
Might as well stop counting sysadmin screwups and hardware failures, at that point. 100% uptime! except when we're down.
The current balance of power is tipped, right now, so hard in favor of the attackers that if anyone wants to take /you/ out, well, it's pretty difficult (read: expensive) to stop them, and if you are some $20/month customer, your upstream is probably going to just finish the job and cut you off... but if the guy next to you gets attacked and you are collateral damage? You should count that against your service provider. There are usually things we can do (as service providers) to limit collateral damage, even in the cases where we are unable to protect the target. If nothing else, providers who tend to tolerate sites that get attacked often, well, they suffer collateral damage from attacks, generally speaking, more often than sites that are less tolerant. It's sad, really 'cause sometimes the targets are not doing anything really wrong, but you've gotta protect your network.
There is some advantage of scale here, too... The DoS that is hardest to fight is the pipe-filling attack. If the attacker can fill your upstream port(s), then there isn't really much you can do, besides blocking the target at your upstream, (I mean, assuming the source is random, as it often is.) The larger your upstreams are, the more you can absorb before you have a choice between cutting off the target customer and having all your customers cut off.
Except maybe if those outages hit them at the worst possible moments of the month (just before a major announcement or something).
Now, managers would froth at the mouth hearing 45 mins/month is acceptable. But those managers are idiots.
I haven't seen any major site that didn't have those (and worse) outages.
5-6 hours a year? Heck tons of sites had those. AWS had them (and thus Heroku had them), GAE had them, Twitter had them, Tumblr (well they had one-two orders of magnitude more), etc.
45 mins a month represent lots of lost revenue to you? Really? If you're not Google or something, then what exactly do you do?
Shouldn't that be like 0.1% of your revenue? And that IF you sell online and IF we assume customers aren't gonna come back. Heck, you lose more because of random fluctuations in buyer preferences than that.