Just to update on how this continued to unfold, following a detailed response by the OpenTofu team, this is the official statement by Matt Aasy the author of the article, apologizing and acknowledging that he was wrong to rush to conclusions:
129 karma · joined January 24, 2013
Who does that? No really?
Feels like the show is being run by lawyers who don't know how Internet works.
I just don't fell like there is a strong enough use case here, but I couldn't wrong.
I wish other companies were as decisive when dealing with "stressers"...
We have a lot of application awareness configurations and our signature pool (which is one of the tools we use for traffic profiling) holds over 10M variant, sometime as much as ~20,000 per user-agent type, to cover all scenarios.
Client Classification - comparing visitor's user-agent, IP, header parameters and etc to our pool of 10M signatures. Suspects will get CAPTCHA. (~0.01% false positives)
Visitor Reputation - we use crowd-sourcing to compile a list of suspected IPs. The list is updated in real time. Combined with other signals, this data allows us a better understanding of the incoming traffic.
Progressive Challenges - We check visitor's ability to retain cookies, execute JS and so on. In this case, the browser-based bots were able to evade those defenses. (These are also the most commonly used Layer 7 mitigation methods.)
Behavior Monitoring - We look at abnormal access rates, visiting patterns, etc. Here we also look for correctional of signals, to help us pinpoint suspicious behavior.
And so, by collecting and cross-referencing different types of data, the system is designed to distinguish between humans and bots. The process is mostly automated and is always seamless.
Basically, DDoS Attacks can be (roughly) divided in 2 categories:
1. Attacks on your server (which usually target your server IP or some other part of your network infrastructure)
2. Attacks on your site (which use bots to flood your site with fake HTTP requests)
As explained above, Network attack can only be countered with strong and flexible infrastructure. The most common solution is a combination of several high-powered servers and load balancing capabilities.
HTTP DDoS attacks are trickier because they're best mitigated by visitor profiling, a technology that can help identify bots from humans and block them while still allowing providing full access to all legitimate visitors. Developing and maintaining such technology is arguably more complicated, simply because it's a software you need to create, not a hardware which you can buy.
Standard profiling solutions include CAPTCHAs and Delay Pages but these will also repel legitimate visitors. (because no one likes CAPTCHAs or waiting for 5-10 extra seconds for page load). Advanced profiling solutions use a combination of behavior and signature recognition, coupled with seamless challenges (i.e. checking for JS support).
CF and Incapsula (where I work) both handle Network DDoS in a similar manner but we have a somewhat different approach to HTTP DDoS.
And yes, while under DDoS (or even without it), dynamic resources can be the "weakest link". This is why WAFs are so important.
“While we have not completed our investigation, we believe this incident was triggered by a product issue that Juniper identified last October, when a patch was also made available"
Good network engineers tend to apply newly release patches. This vulnerability was documented for almost half a year...
To make a long story short, this detailed report helped us introduce several patches to our WAF - but we feel that some of the issues were mostly theoretical and patching them can lead to security eroding false positives.
ModSecurity is a great security solutionand we are happy to be compared to it. We feel that we perhaps offer a more complete package (bot filtering, acceleration, user friendly GUI and easy setup, support, etc).
Still, you can't beat Free and if you are looking for OS security solution, ModSecurity is defiantly a name you should consider.
On a personal note, I wish that more vendors would take security a bit more seriously - especially if they claim to provide it to thousands of clients.
Web evolution is motivated by consumer trust and if we loose this trust we will also loose the cash flow that keeps Internet evolving.
Providing faulty security will do just that.
All CDNs offer DNS level DDOS protection by default. Not because they choose to, but because they have no other option. After all, the same IP ranges are used by all clients and this makes it impossible to pinpoint the original target. (thus no one to blame/bill)
Every CDN does it, but only CF claims it as a "feature".
I've been doing SEO for 8 years and I have to say that I came for the fun and money but I stayed for the challenge and algo changes.
I remember how, 8 years ago, it was all about "5% density" and link stuffing. Today is content quality, social signals, link profile (not just quantity), contextual co-relations and so much much more...
I think that I only truly fallen in love with SEO when Google started using rel=canonical. This is when it really became a game of poker and not a "hungy hungy hippos" with links in it.