|
I've gotta say, I just read through the OVH DDOS mitigation docs, and for me the upshot is that if my servers were targeted, I'm in for an unspecified increase in latency, which for a rather large cross-section of use cases is one and the same as the service being unavailable due to the direct action of the DDOS (which is kinda still what would be happening). It's also not something you can disable; it's mandatory, so as to not impact other customers. I (my employer) use AWS pretty heavily, and we've never noticed our ability to access our resources being impaired by a DDOS on other nodes, so... is it not rather obvious that AWS (and in general, the set of "cloud providers without constant outages on their status pages") have basically the same setup - network is rationed, a given resource will only be allowed so much of the pipe, and your service is unavailable until and unless you have the capacity to handle it. It's not as if it could be any other way. The other danger seems to be in unexpected bills. Does this happen to people? Are there companies going bankrupt because they didn't notice a DDOS for a couple weeks? I've had AWS support reach out to me several times - without ever having had a paid support subscription - when my costs have gone up, just in the course of adding new functionality and expanding capacity. It's not like you set up one instance and can start egressing petabytes. AWS does monitor their infrastructure. All accounts have limits from the get-go; you can't run up a bankruptcy-inducing bill without your phone ringing. And in all cases, your exposure below that level is rather directly under your control. If I happen to have a use case that involves a bunch of random hosts sending me a lot of data, I expect to be able to pay the bill for the bandwidth and the capacity I provisioned to handle it. Or, if I didn't, I max out the bandwidth reserved for my resources and I don't end up seeing all the traffic. I don't see why it'd be helpful (or even meaningful) to differentiate between DDOS vs. legitimate traffic. Wouldn't a published policy on any cost or functionality difference when a DDOS is occurring provide a malicious actor with information they would need to avoid triggering that clause, so as to maximize the damage they're able to cause to your business? I guess I'll likely change my tune if and when I'm targeted and have to deal with a DDOS (and this sentence is why i went to the throwaway, which is a shame; I'd be happy to put my name to the actual content of this post. But fate is not to be tempted.). In the meantime, though, I'm skeptical of the need, and even the desirability, of service-provider policies that have anything to do classifying the "nature" of traffic flows. It just seems completely out-of-scope for them, and in-scope for myself as the person doing the provisioning. |