Slashdot Mirror
Google Releases Project Shield To Fight Against DDoS Attacks (thestack.com)
An anonymous reader writes: Google has launched a free tool to help all media sites and and other organisations protect themselves against Distributed Denial of Service (DDoS) attacks. The Project Shield initiative allows websites to redirect traffic through Google's existing infrastructure, in order to keep their content online in the face of such attacks. Google will aim to work with smaller sites which do not necessarily have the money or are not fully equipped with strong enough infrastructure to the attacks. However, the Shield tool has also been made available to larger outlets, such as popular news sites and human rights platforms.
Nothing is free citizen.
Seriously, the size of some of the DDoS attempts is massive. That's a lot of bandwidth wasted, and there will be a dollar impact associated with this. What additional angle will google be targeting to make money off this?
More information for them to mine, which is what they really crave. Also this just seems like another step along the way for Google to become the internet. They don't actually like the decentralised nature of the internet so they try to crush the competition by giving away free stuff for a while with the hope of getting people dependent on that service and later charging for it. What would the likes of cloudflare have to say about this?
Is Google skimming anything off of the data routed through their pipe while the "bad guys" are running the DOS attack?
I'll stick with Cloudflare.
aim of google seems to be, not to make money, but be god, omniscient and almighty; to know everything at very point of information creation, transmission, storage and even deletion; to do everything from gossiping to make humans immortal.
hubris much?
enjoy the greek tragedy in the making.
From the engadget/Wired article ...
"To use Project Shield, a site has to give Google visibility into who's visiting -- something likely to rankle the company's privacy critics. But Google says that it'll only keep logs for two weeks, after which the data will be stored in aggregate and used to learn more about attacks. The company also notes that the data it collects won't be used in its advertising programs."
The company also notes that the data it collects won't be used in its advertising programs. [But by using Project Shield you and your agents and seven generation of your children's children agree and that we can change the Terms and Conditions of use, in a 64 page-long document of legalise, that only 1 in 100 people will ever read and/or notice, at any time.]"
DaveyJJ
Then google will be the internet.
Oh and whilst we're at it we'll take copies of everything you have, index it. privacy rape it and monetise it.
If nobody is trying to hide when visiting your site, then there's no good reason to hide that data from Google, is there?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
So, what if they "just happen" to have problems on their own end while the original website is being DDoS'ed?
People will say "look at the election numbers, Trump is still at the top" while the true numbers just aren't being updated because of the "technical problems" on Google's end. It's a new service after all, there's bound to be some problems. After all, the people working there are only human.
...have your outside router start ignoring IP addresses that exceed some threshold of activity that is not a 'normal' level of activity for, oh say 90 mins? I have a edgeOS router. I could have sworn I saw a part where I could set rules based on an arbitrary number of attempted connections in a period of time.
"...whenever any Form of Government becomes destructive...it is the Right of the People to alter or to abolish it..."
Just be careful not Just rely on a 3rd party like Google. In doing this Google can make an excuse to strengthen their Internet infrastructure in relation to others who would have had to install fatter pipes and better cache strategies. So, rather than make the whole Internet resistant to DDoS out of necessity, Google will let you skip the cost of better infrastructure. You'll be paying it in weakness.
It's a brilliant move. Out compete Cloudflare and other caching / co-location providers by subsidizing Google's service. The cost to consumers is hidden: Reduced choices. Then Google can comply with take-down notices and since you relied on their service so much normal traffic will kill your site. And if there's little to no competition in the DDoS protection market you'll be screwed.
Ever use the Youtube "watch later" feature? I always notice that many of the vids will be deleted later -- they purposefully don't even list the titles anymore so I can go find them. You have to use a youtube downloader rather than bookmarks. Do you want to have to do that for websites? No, right? However, Effectively, this is the correct solution though. There's no reason that my query for data shouldn't be served by someone else's browser cache in a distributed and decentralized caching solution. However, alphabet soup hates decentralization, they promote centralization to make their job easier.
Hint: we just need to implement NDN (Named Data Networking) and DTN (Disruption Tolerant Networking - NASA's space Internet protocol), essentially adding robust caching and deduplication to the entire system at almost every node and eliminate the need to make a request all the way upstream for data -- It could be served by your neighbor's cache or the ISP node you're directly connected to. Basically: Free co-location for the entire Internet.
Does anyone know how this differs from Cloudflare?
FWIW, I'm using Cloudflare on several of my sites, and it's been extremely useful so far.
I'd love to see a comparison between Shield and Cloudflare, especially any features that one might have that the other doesn't.
Just cruising through this digital world at 33 1/3 rpm...
Just like Cloudflare, Google will now become a gigantic man-in-the-middle. If your site handles sensitive data or money, do not use Google's or Cloudflare's services, because they will have all of your keys, passwords, and sensitive data.
Yeah, I totally hate to generate (in my case music) lists of videos just to later find out some of them are gone without being able to see what has been removed!
They could had kept the title and possibly username, then again others may have different interests there depending on what was uploaded in the first place but .. At-least keep on showing it for the person who made the list so they possibly can find a replacement.
Google puts themselves in a MITM position and if the need ever arises, they can report on who's been reading a particular article, or even censor it in some way (possibly not display it at all, redirect, or alter)
Google is WAY bigger than CloudFlare.
Google is offering this free to a small few categories of websites, CloudFlare offers limited free services to all and paid services to everyone.
Google's sites don't seem to fail. CloudFlare sites fail all the fucking time!
From a technology perspective Google's Project Shield is a CDN system, just like CloudFlare, Alkamai, and the countless other hopefulls that have popped up over the years.
> "allows websites to redirect traffic through Google's existing infrastructure"
So they can legally "steal" your traffic.
Would they protect a porn site against DDoS attacks from Christian wowzers? If not, why not? Are these attacks restraint on speech, but those attacks legitimate protest against speech we don't like?
I get it, if Google's footing the bill they should be allowed to discriminate because one can choose how to spend their own money, but:
- if this is not for sale at any price to certain parties, that raises eyebrows
- even if Google is doing nothing wrong, in fact doing a very good thing, it's still important to understand that from the other side, to certain parties, engaging with this mess looks like a protection racket.
We need a solution to all DDoS. If Google built a spam-fighting system but offered it only to churches who were having trouble reaching their parishoners to do holy churchly things and not to anyone else using email, I'd feel the same way.
Playing in the DDoS space requires constant access to the latest attack types and lots of network data from attacks. Google does machine learning just like the other big players in this space and this is a cost effective way to get data that can be used to train systems. The reality it that it serves a business purpose to have access to attacks for research, to test, and develop new infrastructure. Then you monetize it as a service.
Testing DDoS mitigation is a pain not only for generating traffic but also for how the traffic changes over time. Live data is the best way to go when tuning response algorithms. It is not only traffic volume but things like address and path diversity, attack type mix, target shift patterns, and multilayer attacks that affect the response. This way Google gets all that data for free and can concentrate on the response side.
(Multilayer attacks are when you stir up some "hactivists" to DDoS a site to have the site operators lower the deeper packet inspections [WAFs and such] and then you as the real attacker come in with a targeted attack against the lowered defenses [now that the WAF is offline you SQLi the site and steal what you are really after])
Just about everybody knows this: ISPs need to configure their routers to drop IP packets with source addresses that have no business coming from the interface they came in on. If the DDOSers can't spoof their source address, it puts a big crimp in the main bandwidth amplification methods.
Of course, they'll find something else at some point, but it should slow them down if they have to be on close to the same network as the one they're attacking, or their bots have to send out packets in something closer to a 1:1 relationship to what the target receives.