Project Shield: DDoS Protection by Google for news and human rights orgs(google.com)

Project Shield: DDoS Protection by Google for news and human rights orgs

https://www.google.com/ideas/products/project-shield/

33 comments

kriro11년 전

""" So far we’ve protected hundreds of news organizations and human rights websites that have faced attacks aimed at censoring free expression. By protecting these sites, we’ve helped to keep vital information online during elections, major crises and conflicts. """

The "major crisis" part of that sentence might be overlooked by some people but it's actually pretty important. It's a well known problem that accidental DDoS happens during crisis situations (if you read a lot of crisis related academic papers you'll see Twitter infrastructure mentioned as very valuable for news updates). The Germanwings crash was a recent example, the official sites were accidentally DDosed and Twitter served as an emergency news propagation platform.

The nasty thing about a crisis is that you usually have your hands full with all sorts of other stuff and keeping up web infrastructure slides down on the todo list and/or it comes unexpected and IT isn't prepared. It's often not part of regular planning (this is changing a bit).

So yeah I hope they open it up for other organizations and "switching it on" will become a reasonably fast process.

codecondo11년 전

How do you accidentally DDoS something?

DanBC11년 전

When there is a crisis millions of people make genuine requests. This has the effect of DDOSing the site. I wouldn't call this an accidental DDOS.

Another accidental form of DDOS would be router manufacturers who deliver misconfigured devices.

http://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse

> The first widely known case of NTP server problems began in May 2003, when NETGEAR's hardware products flooded the University of Wisconsin–Madison's NTP server with requests.[5] University personnel initially assumed this was a malicious distributed denial of service attack and took actions to block the flood at their network border. Rather than abating (as most DDOS attacks do) the flow increased, reaching 250,000 packets-per-second (150 megabits per second) by June. Subsequent investigation revealed that four models of NETGEAR routers were the source of the problem. It was found that the SNTP (Simple NTP) client in the routers has two serious flaws. First, it relies on a single NTP server (at the University of Wisconsin–Madison) whose IP address was hard-coded in the firmware. Second, it polls the server at one second intervals until it receives a response. A total of 707,147 products with the faulty client were produced.

> NETGEAR has released firmware updates for the affected products (DG814, HR314, MR814 and RP614) which query NETGEAR's own servers, poll only once every ten minutes, and give up after five failures. While this update fixes the flaws in the original SNTP client, it does not solve the larger problem. Most consumers will never update their router's firmware, particularly if the device seems to be operating properly. The University of Wisconsin–Madison NTP server continues to receive high levels of traffic from NETGEAR routers, with occasional floods of up to 100,000 packets-per-second. NETGEAR has donated $375,000 to the University of Wisconsin–Madison's Division of Information Technology for their help in identifying the flaw.

icot11년 전

This happens in my country every New Years Eve with the telephone/cell networks. Communication networks are in general designed for a certain base capacity and foreseen spikes withing certain limits.

Imagine all the people in your near proximity wanting to use their phones at the same time...

Another example is the 'hug of death' small (unprepared) web sites suffer when exposed to legit traffic due to being mentioned in HN, Reddit, etc.

corobo11년 전

It also happens within the electrical grid here in the UK when popular TV shows and major sporting events finish and everyone flicks their kettle on. Sometimes the demand can be so huge we have to borrow power from France to cover it

"Grid employees must also be familiar with popular soap-opera storylines as one might cause a sudden rise in demand"

http://en.wikipedia.org/wiki/TV_pickup

nl11년 전

On September 11, 2001 websites like CNN and NYT all went down because people kept reloading them.

Google ended up mirroring them.

jnsaff211년 전

Slashdot effect or more recently HN Effect.

http://en.wikipedia.org/wiki/Slashdot_effect

codecondo11년 전

Interesting, I thought OP actually meant actual DDoS. This just seems like a problem of server configuration, lack of resources. Not accidental DDoS.

breakingcups11년 전

It's a denial of service (DoS) caused by multiple clients from different origins (D), is it not? No one means to disrupt the service by visiting it but the combined weight of all clients still leads to just that.

moepstar11년 전

This seems to only be for human rights orgs, news and election -related sites.

https://projectshield.withgoogle.com/public/#application-for...

dang11년 전

Thanks, we updated the title to say that.

xxdesmus11년 전

2013 -> http://www.forbes.com/sites/andygreenberg/2013/10/21/googles...

jacquesm11년 전

CloudFlare has extensive anti DDoS measures as well.

ceejayoz11년 전

And a harder (in the good way) line on freedom of speech. They've been criticized for hosting sites from Anonymous to ISIS/Al-Qaeda. Media organizations should find a pretty good partner in them.

x5n111년 전

Google acting for this sort of thing is right in line with their association with the Council for Foreign Relations which basically runs foreign policy in the United States.

http://www.cfr.org/staff/b13037

justincormack11년 전

And a free programme for at-risk organizations https://www.cloudflare.com/galileo

junto11년 전

Devils advocate here. Would wikileaks qualify?

draugadrotten11년 전

Isn't Google creating an indirect security risk for the reader here by funneling all sensitive HTTP accesses through one service? Google logs will now have information on who is reading human rights material that is in need of protection from censorship. If someone sets out to index the readership, it's now sufficient to get the whole list of readers from Google by legal or illegal means.

kpcyrd11년 전

Same thing applies to cloudflare. Even HN is proxied through them and connections are decrypted at their servers. Looks like nobody cares.

SEJeff11년 전

Seems like this is going to be a huge blow for cloudflare if they open this up past the initial scope.

xxdesmus11년 전

This was originally announced in October 2013 by the way. CloudFlare is still doing OK so far.

andrewstuart211년 전

I'd be surprised. I don't know the guys there but I suspect they're pretty sharp and will find great ways to distinguish their offerings.

themeek11년 전

Please also see the reams of discussion in this thread from earlier today: https://news.ycombinator.com/item?id=9679674

lucb1e11년 전

Page is completely blank for me with some darkblue background. Any idea what's going on? (Using the Tor browser, if that helps.)

[deleted]11년 전

adrianbg11년 전

The front lines are online.

paulhauggis11년 전

I wonder if they will support news sites that don't align with their political views.

paulhauggis11년 전

What I said is the truth. Google has been known to sensor pages based on political view points and not sensor in the same situation when it is in their favor.

I forgot. Too many google employees here on HN.

groby_b11년 전

[citation needed]

paulhauggis11년 전

http://thesop.org/story/politics/2009/11/25/outrage-google-c...

Google censored Michelle Obama monkey pictures. While this is in poor taste, all of the Bush monkey pics were never censored. Even worse were the results for Santorum, which I'm sure the employees of Google thought was hilarious.

More recently:

http://www.thenewamerican.com/tech/computers/item/20408-goog...

"The truth algorithm that Google researchers are developing will compare websites to a vast store of information the corporation has been compiling over the years"

Almost nothing in this world is black and white. When one organization decides that they have the the best version of the "truth", it's pretty scary.

Facebook also censors with political motivation:

http://dailycaller.com/2014/10/20/facebook-marks-yahoo-story...

The Obama campaign even used spam techniques during the campaign:

http://www.breitbart.com/big-government/2012/10/03/obama-to-...

Facebook allowed it during his campaign, but have since changed the rules. If anyone else did this, the campaign would have been shut down immediately.

I guess I shouldn't be surprised, since Zuckerberg even tried to get his employees to read the propaganda filled book by the Chinese president:

http://www.washingtonpost.com/blogs/worldviews/wp/2014/12/08...

It's just more examples of political leaders being in bed with our media companies. Everybody talks about corruption and the 1%, but nobody seems to care about this.

calvintennant11년 전

"for people who wants to censor" AAARRRRGH. Grammar.

ddon11년 전

Can't open :) looks like it is under DDOS :)

funkyy11년 전

Did Google just closed similar service that was intended to speed up sites and secure them against attacks? How anyone can trust Google if they just keep closing useful services without blinking an eye.