Still thank you for the response, gives the ability to clarify that this is by no means an advertisement. You have of course endless options for ddos mitigation right now. But once cloudflare no longer wants you, your other options have a tendency to evaporate as well.
When I checked, some of the equivalents to Cloudflare's lower plans cost hundreds of dollars a month.
99.9% of the time you literally don’t need their services.
If you mean "providing expensive protection services for free on a $5/mo VPC" then sure Cloudflare might be your only bet.
Though I'm not sure how to really solve it. I support ISPs being considered utilities with an obligation to serve any customer unless they can argue a compelling reason why they can't, but DDoS protection is not a technical essential like an internet connection is. Even if it's almost essential for a popular site in 2023
Its totalitarian rot, it doesnt stop, its like a moldy fruit.
Had a situation where one of my servers were getting ddosed we tried multiple providers both cloud and dedicated, but the attack was not getting stopped by anyone, the customer service was useless on most other places its either we get null routed, or hours of back and forth with customer service without any solution.
We moved our servers to OVH the customer service rep directed us to an engineer within a few minutes. I remember we had to send a few packet captures during an attack to one of their network engineers and, not only did they block the attack in a few hours, the engineer in charge explained exactly what happened was such a nice learning experience, that one interaction with them will always make me recommend them.
In addition to a lot of clever tricks ddos protection comes down to a simple question. Who has more resources to keep going.
Sending pictures of pieces of hand written paper over email would be a more user friendly and usable interface than this javascript mess.
Discourse is one of the nicest to use forum platforms. Works on phones, has normal notifications, proper markdown, nice mention-subscription-quote system, nice plugins (such as abbreviation explainer) and it's not an eyesore.
Source: Was on the team (but not the decision-maker) to replace a very large legacy forum with Discourse.
For reference, me saying that emailing around pictures of handwritten text would be preferable to discourse was not an endorsement of mailing around pictures of handwritten text.
Also, as a side note, mailing list deliverability sucks because mailing list maintainers are sometimes stuck in the past and think that impersonating users while modifying messages is a good idea.
All the well ran mailing lists either don't modify messages and instead add unsubscribe headers and pass things on, or modify the messages as well as the from email addresses to avoid falling afoul of DKIM and therefore causing deliverability problems due to DMARC rejections.
HTML emails are also an abomination for replying so I am not sure what your point is there. There's basically one standard for in-line replies for plain text emails but there is no agreement on how to in-line reply to HTML emails.
But I can see how someone might dislike emails and don't think its the right solution for forums. That being said, they're still better than discourse.
List of advantages over discourse:
- Don't need a modern PC or phone to render all the javascript
- There's no mandatory (or any) javascript
- My keyboard isn't hijacked for the purposes of implementing an input scheme which doesn't match the rest of my browsing experience and therefore requires me to re-learn how to use my web browser when I go on the website
- I archive the content easily, index it myself and search through it at my leisure
- The UI is as simple as I want it to be
Forum websites should not require javascript for rendering, or even ideally posting, it was never needed it in the past and I never felt like adding javascript added anything to the user experience. It should be simple, secure, easily searchable and above all else shouldn't hijack your keyboard.
This is a frustrating web experience for anyone who uses any custom bindings in a browser and it repeats itself every time I use one of these websites.
Lastly, I have no idea why forum software needs absolutely any javascript to just render a basic page. Discourse renders as a blank page with javascript disabled, that's just extremely unnecessary.
We really need a user agent that actually acts in the interest of the user.
Now, try to do encourage that behavior in a corporate environment, and you'll just get blank stares.
https://support.torproject.org/abuse/what-about-ddos/
So, is this an attack using a different method?
And what about mitigating attacks on other networks/sites that originate from tor? The site I linked only said "attackers who control enough bandwidth to launch an effective DDoS attack can do it just fine without Tor." They didn't say anything about mitigating the use of tor by attackers. And what they're saying about attacks not being possible on the network is clearly wrong.
So far using i2p has been very nice to use and the tools are well developed. I run a node myself. The way i2p works is very interesting. Some services like Dread which provide i2p access have only been accessible via i2p in recent times due to the load on tor.
We'll have to see how i2p holds up when it inevitably takes over Tor and becomes a target of ddos itself.
Like is it like that Swiss encryption company that kept bricking the encryption for the CIA and employees kept noticing intentional encryption flaws and being told to work on something else?
or something else
Nobody was able to decloak the server even being in NonAnonymous mode but the bigger issue was the ability to reach the server. At least at the time not many people had a browser that could talk to .onion sites. I don't know how many people use Brave or the Tor Browser these days so maybe now it would be less of an issue now. Maybe I will try it again soon. It's easy to send people to the Tor Onion version of your site using the Onion-Location header [1] to see how many people would be able to reach the .onion side of your site.
[1] - https://community.torproject.org/onion-services/advanced/oni...
These[0][1][2]?
[0]: https://blog.torproject.org/whats-new-tor-0298/
[1]: https://2019.www.torproject.org/docs/tor-manual.html.en#Hidd...
[2]: https://2019.www.torproject.org/docs/tor-manual.html.en#Hidd...
Works great for combating human spam though. You tend to behave better if your login took half a day to get and expires quickly when not used. Plus build in cool down time after getting banned.
