Hacker Newsnew | past | comments | ask | show | jobs | submit | balanc's commentslogin

Doesn’t Cloudflare have every incentive to inflate the bandwidth of the attack they have successfully mitigated?

And yes I know that there are Cloudflare employees here so spare me with your pinky swears.


A couple months ago Brain Krebs, who uses Google’s Project Shield, wrote of a very similar attack. 6.3 terabits, all UDP, less then a minute.

https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with...


Couldn’t this logic apply to basically every internal metric across every company?


[flagged]


How does it counter the incentives of all other companies to make it look like they're not the only one???


Cloudflare has the biggest scale and is arguably best positioned to soak up massive attacks. Therefore CF may have a unique incentive to make it sound like attacks are larger and there are more really big ones.


> is arguably best positioned

Lying about the scale of thwarted attacks by others is the counter argument


Still not sure what you're saying:

A) everyone inflates-- in which case, you want to be with the entity with the biggest pipes. Also, of course, we have reasonable estimates about how much traffic everyone can exchange.

B) non-CF players downplay DDoS-- this isn't going to work either.


A) not really, you need an entity with pipes big enough. Have they repeatedly claimed to have frequent attacks bigger than anyone's capacity? (by the way, how are those reasonable estimates immune to everyone lying but not to the lies about the attacks?) B) why?


Capacity isn't a number, like you have 48 units of internets.

You need an entity with peering, pipes, and request rates big enough in the right places.


Capacity is a number, like you can handle 10 tbps attacks (with the peering/pipes/rates infrastructure)


But it's not. How much you can soak up of clients actively trying to handshake and request resources is going to be different from how much of bulk traffic. How much traffic you can soak up in one place (e.g. saturating your peering to where 80% of your customers are). Or how much spoofed traffic you can soak up globally from a botnet.

Cloudflare has a ton of infrastructure, and this just makes them intrinsically more robust to the biggest attacks. It's in their interest, therefore, to make people believe there's a lot of really big attacks.


You're just describing different capacities.

But this complexity likely works against your claim that there are reliable estimates, meaning that it's easier for everyone else to A) inflate their own capacities and argue that B) CF shouldn't be trusted in their assessment as it's inflated.

And I've already addressed your last point, so alternatively: if the biggest attacks are 1 bps of traffic, it doesn't matter that you have a ton of infrastructure because anyone can handle a byte. The lie has to exceed "capacities" of others for it to matter.


> CF shouldn't be trusted in their assessment as it's inflated.

I think since we know CloudFlare has the biggest scale, we know that CloudFlare has the biggest capacity, with a higher baseline request rate and traffic exchanged than anyone else: definitely globally, and almost everywhere locally.

> And I've already addressed your last point, so alternatively: if the biggest attacks are 1 bps of traffic, it doesn't matter that you have a ton of infrastructure because anyone can handle a byte.

Which is why Cloudflare has an incentive to make DDoS attacks sound bigger.

Sure, we always know that everyone has an incentive to make their own capacity sound bigger, and parties with marginal ability to soak DDoS have an incentive to make the DDoS problem sound smaller.


Speaking of incentives, what might be the incentives of those referring to them as Clownflare? I sure have to wonder what their biases are, and how fairly they represent the company.


I think any competent email provider will throttle or block you the first time you send a burst of messages.


Wait, is that true over regular email too? Say I have a back and forth one liner emails every few minutes? It's competent for the provider to throttle or block these?


They do. All email providers have limits either specified or unspecified. It's usually a few hundred per hour and each recipient uses one quota.


This is why they provide a choice to use their own servers


Then why implement email as a backend if email cannot actually be used as a backend?


That's the tricky part of having email as backbone technology. It's an old and varied ecosystem.

I host my own email server and I am pretty sure chats will be instant with it as well as with their servers.

However, some email providers implement various throttling mechanisms.

If you are OK waiting for message to arrive or be dropped silently, you may continue to use Google and Microsoft email.


I haven't run into that problem, but yes, it's possible.

One problem I did run into was “allowed number of outgoing emails”. If you use groups in DeltaChat, even a small grouop of say 10 members will incur a lot of outgoing messages. The provider I originally used has a limit of 200 emails per day, so that was a showstopper.

If you use DeltaChat's chatmail server (which will happen per default if you don't provide an email account of your own), this will not be a problem.


Is that something that can be done?


> worse for everybody in exchange for making someone money

That’s not how the economy works.


> That’s not how the economy works.

Kind of seems like how the economy works quite a lot of the time


How do those people end up making money if nobody wants what they are selling.


In the case of advertising that is the million dollar question. Determining the relationship between ad spend and revenue is next to impossible, whatever bullshit ad companies feed you to get you to spend more on ads.


If I install it on purpose to guarantee to other players that I am not cheating then it is not malware.


If you install malware on purpose, it will still be malware.


Running in kernel space does not automatically make something malware. There are legit reasons for some software to run in kernel space, and anti-cheat is one of them. It performs a useful function for users who want to play online games without cheaters. Running proprietary software in kernel space may not be worth the trade off to you, and that's fine and I agree personally, but that doesn't make it "malware."


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: