I would love if just once an admin of a fedi host under #DDoS attack would have the integrity to say:

“We are under attack. But we will not surrender to Cloudflare & let that privacy-abusing tech giant get a front-row view of all your traffic (including passwords & DMs) while centralizing our decentralized community. We apologize for the downtime while we work on solving this problem in a way that uncompromisingly respects your privacy and does not harm your own security more than the attack itself.”

This is inspired by the recent move of #LemmyWorld joining Cloudflare’s walled garden to thwart a DDoS atk.

So of course the natural order of this thread is to discuss various Cloudflare-free solutions. Such as:

  1. Establish an onion site & redirect all Tor traffic toward the onion site. 1.1. Suggest that users try the onion site when the clearnet is down— and use it as an opportunity to give much needed growth to the Tor network.
  2. Establish 3+ clearnet hosts evenly spaced geographically on VPSs. 2.1. Configure DNS to load-balance the clearnet traffic.
  3. Set up tar-pitting to affect dodgy-appearing traffic. (yes I am doing some serious hand-waving here on this one… someone plz pin down the details of how to do this)
  4. You already know the IPs your users use (per fedi protocols), so why not use that info to configure the firewall during attacks? (can this be done without extra logging, just using pre-existing metadata?)
  5. Disable all avatar & graphics. Make the site text-only when a load threshold is exceeded. Graphic images are what accounts for all the heavy-lifting and they are the least important content (no offense @jerry@infosec.exchange!). (do fedi servers tend to support this or is hacking needed?)
  6. Temporarily defederate from all nodes to focus just on local users being able to access local content. (not sure if this makes sense)
  7. Take the web client offline and direct users to use a 3rd party app during attacks, assuming this significantly lightens the workload.
  8. Find another non-Cloudflared fedi instance that has a smaller population than your own node but which has the resources for growth, open registration, similar philosophies, and suggest to your users that they migrate to it. Most fedi admins have figured out how to operate without Cloudflare, so promote them.

^ This numbering does /not/ imply a sequence of steps. It’s just to give references to use in replies. Not all these moves are necessarily taken together.

What other incident response actions do not depend on Cloudflare?

  • zwekihoyy@lemmy.ml
    101·
    1 year ago

    I’m starting to think some of y’all don’t know what a walled garden is. just saw someone on mastodon refer to signal as a walled garden.

    • diyrebel@lemmy.dbzer0.comOP
      11·
      1 year ago

      You don’t see the wall because you’re in the included group. Unlike Facebook, Cloudflare hides the wall from those they welcome into their garden. If you click on the screenshot on the OP, you can see what the barrier looks like to those of us who are in the excluded group.

      Otherwise I hope you’re not viewing the world through a simplistic “good guys” / “bad guys” lens s.t. those you deem forces of good surely could not be a “walled garden”. The term serves well w.r.t. places where content is published. Restricted access venues: (Facebook, Cloudflare [with restricted access enabled], LinkedIn, Yelp, Quora,…) are not open access. They are walled gardens.

      While #Signal is in fact technically a walled garden, it’s bizarre to bring it up simply because it’s a p2p platform with no public content to speak of. The term doesn’t really serve us well in a discussion of p2p private chat platforms. Although it’s important to recognize Signal:

      • takes an extremely protectionist stance,
      • deploys tactics to push Signal users into Google’s walled garden,
      • threatens lawsuits against projects who attempt to use the same platform (#LibreSignal),
      • excludes people without mobile phones,
      • and is outspokenly hostile toward the idea of federations

      See https://github.com/privacytools/privacytools.io/issues/779

      The exclusivity of Signal’s design and decision making & careless marginalization of classes of people is comparable to that of orgs like Cloudflare & Microsoft.

      A Cloudflare host can leave the walled garden, but steps are needed

      It is possible to configure a CF host with unrestricted access, in which case you could argue those particular sites are not in the walled garden, but that’s relatively rare. And it still requires a hell of a lot of hand-waving on your part because CF algos still override the user settings in some instances.

        • diyrebel@lemmy.dbzer0.comOP
          2·
          1 year ago

          “Exactly” would imply just one issue. It would be like asking Greta what exactly is her issue with climate. Or asking Snowden what exactly is his issue with mass surveillance… or tell RMS he can only pick one problem with non-free software.

          The first problem I encountered with Cloudflare was being in the excluded group. Being blocked from websites that were presented as though they were open to the public was how CF’s existence became known to me. The more you study CF, the more wrongdoing you find. The exclusivity problem just scratches the surface. There’s a good outline of the Cloudflare problem here: https://git.kescher.at/dCF/deCloudflare/src/branch/master/subfiles/rapsheet.cloudflare.md

          Knowing what I know now about CF, I actually prefer to be excluded from their walled garden. I seek out tools that will help me avoid it. Thus I’ve come to actually see the blockade as a benefit. So perhaps I could answer your question after all with a single issue: the problem is that Cloudflare is growing and thus shrinking the decentralized free world as a consequence.