HN user

sneakest

5 karma

Internet developer

Posts1
Comments5
View on HN

the first real question to be asked really is, why does everyone need to commute to the same place in the same time?

Schools (K-12) are one of the biggest drivers of why at the same time. Schools start and end at specific times. This (usually) requires one adult to be around to drop them off and pick them up at school or the bus stop, especially K to at least early middle school. Because of this a lot of people in (sub)urban areas leave from home and from work around the same time. The difference in traffic congestion is drastic when you compare summer to the school year in larger cities with no meaningful mass transit.

I had one of my clients have the same thing happen to them 3 nights in a row about 10 days ago. All of the sudden they got dumped a ton of traffic out of no where. Torrent tracker updates and what seemed like legitimate traffic routed to the wrong ip. Then after about an hour most of it stopped. During the attack and after we changed some firewall settings and clamped down our request per second and connection per ip limits on the web servers. One big change was having the web servers respond 444 to any host request that was not configured (i.e. default). So if someone came to the ip looking for say google.com they would get a 444 response as it is obviously misrouted traffic.

Then the next day the same thing happened but much more traffic. The 444 change helped some but there was just too much traffic for the web servers to handle quickly so they bogged down to a crawl. Luckily we were able to figure out through severfault and some other searches that it appears to be DNS poisoning coming from China. We ended up banning the entire country.

The third day the same thing happened but because we had blocked the traffic from China at our outside firewall the servers were unaffected. Since then we have seen some flashes of traffic being blocked but not nearly as much as before.

In all cases the increased volume of traffic only lasted about an hour. The only thing I can surmise about the length of time is DNS records only being cached for about an hour. So after that time the poisoned cached DNS records were replaced by the real resolving ip address. In the case of the article's author their servers suffered a much longer attack than we did. I am not sure if it is the Chinese government doing it or an attack for hire scheme using holes in many Chinese based DNS servers.

TLDR; Remove default server settings from your web servers and have the default server block respond 444 or 404. This may help stave off the attack until your incoming traffic takes up all available resources of the web servers. Of course you could always block all traffic based in China like we did.

Here is info on the status codes incase you are curious: http://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_C...

IMO you should commit your composer.lock file up to your repository and then use composer.phar install --no-dev --optimize-autoloader on any production instance. Install is much faster and uses hardly any memory compared to the update command.

To add/update any dependencies for your project run the composer.phar update on your development environment or somewhere it can use a ton of memory and cpu without issue. Then just commit and push up your composer.lock changes. Been doing it this way for over a year and had no issues deploying changes in ec2.

I use two monitors to code, debug, shell, test, etc... with when I am working and nothing else is open on that machine other than work or research related to what I am doing. Not even email is open. All of my distractions (email included) are on my laptop with it's own extra screen. The key (for me anyway) is setting your screen saver to come on or go blank after a short period of inactivity mine is 5 minutes. This visually blocks anything from grabbing my attention on this machine. Now all the flashy alerts and popups are hidden from view.

This article should have been titled something else as the multiple monitors aren't the issue. If you are being distracted with multiple monitors from the work you are supposed to be doing then you need to close those distracting items or block them visually.