Sure but maybe something less centralized/proprietary would be preferable

Didn't the admins for Lemmy[.]world post their expenses recently-ish? I can't remember how much it would be for a single user to donate. I'd want to donate, but I'd like to know how much of my contribution would affect operation of the server.

we will all still be here when their hyperactivity wears off.

with the old Reddit simulator, personally I'm not going anywhere anytime soon. This place has a great user base and it feels so old-school.

I wonder if the owners of deddit, fb, tweetster, et al, might think it financially worthwhile to cause disruption in the fediverse, and even its ultimate failure.

Wondering if reddit or Musk are behind the attacks?

For most hackers or wanna-bes (often called Script Kiddies, that is, people (generally young, even children thus the "Kiddies") who are not technologically inclined enough to be real hackers and see a tutorial online on how to run pre-written scripts that repeatedly perform various functions), the answer to "Why do you do it?" is often:

1. "Because I was bored."
2. "Because I can."

Very rarely are other reasons given.

I was using voip.ms last year when they were DDoS'd for over a week, by a group demanding payment via anonymous crypto. The DDoS ended when they switched to CloudFlare (which was probably pretty difficult because they're a SIP provider.)

Almost any website with a small number of servers is vulnerable to this attack, which happens to be great business for CloudFlare. I wonder which companies are most effectively competing with CloudFlare?

Nah, it's not the 00s anymore. Hacker gangs are a real thing today.

I'm not actually in the security field so take this with a grain of salt. But I believe that these attacks play a similar role to random attacks in low level gangs. It proves that your criminal group has power and the ability to deface a website.

So if you publish that Lemmy.world will go down next week because your hackers are on it.... It's advertising. Its just business. It proves that your hackers have an ability and that you are up for sale.

You don’t think just being bored is enough reason for some?

With my tinfoil hat on, I'd say one concern is that Cloudfare is basically a monopoly and nothing is stopping them from DDoSing sites to force them to use their product.

You might have Cloudflare add a request header to the origin request, like x-cloudflare-key: <somesecret>, and then configure nginx on the server to block everything not containing that header.

Exposing your hetzner sounds fucked up

Seems like we had downtime again just a little while earlier?

Hmm, best would be if those kids find a real hobby so they stop bothering us. On the other hand, it helps us understand Lemmy better and secure it.

People in here really thinking big businesses are attacking lemmy lmao its ridiculous.

Load balancing applications is significantly more complex than most people anticipate. In the naive implementation it typically increases database loads and reduces site performance. Static content balancing is trivial, and cloudflare will do that by default, but implementing the hard part will require careful software development to prevent a naive implementation from bringing down the database. Sticky sessions are just the beginning.

It costs more money right?

Dont understand this either, who the fck would expose real server IP in first place?

Be aware that you use another server so you might consider donating to them instead.

https://opencollective.com/mastodonworld

https://patreon.com/mastodonworld

~ Friedrich Nietzsche

Can you give some insight to this?

It seems like you made this comment in jest, but I wouldn't say it's outside the realm of possibility. We can't fly off the handle and lob accusations absent any sort of proof, but it would hardly be the first example of a corporation targeting an up-and-coming disruptive service run by amateurs.

If your site was already accessible by HTTPS before you put it behind Cloudflare, try Full (Strict).

What are your reasons for hating cloudflair? Best i can tell they run a good service and their free offerings have been great (1.1.1.1)

I saw a post "Lemmy seems to have way more leftists than xyz." So I wouldn't be surprised to find it's political nonsense, people attacking a site they see as "the left."

Just make sure you do your research before you do - people have broken federation by enabling it without due care in the past.

The kinds of people who do these things can have different motivations.

Some DDOS operators are "hired goons" who will DDOS whomever they're paid to. However, in order to demonstrate their capabilities, they need to do some damage first. If they can cause a big outage, they can later point to that outage and say "we did that" as proof that they're capable of doing damage.

Some DDOS operators are ideological or identity/drama-driven. They decide that they have a Cause, and that this justifies doing some damage. The same groups might do DDOS and also harassment, doxxing, spamming, etc. — their goal is to cause misery to the Bad People and "drive them off the Internet" by whatever means they find handy.

Some DDOS operators are just plain extortionists. They crash a site once or twice, then threaten to keep doing it forever until the site owner pays them off.

Some DDOS operators are bored kids making trouble.

Some DDOS operators are nation-state agencies trying to censor foreign sites that say things they don't like. In one case, the China government attacked GitHub to get at the anti-censorship site GreatFire.

CloudFlare IP ranges can be found here. The DNS entry can point to any one of those IP addresses.

It's about skills. Script kiddie can download and run a script written by someone else but that's pretty much it.