HN

Need help?
<- Back
Understanding the recent DDoS attack against Read the Docs

Understanding the recent DDoS attack against Read the Docs

davidfischer

Comments (33)

  • fn-mote
    There’s an assumption that turning on Cloudflare’s “under attack” mode would mitigate the attack.Given how adaptive the rest of the attack was, I would be very curious to find out how it would approach that obstacle.
  • gopher_space
    My naive take on a Cloudflare perspective wants to combine "three times is enemy action" with toddler-speed block dropping and manual clearance. What's the money reason this problem isn't handled at the ISP level?
  • bennett_dev
    Interesting that the Under Attack Mode wasn’t used at all here. I understand not wanting to break APIs but I feel temporarily challenging non-API usage could have at least helped without impacting users too much?
  • Onavo
    A more interesting question is, what exactly do the attackers gain from hitting read the docs? Most of their docs hosting is static/easily CDN cached. Unlike database bound sites, you would need a lot more traffic to overload pure/mostly static hosting. Maybe it's a malicious AI lab looking to deny their competitors training data? As far as infosec profiling goes, this is probably the oddest case I have heard of.I am thinking it's probably an AI lab that misconfigured their data scraper (made it too agentic) and it ended up looking like a DDoS.The new generation of scrapers are all agentic and self healing. (As an example see YC's https://parse.bot)
  • LoganDark
    Yippee, free load test!
  • anon
    undefined
  • tescreal
    I'm curious if anybody could speculate who would be attacking a documentation silo, and to what end?
  • ACCount37
    > One decision we made is to always give real users an escape hatch. Read the Docs very rarely issues outright blocks or bans to specific IPs or user agents. Instead, our "worst" is a JavaScript challenge, and if a user solves a challenge, they are very unlikely to get challenged again for the next day or so.Finally, a competent response that doesn't leave the users hang out to dry.I'm so tired of seeing incompetents with measures like "blackhole 2 continents" deployed even outside active attacks.
  • anon
    undefined
  • Surac
    Sure it wasn't a AI crawler?