Does this board use a security company like Cloudflare or BitMitigate?

[aceplace57]

I’ve been following the news about 8chan. Was surprised to learn that companies like Cloudflare and BitMitigate protect web sites from attacks.

I recall this board has been hit by denial-of-service attacks. If the SDMB is using BitMitigate they need to find another provider. The SDMB isn’t controversial, but there are plenty of hackers out there that will attack anyone.

Online providers knock 8chan offline after mass shooting

Like Cloudflare, BitMitigate protects web sites from denial-of-service attacks that can make them unreachable — the kind of online armor that contentious message boards require to survive.

But on Monday, London-based Voxility, a provider of network hardware and services, upended both Epik and BitMitigate by terminating its contract with the companies, said Maria Sirbu, the company’s vice president of business development.

[TubaDiva]

Dunno but that’s part of the deal, isn’t it? That’s not the kind of information a company wants to make public – they don’t want to talk about their security measures because it IS a matter of security.

Jenny
your humble TubaDiva
Administrator

[aceplace57]

Sometimes it helps to let people know a place is protected.
A lot of people put ADT signs in their yard. Some of them aren’t clients of that company. The signs often work anyway.

I understand the board doesn’t want to give out specific information about security.

[steronz]

@TubaDiva

Dunno but that’s part of the deal, isn’t it? That’s not the kind of information a company wants to make public – they don’t want to talk about their security measures because it IS a matter of security.

Jenny
your humble TubaDiva
Administrator

Generally speaking, security through obscurity isn’t security at all. Like, if you have a lock, you might think you wouldn’t want to advertise what kind of lock it is because that would attract people who might know that particular lock’s weakness, but a true lock picking expert wouldn’t be stymied by that – they’re going to recognize the lock and know its weakness. Better to get a good lock in the first place than hope to keep its weaknesses secret.

Plus, you know, if Cloudflare is providing DDoS protection all traffic is going to be routed through their servers anyway, which is going to let the cat out of the bag.
To answer the OP, it looks like SDMB is hosted on Google’s cloud, so they’re going to be the ones providing DDoS protection.

[Darren_Garrison]

@TubaDiva

Dunno but that’s part of the deal, isn’t it? That’s not the kind of information a company wants to make public – they don’t want to talk about their security measures because it IS a matter of security.

Jenny
your humble TubaDiva
Administrator

Not at all (I explain to the site administrator). When there are problems with a site, Cloudflare displays (to the user at home) error messages such as this. Nothing secret. You don’t have Cloudflare.

[Helena330]

Here’s a thought: *Maybe they don’t want to talk about it. *

[Snowboarder_Bo]

@steronz

Generally speaking, security through obscurity isn’t security at all. Like, if you have a lock, you might think you wouldn’t want to advertise what kind of lock it is because that would attract people who might know that particular lock’s weakness, but a true lock picking expert wouldn’t be stymied by that – they’re going to recognize the lock and know its weakness. Better to get a good lock in the first place than hope to keep its weaknesses secret.

Lemme see… so if I get, say, a Master lock, then anyone who wants to look it up could pick the lock, including a lock pick expert.

But if I get a lock and no one knows what kind of lock it is, only a lock pick expert could pick the lock.

But you think it makes more sense to get the Master lock?

:dubious::rolleyes:

[steronz]

@Snowboarder_Bo

Lemme see… so if I get, say, a Master lock, then anyone who wants to look it up could pick the lock, including a lock pick expert.

But if I get a lock and no one knows what kind of lock it is, only a lock pick expert could pick the lock.

But you think it makes more sense to get the Master lock?

:dubious::rolleyes:

I’m not making this up.

@That wiki

An early opponent of security through obscurity was the locksmith Alfred Charles Hobbs, who in 1851 demonstrated to the public how state-of-the-art locks could be picked and who, in response to concerns that exposing security flaws in the design of locks could make them more vulnerable to criminals, said: “Rogues are very keen in their profession, and know already much more than we can teach them”.

The principal is that your lock should be unpickable, rather than having a pickable lock and keeping its identity (and its flaws) secret.

[Sunny_Daze]

The idea is that obscurity should not be your only defense. This is not the same idea as telling the adversary what your defenses are.

[Snowboarder_Bo]

@Sunny_Daze

The idea is that obscurity should not be your only defense. This is not the same idea as telling the adversary what your defenses are.

Aye.

[TubaDiva]

Please note that everything about the Chicago Sun-Times is private; it’s a privately held company. As a general rule they do not talk overmuch about anything except that they want you to buy the paper and subscribe to their services.

Jenny
your humble TubaDiva
Administrator

[Derleth]

@Sunny_Daze

The idea is that obscurity should not be your only defense. This is not the same idea as telling the adversary what your defenses are.

No, you assume your adversary knows what your defenses are, because it gives them no advantage to know any such thing assuming you’re competent.

[DPRK]

Who are the Sun-Times’s adversaries?

[Sunny_Daze]

Your statement in no way contradicts mine. However, given the state of computer security I disagree that telling attackers exactly how you’re defended makes sense.

[Derleth]

@DPRK

Who are the Sun-Times’s adversaries?

Realistically, spammers.

@Sunny_Daze

Your statement in no way contradicts mine. However, given the state of computer security I disagree that telling attackers exactly how you’re defended makes sense.

Thinking secrecy protects you is wrong. That’s my point.

[steronz]

Y’all may be reading too much into my choice of the word “advertise” in post #4. Certainly there’s no sense in putting up a big neon sign advertising the brand of lock you’re using, that gets you nothing. However, if a friend asks you what kind of lock you bought to lock up your bike, and you’re hesitant to tell her because you’re afraid some nefarious actor might overhear you, that’s probably a sign that you’re thinking about security wrong.

In the same way, if someone asks what DDoS protection your site uses and you’re hesitant to tell them because you think it will hurt your security for people to know, you’re probably thinking about it wrong. And it’s especially silly in the case of DDoS protection, because there’s basically no way to actually keep that a secret – a simple traceroute will tell anyone what you’re using if you’re using a 3rd party service provider.

In any case, this is ATMB not GD and the question has been answered.

[AlsoNamedBort]

@DPRK

Who are the Sun-Times’s adversaries?

The Tribune is coming! The Tribune is coming!

[Atamasama]

I hope the arch-rival of the Sun-Times is the Moon-Spaces.

[Derleth]

@Atamasama

I hope the arch-rival of the Sun-Times is the Moon-Spaces.

You mean the Washington Times?

[Snowboarder_Bo]

@Derleth

Realistically, spammers.

Thinking secrecy protects you is wrong. That’s my point.

…and that’s why governments everywhere no longer classify information as secret, right? :dubious: