DDraceNetwork - developer

i'm only having about 10 Mbit/sec incoming

00:08

what kind of sorry ass DDoS is that

its spread thin across every server on tw i guess

get that cloudlfare waf boyssss

(edited)

00:42

probably wont help in this situation anyways, idk whats being ddos and what the interfacing application is

00:43

also cloudflare can be bypassed anyways so not like it would matter... rip

cloudflare is for tcp right

ive seen udp and tcp floods before but I am not too sure what is being ddos'ed, how, where it is located, what is the interfacing application, etc etc.

what: every popular teeworlds server+the master server itself how: spoofed udp flood

where: everywhere

cloudflare offers 1 website free waf protection, they do offer more indepth comprehensive packages that allow you to pass all your traffic through their network and tunnel back to your site but ingress and egress is costly. Also, if your links get saturated then whats the point as your links would be your bottleneck.

thats for tcp isnt it

its for http

then yes; also the problem isnt that the links get saturated (generally), its that it consumes all the cpu of the server when it tries to either filter or reply

you usually want to block flood as high upstream as possible, closest to the gateways before it would ideally reach your network. these providers want you to pay a fortune for ddos protection, the only good ones ive heard is OVH for gaming, other providers usually switch off your VPS when ddos happens/ (edited)

yes

00:50

ovh is good

lol

where did you get this information?

and nullroute generally isnt an issue with these types of attacks

00:52

at work we had both a tcp and udp flood coming to our network.. funny enough the source address was 0.0.0.0/0 and destination address was 0.0.0.0/0. our perimeter firewall was dropping these packets however our links were saturated so not point trying to add extra mitigation on the perimeter. so we contact our provider to start blocking incoming traffic to our network upstream to lessen the saturation and then our perimeter fw can handle the rest.

these attacks are generally spoofing real tw player ips so blocking it this way isnt possible

00:55

and they arent high volume enough to worry about saturating the link

d3fault

[ddnet/ddnet] Issue opened: #2470 Verify that client sends server "zoom level" at correct time, depending on zooming in vs out, now that we have smooth zoom

Maybe this is already handled, idk. Since zoom is now non-instant (a46b266), the client needs to be smarter about when it "tells" the server about it's zoom level (1782d95). Specifically, when zooming in the client should wait until after the "smooth zoom animation" finishes before sending the server the new zoom level... and when zooming out the client should send the server the new zoom level before the "smooth zoom animation" starts. Reason: so tees aren't considered "out of ran...

d3fault

[ddnet/ddnet] Issue closed: #2079 New freezehammer doesn't always work with deepfly bind, but should

def-

[ddnet/ddnet] Pull request opened: #2471 Don't send zoom level while zooming (fixes #2470)

I love how everyone has a great experience with ovh, but when we try them they null route us 5 minutes into attacks

08:13

Or put a firewall on our ssh port so we cant even connect, best ddos protection

OVH blocked my private IP address every time I refreshed the ddnet.tw website too quickly

Now that I think about it, it does actually stop the ddos. If there is no traffic there can't be any ddos

sirius1242

[ddnet/ddnet] Pull request opened: #2472 Add function to show health and armor in nameplates. (mainly for server demo)

The effect is as follows: !effect image

use cl_nameplates_ha to switch on-off. (default is off)
use cl_nameplates_ha_size to adjust size of health and armor nameplates.

Mainly for server-side-recorded demos. If it can't get health and armor data, this will not be rendered.

https://tutanota.com/blog/posts/lawful-access-encrypted-data-act-backdoor/

New anti-encryption bill worse than EARN IT. Act now to stop both.

The Lawful Access to Encrypted Data Act would require US companies to backdoor encryption for the "good guys".

wow

08:57

but i think that always was a backdoor for government

apple has for fbi

08:58

cuz fbi cried

Didn't FBI cry to force Apple creating backdoor for them, because they couldn't break into one of apple's phone?

Imagine being an old dinasaur thinking you can regulate math

09:52

If you got nothing to hide you got nothing to worry about guise

yo @Learath2 how do you respond to people that say "i have nothing to hide"?

by pointing out that this argument only works when ur values 100% align with those of the government in the country u live in?

10:49

chiller

10:49

someone was faking u on fng earlier

10:50

they told me u allowed it is that true

ChillerDragon: Just because you have nothing to hide from the current people in power, doesn't mean you won't have something to hide from the next govenrment in power

yes thats what i meant

Also, it's a slippery slope, you got nothign to hide, so how about microphones in your house? It's only the government, there is no reason to worry

11:02

Or some cameras maybe?

the more backdoors like this that exist, the more likely it is theyll be exploited by a malicious 3rd party too

How about we give a skeleton key to the government so they can unlock every lock ever made?

https://en.wikipedia.org/wiki/Transportation_Security_Administration#Checked_baggage

Transportation Security Administration

The Transportation Security Administration (TSA) is an agency of the U.S. Department of Homeland Security that has authority over the security of the traveling public in the United States. It was created as a response to the September 11 attacks. Chiefly concerned with air tra...

Exactly ^^, everyone and their mothers can get a copy of the TSA skeleton keys now

11:06

And the TSA has the worst track record ever, the backdoor didn't even help

11:07

Besides, I don't even know of a secure way to give them a backdoor

asymmetric crypto

You can't revoke keys

assuming they can keep the key secure

Also, how do you prove that two ciphertexts belong to the same plaintext?

11:09

If you only have a key for one?

you require the software authors to do it that way

11:09

didn't work great for ban of cryptography exports

11:10

but that did delay secure crypto for the world for a bit

11:10

even creeping into standards

I guess if you punish everyone releasing proper crypto software, but if you write the software yourself, there is no way for them to figure it out

yes

11:11

I guess they'd be fine with that

You don't even need to do the crypto yourself, not like they can make openssl disappear. You can just encrypt what you want with the governments key and the actual message with the recepients key

it's not quite as easy, usually when doing asymmetric crypto, you don't encrypt the message, but the random symmetric key used for encrypting the message

I actually wondered whether you could have two keys decrypting the same ciphertext, but neither the discrete logarithm nor the elliptic curve multiplication feel like they could be modified as such

https://earth.2020.cscg.de/tasks/RSA%20Service

11:13

ctf task: here's a plain text and a cipher text, find a key

bad prime choice?

yes

@heinrich5991, that's a good idea actually, provide two encrypted symmetric keys and one ciphertext

that's how asymmetric crypto is usually implemented