Update on the pool downtime

[GregoryGHarding]

yep did a bit of research on JP VPS too.. sounds like it should work

[jstefanop]

I talked with Chris.

We determined that the previous method won't work, because Verizon is blocking outbound traffic that appears to come from IPs outside their network. The idea was to use a front server that had a lot of bandwidth to filter traffic and then just re-broadcast good packets with a different destination IP. Our server would then reply and rewrite the packets as if they came from the front server. But Verizon apparently filters these packets, a policy which was probably informed by people who tried to execute DDoS attacks with fake source addresses from within their network.

So Chris is trying a different idea. He's going to buy a VPS that provides DDoS protection from Javapipe, and set up a tunnel. Inbound, the behavior is the same, but outbound the packets travel back to the origin server and are broadcast there. No filtering is going to happen out there because the packets actually are coming from the server they pretend to come from.

We'll see if Chris can get this online in a few hours.

Probably not a good idea to broadcast details about DDoS protections on a public forum

[Steve Sokolowski]

I talked with Chris.

We determined that the previous method won't work, because Verizon is blocking outbound traffic that appears to come from IPs outside their network. The idea was to use a front server that had a lot of bandwidth to filter traffic and then just re-broadcast good packets with a different destination IP. Our server would then reply and rewrite the packets as if they came from the front server. But Verizon apparently filters these packets, a policy which was probably informed by people who tried to execute DDoS attacks with fake source addresses from within their network.

So Chris is trying a different idea. He's going to buy a VPS that provides DDoS protection from Javapipe, and set up a tunnel. Inbound, the behavior is the same, but outbound the packets travel back to the origin server and are broadcast there. No filtering is going to happen out there because the packets actually are coming from the server they pretend to come from.

We'll see if Chris can get this online in a few hours.

Probably not a good idea to broadcast details about DDoS protections on a public forum

This is pretty standard practice, so it's nothing new to them.

A few updates. First, Chris was unable to complete his tasking today because he ran out of energy and fell asleep, having slept only 4h last night.

Second, even if he had been able to stay awake, a third IP address was attacked and lost. The site requires three IP addresses to operate, and we now only have two addresses available. Therefore, he can't make any further progress until 8:00am tomorrow, when he's going to buy new IPs. Then he'll work on connecting the "DDoS protected" IP through the VPN tunnel.

The largest coin payouts will be executed tonight. If the attacks take out the trader server, then we won't be able to execute payouts tonight. The forums might also be taken out, and if that's the case, then we'll keep people updated on twitter.

Right now, I'd say there's a 60% chance the site is available tomorrow, 80% by Tuesday, and almost certainly by Wednesday.

[Eyedol-X]

I talked with Chris.

We determined that the previous method won't work, because Verizon is blocking outbound traffic that appears to come from IPs outside their network. The idea was to use a front server that had a lot of bandwidth to filter traffic and then just re-broadcast good packets with a different destination IP. Our server would then reply and rewrite the packets as if they came from the front server. But Verizon apparently filters these packets, a policy which was probably informed by people who tried to execute DDoS attacks with fake source addresses from within their network.

So Chris is trying a different idea. He's going to buy a VPS that provides DDoS protection from Javapipe, and set up a tunnel. Inbound, the behavior is the same, but outbound the packets travel back to the origin server and are broadcast there. No filtering is going to happen out there because the packets actually are coming from the server they pretend to come from.

We'll see if Chris can get this online in a few hours.

Probably not a good idea to broadcast details about DDoS protections on a public forum

This is pretty standard practice, so it's nothing new to them.

A few updates. First, Chris was unable to complete his tasking today because he ran out of energy and fell asleep, having slept only 4h last night.

Second, even if he had been able to stay awake, a third IP address was attacked and lost. The site requires three IP addresses to operate, and we now only have two addresses available. Therefore, he can't make any further progress until 8:00am tomorrow, when he's going to buy new IPs. Then he'll work on connecting the "DDoS protected" through the VPN tunnel.

The largest coin payouts will be executed tonight. If the attacks take out the trader server, then we won't be able to execute payouts tonight. The forums might also be taken out, and if that's the case, then we'll keep people updated on twitter.

Right now, I'd say there's a 60% chance the site is available tomorrow, 80% by Tuesday, and almost certainly by Wednesday.

Bummer to hear about this kind of down time, thanks for the work you guys are doing. Looking forward to the site being back online.

[GregoryGHarding]

thanks for the update steve let chris get his Z's he deserves the beauty rest..
both for his hard work and that thing he calls a profile pic

[vinylwasp]

I don't think these people have any purpose at all, and they're actually pretty dumb. Would you:
1. Spend your own money
2. Not be able to get anything in return because you can't steal any money or hack any systems
3. Provide more evidence for us to add to the police reports so that you can live in fear of arrest

That doesn't seem to be very smart to me. If I were to do something like this, I would at least want to have some potential for gain in exchange for my money and the chance of spending years in prison.

If they're another Pool operator that directly benefits from PH being down, then there's a strong economic motivation to keep DDoSing.
If they do it for long enough their strategy may be to cause you sufficient loss of revenue and cost to remediate to ultimately drive you out of business. I hope this doesn't happen of course but there are plenty of precedents for competitor DDoS attacks.

DDoS attacks are actually pretty cheap. Just google "web site stressor" and you'll find services (sic) for a few bucks per hour.
Javapipe sounds promising, my only concern would be increased latency, but we'll just have to wait and see what the impact of that might be.

[rootdude]

This definitely hurts the bottom line. Sorry you're having to deal with it Steve/Chris.

[rootdude]

Why not switch to different port numbers? Just shut down 3333 temporarily and use 443 and maybe a few others?

[topkhodon]

I talked with Chris.
Right now, I'd say there's a 60% chance the site is available tomorrow, 80% by Tuesday, and almost certainly by Wednesday.

not so bad. I will waiting for restoring of pool. We belive in you. From Russia with love and hope.

[olkah]

Когда будете работать снова ???