Attacks are never metered: why we changed how we bill
attacks are never metered: why we changed how we bill sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Why per-route…
Tuning challenge thresholds for mobile traffic behind CGNAT (part 2)
This post is about tuning challenge thresholds for mobile traffic behind CGNAT. It started, as most of our posts do, with an incident that did not go the way we expected.The economics…
Load testing through Deflecto without triggering mitigation
Over the last few months we have spent a lot of time on load testing through Deflecto without triggering mitigation. This is what we learned.Measuring successWe track three numbers for every incident:…
Why most layer 7 attacks last less than ten minutes (part 2)
We get asked about why most layer 7 attacks last less than ten minutes more than almost anything else, so here is the long answer.Lessons for your own runbookKnow who can change…
Data residency for public-sector customers (part 3)
Here is a question we could not answer well a year ago: what really happens with data residency for public-sector customers? We can answer it now.Compliance is a side effectRegulators increasingly ask…
Extortion DDoS campaigns target payment providers again
extortion DDoS campaigns target payment providers again sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.The economics behind itA booter…
Choosing between DNS delegation and CNAME onboarding (part 4)
Here is a question we could not answer well a year ago: what really happens with choosing between DNS delegation and CNAME onboarding? We can answer it now.What we changedWe moved the…
Introducing adaptive proof-of-work difficulty (part 3)
Over the last few months we have spent a lot of time on introducing adaptive proof-of-work difficulty. This is what we learned.What we changedWe moved the decision from a single threshold to…
Reading a Deflecto incident report
Here is a question we could not answer well a year ago: what really happens with reading a Deflecto incident report? We can answer it now.Testing in production, safelyEvery rule starts in…
Residential proxies are the new botnet (part 2)
Over the last few months we have spent a lot of time on residential proxies are the new botnet. This is what we learned.Why per-route baselines matterA thousand requests per second to…
Per-tenant rate limits for SaaS platforms (part 2)
Here is a question we could not answer well a year ago: what really happens with per-tenant rate limits for SaaS platforms? We can answer it now.Protecting the originNone of this matters…
What we learned from load-testing our own edge to failure (part 3)
what we learned from load-testing our own edge to failure sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Testing in…