Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would be a relief to hear that you thought of this possibility and took adequate countermeasures.

share|improve this question
Sounds suspect to me. Are you preparing one? – Gnoupi May 27 '10 at 15:03
Scoping out the joint, eh? – Andy E May 27 '10 at 15:04
@Gnoupi Psssht! They must not notice my evil intent yet! – mafu May 27 '10 at 15:06
Is anyone truly prepared for a DDoS attack? – squillman May 27 '10 at 15:07
@squillman: slashdot? – perbert May 27 '10 at 15:08
@squillman sure, but I'd still assume that a site this big should take basic means to deal with such a thing. – mafu May 27 '10 at 15:09
Please go into detail what countermeasures SO has prepared, and where the vulnerabilities are. pulls out notepad – Michael Mrozek May 27 '10 at 15:26
In the event of (say) a full-scale alien invasion, how prepared do you think this planet's defenses would be? Tell me! – Blorgbeard May 27 '10 at 16:05
Are they prepared for the Spanish Inquisition? – Lance Roberts May 27 '10 at 16:38
@Lance: No one expects the Spanish Inquisition! – Bill the Lizard May 27 '10 at 16:41
Regular SO usage can be likened to a DDoS attack :P – Ólafur Waage May 27 '10 at 20:02
@Blorgbeard: That depends, what kind of Aliens? Tommy Lee Jones, Jeff Goldblum and Will Smith are still alive and kicking, so basically nothing can happen to us. – Time Traveling Bobby Apr 17 '12 at 14:59
That's a nice Q&A network you got there. It'd be a shame if something were to happen to it. – RivieraKid Apr 17 '12 at 15:14
@MichaelMrozek "pulls out notepad"? Psh. A real programmer would use [vi/emacs/notepad++/a magnetized needle and a steady hand]. – Pops Apr 17 '12 at 15:15
@perbert I think squillman was talking about being prepared to withstand a DDoS attack, not create one. :) – Andrew Grimm Jun 6 '12 at 23:21
up vote 7 down vote accepted

The rate limiting that has been implemented should fend off a good deal of basic crap. The team is obviously on top of their infrastructure as is evidenced by this post on the new Serverfault Blog. Also others on the Stackoverflow blog. The measures in place already should go a fair distance in preventing a DDoS, and with constant monitoring I would expect that an attack would be quickly noticed and addressed. I would wager that their relationship with the Peer1 would be such that they would get some priority assistance in the case that an attack ensues.

share|improve this answer

I find it hard to believe that someone that has access to more zombies than SO has concurrent users would have any reason to attack SO, and if they have less, I don't think that it would more than tickle the servers.

Of course, they have their resident sysadmin that can jump in at any time.

share|improve this answer

Is SO prepared to meet a DDoS attack?

The discipline of Risk Management addresses preparedness.

There are two main constraints of Risk Management: impact and probability.

In order to answer your question, we would gauge the impact of a successful attack and the probability of such an attack occurring.

There are several possible responses to risk; each has its strengths and drawbacks, and the best fit depends upon a variety of factors. In order to "be prepare," (the definition of being prepared) one or more responses would be planned based upon the risk(s).


  • Acceptance

    In this case, the response is to do nothing to prevent the risk from occurring. A plan for dealing with the aftermath might be appropriate. This response is appropriate for low-impact risks or low-impact, low- or medium-probability risks. For example, the risk of an airplane falling on one's house has a low probability. If it does occur, it would be high impact. One would accept the risk because the cost of doing anything else (moving into a cave, erecting an anti-aircraft defense shield) is overkill.

  • Transfer

    The risk is transfered to another party. A common form of this response is insurance. The probability of getting into an automobile accident is high enough and the impact is significant enough to merit transferring the risk to the insurance company. Another example would be to outsource a portion of a project to a third party and make them contractually obligated to deliver.

  • Avoidance

    This response is to eliminate the risk by removing the condition(s) that could lead to the risk being realized. If I have a risk of my backyard grill's propane tank exploding, I simply throw away the tank and the risk is eliminated.

  • Mitigation

    This response is a middle ground between avoidance and acceptance. It reduces the risk's probability and/or impact but does not eliminate the risk. An example of this would be to replace one's 1965 junker with a modern vehicle that had seatbelts, a rollcage, crush zones and airbags in order to mitigate the risk of dying in a car crash.

SO Preparedness

Wikipedia lists "5 types of DDOS", but for purposes of this exercise, we'll address only one (syn flood). Obviously a comprehensive analysis would take all risks in to account, as each would have different impact/probability numbers and responses.

In light of this, is SO prepared?

According to @squillman's answer, the team has taken steps to mitigate (and possibly transfer) the impact of A DDOS. What about the probability? Possible responses:

  • Avoidance - is there a way to avoid a DDOS completely? Short of cutting the cord, no. As long as users can get in, a botnet can attempt to connect.

  • Transfer - is there a way to transfer the risk, so as to avoid the probability? Unlikely. Setting up a honeypot or having the hosting provider take other countermeasures to hide/mask the location of SO would not be feasible.

  • Mitigation - making the site less attractive to griefers/flooders/script kiddies would be a form of this response, but undesirable from a usability standpoint. Employing resources to locate and prosecute perpetrators would not be financially/legally feasible.

  • Acceptance - accept that one is going to get attacked, but taking steps to reduce the impact is probably the easiest response in SO's case.

Given the above, there are things the SO team could do to reduce the probability of a DDOS attack (besides my contrived examples). They are prepared. They could be more prepared.

share|improve this answer
-1 Not sure what information this answer contributes. – user164291 Jun 6 '12 at 21:36
So basically you're saying that squillman has answered the question? What does the unsubstantiated content on the likelihood of an attack add? – Bart Jun 6 '12 at 21:41
@Bart quillman answered the impact aspect. He did not answer the probability aspect‌​. – BryanH Jun 6 '12 at 22:08
Fair enough, but you don't back up the probability aspect with anything though. I don't yet see the added value in this answer. – Bart Jun 6 '12 at 22:12
Done and done... – BryanH Jun 6 '12 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .