Both should be fine now.

Nope, proxy misconfiguration from the ISP I think. Trying to get it sorted out.

Hi,

We've put mtgox back online, this time through a level7 firewall (application level firewall, basically it filters bad requests and ddos at application level, which means mtgox should stay online more easily).

Anyway now is the time for some russian guys to attack again, so we can see if it works


If my dear russian friend who asked me $5000 via LR by email (then $7000, then more, but oh well) read me, let me say this to you:


If we can live through this, it means we'll have enough anti-ddos protections (for now).

ddos ended.

We are setting up a layer7 firewall in front of mtgox to block those attacks~

More than anything, I confirm it can be lifted on a case-by-case basis. We'll have a better policy once we have made sure everything is fine.

Hi,

Not totally down. It's still up if you try enough, but it's not optimal. We are tweaking ddos filters to match the new attack pattern.


Thanks,
Mark

Plus, we are working on lifting this limitation. This will however require filling some requirements (KYC-like, we cannot send huge amounts of funds blindly to just anyone, that's what the law says). More details to come~

Site seems back up, ISP is doing its job.

The guy who mailed me requests to pay him $7000 (yep, got $2000 more because I reported him) first told me he wants rates down, then told me he needs the money.

The ISP support said:

Heya,

Attacker is back, and has a new email address (it starts with fuuuuckyouuuuumtgox). I think he's not happy.

Anyway we'll try tweaking the ddos protections to avoid blocking legit traffic, it's going to take a bit more time.

Hi,

I'm going to implement a "withdraw queue" for LR, and will stop processing withdraws in realtime, because of all the problems we got with this API. This also means that you'll be able to cancel LR withdraws at a later time if something goes wrong.

During normal times, LR withdraws will still be processed in realtime, however if an error occurs or we reach the daily limit, your funds will still be scheduled for transfer. We had a lot of withdraws during the past days (I guess people fear for their funds during the DDoS) and we've hit limits I never knew existed at LR. Anyway I'm currently rewriting the LR handlers to pass through a different system that will allow more reliable withdraws and deposits.


Thanks
Mark

Hi,

We are having a lot of issues with LibertyReserve, mainly due - I guess - to the way it's implemented. I'm going to move the LR implementation to something better that will correctly track transactions too...


Mark

Hi,

Please email info@mtgox.com with the transaction details (including batch number).


Thanks,

This message means we hit the daily API limit. I'll try to see ways to increase it, in the meantime you can just retry "tomorrow" (no, I don't know when LR changes day)

When the price comes from mysql, it is as a string. I could cast it to float to make sure it's a float, but I guess it doesn't change much for anyone (shouldn't, anyway)

It was cheaper, and it seems more reliable. All win.

Let me use a provocative title too.

I would like to discuss the recent DDoS event, and what can be done to protect against those. MtGox being a rather large exchange site, we could switch rather quickly to a different hosting provider with DDoS protections and keep the site running while packets were flying furiously outside the fence, however it is not the case of everyone.

I've been thinking about various options and will propose various solutions based on the situation.


Web hosting with KalyHost

Since we now have a DDoS proof dedicated server, I could host more sites there. Each site would get its own ip, ability to have SSL, and be "ddos protected" by Black Lotus. This is a bit costly, but much less than the standard offer, and could be negociated on yearly basis for various sites.

If your exchange site is interested please contact me ( support@kalyhost.com ) so we can discuss this and find a solution.

In long term we need to avoid this as it makes one infrastructure an ideal target to get many sites down, however it might be good enough for smaller sites to grow without having to worry about ddos.

Decentralized exchange

This would be obviously the ideal solution. We have started thinking about this here, and we'll include a something with QBitcoin. More details soon.

Inter-exchange system

This is a bit like the previous "decentralized exchange", but different. Basically this would involve to make not users but exchange sites peer-to-peer. Then even if one of the exchange sites goes down, things can still work (a bit like real exchange works in the world). I discussed this with some other exchange sites and it could be a solution too (after more talks).



More ideas are welcome, let's make the bitcoin economy solid enough to not freeze in front of a russian asking $5000!

The attacker sent an email from a stolen address offering to stop his attack for $5000 via libertyreserve.

This was - of course - denied. We do not negociate with internet terrorists!

The attack has stopped, with a promise to start again in 2 hours.

Previous attack had no impact as the ddos protection successfully blocked it (and a few dozen of normal users too). We are trying to get the ddos filtering to not block normal users.

For reference, a subset of the observed ips this time:
http://paste.pocoo.org/raw/382648/