Development Theory

I once rented a part of a house that had been, well, not fully cleaned out from the previous occupants. It was a house full of hackers that had been variously occupied by friends and friends-of-friends for almost a decade as they passed through Austin on their way from or to new lives, which is to say, it had, well, "character".

One of the odder things left behind by the previous inhabitants was a literal pile of Final Fantasy boxes, completely intact save for the all-important registration codes. A bit of digging uncovered a fascinating tale of cross-border, tax- and fee-free value transfer. The former occupant, let's call him "Bob" was engaged in a business proposition with a colleague based in South Korea, let's call her "Alice." Whatever version of the RPG Final Fantasy had just been released in the States (only). This had proved very difficult to pirate, causing a huge untapped demand in Korea. Koreans, however, had been happily hacking away at another RPG game which was only just now catching on Stateside. So, Bob would tear off and destroy these registration codes, emailing the codes themselves to Alice in Korea. Alice, in exchange, would provide Bob powerful and rare in-game items for the newly-popular game - these were of less value to the Korean market, as it was saturated with players and therefore items, but there was no arbitrage market into the States -- before Alice and Bob, at least. Bob could then sell these on online grey markets for such items, effectively creating a way for both Alice and Bob to profit (rather lucratively, from my understanding) from local markets, and transfer value across borders without incurring bank costs, wire fees, or, for that matter, taxes. This setup lasted for as long as both were able to extract value from the arbitrage process, but obviously wasn't able to scale or even easily re-adapt to new opportunities.

With the rise and increasing stability of bitcoin as an actual contender for a digital currency, the global market suddenly starts looking a lot more local.

Google has been making headlines with their shiny Project Shield which wraps PageSpeed with other tools to defend sites against denial of service attacks. The history of the denial of service, however, runs deep, and underlines that no centralized response to it will ever be able to cost-effectively scale against a distributed attack.

Let's rewind back to the 90s. Denial of service was a very, very different thing then - it was a tool for free expression, not one used to mute dissenting opinions as it is today.
In the dot-com boomtimes of the late 90s, I was absolutely fascinated by the digital protests that sprung up in reaction to Mexico's treatment of the Zapatista Movement. Floodnet was an activist art project by the Electronic Disturbance Theater. Floodnet was simply a website you could visit and it would direct your browser to constantly reload pages on the website of the Mexcian government. In addition to overloading the website with thousands of requests from you and our fellow programmers, you could add in a political message with each page load, to force the government's server to fill their log files with messages like "human rights not found."

"The FloodNet application of error log spamming is conceptual Internet art. This is your chance to voice your political concerns on a targeted server. [...] The server may respond to your intentional mistake with a message like: "human_rights not found on this server." So by creatively selecting phases, you can make the server voice your concerns. It may not use the kind of resources that the constant reloading uses (FloodNet automatically does that too), but it is sassy conceptualism and it invites you to play with clever statements while the background applet is running." (via http://www.thing.net/~rdom/ecd/ZapTact.html)

Floodnet used DoS attacks to protest the Mexican Government

This original "denial of service" attack was seen as the digital mirror of a classic "sit-in" protest. It was a way for a David to strike back at a Goliath through technology. However, this, ahem, "sassy" political activism began an arms race that today is dominated by Goliaths alone. Instead of a tool of protest, denial of service attacks are today tools of retribution and ways to mute dissenting voices. They are massively automated and distributed, and are run not by rowdy bands of dissidents, but by well-organized for-hire groups (https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fe…) and even from government infrastructures.

The only defense, so far, has been equally massive, and centralized, commercial services. This is a growing industry with its own round of disruptive innovators all to itself. This current business innovation is helping to move from the monolithic services protecting online infrastructures at high costs to a more scalable model, with services that smaller websites can benefit from. Still, back-end models are the same - providing shelter from DDoS attacks by having sufficient servers and bandwidth to absorb whatever their proprietary tools and filters cannot outright block.

Open source models to fight back have been conspicuous in their absence - until now.

The Deflect Project, created by the eQualit.ie technology collective based out of Montreal and Dublin, is responding to that gap. They focus on providing protection for activists and journalists around the world, who are subject to DDoS attacks from those who disagree with their views all the way to their own governments. Thanks to grant funding, Deflect is able to offer their services for free to independent media sites, NGOs and non-profits -- but the technology model under the hood is the real game-changer.

1. Build for sustainability. Minimize what you have to build yourself, and leverage existing platforms This means giving strong preferences to open source platforms or at least existing services that meet a set of criteria (their service meets your needs, you own your data, shared values, track record...) For any service, someone, somewhere has already built a powerful framework that will be constantly updated and improved, and bakes in thousands of features (security, translation, powerful content management, mobile interfaces, etc.) which will be effortless to turn on when you discover you need them. Focus your precious software development budget on the much smaller number of things that are custom to your work and don't exist. This greatly reduces the initial dev costs as well as ongoing maintenance costs.
2. Seriously, don't build it yourself.