Your doorbell is not moody, the internet took a punch

I thought my smart doorbell was sulking again, then my bank app froze like a cat that just knocked over a glass and is pretending it did not, group text time, is the internet down or is it me, and the answer was, oui, someone hit the web with a sledgehammer. Cloudflare took the blow, most of us only felt a wobble, but you noticed it in the little places that only matter when they fail. The future is evenly distributed until checkout spins forever, then it is very local, very fast.

Dad joke break, because I like you, and because we need it. 11.5 terabits per second is not a headcount, it is how much water they shoved through the pipes, a UDPate you did not ask for. Think fire hydrant into a straw. Short burst, about thirty seconds, heavy on UDP, weird fingerprint, and a big slice came from Google Cloud. Not because Google went cartoon villain, because criminals rent servers like startups, spin up, spoof the source, spray garbage, shut it down, walk away, disruption by the minute, because we sell compute like vending snacks, non refundable. The cloud made building easy, maintenant it makes breaking easy too. Convenience cuts both ways, mon ami.

So what is actually happening, we industrialized DDoS. The scrubbers are auto swatting hundreds of spikes a day, packet rates in the billions, traffic that makes backbone graphs sweat through their suits. Two months ago the ceiling was single digits, now we are clocking low teens. The curve is not just rising, it is steepening. Why, more rentable horsepower, too many open reflectors that should have been fixed back when dial up was a thing, better amplification kits, and a playbook of short, multi vector bursts at the edges where capacity is tight. Think body shots, not haymakers, acupuncture with hammers at the margins.

Here is the soft pivot. This is not gamer drama or some bored teenager farming clout. This is whether you can reach a doctor, move money, get an emergency alert, or unlock a door when you need to. A minute of chaos can stall a hospital portal or scramble a small city dispatch, that is not a prank, that is a tax on the public. Bursts become censorship by congestion when they line up with elections, labor actions, or breaking news. Ten seconds at the wrong router and you are freezing logistics. Add a routing wobble or a brittle supply chain and you get a cascade, we have watched outages ripple through productivity suites and DNS, toss in a few ten plus terabit jabs at peak and the safety margin evaporates.

And yes, the conflict of interest is right there polishing its halo. The more we rely on a few private firms to scrub the pipes, the more power they have to decide who gets through and when. Availability is a public good and their centers keep the lights on, also true, their thresholds are theirs, the visibility is theirs, and smaller sites end up paying the same companies that set the bar. Pay for the shield or accept the risk, that is the business. Attack crews rent cheap nodes, leverage amplification, sell disruption like gig work, targets eat downtime and sign emergency contracts, providers publish heroic graphs then upsell the platinum tier, clouds tout trust and safety while racing to evict abusers after someone else bleeds, and the costs roll downhill to users as higher prices and to the commons as more centralization.

Actual solutions look different from security theater. Cloud hosts need sane egress rate limits out of the box, budget locks that freeze suspicious spikes before the bill melts the card, instant sinkholes for spoofed sources, and source address filtering at the edges so fake return addresses never leave the building. ISPs should finally close the reflectors we have nagged since Napster, that means audit the usual UDP amplifiers and fix them, not next quarter, now. Upstreams should publish packet level postmortems with enough detail to teach, not to brag, show the paths, the ports, the timing, leave out the chest beating. If you run a site, you are not too small to matter, if checkout lives in one region on one upstream, move it, redundancy is cheaper than apology emails, failover is not optional, and yes it is annoying to architect for abuse, so is replacing the roof every storm. Run health checks from places you do not control, use a CDN with pre negotiated scrubbing, test it on a quiet Tuesday so Friday does not become your horror story.

Short version, then we zoom, someone swung hard at the internet, Cloudflare caught it, and the dust is still settling in the places you only notice when reality stutters. That should bother you, not because the block was wrong, but because the hits keep getting heavier and the answers keep getting narrower. The hopeful bit, we can spread the load, more diverse hosting, sane defaults for egress, community run resolvers with real headroom, municipal fiber that answers to residents not quarterly calls, and blunt transparency so the rest of us can tune defenses without guessing. It is not glamorous, it is plumbing, bien sûr. If you made it this far, congratulations, you now care about BGP and UDP on a weeknight, which makes you exactly the kind of person who can fix your corner, start small, document it, tell a friend.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI