Realistically (or perhaps otherwise), what can Americans without enough money to lobby individually, do to prevent the FCC acting against our greater good, especially in the face of evidence that they are maliciously acting against the greater good? I have already called all of my senators and congressfolk, as well as written the president (for all that will do). This does not feel effective.
They claim that because the FCC uses Akamai as a CDN, that the FCC is immune from DDOS attacks. The FCC comment section is heavily reliant on a database, and you could simply overwhelm the database to DDOS that site. I would bet it is unlikely that the FCC utilized a cache for the queries.
I too think that the DDOS is bollocks but I wouldn't go so far as to describe the reddit comment as flawed - MNGrrl presents quite a lot of additional evidence alongside the Akamai assertion. If you have some spare time it is worth reading/skimming the rest of the reddit thread. Whilst you are at it, look at the posting history of the highly rated commentators for some contextual bias hints. Follow links as well and lose a lot of time 8)
On balance the official story really does not stack up and I think a fully tooled up investigative journo could tear the FCC to pieces if given enough time and motivation to dot the Is and cross the Ts. The keyword there is motivation ...
But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection.
At what point did the government become a special interest group which does not exist to protect the nation it serves? Providing good security advice is their job.
Even if they do have some super secret techniques, keeping them secret is not a strategy, it's what idiots who don't know anything about technology or computers or network security would do.
I would trust Cloudflare's staff over the FCC's I.T. department every day of the week, and I hate Cloudflare.
As a constitutionalist, the real problem as I have condensed it is that the balance between providing for the common defense has completely overshadowed things like securing the blessings of liberty. Our gov is increasingly leaning authoritarian, and the populace has allowed it.
That aside, I would agree with you.
The primary purpose of cloudflare is to hide the IP address of the server and filter packets on IP level. It does not magically protects from any attack, especially on application level.
It is wrong to assume that there is a universal automatic solution against DDOS. Neither CDN nor Cloudflare nor REST API (how?) can help with this.
There is a complex regex search that the site uses to find copies of "the comment" – I was shocked how many of my family members (not with their actual addresses, but names of actual members of my family) filed brief comments that start out "The unprecedented regulatory power the Obama Administration imposed on the internet is smothering innovation, damaging the American economy and obstructing job creation."
Presumably the text is varied in order to hamper the efforts of people like Comcastroturf that are trying to help quantify the number of these fraudulent comments that were filed.
I have no idea if the volume of these type of comments are enough to constitute a "DoS" attack, let alone DDOS, but the scale is quite grand.
I was shocked how few names I had to try before I found copies of "the comment" in filings in the names of many members of my family. Maybe about 50% hit rate. Higher with a common name.
The news coverage of this campaign was back in May, but the campaign continued on into July at least.
In all seriousness, my research following the DDOS/astro-turfing campaign led me to at least some of the astro-turfing being the result of efforts by the Center for Individual Freedom a far right-wing political operation masquerading as a non-profit.
There's an entire shadowy layer of questionable "public advocacy" groups out there tied to unquestionably partisan organizations. And sometimes even the political parties themselves.
The Center for Individual Freedom for example has received monies from Crossroads GPS, which is Karl Rove's umbrella organization for disbursing funds raised nationally to further the extreme agenda of the American right-wing and its financial backers, whether that be Putin or the Kochs.
It's pretty clear that he's trying to pull the wool over our eyes and because the tech press has gone from being actual journalists to just eating up PR pieces and worrying about access so much that they refuse to do any real investigations, we're left with no one who appears credible to the public to actually do the investigation and publicize the wrong-doing.
Alternatively you can usually let Akamai or similar advertise your IPs, and let them help with the load, but ultimately that's just distributing traffic to more devices so you can still check IPs against a blacklist.
Since we're talking about the availability aspect of security, there is hopefully no obscurity involved (confidentiality on the other hand is nothing but obscurity). And really, an obscurity technique like using alternate ports won't even help you much because that still hits your firewall and requires processing on each packet.