I know AC I'm replying to was being funny, but major players like Akamai, which only uses multi-tenant data centers and sundry free colo, are also finding the ability to reduce greenhouse gases 90% per bit delivered over the last 6 years.

Argg - I accidentally moderated this point off-topic. Someone please up-vote. This post is to undo my vote. (In my defense my browser was doing some funky pull-down menu flashing.)

Levels of increasing protection:

1. 1. Use a CDN and hope no one finds the origin domain or ips the CDN uses.
   Which as we can see from the article doesn't work due to the many ways they can be leaked.
   E.g., for www.example.com, try origin.www.example.com, ftp.example.com or IPs used in the past for www.example.com.
2. 2. Have the origin servers only respond to white-listed IPs. That white-list needs to include those of the CDN.
   Still suspectible to a volumetric bandwidth attack. I.e., attacks with enough packets to overwhelm the origin server(s) or the ISP link to those servers.
3. 3. Change your origin IPs periodically.
   Useless against a volumetric attack if they are just different IPs connected to the same uplink/router. Difficult to keep switching to use different ISP and each new provider brings its own problems.
4. 4. Have origin(s) capable of withstanding a volumetric attack.
   Not cheap. The XOR DDoS botnet has recently produced DDoS attacks up to 150+ Gbps.
5. 5. Use a BGP redirection service that routes all public internet packets whose destination IP address is the origin's through geo-graphically distributed scrubbing centers.
   Attackers sending traffic through the public internet to your origin are sending them to one of many scrubbing centers. The combined capacity on all these scrubbing centers can cope with volumetric attacks. The scrubbing centers will only forward desireable packets to the real origin using GRE tunneling.

Akamai's BGP redirection service has some restrictions typical of other services. E.g.,

• * A /24 prefix (Class C subnet) at a minimum. It needs to be is registered and belong to customer, as some ISP given not allow re-advertise.
• * A BGP (Border Gateway Protocol) and GRE (Generic Routing Encapsulation) capable router.
• * IP address space to terminate GRE tunnels located outside the prefixes you need to defend.

Yes, the article referenced doesn't point to the actual study directly, a but with a bit of goggling I found:

• Some results here: http://www.measurementlab.net/observatory.
• You can add to the measurements by clicking this link: https://www.battleforthenet.com/internethealthtest/, which says:

  The battleground — where this degradation takes place — is at ISP interconnection points. These are the places where traffic requested by ISP customers crosses between the ISP’s network and another network on which content and application providers host their services.
  This test measures whether interconnection points are experiencing problems. It runs speed measurements from your (the test user’s) ISP, across multiple interconnection points, thus detecting degraded performance.

What I don't understand is why people assume congestion is intentional throttling by ISPs for them to profit later with imagined fast lanes. Isn't the simpler assumption that it costs ISPs money to add interconnection capacity. And since their customers don't/can't choose ISPs based on the quality of their connection all the way to the popular content providers, the ISPs don't spend money on those upgrades? Usually the only thing customers have to go on and promised is the maximum download/upload speeds quoted by the ISP for the last mile.

If you are a windows user, Christian Zeitnitz offers a PC based Soundcard Oscilloscope free for non-commercial use. It also has a frequency spectrum waterfall diagram, x-y plots. Easy to install and run. Fun to speak into your microphone to test it out.

Only suitable audio speed signals like XOScope. I.e., 20-20000Hz from 44.1kHz sampling and 16-bit resolution. And without external hardware voltage dividers/protection the usual warnings about blowing up your soundcard if you feed in voltage outside of ±0.7V into it.

In the second-last paragraph the referenced article says:

Over the years and after doing several security assessments using social engineering techniques, nine times out of 10 we usually get caught when that one person says "I need to call someone about what you're doing."

Is that nine out of the 10 attempts they get caught? A real intruder will not likely even try to break in with a 90% chance of going to jail. Or out of 10 times they get caught, nine are due to this reason?