SECURITY HYGIENE DURING ANNOUNCEMENTS

[Itsapov]

I want to raise a concern about operational security in the recent status updates.

Transparency during incidents is appreciated, but the last few posts have exposed details that should be internal only.

Specifically:

1. Provider name and datacenter location
2. Hardware status and upgrade timeline
3. Mitigation methods and proxy architecture
4. Minute-level attack windows that let an attacker measure what worked and what didn't

None of this information helps users. All of it helps attackers. Keep in mind that every public post is read by the adversary too.

Users need two things from a status update:
1. Reassurance that the team is actively working the problem.
2. A rough ETA for resolution. (if it does not enable another attack)

That's it. No infrastructure specifics required for credibility.
I'd recommend pulling the operational details from the existing posts as well. Even after an incident winds down, those details remain searchable and useful to copycats.

<Edit_1> "It's technically discoverable" and "we confirmed it publicly" are different threat levels.
Recon still takes time and has a cost. Free confirmation eliminates it. </Edit_1>

Please keep your cards closer to your chest.

For what it's worth, I loved Turtle WoW and want to see Octowow thrive. If the team wants another set of eyes on the mitigation approach, I'm happy to help where I can.

[Rainy]

Yes I 100% stand by this, we only need ETA's not that much information, I want Octo to be safe

[Defiant]

A single ping would show that information. You're acting like they revealed some kind of secret information. They didn't.

[Itsapov]

A ping gives you an IP and RTT. Not any of the following.
But that's also besides the point. There is no benefit to spelling any of this out in public.
None of it helps users. All of it helps attackers.

What I refer to:

https://octowow.st/forum/viewtopic.php?t=2188

They posted logs from an attack timeline.

An attacker correlates those timestamps against their own C2 logs and gets a direct feedback loop:
how long each vector ran before it stopped being effective, and whether the response is manual or automated.

https://octowow.st/forum/viewtopic.php?t=2204

Tells the attacker: The mitigation architecture (TCP proxy, temporary, provider-dependent).

https://octowow.st/forum/viewtopic.php?t=2247

They posted a screenshot of internal support correspondence from FlokiNET, broadcasting that parts are missing and in transit.

Now they have a estimation window on how long a cheap stresser service is sufficient before they'd need to escalate to something that can punch through upgraded hardware.

Again, the point is "there is no benefit in sharing"

[Hfm1]

Take op´s advice and stop giving us information.

All i want to know is can u get the server stable in a overseeable timeframe or not.

[Gibom]

yes

[Trusty420]

Take op´s advice and stop giving us information.

All i want to know is can u get the server stable in a overseeable timeframe or not.

This honestly, i kept thinking the same, they give out way too much detail the potential attackers can use against them.

Keep up the good work, we will not give up on this server!
There will be a day where we get past these constant attacks but until then, the community needs to stay strong and not give in and jump ships.

Stay persistent guys, we will get through it eventually!