Attacked but Still Standing

At Glass, we take your privacy and the safety of your photos seriously. As the community grows, these types of challenges get harder, but thankfully we’ve invested in tools and monitoring systems to make sure Glass is something you can rely on. We’re a tiny team, most days it’s just Stefan keeping watch, but that doesn’t mean we’re unprepared.

This past weekend, we were hit with a large-scale distributed denial-of-service (DDoS) attack. In simple terms, this is when a large number of computers or bots flood a server with far more requests than it normally sees. The goal is to overwhelm the system — either by slowing it down, making it unreachable, or forcing it to waste resources. The traffic was relentless, peaking at millions of requests per hour from hundreds of IPs across dozens of countries. It was over 80x our normal baseline. That’s the equivalent of suddenly having a packed football stadium all trying to hit “refresh” at the exact same second, over and over.

The likely intent was to scrape our content, or to knock us offline, we’ll never know for sure. These attacks often happen for different reasons:

• Disruption: Some attackers simply want to knock a service offline to cause frustration.

• Extortion: Others demand payment to stop flooding the system.

• Denial of wallet: A newer trend is to run up cloud and bandwidth bills — trying to make a service too expensive to operate.

• Masking other activity: Sometimes DDoS is used as “cover fire” while attackers attempt something else in the background.

No matter the motivation, the effect is the same: a flood of fake traffic competes with real users for resources. Left unchecked, this can degrade performance, cause downtime, or create massive costs.

It didn’t work.

Glass stayed online. Photos stayed safe. The community kept on humming. There was no data breach, no user compromise, no downtime. Also, if you’re curious to know more of the details, we have a clear security policy that outlines how we keep your data safe and secure.

Just a lot of noise, and a lot of traffic our systems handled mostly without blinking. It still made for a bunch of work for us sadly, but thankfully members didn’t experience a thing. This isn’t always the case, moments like this can bankrupt startups and bootstrapped companies like ours. Events like this require a lot of planning, and a bit luck. This could have been much worse for us, and we’re thankful we ended up being able to weather this storm.

We’ve been building moderation tools and abuse prevention systems for years now, preparing for exactly these kinds of bad actors. This wasn’t our first rodeo. And while we’ll share more soon about the tools and infrastructure we’re building around content moderation, we’re proud to say our systems for monitoring for these types of attacks, well they worked.

We know that when you pay for a platform like Glass, you’re investing in more than a product — you’re placing your trust in our stewardship. Attacks like these are a reminder that trust needs to be earned every day.

Thanks for trusting us with your work. We won’t stop trying to earn it.