diff --git a/slides/ddos/amp.png b/slides/ddos/amp.png
new file mode 100644
index 0000000..ea8d553
Binary files /dev/null and b/slides/ddos/amp.png differ
diff --git a/slides/ddos/ddos.md b/slides/ddos/ddos.md
new file mode 100644
index 0000000..7287019
--- /dev/null
+++ b/slides/ddos/ddos.md
@@ -0,0 +1,96 @@
+# DDOS attacks
+
+# History
+
+- Operation Chanology 2008
+- Operation Avenge Assange 2010
+- LOIC
+- Mirai botnet 2017
+
+# Distributed vs not distributed
+
+- vulnerability or bandwidth
+- size of target
+- masses against the powerful
+
+# Reverse proxies
+
+- hidding behind Cloudflare
+- MX records
+- masscan with a Host header
+- finding the hosting provider
+
+# Amplification
+
+- open relays
+- nameservers with a big response (AXFR)
+- method of hidding from the target
+- spoofing IP needed, also ends up hiding from the relay 
+- ISPs in Serbia droping them or rewriting them (CGNAT?)
+- don't be stupid
+
+# Amplification
+![Amplification by protocol](slides/ddos/amp.png)
+
+# SYN Flood
+
+![3-way handshake](slides/ddos/tcp.jpg)
+
+# SYN Flood
+
+- spoofing doesn't break the attack
+- defense can be configured, but it decreases relibility
+
+# Other transmission layer attacks
+
+- slow read, small TCP receive window
+- TTL expiry, takes more CPU to drop then to forward
+
+# HTTP/app based
+
+- GET of large assests, URI takes relatively a lot of CPU work
+- slow POST
+- maybe search functions, database intensive work (regex?)
+- Slowloris
+- HTTP pipelining, order of requests, have to keep in memory
+
+# SSL/TLS
+
+- renegotiation
+- flood
+
+# Vulnerability
+
+- all bugs in software are usually a DoS vulnerability
+- most common type of CVE by far
+- any layer bug will break the service, finding the weakest link
+
+# Network recon
+
+- sometimes the weakest link is router
+- reverse proxy
+- DNS server? (ignoring the TTL)
+- anything used before connecting to server
+
+# Guerrilla warfare tactics
+
+- making sure the target uses more resources then the attacker
+- getting broad support from the masses
+- spoofing and being hard to find
+- long term fight. losing battles, but winning the war
+
+# Government DoS attacks
+
+- Autistici/Inventati shutdown, censorship with excuse of terrorism
+- Financial derisking isolation, sanctions with excuse of derisking
+- State sponsored flood attacks
+- Arrests, attacking the person behind the service, TPB, Wikileaks
+
+# Conclusion
+
+- don't be afraid, but be careful
+- protest menatality, don't give up, don't let them rest
+- long term results, can't win in a day
+- organize, A/I call for a network called Resistance
+- don't pretend politics have nothing to do with it
+- fight your enemy, not theirs, public support
diff --git a/slides/ddos/tcp.jpg b/slides/ddos/tcp.jpg
new file mode 100644
index 0000000..58e0d86
Binary files /dev/null and b/slides/ddos/tcp.jpg differ