Hacker News Reader

Comment by jacquesm | Hacker News Reader

What an incredibly crappy reason. That's the 'net' analogy of 'but what about the terrorists'. If such DDOSes are that much of a problem the correct response is to have better mitigation and/or detection processes in place not to limit the normal use of the net.

By that reasoning we should disallow broadband entirely.

View on HN

That's a bandage on a broken limb approach. The problem is that we have naive routing protocols that trust every packet received. The various BGP fiascoes have shown that we need to rewrite the routing protocols with the assumption of distrust. Until that happens DDoS will always be the pain in the butt that's always been.

which is cheaper, uRPF everywhere or re-writing everything (aka forklift upgrade).

my gut says the former and not the latter. I could be wrong.

You sound like the kind of person who also thought everyone would voluntarily move to IPv6 in a timely manner.

Are you familiar with DDOS attacks? Current mitigation strategies are literally "have more bandwidth than they do" and null routing. Given that null routing effectively means people have accomplished their goal of bringing down a site, the only way to mitigate that is to not allow DDOSers to acquire enormous amounts of bandwidth.

It's true that a lot of the biggest issues would be mitigated if ISPs would consistently perform packet ingress filtering, fix open DNS resolvers, etc. But to act like this is an easy infrastructure problem is to ignore the technical challenges inherent in the problem.

> Are you familiar with DDOS attacks?

No, I'm a clueless newbie who can't tell a twinax cable from a RAM chip.

> Current mitigation strategies are literally "have more bandwidth than they do" and null routing.

I think you may be behind the times a bit.

It is definitely not an 'easy problem' but it is also not so simple as to get rid of symmetrical net access at the consumer level.

Anyway, you're the guru I guess.

> I think you may be behind the times a bit.

Elaborate. I may well be behind the times.

> It is definitely not an 'easy problem' but it is also not so simple as to get rid of symmetrical net access at the consumer level.

No, it isn't. But it's also true that you need 10x more machines with a 10x disparity for a volumetric attack.

Reply on news.ycombinator.com