It is the fragility of the TCP/IP infrastructure relative to DDOS attacks that is the problem.
I would love to hear about DDOS resilient service architectures that don't require something like Cloudflare.
I would love to hear about DDOS resilient service architectures that don't require something like Cloudflare.
It turns out that there's actually a ton of academic research on a number of very promising techniques, in addition to the approaches I'm hoping to develop.
I see the issue more as UI/UX/ease of use/cost of adoption. Right now a lot of approaches you could probably defend a Ph.D. on the topic. They need to instead become approaches developers choose because it's the easiest and most cost-effective way to deliver a high-quality service.
Three of the most important: * Blockchains * Protocol-level anti-DDoS changes (protocols specifically designed to make them less suitable for use in in DoS) * https://en.wikipedia.org/wiki/Content_centric_networking
My gut says that real solutions to DDOS problems are going to have to come from new approaches to networking in general and not just tweaks to TCP/IP or throwing massive amounts of infrastructure at the problem.
But I would point out a subtle distinction: I believe TCP/IP and DNS provide an adequate building block for what needs to happen in a backwards-compatible progressive enhancement way.
I distinguish this from IPv6 which - because of how we chose to implement it - has created a ton of chicken-egg issues with the incentives for adoption.
I know there are a lot of sheep to be shorn in the centralized httpasture, but that shouldn't prevent us earnestly appraising how various technologies effect society.
It could work of course for very restricted applications, like software updates, but general, unfiltered web? No thank you.
Unless you're thinking of lots of content mirroring services where you can publish your mirrored content... but then, what's the difference from cloudflare?
The difference is in the namespace of those protocols. Rather than just reusing L4 addresses, they create addresses that are conducive to decentralization.
The problem with site mirroring services is once again fundamentally comes down to the naming. Either the site operator has to setup and incorporate the mirrors, or site visitors have to discover and visit each mirror manually. There is no middleground where you can ad-hoc casually ask a peer for a copy and have the exact same functionality.
Yes, it is non-trivial to setup, but if you need it, then automating this part may be more trivial than getting clients to switch to a new protocol.
Some possible general alternatives:
- Wait to retrieve from publisher directly, never from third party cloud services
- Ask friends, if this conforms to their privacy goals. Perhaps via store-and-forward mix.
- Ask public altruistic peers.
- Ask for-profit "cache providers".
- Retrieve from multiple independent cloud service(s) using a technique such as PIR