Hacker News Reader

Comment by NetStrikeForce | Hacker News Reader

Kudos to both Krebs and Google for their courage. I have profound admiration for Brian's work and Google's technology.

I didn't know about Project Shield and I think it's an interesting initiative. However, for some reason it leaves me a bit unease (not as much as the idea of being taken down by a 650Gbps DDoS at will!) - not sure what it is, but we might be moving towards an Internet where only the "approved" would have "free" speech.

I really hope ISP naming and shaming takes over, so we can make DDoS a little bit more difficult.

View on HN

> I really hope ISP naming and shaming takes over, so we can make DDoS a little bit more difficult.

I think naming and shaming would have little impact and whatever impact it did have would be short lived. Consumers tend to have short attention spans and zero long term memory. Take the banking/finance industry for example, were egregious, predatory and at times criminal tactics are par for the course. Banking institutions are named and shamed all the time, yet the Bank of Americas, Wells Fargos and Goldman Sachs of the world still exist.

From what I hear about the US, many people there don't even have any alternative ISP to change to...

Also changing a service provider often can be a huge inconvenience for one. For instance, if I were to learn today that my ISP makes DDoS very easy and doesn't care about the issue, I'd have a choice between one or two random small providers I don't know, and two big telecom operators that are already on my "do no ISP-related business with" list due to their annoying telemarketing.

It's also fairly standard to suffer 1-2 weeks of outages when changing ISP's, which is somewhere between unwelcome and prohibitive for a lot of people. Worse, even places with "competitive" markets often have only one provider giving decent speeds - 1-5 Mbps maximum is not a realistic option for a lot of uses.

The banking industry is heavily regulated, and getting more so. Described criminal tactics as being "par for the course" is not true.

Also, regular consumers have little recourse against large banks for many reasons (e.g many consumers have little direct contact or influence with investment banks), which is who it is up to governments and regulators. ISPs are similar in some ways, but are way more consumer controlled.

There would be no DDoS if computers connected to the internet were secure

> if computers connected to the internet were secure

"Secure" and "Internet-connected" are generally understood to be mutually exclusive.

There were prior systems designed to be effectively immune to many forms of code injection or DOS from external input. They used tagged CPU's, verified protocols, separation kernels, app-level firewalls on PCI cards, etc. Many were connected to the Internet without any reported breaches.

They're mainly mutually exclusive in the common case due to lack of adoption of high-assurance techniques for security. Hell, even medium that knocks out low-hanging fruit doesn't usually get adopted. So, the problems we see were an inevitable result for all the mainstream stacks and security tech.

Reply on news.ycombinator.com