Hacker News Reader

> namely BGP

DDoS attacks would still occur if we used a routing protocol other than BGP. It's not created by BGP, it's created by the fact that the Internet is end-to-end oversubscribed.

The weakness in the internet that allows for DDoS is that you can't tell your peers to filter incoming traffic on your behalf, so you need to discriminate on the edge. The attacker still gets to eat up your bandwidth and CPU time.

BGP absolutely does allow you to tell your peers to filter traffic before passing it to you. https://www.rfc-editor.org/rfc/rfc7999.html

This is just IP-based filtering, which is useless as the attacker can purchase more IP space.

What you need is something like a whitelist-by-public-key or hashcash or something.

Isn't the issue more with how we implemented IP than BGP? AFAIK, DDoS attacks would be far less effective if every ISP implemented BCP 38.

It's a problem that stop on an corporate level is also hard. Ultimately CDN is the only mitigation.