3 ms·

There are extremely good reasons to cap consumer upload bandwidth. For example, the majority of DDOSes start from consumer machines, not servers: enormous DDOS

There are extremely good reasons to cap consumer upload bandwidth. For example, the majority of DDOSes start from consumer machines, not servers: enormous DDOSes become trivial even without a botnet without capping (and part of the reason enormous DDOSes are becoming more common is relaxation of upload bandwidth restrictions--let's not beat around the bush).

jacquesm 11y ago
What an incredibly crappy reason. That's the 'net' analogy of 'but what about the terrorists'. If such DDOSes are that much of a problem the correct response is to have better mitigation and/or detection processes in place not to limit the normal use of the net. By that reasoning we should disallow broadband entirely.
- Jweb_Guru 11y ago
  Are you familiar with DDOS attacks? Current mitigation strategies are literally "have more bandwidth than they do" and null routing. Given that null routing effectively means people have accomplished their goal of bringing down a site, the only way to mitigate that is to not allow DDOSers to acquire enormous amounts of bandwidth. It's true that a lot of the biggest issues would be mitigated if ISPs would consistently perform packet ingress filtering, fix open DNS resolvers, etc. But to act like this is an easy infrastructure problem is to ignore the technical challenges inherent in the problem.
  - jacquesm 11y ago
    > Are you familiar with DDOS attacks? No, I'm a clueless newbie who can't tell a twinax cable from a RAM chip. > Current mitigation strategies are literally "have more bandwidth than they do" and null routing. I think you may be behind the times a bit. It is definitely not an 'easy problem' but it is also not so simple as to get rid of symmetrical net access at the consumer level. Anyway, you're the guru I guess.
    - Jweb_Guru 11y ago
      > I think you may be behind the times a bit. Elaborate. I may well be behind the times. > It is definitely not an 'easy problem' but it is also not so simple as to get rid of symmetrical net access at the consumer level. No, it isn't. But it's also true that you need 10x more machines with a 10x disparity for a volumetric attack.
- norea-armozel 11y ago
  That's a bandage on a broken limb approach. The problem is that we have naive routing protocols that trust every packet received. The various BGP fiascoes have shown that we need to rewrite the routing protocols with the assumption of distrust. Until that happens DDoS will always be the pain in the butt that's always been.
  - pyvpx 11y ago
    which is cheaper, uRPF everywhere or re-writing everything (aka forklift upgrade). my gut says the former and not the latter. I could be wrong.
    - caskance 11y ago
      You sound like the kind of person who also thought everyone would voluntarily move to IPv6 in a timely manner.

jacquesm 11y ago

What an incredibly crappy reason. That's the 'net' analogy of 'but what about the terrorists'. If such DDOSes are that much of a problem the correct response is to have better mitigation and/or detection processes in place not to limit the normal use of the net. By that reasoning we should disallow broadband entirely.

Jweb_Guru 11y ago
Are you familiar with DDOS attacks? Current mitigation strategies are literally "have more bandwidth than they do" and null routing. Given that null routing effectively means people have accomplished their goal of bringing down a site, the only way to mitigate that is to not allow DDOSers to acquire enormous amounts of bandwidth. It's true that a lot of the biggest issues would be mitigated if ISPs would consistently perform packet ingress filtering, fix open DNS resolvers, etc. But to act like this is an easy infrastructure problem is to ignore the technical challenges inherent in the problem.
- jacquesm 11y ago
  > Are you familiar with DDOS attacks? No, I'm a clueless newbie who can't tell a twinax cable from a RAM chip. > Current mitigation strategies are literally "have more bandwidth than they do" and null routing. I think you may be behind the times a bit. It is definitely not an 'easy problem' but it is also not so simple as to get rid of symmetrical net access at the consumer level. Anyway, you're the guru I guess.
  - Jweb_Guru 11y ago
    > I think you may be behind the times a bit. Elaborate. I may well be behind the times. > It is definitely not an 'easy problem' but it is also not so simple as to get rid of symmetrical net access at the consumer level. No, it isn't. But it's also true that you need 10x more machines with a 10x disparity for a volumetric attack.
norea-armozel 11y ago
That's a bandage on a broken limb approach. The problem is that we have naive routing protocols that trust every packet received. The various BGP fiascoes have shown that we need to rewrite the routing protocols with the assumption of distrust. Until that happens DDoS will always be the pain in the butt that's always been.
- pyvpx 11y ago
  which is cheaper, uRPF everywhere or re-writing everything (aka forklift upgrade). my gut says the former and not the latter. I could be wrong.
  - caskance 11y ago
    You sound like the kind of person who also thought everyone would voluntarily move to IPv6 in a timely manner.