43 ms·
Because it's an attack on fundamental physical resources, rather than on any technological feature. There are exactly two workarounds: Minimize processing of p
by ori_b 11y ago
Because it's an attack on fundamental physical resources, rather than on any technological feature.
There are exactly two workarounds: Minimize processing of packets that you think are coming from the attackers, and have more servers.
Asking why we haven't solved DDOS is kind of like saying "Why can't we cure decapitation? We've got all of these new antibiotics!"
- brongondwana 11y agoNot even more servers - fatter pipe. We are using less than 1% of the inbound capacity of our connection in normal operation, yet the attackers easily filled it. The firewalls that we are running were easily able to absorb the additional traffic. Neil's metaphor of the post office was quite accurate - even in the heaviest attack, when we didn't have upstream DDoS protection turned on, about 10% of user traffic was getting through just fine - it's just that a random 10% of traffic makes for a very poor TCP experience.