4 ms·
It's sort of pathetic that our answer to trying to stop DDoS amplification attacks is to cripple public UDP services. It shouldn't be acceptable for an ISP to o
by hueving 11y ago
It's sort of pathetic that our answer to trying to stop DDoS amplification attacks is to cripple public UDP services. It shouldn't be acceptable for an ISP to originate spoofed packets. There is absolutely no excuse for it, yet we continue to accept it as some kind of inevitability and treat symptom after symptom of the same root cause.
- Scaevolus 11y agoCloudflare disables ANY for TCP requests as well, which might be frustrating for debugging. I don't fully understand its usages though, so maybe it's not such a big deal? Forcing large payloads to upgrade to TCP responses is probably a more compatible fix for this in general.
- AndyMcConachie 11y agoBCP38/Anti-Spoofing is a really really hard problem to fix. It may not happen in our lifetimes. There is the MANRS document/routing manifesto, which has been gaining traction. https://www.routingmanifesto.org/ https://www.routingmanifesto.org/ There are other initiatives as well. But the problem is very difficult to solve.
- madsushi 11y agoDo you mean the problem is technically hard or politically hard? From my understanding, it's not too difficult for an ISP to implement, the problem is convincing ISPs to implement it (when many don't care).
- Pharaoh2 11y agoThe problem is technically difficult to solve. The same way deploying IPv6 was.
- devicenull 11y agoIt's also worse, because if you were to deploy BCP38, you don't really get a whole lot from it. Sure, it's a good thing to do, but at the end of the day people aren't going to pick your service because you have BCP38 setup properly.
- Pharaoh2 11y agoPretty sure 99% consumers don't give a shit if their ISPs support end to end IPv6 too.
- hueving 11y agoNo, quite the opposite. Nearly every router has a very simple option to not allow packets from IPs not on the same CIDR as the interface. If ISPs turned this on on each edge interface, the problem would be solved. It's entirely political/economic. There is no incentive for an ISP to do so because it provides no direct benefit. It's a classic issue of externalities.
- deleted 11y ago[deleted]
- darkr 11y agoIn a hostile Internet, where ISPs performing egress reverse path validation is the exception, rather than the rule, public UDP- based services are doomed.
- teddyh 11y agoWith the exception of “discard” (on port 9), of course.
- mindslight 11y agoI can imagine a whole class of neat protocols that would use an incorrect ip_src field to help anonymity. Imagine broadcasting a request for a specific file to an IRC channel, and receiving fountain-coded responses from still-hidden sources. While an explicit address could be designated for this, carriers would rather have control and surveillance voyeurs would have an easier target. It's better to not push to eliminate what end-to-end freedom we still have.