2 ms·
That link is about source port randomization in DNS, which Bernstein was a proponent of and most software implement today. DDoS by DNS is something else entire
by xorcist 11y ago
That link is about source port randomization in DNS, which Bernstein was a proponent of and most software implement today.
DDoS by DNS is something else entirely. The cookies that Bernstein advocate does not help here. Only ingress filtering helps, but it has to be implemented world wide before it useful, and not many bother unless forced to.
That much was well known at the time, and not something Bernstein predicted, but he has argued against adding yet another large record type to DNS. That's a good argument but at the same time not very helpful. The problem here is that there are several other queries with large replies and you just need one for an attack. Then there's all of NTP, and so on.
It's one of those problems likely to get worse before it gets better.