3 ms·
> It is kind of epic how DJB predicted this. That's not how I read the linked essay. The lesson I get from that is that until relatively recently it was trivia
by simoncion 11y ago
> It is kind of epic how DJB predicted this.
That's not how I read the linked essay. The lesson I get from that is that until relatively recently it was trivial to poison DNS responses requested by most DNS servers, and that it's still quite possible if you have a "nearby" malicious machine.
The CloudFlare essay appears to be talking about DDoS attacks via traffic amplification through large DNS queries.
Yes they both involve DNS, but -AIUI- nether DNSSEC nor DNSCurve will fix the problem mentioned in the CloudFlare essay.
Am I misunderstanding either essay?
- StreamBright 11y agoTo be more specific he talks about it here: http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://imgur.com/m6YCyG8 http://imgur.com/m6YCyG8
- simoncion 11y ago> To be more specific... ITYM: "To actually link to a talk where he talks about the topic I thought he was talking about..." ;) But yeah, thanks for the links. That's good stuff.
- StreamBright 11y agoYep, copy paste fail the first link.
- jedisct1 11y agoDNSCrypt works around the amplification problem (for public resolvers) by requiring a UDP query to be at least a big as the response, or the response will be truncated.