3 ms·

To quote Krebs [1] on that subject: > BCP38 is designed to filter such spoofed traffic, so that it never even traverses the network of an ISP that’s adopted th

by FoeNyx 10y ago

To quote Krebs [1] on that subject: > BCP38 is designed to filter such spoofed traffic, so that it never even traverses the network of an ISP that’s adopted the anti-spoofing measures. However, there are non-trivial economic reasons that many ISPs fail to adopt this best practice. This blog post [2] from the Internet Society does a good job of explaining why many ISPs ultimately decide not to implement BCP38. [1] https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c... [2] http://www.internetsociety.org/deploy360/blog/2014/07/anti-spoofing-bcp-38-and-the-tragedy-of-the-commons/ http://www.internetsociety.org/deploy360/blog/2014/07/anti-s...

LeifCarrotson 10y ago
I read the article. The reasons are trivial. First, old (>10 years) networking hardware may be unable to support it. All new hardware can do it, but some old stuff can't, and some ISPs haven't budgeted for the update. Response: 10 years is forever in the hardware cycle. This isn't a woodworking business, where old heavy iron is a good thing. Sensible businesses budget for returns on investment and mean time between failure on shorter time scales. Second, the labor to install network hardware replacements and perform configuration updates is expensive. Response: That's literally your job, you don't get paid to sit around and collect money. Third, and most importantly, the costs of the DDOS are not felt by the ISP. It's a tragedy of the commons. Response: Regulation, obviously, is required. If your network causes damage that the industry says you should have prevented, you should pay.
- pixl97 10y ago
  ISP > you don't get paid to sit around and collect money. I don't think you understand the purposes of ISPs in the US :)
- beached_whale 10y ago
  Maybe some of the larger providers should stop pairing with these networks? Clean up their acts or have no business
  - shakna 10y ago
    The largest provider in my nation is one of these networks, they don't do a thing until forced my the regulatory body.

by FoeNyx 10y ago

LeifCarrotson 10y ago

I read the article. The reasons are trivial. First, old (>10 years) networking hardware may be unable to support it. All new hardware can do it, but some old stuff can't, and some ISPs haven't budgeted for the update. Response: 10 years is forever in the hardware cycle. This isn't a woodworking business, where old heavy iron is a good thing. Sensible businesses budget for returns on investment and mean time between failure on shorter time scales. Second, the labor to install network hardware replacements and perform configuration updates is expensive. Response: That's literally your job, you don't get paid to sit around and collect money. Third, and most importantly, the costs of the DDOS are not felt by the ISP. It's a tragedy of the commons. Response: Regulation, obviously, is required. If your network causes damage that the industry says you should have prevented, you should pay.

pixl97 10y ago
ISP > you don't get paid to sit around and collect money. I don't think you understand the purposes of ISPs in the US :)
beached_whale 10y ago
Maybe some of the larger providers should stop pairing with these networks? Clean up their acts or have no business
- shakna 10y ago
  The largest provider in my nation is one of these networks, they don't do a thing until forced my the regulatory body.