5 ms·

"Decentralization of core nameserving and smarter caching downlevel so that single modes of failure on internet name resolution doesn't bring entire swaths of t

"Decentralization of core nameserving and smarter caching downlevel so that single modes of failure on internet name resolution doesn't bring entire swaths of the internet down" is what I was thinking. Reflection (UDP) and amplification are problems, sure - we could address those as well.

tedunangst 10y ago
This wasn't an attack against the root servers, so it's unclear what decentralization help. Should Dyn stand up two servers? That sounds like a good idea, but also something they can do themselves.
- jwtadvice 10y ago
  So a proposal here would look like: redundant resolvers with ISPs and routers failing and load balancing between them along with smarter caching strategies on the entire name resolution stack. Getting more academic and speculative with a “pie-in-the-sky” proposal that would remove both privacy and centralization concerns: quorum strategies over a peer-based, differential privacy protected authenticated database seeded by root servers. The point here is that “IoT” isn’t the problem. Thousands of traditional servers can do just as much damage (or more) than thousands of IoT devices in a DDoS. You want to stop attacks that bring down DNS? Fix DNS. You aren’t going to be able to legislate away compromise-likely devices and services. That’s an imaginary solution, and likely to exacerbate other issues (IoT privacy).
  - tptacek 10y ago
    I'm still not clear on how this is a solution. Attackers don't need to target DNS. With massive botnets, they can generate backbone-melting traffic --- which will look identical to legitimate traffic --- without the use of any amplifiers, and which will knock out any service they choose.
    - jwtadvice 10y ago
      This isn't a proposal to stop all DDoS. That's some crazy feature creep you're suggesting. Look, if the purpose is to stop all DDoS, legislating IoT devices won't solve that problem either. You seem to be disqualifying a solution to attacks on DNS because it doesn't solve a problem we aren't trying to solve. I don't get it.
      - tptacek 10y ago
        Sorry. Reset. What problem are we trying to solve, and why that problem next?
        jwtadvice 10y ago
        > What problem are we trying to solve? The problem where DNS providers, such as Dyn, are taken down, leading to outages to large swaths of the internet. > Why that problem next? The recommendation to tackle this problem next is the topic of discussion. Namely, the DDoS letter to Chairman Wheeler. The letter inappropriately confuses fixing this recent outage/attack on DNS with preventing IoT devices from being compromised. My proposal (the high level comment) is to fix the problem being discussed by fixing DNS (making it difficult, as a core internet service, from being DDoSed).

tedunangst 10y ago

This wasn't an attack against the root servers, so it's unclear what decentralization help. Should Dyn stand up two servers? That sounds like a good idea, but also something they can do themselves.

jwtadvice 10y ago
So a proposal here would look like: redundant resolvers with ISPs and routers failing and load balancing between them along with smarter caching strategies on the entire name resolution stack. Getting more academic and speculative with a “pie-in-the-sky” proposal that would remove both privacy and centralization concerns: quorum strategies over a peer-based, differential privacy protected authenticated database seeded by root servers. The point here is that “IoT” isn’t the problem. Thousands of traditional servers can do just as much damage (or more) than thousands of IoT devices in a DDoS. You want to stop attacks that bring down DNS? Fix DNS. You aren’t going to be able to legislate away compromise-likely devices and services. That’s an imaginary solution, and likely to exacerbate other issues (IoT privacy).
- tptacek 10y ago
  I'm still not clear on how this is a solution. Attackers don't need to target DNS. With massive botnets, they can generate backbone-melting traffic --- which will look identical to legitimate traffic --- without the use of any amplifiers, and which will knock out any service they choose.
  - jwtadvice 10y ago
    This isn't a proposal to stop all DDoS. That's some crazy feature creep you're suggesting. Look, if the purpose is to stop all DDoS, legislating IoT devices won't solve that problem either. You seem to be disqualifying a solution to attacks on DNS because it doesn't solve a problem we aren't trying to solve. I don't get it.
    - tptacek 10y ago
      Sorry. Reset. What problem are we trying to solve, and why that problem next?
      - jwtadvice 10y ago
        > What problem are we trying to solve? The problem where DNS providers, such as Dyn, are taken down, leading to outages to large swaths of the internet. > Why that problem next? The recommendation to tackle this problem next is the topic of discussion. Namely, the DDoS letter to Chairman Wheeler. The letter inappropriately confuses fixing this recent outage/attack on DNS with preventing IoT devices from being compromised. My proposal (the high level comment) is to fix the problem being discussed by fixing DNS (making it difficult, as a core internet service, from being DDoSed).