4 ms·

Ingress filtering really is not a big deal, and has been supported by all routing edge hardware/software for 15 or 20 years now. The fact it isn't implemented

• sanderjd 9y ago
  I think you're misunderstanding me. It's hard because doing anything is hard at scale. But I'm not saying it shouldn't be done because it's hard. Big companies do this sort of hard stuff all the time. But resources are limited and lots of efforts are competing to be the priority. It is natural that the things that will make or save money for the organization will take priority over things that are just general nice-to-haves. So the question is: how would this affect the bottom line of an ISP? If it wouldn't move the needle much, or would move it in the wrong direction, it's unlikely to get done. This is why I'm saying we need regulatory support - to shift the incentives. A possibility I recently heard about and thought sounded interesting would be requiring certain kinds of companies hold security insurance, and allowing damages for things like DDoS attacks. Then, if the insurance is functioning properly, doing things like this would decrease premiums. Mostly though, I'm just bummed that I don't seem to hear much about any ideas for how to actually attack the problem after things like WannaCry or big data leaks happen. This is clearly a systemic problem, and nobody really seems to be attacking it at that level.