4 ms·
This is a refreshing change from cloudflare. Back when recursive DNS was the amplification de jour they complained about DNS instead of IP spoofing. https://bl
by hueving 9y ago
This is a refreshing change from cloudflare. Back when recursive DNS was the amplification de jour they complained about DNS instead of IP spoofing.
https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/ https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-o...
- makomk 9y agoThis is an odd change from Cloudflare. Were it not for the DDoS amplification problem it'd be perfectly reasonable to make recursive DNS servers publicly accessible, but memcached servers should never be exposed to the public internet - they're not designed to be and doing so allows everyone to exfiltrate, modify or delete the cached data which you almost certainly don't want to be possible.
- hueving 9y agoRight, exposing a memcached server is bad because memcached isn't meant to be public. However, in the context of DRDoS discussions it doesn't matter if the UDP service is good for public exposure. That's completely a distraction from the underlying IP spoofing disease that enables attacks on all connectionless protocols.