I am not quite convinced by the arguments with which the attack is downplayed here. I think this explanation is biased too much towards attackimg short lived HT

I am not quite convinced by the arguments with which the attack is downplayed here. I think this explanation is biased too much towards attackimg short lived HTTP connections. Not all TCP connections are short lived. It might also be possible to spoof DNS replies with some guessing (if the VPN endpoint is associated with a known public provider, the DNS server is likely known as well).