4 ms·

Well, I have a lot, but I don't want this to turn into a dissertation about why I don't like UDP for most things. The biggest red flag to me is that it is triv

by axaxs 7y ago

Well, I have a lot, but I don't want this to turn into a dissertation about why I don't like UDP for most things. The biggest red flag to me is that it is trivial to make the server send sizable packets to clients who didn't ask for them nor want them. Spoofing is not a solved problem, no matter how many times people scream at providers to block it before it gets out. Why isn't there a minimal ACK process up front? I mean, this thing is designed such that it's vulnerable to reflection attacks on -day 1-.

baby 7y ago
UDP is a 4-page RFC that is pretty much a definition of IP with ports. You can easily imagine TCP as a bunch of algorithms on top of UDP. Knowing that I’m not sure what you don’t like about UDP? Amplification attacks and spoofing are taken care of by QUIC, so these are not problems at the moment.
- axaxs 7y ago
  That's a little unfair. When someone tells you something relies on UDP, nobody in their right mind assumes that this person implemented TCP features on top. UDP is simple and quick, and the assumption is that there was a reason they chose that route. AFAICT, QUIC loosely defines a way to do client address validation, but it isn't required! It's worded as 'CAN' and 'MAY' in places, and places outside the spec basically hint that 'oh no! it adds another round trip'. This makes it feel totally bolted on. Why wasn't it required up front? If someone came up to me with this idea of QUIC, the -first- thing I'd tell them is to solve this problem definitively first. The idea seems sound to me, but not if you let everyone turn it off...
  - magicalhippo 7y ago
    > When someone tells you something relies on UDP, nobody in their right mind assumes that this person implemented TCP features on top. AFAIK it's rather common in multiplayer games to do TCP-like features over UDP, as they usually need the UDP features but also need reliable transport for some data, and it's rather tricky to do both UDP and TCP at the same time. See for example https://fabiensanglard.net/quakeSource/quakeSourceNetWork.php https://fabiensanglard.net/quakeSource/quakeSourceNetWork.ph... or https://gafferongames.com/post/reliability_ordering_and_congestion_avoidance_over_udp/ https://gafferongames.com/post/reliability_ordering_and_cong...

by axaxs 7y ago

baby 7y ago

UDP is a 4-page RFC that is pretty much a definition of IP with ports. You can easily imagine TCP as a bunch of algorithms on top of UDP. Knowing that I’m not sure what you don’t like about UDP? Amplification attacks and spoofing are taken care of by QUIC, so these are not problems at the moment.

axaxs 7y ago
That's a little unfair. When someone tells you something relies on UDP, nobody in their right mind assumes that this person implemented TCP features on top. UDP is simple and quick, and the assumption is that there was a reason they chose that route. AFAICT, QUIC loosely defines a way to do client address validation, but it isn't required! It's worded as 'CAN' and 'MAY' in places, and places outside the spec basically hint that 'oh no! it adds another round trip'. This makes it feel totally bolted on. Why wasn't it required up front? If someone came up to me with this idea of QUIC, the -first- thing I'd tell them is to solve this problem definitively first. The idea seems sound to me, but not if you let everyone turn it off...
- magicalhippo 7y ago
  > When someone tells you something relies on UDP, nobody in their right mind assumes that this person implemented TCP features on top. AFAIK it's rather common in multiplayer games to do TCP-like features over UDP, as they usually need the UDP features but also need reliable transport for some data, and it's rather tricky to do both UDP and TCP at the same time. See for example https://fabiensanglard.net/quakeSource/quakeSourceNetWork.php https://fabiensanglard.net/quakeSource/quakeSourceNetWork.ph... or https://gafferongames.com/post/reliability_ordering_and_congestion_avoidance_over_udp/ https://gafferongames.com/post/reliability_ordering_and_cong...