4 ms·
Modern UDP-based protocols handle this in two ways. First, prefer to make responses no larger than the request, so there is no amplification. Second, if the re
by zrm 5y ago
Modern UDP-based protocols handle this in two ways. First, prefer to make responses no larger than the request, so there is no amplification.
Second, if the response has to be larger than the request, send the requestor an address-specific value in a small initial response, e.g. HMAC of a secret and the sender IP. Then any request that incurs a large response has to contain that value. If the sender is spoofing the IP address and can't receive the small response sent to that address, they can't cause a large response to be sent there.
This can't be done with DNS because of "security" middleboxes. They ossify the protocol because they reject anything they don't understand, and they don't understand new versions of the protocol even if both of the endpoints do. So the protocol gets frozen in time and no security improvements can be made because of the things that claim to be there to improve security.
- anakaine 5y agoThat sounds like its time to push standards forward, announce deprecations in advance, and have as many end services as possible adopt erroring if what they are receiving isn't standards compliant. There is little actual reason for security middleware to not keep up.
- jfrunyon 5y agoExcept that in practice, deprecations don't work, no matter how much warning you give.
- anakaine 5y agoThe point of deprecations is to eventually force a bad experience for those who are not keeping up. They definitely do work, but the time periods to affect change can be long. In the tech sphere many seem to interpret a long transition period as not working granted the usual pace of change.
- NullPrefix 5y agoIs IPv4 deprecated already?
- ratsmack 5y agoThree years ago Comcast told me they would be rolling out IPv6 to my business account... I'm still waiting.
- dnautics 5y agoThat's different. There are ways in which ipv4 is subjectively better than ipv6, and "the catastrophe of needing more addresses" has not really panned out yet.
- theblazehen 5y ago> There are ways in which ipv4 is subjectively better than ipv6 Apart from human readability, how so?
- jfrunyon 5y agoThe only way in which IPv4 is better than IPv6 is that many people understand one and not the other.
- rasz 5y agois Frash depreciated? Tried browsing without ECDSA support lately? It can be done.
- exikyut 5y agoEverything is working as intended though: we're talking about security middleware, not security middleware. This stuff is built on the foundation of puffing out EnTeRpRiSe ScAlE egos with "look at all this vast complexity that I made, I am a god". It's not built on a technical foundation of always moving the needle forward just because you can and because it's cool and the right thing to do. Sooo, all the $$$ get spent on dashboards and analytics screens and front panel designs and logos and stuff. The actual DNS bits? Probably /r/programminghorror material.