4 ms·
I think the most crucial functionality missing from a security standpoint, is the ability for one IP address owner to tell another that they're refusing service
by bryans 5y ago
I think the most crucial functionality missing from a security standpoint, is the ability for one IP address owner to tell another that they're refusing service, and the owner of the refused IP being required to filter that traffic at THEIR routing layer. This would effectively eliminate nearly every type of DDoS, and it would also shift the responsibility to handle the attack away from the target's provider, and place it squarely on the providers of the compromised systems -- which is how it should be.
Imagine a world without DDoS or Cloudflare's 3+ second redirect.
- edgyquant 5y ago>the owner of the refused IP being required to filter that traffic at THEIR routing layer What's to stop a malicious actor from just ignoring the refusal?
- bryans 5y agoNamely that an IP "owner" in this scenario could and should also be the participating upstream provider(s) between the requesting IP and malicious actor. If a particular provider isn't participating in the system, the traffic can still be blocked by one that is -- if not blocking the entire range.
- laurent92 5y agoAnd that would also be used in rate-limiting and integrated to apps so no need to implement it manually.