4 ms·
You need to have application-level checksums anyway, since pretty much every router or switch these days will recalculate checksums on all layers (they need to
by Sesse__ 5y ago
You need to have application-level checksums anyway, since pretty much every router or switch these days will recalculate checksums on all layers (they need to if routing the packet, and since pretty much all COTS chipsets can do L3, they do so all the time even if the switch's software won't let you configure it), so if a bit flips in any router's processing, your checksums won't detect it.
- mprovost 5y agoSure but that means rewriting every application. There was a mind blowing Defcon presentation a few years ago "Bit-squatting: DNS Hijacking Without Exploitation" by Artem Dinaburg where they registered a bunch of domains that were one bit off from well known cloud providers, and recorded all of the requests that leaked out of their internal networks when the DNS response had a bit flipped. That's not to say that you're going to have a huge DNS response, but there is already some amount of this going on at every level of the stack and unless you rewrite every application from DNS on up to check then you're still going to encounter errors.
- Sesse__ 5y agoWell, use TLS and every TCP-using application is already secured.