Oh, perhaps we should have gone into it in more detail, but this is a direct consequence of the architecture of IETF MASQUE. It's not a VPN tunnel of the classi

Oh, perhaps we should have gone into it in more detail, but this is a direct consequence of the architecture of IETF MASQUE. It's not a VPN tunnel of the classic sort. Instead it's nested HTTPS-based proxying of E2EE TLS streams. The reason UDP is a risk to Fastly in that context is that their infrastructure can be instructed in connection requests to create non-congestion-controlled streams to arbitrary destinations, and they have a lot of bandwidth at their disposal. We want to put mitigations in place to prevent use of this infrastructure for DoS attacks before opening up UDP widely.