4 ms·

The main issue caused by vulnerable devices is that they can be used in DDoS attacks. If there were no attacks, there would be almost no merit to hack those dev

The main issue caused by vulnerable devices is that they can be used in DDoS attacks. If there were no attacks, there would be almost no merit to hack those devices. So why don't we take measures against DDoS attacks instead? What I suggest is to make all Tier-1 ISPs adapt a protocol that would allow any host to block incoming traffic from specific IP/subnet at all upstream providers. So during attack the malicious traffic would be blocked at source network level or at Tier-1 level and never reach the target. Wouldn't networks be more secure in this case? Critical infrastructure like banks or government services would be better protected. Also, middlemen like Cloudflare would become unnecessary. What surprises me is why we use technologies that allow to perform DDoS attacks with mimimun costs. ISPs turn a blind eye to this and route malicious traffic to the victim without trying to stop it. Security updates for IoT devices won't fix this. ISPs are the ones who need to be fixed. Also, if IoT devices were restricted to local network, then outdated firmware wouldn't be a problem too.

NoZebra120vClip 3y ago
> What I suggest is to make all Tier-1 ISPs adapt a protocol that would allow any host to block incoming traffic from specific IP/subnet at all upstream providers. Cool story bro, and this is authenticated and secured, how? What happens when malware starts black-holing Google and Microsoft for all my devices? What happens when a botnet starts black-holding Cloudflare for all their neighbors? You want to prevent a floody-floody DDOS by creating opportunities for another variety of DDOS?
- codedokode 3y ago
  > What happens when malware starts black-holing Google and Microsoft for all my devices? You will send an unblock packet. Well, maybe this protocol should only work for commercial IP addresses, not for residential. > this is authenticated and secured, how? By your source IP address. You can only block traffic to your own IP address.
  - NoZebra120vClip 3y ago
    > By your source IP address. Hey, 1985 called, and they want their authentication methods back.

NoZebra120vClip 3y ago

> What I suggest is to make all Tier-1 ISPs adapt a protocol that would allow any host to block incoming traffic from specific IP/subnet at all upstream providers. Cool story bro, and this is authenticated and secured, how? What happens when malware starts black-holing Google and Microsoft for all my devices? What happens when a botnet starts black-holding Cloudflare for all their neighbors? You want to prevent a floody-floody DDOS by creating opportunities for another variety of DDOS?

codedokode 3y ago
> What happens when malware starts black-holing Google and Microsoft for all my devices? You will send an unblock packet. Well, maybe this protocol should only work for commercial IP addresses, not for residential. > this is authenticated and secured, how? By your source IP address. You can only block traffic to your own IP address.
- NoZebra120vClip 3y ago
  > By your source IP address. Hey, 1985 called, and they want their authentication methods back.