3 ms·
> What you say already exists, hell, you can use BGP to distribute ACLs But you should own an AS for that? > But it costs space in the routing tables Not imp
by codedokode 3y ago
> What you say already exists, hell, you can use BGP to distribute ACLs
But you should own an AS for that?
> But it costs space in the routing tables
Not implementing my proposal leaves critical infrastructure unprotected from foreign attacks. Make larger routing tables. Also, instead of blocking single IPs one can block /8 or /16 subnets.
- CountSessine 3y agoMake larger routing tables. Brilliant! Why didn’t we think of that?!? MOARE TCAMS!!!
- codedokode 3y agoif Cloudflare can do this on commodity hardware (stop attacks and block thousands of IPs), then router manufacturers who have custom hardware can do much more. Also, in Russia for example, there is DPI inspection and recording of all Internet traffic and if it is possible in Russia, then West can probably do 10x more. Simply adding a blacklist on routers seems like an easy task compared to DPI inspection.
- codedokode 3y agoThis can be made on a paid basis. For example, for $1/month a customer gets a right to insert 1000 records (block up to 1000 networks or IPs) into blacklist on all Tier-1 ISPs. For $100/mo you can withstand an attack from 100 000 IPs which is more than enough and Cloudflare goes bankrupt.