I personally would rephrase it an instead say: "any developer building protocols on top of UDP has the responsibility to appropriately handle the various atta

I personally would rephrase it an instead say: "any developer building protocols on top of UDP has the responsibility to appropriately handle the various attack vectors which come from udp being "connectionless"" This also means you have to add functionality to avoid various applification attacks against you (e.g. package forging/cloning/reply variations) but also much more important against others caused by you (e.g. you mustn't provide any form of unauthenticated UDP replay server which could be used for amplification attacks, this includes protocols which through bad design can be used as such replay servers even if they are not meant to be such servers). Note that this always stays in the territory of "appropriately". Still this means that developing acceptable protocols on top of UDP if they are meant to be used on the internet (e.g. not just inside of an VPN) is kinda way harder then doing so on top of TCP instead of "simpler" like some of the sources the article refers to argue.