4 ms·

Also the incentives set by tier ones are completely wrong for the DDoS problem to be solved. Instead of finding ways to isolate and blackhole the offending net

Also the incentives set by tier ones are completely wrong for the DDoS problem to be solved. Instead of finding ways to isolate and blackhole the offending networks - granted that refining this data into small enough ranges would be quite difficult - they instead punish the targets, who are already suffering to begin with. This is mobster mentality. You can bet that if random ISPs ranges would get blackholed when there are missbehaving clients, they would instantly come up with ways to detect and mitigate excessive traffic, net neutrality be damned.

viraptor 3y ago
The problem for ISPs is that they can't really tell who's misbehaving. Does the user do lots of requests to a host? Maybe they're part of DDoS. Maybe they're uploading a file in many fragments. Maybe they have automation for that endpoint setup and the service being down causes repeating request. Maybe ... If the ISP listens to every abuse complaint, we could easily take down most residential ranges by claiming they're part of DDoS on their local Netflix PoP IP.
- mariusor 3y ago
  The ISPs can tell that someone is missbehaving when their upstream informs them their IPs are taking part in a DDoS. This information can trickle down from the tier one that presently just blackholes the victim. Nobody says that infrastructure that was designed in the late eighties can't be improved upon with additional functionality, namely passing top down information about missbehaving network ranges and or IPs. As an ISP you already see devices on your network sending traffic in unusual patters, and when receive the warning that they are part of a DDoS you shut them down. If not, your whole range goes down, etc. Let's add a fourth to the three-napkin protocol.
  - viraptor 3y ago
    Given that right now we can't even verify BGP announcements which are a more critical target, I don't think we can tackle blocking. We'd need a realtime notification system which is not spoofable and has the ability to almost instantly boot anyone off the internet... and it needs to be reachable by nation-controlled ISPs. That's really a massive problem to solve and ensure it's not used for any other purpose. We haven't even established the trust/signing at that level yet. (see the nation-controlled CAs getting booted for spoofing domains)
    - mariusor 3y ago
      All good points, but it doesn't sound impossible. :)

viraptor 3y ago

The problem for ISPs is that they can't really tell who's misbehaving. Does the user do lots of requests to a host? Maybe they're part of DDoS. Maybe they're uploading a file in many fragments. Maybe they have automation for that endpoint setup and the service being down causes repeating request. Maybe ... If the ISP listens to every abuse complaint, we could easily take down most residential ranges by claiming they're part of DDoS on their local Netflix PoP IP.

mariusor 3y ago
The ISPs can tell that someone is missbehaving when their upstream informs them their IPs are taking part in a DDoS. This information can trickle down from the tier one that presently just blackholes the victim. Nobody says that infrastructure that was designed in the late eighties can't be improved upon with additional functionality, namely passing top down information about missbehaving network ranges and or IPs. As an ISP you already see devices on your network sending traffic in unusual patters, and when receive the warning that they are part of a DDoS you shut them down. If not, your whole range goes down, etc. Let's add a fourth to the three-napkin protocol.
- viraptor 3y ago
  Given that right now we can't even verify BGP announcements which are a more critical target, I don't think we can tackle blocking. We'd need a realtime notification system which is not spoofable and has the ability to almost instantly boot anyone off the internet... and it needs to be reachable by nation-controlled ISPs. That's really a massive problem to solve and ensure it's not used for any other purpose. We haven't even established the trust/signing at that level yet. (see the nation-controlled CAs getting booted for spoofing domains)
  - mariusor 3y ago
    All good points, but it doesn't sound impossible. :)