4 ms·

I guess we're gonna see a lot of these issues over the years. Even TCP still has some novel attack vector for a DoS once a decade or so today, and it is a dinos

I guess we're gonna see a lot of these issues over the years. Even TCP still has some novel attack vector for a DoS once a decade or so today, and it is a dinosaur conceived when the default assumption was that everyone is playing nice on the Internet. Surprising to see that a protocol designed today still allows for such trivial resource exhaustion attacks. And thanks to the protocol living in user space, we're guaranteed that vulnerable implementations will live on for years to come in docker containers, smartphone apps, etc. (Granted in this case it seems not that bad at least for the latter since this affects servers.)

BitPirate 3y ago
I'd argue that the decision to keep it in userspace was the right one. If an application doesn't get security updates, a broken QUIC stack is probably the least of your worries. You also mention Android, which is notorious for having a lot of devices that don't get OS updates because they've reached end-of-life. Protocol ossification at the OS level is also a valid concern. https://http3-explained.haxx.se/en/quic/quic-userspace https://http3-explained.haxx.se/en/quic/quic-userspace
crotchfire 3y ago
Resource exhaustion attacks have gotten much, much worse over the past decade. The "modern" way to do things is to have a connection/session for everything you do. This means state allocation for everything you do, which means resource exhaustion attacks everywhere. It has turned the internet into a fragile mess that can't survive without a godlike cloudflare to sweep all the resource exhaustion attacks under the rug. Hey I know, let's make DNS use TCP! What could go wrong. Bittorrent survives and even thrives in the face of constant active MPAA-funded attacks, because its DHT doesn't use sessions. IPFS collapses under its own weight because it does. Wireguard is the only silver lining in all of this. I think it's the only major sessionless protocol introduced in the last decade. The cookie scheme it uses to avoid sessions is genius (and Rosenpass has an improved version that avoids creating a circular dependency with NTP).
- anacrolix 3y ago
  Amen.

BitPirate 3y ago

I'd argue that the decision to keep it in userspace was the right one. If an application doesn't get security updates, a broken QUIC stack is probably the least of your worries. You also mention Android, which is notorious for having a lot of devices that don't get OS updates because they've reached end-of-life. Protocol ossification at the OS level is also a valid concern. https://http3-explained.haxx.se/en/quic/quic-userspace https://http3-explained.haxx.se/en/quic/quic-userspace

crotchfire 3y ago

Resource exhaustion attacks have gotten much, much worse over the past decade. The "modern" way to do things is to have a connection/session for everything you do. This means state allocation for everything you do, which means resource exhaustion attacks everywhere. It has turned the internet into a fragile mess that can't survive without a godlike cloudflare to sweep all the resource exhaustion attacks under the rug. Hey I know, let's make DNS use TCP! What could go wrong. Bittorrent survives and even thrives in the face of constant active MPAA-funded attacks, because its DHT doesn't use sessions. IPFS collapses under its own weight because it does. Wireguard is the only silver lining in all of this. I think it's the only major sessionless protocol introduced in the last decade. The cookie scheme it uses to avoid sessions is genius (and Rosenpass has an improved version that avoids creating a circular dependency with NTP).

anacrolix 3y ago
Amen.