I thought that QUIC used a signed request wrapped in UDP? If it's forged, it should be pretty easy to drop at the application layer, right? Other than that, yo

I thought that QUIC used a signed request wrapped in UDP? If it's forged, it should be pretty easy to drop at the application layer, right? Other than that, you're still open to a volumetric attack, but that's not any different from using 1480 byte TCP SYNs. Small pipes are going to be clogged regardless.