Hacker News Reader

Comment by hueving | Hacker News Reader

It's sort of pathetic that our answer to trying to stop DDoS amplification attacks is to cripple public UDP services. It shouldn't be acceptable for an ISP to originate spoofed packets. There is absolutely no excuse for it, yet we continue to accept it as some kind of inevitability and treat symptom after symptom of the same root cause.

View on HN

Cloudflare disables ANY for TCP requests as well, which might be frustrating for debugging. I don't fully understand its usages though, so maybe it's not such a big deal?

Forcing large payloads to upgrade to TCP responses is probably a more compatible fix for this in general.

BCP38/Anti-Spoofing is a really really hard problem to fix. It may not happen in our lifetimes. There is the MANRS document/routing manifesto, which has been gaining traction. https://www.routingmanifesto.org/

There are other initiatives as well. But the problem is very difficult to solve.

Do you mean the problem is technically hard or politically hard? From my understanding, it's not too difficult for an ISP to implement, the problem is convincing ISPs to implement it (when many don't care).

The problem is technically difficult to solve. The same way deploying IPv6 was.

No, quite the opposite. Nearly every router has a very simple option to not allow packets from IPs not on the same CIDR as the interface. If ISPs turned this on on each edge interface, the problem would be solved.

It's entirely political/economic. There is no incentive for an ISP to do so because it provides no direct benefit. It's a classic issue of externalities.

It's also worse, because if you were to deploy BCP38, you don't really get a whole lot from it. Sure, it's a good thing to do, but at the end of the day people aren't going to pick your service because you have BCP38 setup properly.

Pretty sure 99% consumers don't give a shit if their ISPs support end to end IPv6 too.

I can imagine a whole class of neat protocols that would use an incorrect ip_src field to help anonymity. Imagine broadcasting a request for a specific file to an IRC channel, and receiving fountain-coded responses from still-hidden sources.

While an explicit address could be designated for this, carriers would rather have control and surveillance voyeurs would have an easier target. It's better to not push to eliminate what end-to-end freedom we still have.

In a hostile Internet, where ISPs performing egress reverse path validation is the exception, rather than the rule, public UDP- based services are doomed.

With the exception of “discard” (on port 9), of course.

Reply on news.ycombinator.com