Comment by willholloway | Hacker News Reader

Comment by willholloway | Hacker News Reader

Parent Full thread

Could we not solve the problem of DDOS through collaboration between hosts and ISP's?

1) DDOS attack is detected 2) Attacking IP addresses are sent automated DDOS abuse notifications 3) ISP, like your credit card company when it's machine learning algos detect fraud ask for human back channel verification like SMS. 4) ISP notifies user of suspected bot on one of their devices. The onus is put on the user to run a secure network and remove or fix offending devices.

This system could work well for residential connections at least.

It could be implemented similarly to the way spam is handled by the internet, bad neighborhoods and networks that don't self police are treated as second class citizens.

> It could be implemented similarly to the way spam is handled by the internet, bad neighborhoods and networks that don't self police are treated as second class citizens.

Please no, the way spam is handled on the internet means that anyone who isn't already a massive internet company is usually treat as a second class citizen

On second thought, agreed. I hope that is not part of the solution.

I think that our routers may be the key, or are at least completely negligent at the moment.

A normal consumer router is essentially a black box, but it should be a watchdog. The router should alert users when suspect outbound traffic is originating from it's network.

Of course the router could be compromised, and router patch cycles are atrocious generally, but this method could notify in case of hacked IP cameras and thermostats.

ISPs do this for bittorrent, I imagine similar things could be set up for DDOS attacks. A little message from the ISP like "hey, you were sending out some DDoS stuff, please check your devices."

This. But with ISP procedures mandated by governments, with international synchronization of rules.

This already works well for medicine, aviation, telephone systems, transit signaling, and a huge number of other things. There's no reason to believe this wouldn't work for internet security.

We could start by mandating the network best practices RFC.

Reply on news.ycombinator.com