Hacker News Reader

Comment by pavel_lishin | Hacker News Reader

For people who won't read the article, it makes it clear that this is just a thought experiment, and offers a lot of reasons why we don't legalize cybercrime.

But one reason that's not mentioned is that it's horribly asymmetric:

> Let me paint a utopian world for you, where all kinds of cybercrime – hacking, ransomware, DDoS, etc. – are entirely legal.

It's much more expensive to defend against a DDoS attack than it is to launch one. Granted, if we did live in a world where cybercrime was legal, and things like IoT cameras were much harder to subvert into a free botnet, it might become more expensive, but in the end a lot more effort would be put into prevention than would be put into cause.

View on HN

Wouldn't it be possible to make the economics of DDoS symmetrical by enforcing repercussions at the ISP level?

If 10,000 IPs are syn flooding, all out of one ISP, their peers can stop routing that ISP's traffic until that ISP starts mitigating.

I imagine the biggest impracticality is that ISPs are monopolistic, so if you stop routing someone like Comcast, all of a sudden half of America is offline.

Perhaps we COULD let the internet be the Wild West, if we had a fair selection of providers, or if they effectively self-regulated.

Yes. Such things were in my recommendations. You could ensure stuff can always be traced to source (at transport level), filtered, and/or rate-limited. DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening. Simultaneously, supply side starts offering all kinds of options to prevent that which are cheaper than being declared digital version of a public nuisance.

The Tier 1-3's mostly don't care since they're paid primarily to provide the line plus have regulators in their pockets. There's certainly work in these to reduce DDOS a bit for competitiveness but they avoid a simple solution like mine out of greed. ;)

> DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening.

Who would pay? My name is Serhei, and I'm in Ukraine, and I just unleashed a 100k-strong botnet of smartbulbs and babycams. It's spread somewhat evenly across American households, and mostly among their ISPs. I still pay nothing.

The people who connect products or configurations with shit security to the Internet. Bad security has to cost them something before the demand for good security is generated. Just headaches right now but loss of money or Internet is more severe. Then, with a demand, either the hardware/software market or the regulators will start doing something from there. They're already doing something where numerous products exist that were all created by relatively small companies or teams. They'll do a lot more.

> the biggest impracticality is that ISPs are monopolistic

I reckon the biggest problem would be that you could DoS an entire ISP simply by doing a SYN flood attack from inside it.

Sure, until that ISP learned to not let you do that (or at least not to pass it on to the outside world).

For me this was just the start of a thought experiment. He didn't take the train past the first station.

At first glance it seems like "Oh if only cybercrime were illegal then companies would have to step up their security practices." But this just isn't true. The companies responsible for the security holes in IoT devices are not the ones who suffer because of the DDoS attacks launched with them.

Similarly, the free market response to the current reality of cyber crime is not for makers of vulnerable devices and software to simply make better products, but it is additional services and companies rising up to fill needs. Some of these are effective and others are not, and they all cost a lot of money for the victims of the attacks, and not for the people making vulnerable products.

For me this blog post was really lazy and needed a lot more thought put into it.

But the same thing applies right now even though cybercrime is a crime.

> It's much more expensive to defend against a DDoS attack than it is to launch one.

Only because there is little incentive to change our infrastructure to mitigate such attacks. If we change to content-based addressing that utilizes pervasive multi-level caching, then every DDoS becomes instantly futile.

Reply on news.ycombinator.com