Hacker News Reader

Comment by ajamesm | Hacker News Reader

Wouldn't it be possible to make the economics of DDoS symmetrical by enforcing repercussions at the ISP level?

If 10,000 IPs are syn flooding, all out of one ISP, their peers can stop routing that ISP's traffic until that ISP starts mitigating.

I imagine the biggest impracticality is that ISPs are monopolistic, so if you stop routing someone like Comcast, all of a sudden half of America is offline.

Perhaps we COULD let the internet be the Wild West, if we had a fair selection of providers, or if they effectively self-regulated.

View on HN

Yes. Such things were in my recommendations. You could ensure stuff can always be traced to source (at transport level), filtered, and/or rate-limited. DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening. Simultaneously, supply side starts offering all kinds of options to prevent that which are cheaper than being declared digital version of a public nuisance.

The Tier 1-3's mostly don't care since they're paid primarily to provide the line plus have regulators in their pockets. There's certainly work in these to reduce DDOS a bit for competitiveness but they avoid a simple solution like mine out of greed. ;)

> DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening.

Who would pay? My name is Serhei, and I'm in Ukraine, and I just unleashed a 100k-strong botnet of smartbulbs and babycams. It's spread somewhat evenly across American households, and mostly among their ISPs. I still pay nothing.

The people who connect products or configurations with shit security to the Internet. Bad security has to cost them something before the demand for good security is generated. Just headaches right now but loss of money or Internet is more severe. Then, with a demand, either the hardware/software market or the regulators will start doing something from there. They're already doing something where numerous products exist that were all created by relatively small companies or teams. They'll do a lot more.

> the biggest impracticality is that ISPs are monopolistic

I reckon the biggest problem would be that you could DoS an entire ISP simply by doing a SYN flood attack from inside it.

Sure, until that ISP learned to not let you do that (or at least not to pass it on to the outside world).

Reply on news.ycombinator.com