Hacker News Reader

There's an even simpler solution I've used ever since I became aware of the first amplification attacks during the 00s: either implement your own simple 3wh, or if you really want a simple request/reply protocol with no state associated, pad the request so it matches the reply in size. Sometimes your reply is large though and needs a couple dozen packets so then you're usually forced to use the first solution.

View on HN

I suggested the certificate solution but it's far from being lightweight. I found a simpler solution that may fit some use cases.

The client sends a request, the server returns a response that may be big that also contains a random value. The client must return this random value in a thank you message.

If the server doesn't receive the thank you message, it slows down responses to that ip address and eventually blacklist it if it's repeated.

From the client perspective, the answer is obtained in one round trip time. The price to pay on the server is the need to keep track of the expected thank you messages, and the throttled or blacklisted addresses.

Reply on news.ycombinator.com