Hacker News Reader

As soon as it's on the general Internet, any ill-meaning enemy can just force the VPN endpoints offline by blasting them with junk traffic.

View on HN

That can be mitigated effectively in this case using an IP whitelist. All unrecognized traffic can simply be dropped.

...Until they switch to a bandwidth exhaustion attack.

True, saturating all routes to a host is quite feasible, but with sufficient redundancy (say with multiple PTP wireless links, which can be done quite cheaply) you'd have to knock the Internet out in such a huge area we'd be talking about WW3.

There's no argument that a private line is ideal for critical infrastructure, but if they must make do, there are ways to make it work.

People managed to shoot Wikipedia off the Internet as recently as 2019.

Anyone not behind one of the major CDNs can be targeted and taken down. And bandwidth-exhausting a few routers in front of the target is certainly possible, it's just not profitable for cybercriminals - but for a nation-state? No problem at all to muster a few terabit/s of capacity for them.

Reply on news.ycombinator.com