Certificate transparency logs and how they are a gold mine to bug hunters

Re:Certificate transparency logs and how they are a gold min... by Firerouge on Sunday September 09, 2018 @05:11AM (#17945062)

The minor note that his ISP rate limited DNS to 36 or 50 response batches stood out to me. I don't understand why they'd want to do that or how that benefits them.

Is this the sort of targeted traffic shaping net neutrality would prohibit?

[ Parent | on HN ]

Re:Certificate transparency logs and how they are a gold min... by rocqua on Sunday September 09, 2018 @08:52AM (#17945677)

DNS (used to be?) is a great amplifier for DDOS attacks. Because the 'source' address is user supplied, and there are DNS responses that are much larger than the requests. So you can use 1Mb/s of data to send DNS queries with your targets IP as the source address to get e.g. a 10Mb/s stream of data to your target.

Maybe the rate-limiting is an attempt to subvert being used in this kind of DDOS.

[ Parent | on HN ]

Re:Certificate transparency logs and how they are a gold min... by benjojo12 on Sunday September 09, 2018 @05:29AM (#17945109)

He was [likely] using his ISP's or Other providers resolvers, Large bursts of queries are very annoying to deal with, and are very rarely legit ( and more software going wrong )

It's very common to rate limit querying down to some low number to protect the rest of the customers using it

[ Parent | on HN ]

Re:Certificate transparency logs and how they are a gold min... by whoopdedo on Sunday September 09, 2018 @08:50AM (#17945671)

Likely a defense against DDOS.

[ Parent | on HN ]