Belgian ISP under 250 Gbps DDoS for days on end

Re:Belgian ISP under 250 Gbps DDoS for days on end by zrm on Saturday September 18, 2021 @08:13PM (#28580530)

Modern UDP-based protocols handle this in two ways. First, prefer to make responses no larger than the request, so there is no amplification.

Second, if the response has to be larger than the request, send the requestor an address-specific value in a small initial response, e.g. HMAC of a secret and the sender IP. Then any request that incurs a large response has to contain that value. If the sender is spoofing the IP address and can't receive the small response sent to that address, they can't cause a large response to be sent there.

This can't be done with DNS because of "security" middleboxes. They ossify the protocol because they reject anything they don't understand, and they don't understand new versions of the protocol even if both of the endpoints do. So the protocol gets frozen in time and no security improvements can be made because of the things that claim to be there to improve security.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by anakaine on Saturday September 18, 2021 @09:03PM (#28580776)

That sounds like its time to push standards forward, announce deprecations in advance, and have as many end services as possible adopt erroring if what they are receiving isn't standards compliant.

There is little actual reason for security middleware to not keep up.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by exikyut on Sunday September 19, 2021 @03:03AM (#28582291)

Everything is working as intended though: we're talking about security middleware, not security middleware.

This stuff is built on the foundation of puffing out EnTeRpRiSe ScAlE egos with "look at all this vast complexity that I made, I am a god". It's not built on a technical foundation of always moving the needle forward just because you can and because it's cool and the right thing to do.

Sooo, all the $$$ get spent on dashboards and analytics screens and front panel designs and logos and stuff. The actual DNS bits? Probably /r/programminghorror material.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by jfrunyon on Saturday September 18, 2021 @09:48PM (#28580992)

Except that in practice, deprecations don't work, no matter how much warning you give.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by anakaine on Saturday September 18, 2021 @09:54PM (#28581027)

The point of deprecations is to eventually force a bad experience for those who are not keeping up. They definitely do work, but the time periods to affect change can be long. In the tech sphere many seem to interpret a long transition period as not working granted the usual pace of change.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by NullPrefix on Saturday September 18, 2021 @10:21PM (#28581167)

Is IPv4 deprecated already?

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by dnautics on Sunday September 19, 2021 @12:53AM (#28581811)

That's different. There are ways in which ipv4 is subjectively better than ipv6, and "the catastrophe of needing more addresses" has not really panned out yet.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by theblazehen on Sunday September 19, 2021 @03:28AM (#28582402)

> There are ways in which ipv4 is subjectively better than ipv6

Apart from human readability, how so?

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by dnautics on Sunday September 19, 2021 @08:58AM (#28583982)

Some people like that addresses must be masqueraded behind NAT. We've solved how to do p2p through that system.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by Akronymus on Sunday September 19, 2021 @04:45PM (#28587772)

More "solved" than solved IMO. You still need some 3rd party to make the initial connection, for example.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by jfrunyon on Sunday September 19, 2021 @10:52PM (#28589955)

The only way in which IPv4 is better than IPv6 is that many people understand one and not the other.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by ratsmack on Saturday September 18, 2021 @11:14PM (#28581371)

Three years ago Comcast told me they would be rolling out IPv6 to my business account... I'm still waiting.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by rasz on Sunday September 19, 2021 @01:00AM (#28581842)

is Frash depreciated? Tried browsing without ECDSA support lately? It can be done.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by megous on Sunday September 19, 2021 @09:26AM (#28584161)

Resolver software is massively distributed, you don't force anything. The only place that can force anything from the top may be root servers, but even then, many resolver operators are probably just downloading root zone in bulk via https from somewhere to precache it and don't contact root servers at all.

[ Parent | on HN ]