Cloudflare's abuse policies and approach

Re:Cloudflare's abuse policies and approach by greyface- on Wednesday August 31, 2022 @11:32AM (#32663507)

> namely BGP

DDoS attacks would still occur if we used a routing protocol other than BGP. It's not created by BGP, it's created by the fact that the Internet is end-to-end oversubscribed.

[ Parent | on HN ]

Re:Cloudflare's abuse policies and approach by cowtools on Wednesday August 31, 2022 @11:44AM (#32663736)

The weakness in the internet that allows for DDoS is that you can't tell your peers to filter incoming traffic on your behalf, so you need to discriminate on the edge. The attacker still gets to eat up your bandwidth and CPU time.

[ Parent | on HN ]

Re:Cloudflare's abuse policies and approach by greyface- on Wednesday August 31, 2022 @11:47AM (#32663781)

BGP absolutely does allow you to tell your peers to filter traffic before passing it to you. https://www.rfc-editor.org/rfc/rfc7999.html

[ Parent | on HN ]

Re:Cloudflare's abuse policies and approach by cowtools on Wednesday August 31, 2022 @11:51AM (#32663868)

This is just IP-based filtering, which is useless as the attacker can purchase more IP space.

What you need is something like a whitelist-by-public-key or hashcash or something.

[ Parent | on HN ]