Re:The novel HTTP/2 'Rapid Reset' DDoS attack
by LK5ZJwMwgBbHuVI on Tuesday October 10, 2023 @03:58PM
(#37836701)
We could have prevented the replay/amplification dos attacks that use DNS by making DNS use TCP.
In practice though the only way to "fix" DNS that would've worked in the 80s would've probably been to require the request be padded to larger than the response...
Re:The novel HTTP/2 'Rapid Reset' DDoS attack
by smallnix on Tuesday October 10, 2023 @05:24PM
(#37837749)
But TCP is way more complex
Re:The novel HTTP/2 'Rapid Reset' DDoS attack
by LK5ZJwMwgBbHuVI on Monday October 16, 2023 @04:31PM
(#37906125)
... yeah? I know? "In practice though the only way to "fix" DNS that would've worked in the 80s would've probably been to require the request be padded to larger than the response..."
It's not as complex as some "mutual authentication" scheme though lmao
That feels intuitive in the "less code is less bugs is less security issues" sense but implies that "secure" and "can't be abused" are the same thing.
Related? Sure. Same? No.
Oddly enough, we probably could have prevented the replay/amplification dos attacks that use DNS by making DNS more complex / adding mutual authentication so it's not possible for A to request something that is then sent to B.