Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21 • Hacker News Board

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#91

Post by zebraflask » Sat, Oct 22, 2016, 7:07 PM UTC

philiphodgen wrote: post #63

natch wrote: post #60

Earlier quoted context omitted.

You say this as if it is just one device used in these attacks. And as if it will be easy to stroll over to the owner's location and determine the supply chain of that one device. And as if it will be easy to collect from the Chinese manufacturer who probably folded last week and reopened under a different name for completely different reasons.

This is why tort lawyers sue distributors and retailers in the USA. They are here and they have insurance. Once there is a court decision, a rational seller (oh, Amazon hypothetically) will understand that selling fly-by-night small manufacturer items is fraught with peril. The offending items disappear from the marketplace.

I'm starting to think you might have some issues with Amazon. Would you care to elaborate?

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#92

Post by m8y » Sat, Oct 22, 2016, 9:13 PM UTC

TekMol wrote: post #5

I am sure the DDoS problem is something that the free market will sort out. The individual players will make it costly for the other players to send problems their way. I expect a chain of "charge the next node for resource usage" to evolve. If this chain will go all the way to the end user, I don't know. If it will, then end users will probably start using routers that feature restrictions / monitoring / control of…

You don't know how DDoS works.

The coffee machine might only have to send one packet per minute. The combined force of 100 million coffee machines distributed around the globe sending 1 packet per minute each to the same destination means that, in your suggested model, the end user traffic sources barely incur cost at all, while the target and every unrelated third party who happens to be unfortunate enough to be "close" to them are bankrupted.

Congratulations, you've just turned a temporary network DDoS into a permanent financial one.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#93

Post by natch » Sat, Oct 22, 2016, 11:12 PM UTC

philiphodgen wrote: post #88

natch wrote: post #86

Earlier quoted context omitted.

I didn't raise that, because I felt it was a red herring. More importantly, with regulation we would at least have a prayer of making a dent. With lawsuits, not a prayer. It's hard to sue when you don't know what the device is, where it is in the world, whether its IP address is real or not, whether it's behind NAT, who the owner is, who bought it, who distributed it, who the retailer is, who their supplier is, who t…

Who would be the regulator for webcams sold in Uzbekistan? Who would enforce those regulations in Ukraine? I'm not saying regulation is bad. And we have it already. Look at that alphabet soup of little logos in the back of every electronic device you own. I'm just saying regulation is an imperfect solution. Tort law and economic incentives are an imperfect solution. And I am wary of government solutions, even if they…

That's not how it works. They don't design shitty products specifically for sale in Uzbekistan. Off-brand crappy products are typically simply copied from the designs of mainstream products, and the features baked in for the large markets (US) get automatically included. Often times this happens with secret "third" shifts where the factory reports two shifts per day to the main customer that supplied a design for manufacture, and then the third shift is run illicitly and solely for the profit of the factory management / owners. These illicit products are then sole to places where enforcement is sketchy. They don't go and retool the factory for the third shift just to make stuff more crappy.

Yes there are still some crappy products that fall through the cracks. But the rising tide would eventually help lift all boats.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#94

Post by natch » Sat, Oct 22, 2016, 11:14 PM UTC

philiphodgen wrote: post #88

natch wrote: post #86

Earlier quoted context omitted.

I didn't raise that, because I felt it was a red herring. More importantly, with regulation we would at least have a prayer of making a dent. With lawsuits, not a prayer. It's hard to sue when you don't know what the device is, where it is in the world, whether its IP address is real or not, whether it's behind NAT, who the owner is, who bought it, who distributed it, who the retailer is, who their supplier is, who t…

Who would be the regulator for webcams sold in Uzbekistan? Who would enforce those regulations in Ukraine? I'm not saying regulation is bad. And we have it already. Look at that alphabet soup of little logos in the back of every electronic device you own. I'm just saying regulation is an imperfect solution. Tort law and economic incentives are an imperfect solution. And I am wary of government solutions, even if they…

Saying any solution is imperfect is just a waste of breath. Of course that's the case. The point is to move forward with improvements regardless, because improvements, guess what, improve things.