<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">...<br>
<br>
Roland Dobbins wrote:
<blockquote
cite="mid:3a3ecf3e-a2f2-4788-b62a-45c62fcdf86d@email.android.com"
type="cite">
<pre wrap="">
Vernon Schryver <a class="moz-txt-link-rfc2396E" href="mailto:vjs@rhyolite.com"><vjs@rhyolite.com></a> wrote:
</pre>
<blockquote type="cite"><pre wrap="">That you manage to "authenticate" some DNS requests from 10.2.3.4
using TCP, TSIG, or any other scheme IMPLIES NOTHING about other
UDP requests that claim to be from 10.2.3.4.
</pre></blockquote>
<pre wrap=""><!---->
That's true - but, you know, I've been using this mechanism to defeat some pretty serious spoofed DDoS attacks for the last 11 years or so, and it works pretty well, in practice. More granularity is welcome, but in a majority of cases, it's been Good Enough. ...</pre>
</blockquote>
<br>
good enough for point solutions such as ddos-resistance as a service:
yes.<br>
<br>
good enough to be generally deployable by end system operators: no.<br>
<br>
we're talking about different things.<br>
<br>
paul<br>
<blockquote
cite="mid:3a3ecf3e-a2f2-4788-b62a-45c62fcdf86d@email.android.com"
type="cite">
</blockquote>
</body></html>