<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body text="#000000" bgcolor="#FFFFFF"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:7451196C-0357-4698-AE79-B741F922E4B8@vpnc.org" type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="paul.hoffman@vpnc.org" photoname="Paul Hoffman"
src="cid:part1.02070001.09000608@redbarn.org"
name="compose-unknown-contact.jpg" width="25px" height="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:paul.hoffman@vpnc.org"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Paul Hoffman</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Wednesday,
February 11, 2015 7:50 AM</span></font></div></div></div>
<div style="color: rgb(136, 136, 136); margin-left: 24px;
margin-right: 24px;" __pbrmquotes="true" class="__pbConvBody"><div><!----><br>"Better"
for whom? If some of the root server operators run RRL, all they are
doing is causing the DDoS purveyors to switch to the other root server
operators. If that happens, and then all of the root server operators
feel that they have to run RRL, the attackers simply add ten lines of
code to spread the load across all the root server operators at just
below the threshold.<br></div></div>
</blockquote>
<br>
there are many bypasses better than that one.<br>
<blockquote style="border: 0px none;"
cite="mid:7451196C-0357-4698-AE79-B741F922E4B8@vpnc.org" type="cite">
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody">
<div><br>This feels like another poorly-thought-out experiment on
the live operating DNS with, as usual, insufficient data about the
experiment being collected. If I'm wrong, and your number of "25/sec" is
based on analysis and data, it would be great for you to share it here.</div>
</div>
</blockquote>
<br>
25/sec will not be enough for large rdns plants. that's why the default
policy for slip and drop is so important. f-root's team must have
overridden those, probably because various people have spread some FUD
about drops.<br>
<br>
this work came out of ddos work not dns work. after the tenth
anniversary of SAC004 came and went, with more rather than fewer edges
lacking SAV. 25/sec of signed nxdomain is enough to overload any DSL
circuit. i'd be happy to work with you to find an upper limit. this is a
zero sum game; we're deciding who feels the pain from the unprotected
edge.<br>
<br>
<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>