World's biggest DDoS attack record broken after just five days

Re: ISPs could mitigate this

So you're able to to fix and happy to be responsible for all the engine management software in your car. You know say the crooked VW stuff? What about manufacturing defects in, say, your tyres?

I have a remote web cam. How am I supposed to know what software it's running, let alone do anything about it?

So NO.

Re: ISPs could mitigate this

@ andyp-random-number

We do it for cars, people have to make sure their car is compliant so as not to be a danger to others, it's called an MOT. While MOTs aren't perfect, at least the responsibility is put onto the owner.

My father use to have this approach to driving: assume the other driver is an idiot. Sure, it's the other driver's responsibility to drive safely and with due care and attention, but the injuries you suffer in an accident aren't any less severe because you happened to be in the right.

The same principle applies to MOTs and car maintenance. Your injuries aren't any less severe because the guy should have ensured his car was in a safe condition but did not. At best, the insurance companies will pay for your expenses because the accident wasn't your fault. It's still better to drive defensively.

Yes, people running memcached should tighten their security. There should be a way to fine those that do not, or at least to pass costs of defending yourself from their stupidity onto them. But this isn't an ideal world, so drive defensively.

Re: ISPs could mitigate this - car MOT

Just one small flaw in your plan. The MOT helps to secure road safety in the UK from dangerous cars on the UK roads and is policed in the UK where the cars physically are.

How do you propose to enforce an MOT on servers all over the world and completely outside your jurisdiction?

If you can't knock on (kick down) the door then you can't tackle the problem at source. You have to police the borders (just like illegal goods) which is the point where you can take physical control.

So having ISP routers acting as border guards is probably one of the more effective ways to address the problem.

Re: ISPs could mitigate this

"I don't understand why responsibility is normally passed onto someone else, in this case an ISP. Why not make the people responsible for the problem, sort their problem, legally.

We do it for cars, people have to make sure their car is compliant so as not to be a danger to others, it's called an MOT. While MOTs aren't perfect, at least the responsibility is put onto the owner."

We do not do it for cars.

Compliance is enforced on the manufacturers, not the drivers. We do not require all drivers to be automotive engineers who can fix flaws in the design or construction of their vehicles.

If you really want to do this, go after the database software vendors, or maybe the router manufacturers.

Re: ISPs could mitigate this

"People running equipment on the net that is caperable of causing harm to others should be held to account. Pass the bill on to them, with a fine, perhaps even make them go through a training course to show they are fit to let their hardware loose onto the the wider world."

Groan. That's what we'll do. Imagine how well that'll work when your 94 year old grandad gets a virus on his iPad that causes issues out on the Internet.

Of course it SHOULDN'T be down to ISP's to sort this, but at the end of the day, it HAS to be! What other way is there? Those with the know-how should be able to request "unfiltered" connections if they so wish, for the rest, blocks as described by the previous poster should be the norm - same as how parental controls are until an adult unlocks them.

I appreciate in this case it'll only be sysadmin's unleashing a memcache problem, but in other cases, IoT etc, we all need some protection from what's out there. And would you rather ISP's took that on board and made your connection inover a little safer, or would you rather all in sundry could just have their connections doing whatever they like because they're still waiting for their "training course" coming up?

You could argue the same with traffic lights and give way signs out on the road.. "Why make someone else responsible?".. Well because without them, a number of folks would run riot!