Ladies&Gentlemen,
IMO, just 'getting the word out' in mailing lists, newsgroups and WWW sites
is not an effective way to mitigate the denial-of-service attacks under
consideration. Here is why.....
When a security hole is found, for example a buffer problem in a networking
daemon, 'getting the word out' is effective, because the end user is
highly motivated to correct the problem because the problem effects
whomever directly (and those who do not fix the problem only effect their
sphere of influence, not the entire Internet community).
However, in the instance of these DoS attacks, the lower tier ISP is not
significantly motivated to take corrective actions because the
results have little direct or immediate effects on business ops.
Furthermore, if the provider fails to maintain the filter list or
even configure the lists in the first place, little or nothing
will effect day to day operations (because more pressing matters
are in most businesses radar screen, i.e. surviving !)
It is for this one reason; the security problem effects users
*outside* the providers influence and not inside, merely
providing information is a good, but not an effective, way of mitigating
the situation, especially in the short term.
Continuing with a suggestion.....
Overly simplifed, the net is loosely organized along a routing
hierarchy with level 0 transit providers at the top. The level
0 providers might agree not to provide services to lower tier
providers or customers that do not provide a means of verifying
that source route filters are in place (repeat this for lower
tiers ...... ) { what is the international organization to
do this?, or should there even be one ?)
Also, to make matters easier, a WG might be formed, chaired
by level 0 provider(s) perhaps, working on both the admin policy and
a set of software verification tools to do verification 'magic'
on the filters as envisioned by the WG.
Furthermore, because the success of this venture is important
to, not only providers, but commerce as a whole, ISI, MERIT,
or some other org with hooks into the Internetworking Money
Flow (IMF :) from NSF or DARPA, etc. might consider putting together
a white paper to request additional funding to develop the
software tools and manage the releases.
Hopefully....
this idea is not falling on 'blind eyes' (as opposed to 'deaf
ears' :-) IMO, just 'getting the word out' is not enough to
take a significant bite out of this problem. The first
step to significantly mitigate DoS attacks has been taken
(getting the word out), but, IMO, a greater, second step
should be in our radar now.
Thanks for your patience,
Tim
