Re: HTTP is just fine -- v. HTTP is insecure --> need a better metaphor

Hanno Böck <[email protected]> Sat, 28 Nov 2015 16:31:09 +0100

Newsgroups	gmane.comp.mozilla.security
Message-ID	<20151128163109.0eca9231@pc1>

On Sat, 28 Nov 2015 16:30:05 +0000
Kevin Chadwick <[email protected]> wrote:

> 1./ DDOS amplification meaning it's harder to keep any parts of my
> sites and future sites running and not just http pages, should such an
> attack occur. (This is important at most scales). It's probably
> worth noting that wasting extra redundant resources on protection here
> would actually be far worse for the world.

This is the second time I read ddos amplification in this thread.

DDOS amplification is an issue where UDP services (mostly ntp and dns)
send a reply to potentially forged packets that is larger than the sent
package. This can be abused for ddos attacks.

This has nothing to do with https. Not at all. HTTPS won't make ddos
amplification any different, it happens on completely different
protocols.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [email protected]
GPG: BBB51E42

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 819 B)