Discuss mailing list

["Alex M (Coyo)" <coyo AT darkdna.net>]

On 03/16/2013 03:11 PM, Alex M (Coyo) wrote:
> On 03/16/2013 02:38 PM, Peter Green wrote:
> > It seems that someone pulled the plug on a server being used for
> > DDOSing maybe using an amplification attack, and someone on the end of
> > the attack or in some way responsible for the network the attacks were
> > coming from doing as Brian pointed out the right thing.

What should have happened is nullrouting the server temporarily to 
mitigate network damage from the amplification attack, informing the 
customer (Brian) of the emergency action, apologizing for the necessity, 
then restoring the route to the customer's server once the amplification 
attack was countered.

There was no justification for completely disabling the server and/or 
the server's connectivity wholesale and then chastising Brian for daring 
to run a perfectly valid and legitimate open resolver.

The fault is not Brian's for operating a server at personal expense that 
outperforms nearly any default carrier resolver in existence.

Abuse of open resolvers is a matter of law enforcement against the 
actual perpetrator, not Brian, who is providing a necessary service at 
personal expense, and according to industry standards and accepted best 
practices.

Taking action against Brian is not only unjustifiable but intolerable.

If you still feel that my reaction was unwarranted, than I apologize, 
and will refrain from expressing my outrage in the future.