A small warning about UDP based protocols

The Gemini protocol has inspried others to implement “simple” protocols, like Mercury (alternate link), Spartan (alternate link) and Nex (alternate link). But there's another protocol being designed that has me worried—Guppy (alternate link), which based on UDP instead of TCP.

Yes, UDP is simpler than TCP. Yes, you can get results with just one exchange of packets. But the downside of UDP is that you will be exploited for amplification attacks! I found this out the hard way a few years ago and shut down my UDP QOTD service. Any time you have a UDP-based protocol where a small packet to the server results in a large packet from the server will be exploited with a constant barrage of forged packets. That's one reason for the TCP three-way handshake.

Also, the Guppy protocol spec states, “it's an experiment in designing a protocol simpler than Gopher and Spartan, which provides a similar feature set but with faster transfer speeds (for small documents) and using a much simpler software stack,” but there's a downside—you can easily over-saturate a link with data, which is another reason UDP is popular for amplification attacks. Congestion control is one reason why TCP exists (some say it's the only reason and the other benefits, like a reliable, stream-oriented connection is a side effect of the design).

My intent here isn't to discourage experimentation. I like the fact that people are experiementing with this stuff. But I do want to pass along some painful experiences I had when playing around with UDP on the open Internet.

You have my permission to link freely to any entry here. Go ahead, I won't bite. I promise.

The dates are the permanent links to that day's entries (or entry, if there is only one entry). The titles are the permanent links to that entry only. The format for the links are simple: Start with the base link for this site: https://boston.conman.org/, then add the date you are interested in, say 2000/08/01, so that would make the final URL:

https://boston.conman.org/2000/08/01

You can also specify the entire month by leaving off the day portion. You can even select an arbitrary portion of time.

You may also note subtle shading of the links and that's intentional: the “closer” the link is (relative to the page) the “brighter” it appears. It's an experiment in using color shading to denote the distance a link is from here. If you don't notice it, don't worry; it's not all that important.

It is assumed that every brand name, slogan, corporate name, symbol, design element, et cetera mentioned in these pages is a protected and/or trademarked entity, the sole property of its owner(s), and acknowledgement of this status is implied.

from Hacker News https://ift.tt/dDhbSMO