I.e. a single compromised host in the "permitted prefix filter range"
can cause as much trouble as the current attacks. Granted, it's a bit
easier to track down a host like this, but eliminating the majority of
compromisable hosts is even more difficult than global implementation of
the cited document. The bitter irony is that non-implementation of this
draft will most probably corelate with presence of compromisable hosts.
Well, that's true, but it's a different facet of the same problem.
The draft only attempts to solve what it is that we can solve be
ingress filtering. Solutions using firewalls or proxy devices which
defat this type of attack are a Good Thing, but if everyone does
ingress filtering, a large percentage of this problem disappear.
- paul