Skip to content

PoW requirement in bootstrap phase leads to easy DoS #14

@majestrate

Description

@majestrate

Rate-limits MUST apply per /24 IPv4, /56 IPv6, and per-AS aggregates; any bucket MUST NOT exceed 5 % of responder respondent capacity.

Mobile networks would be dead in the water from this requirement as they see extensive use of CGNAT to put many thousands of devices on one public address (/32). Combine that with low end requirements on the devices this would render access from these networks rather hard. A large portion of the internet uses it via these networks, please consider revisiting this requirement to boost adoption.

Activity

slammingprogramming

slammingprogramming commented on Aug 11, 2025

@slammingprogramming

The specification’s intention behind applying rate limits at the /24 IPv4, /56 IPv6, and per-AS aggregate levels—and capping buckets to 5% capacity—is to prevent abuse and ensure fairness across the network by avoiding large-scale Sybil or flooding attacks originating from a single network block or organization.

We acknowledge that mobile networks, which often use Carrier-Grade NAT (CGNAT), can have thousands of devices behind a single public IP, which makes strict IP-based rate-limiting challenging and risks throttling legitimate users.

Some possible considerations or mitigations include:
• Per-AS aggregate limits provide a coarser-grained control, allowing operators to tune capacity per network rather than strictly per IP range, which might help mobile providers balance accessibility and abuse control.
• Implementations could incorporate additional signals beyond IP subnet, such as client identity, behavior heuristics, or authenticated tokens, to more fairly rate-limit on a per-device basis behind CGNAT.
• Future versions or governance discussions could explore adaptive rate-limiting models that better reflect mobile network realities without compromising network integrity.

We’ll note this feedback for ongoing review, as balancing anti-abuse mechanisms with wide accessibility and adoption—especially for mobile users—is critical for Betanet’s success.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @majestrate@slammingprogramming

        Issue actions

          PoW requirement in bootstrap phase leads to easy DoS · Issue #14 · ravendevteam/betanet