anti-thought

Looks like it will be another pretty branded CVE: https://www.reddit.com/r/PFSENSE/comments/76ksdi/core_protoc...

They mention it will be at https://krackattacks.com

For what its worth, the base algorithm is extremely similar in concept to an Erlang queue implementation I saw recently [1]. But I do like doing these language implementation comparisons. The Erlang one definitely suffers from the base language being copy-on-write though.

[1] https://github.com/dstar4138/libemp/tree/develop/src/buffers...

Think of the internet like a tree, where the root is you and all other IPs are the leaves at the end. IPs close together tend to share more path of the tree as you attempt to reach them from the root. If you are sending an overwhelming amount of packets in one direction for too long, you have a higher chance of harming nodes (i.e. routers) along that path. Randomizing your end goal on the tree, by definition, equally spreads the packet spray accross the tree.

This is how they can claim: "... it'll only melt your own network. It randomizes the target IP addresses so that it shouldn't overwhelm any distant network."

Note "shouldn't", this was probably added due, in part, through use-case. If I were not scanning the whole Internet, and instead just scan a small section. Masscan has less of a space to randomize through, which means the tree is smaller and the shared paths are more frequent.

Jim Weirich was an excellent speaker, and this was one of his best presentations. I thought his method of building up to the purpose of combinators (not just the Y) was much better than just an explanation. He references [1] (note url change) which does something similar and is also a good read/view.

[1] http://codon.com/programming-with-nothing

That (which can be fixed somewhat easily by [1]), and they rely on version >= v0.10.* which is gross as only v0.6.9 is provided by the default Ubuntu 12.04 repos (which are what is recommended by their README).

[1] - `ln -s $(which nodejs) ~/bin/node`