In Ancapistan, what would force the web-hosting services that, if they support HTTP 3 (or any other QUIC-based protocol), they implement it properly? Improperly set up HTTP 3 servers can be used to make a DNS-reflection-like attack on steroids, right?

So, as I am sure many of you know, statists claim that the Internet as we know it couldn’t work in an anarchy due to the problem of improperly set up DNS servers. If there were no laws requiring ISPs to set up their DNS servers, probably many ISPs would set up their DNS servers to respond to requests from all IP addresses, rather than just the IP addresses they are supposed to serve. And since DNS servers sometimes respond with responses formed of multiple UDP packets to requests consisting of only one UDP packet, they could then be used to massively amplify denial-of-service attacks: the attacker would spoof its IP address to be equal to that of the victim server and send those short DNS requests, flooding the victim server with long DNS responses to the queries it did not actually make. That is called DNS reflection attack.

Now, some anarcho-capitalists and other libertarians respond by claiming that’s a very temporary problem. That soon enough all ISPs will support DNS-over-HTTPS and the client computers will have it enabled by default, and you cannot make encrypted requests while spoofing your IP address. There are a number of problems with that response. First of all, ISPs make some money by selling our DNS data, and that’s why ISPs tend to be against widespread DNS-over-HTTPS. I can hardly see the widespread switch to DNS-over-HTTPS happening in Ancapistan.

But even if we assume that’s true, the Internet of the near future, if the current trends continue, will suffer from another similar problem which makes the government necessary for it to function. In fact, it’s an even worse problem. Namely, the widespread adoption of HTTP 3 and the QUIC protocol. HTTP 3 is, unlike HTTP 1 and HTTP 2, based on UDP, rather than TCP. That means that there is no TCP handshake preventing the IP spoofing attacks.

Now, HTTP 3 has two mechanisms supposed to prevent IP spoofing attacks:

1. All connections begin with a simplified handshake to prove they aren’t IP-spoofing attacks.

2. The server is supposed to reject requests with a session ID that has expired. That is to prevent somebody from snooping on the connection, observing that some cyphered request led to a huge response from the server, and then later spoofing their IP address and repeating that same request (without needing to know what is in it).

Now, let’s say some web-hosting service decides to speed up its servers by not checking whether the handshake has been done correctly. Somebody could, you know, spoof his IP address and send a fake handshake along with the initial request. Or what if some server doesn’t implement the checking whether the session has expired? Then, well, the sessions are useless, and don’t really prevent the attack described in the defense number 2.

I say this is an even worse than the DNS reflection attacks because DNS servers respond with at most 4 UDP packets to a 1-packet-long request, whereas there is no limit to how big an HTTP 3 response might be (Let’s say you want to download one huge binary file.).

How would the Ancapistan address that problem?

I have a university bachelor degree in computer engineering (you can take a look at my bachelor thesis if you do not believe me), so I know what I am talking about when talking about things like this.