IP Spoofing
I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers (<a href="http:&#x2F;&#x2F;blog.zorinaq.com&#x2F;nginx-resolver-vulns&#x2F;" rel="nofollow">http:&#x2F;&#x2F;blog.zorinaq.com&#x2F;nginx-resolver-vulns&#x2F;</a>) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can&#x27;t be done on the Internet. And yet <a href="https:&#x2F;&#x2F;spoofer.caida.org&#x2F;summary.php" rel="nofollow">https:&#x2F;&#x2F;spoofer.caida.org&#x2F;summary.php</a> shows ~25% of network prefixes can be spoofed... <i>sigh</i>