Risk assessments making bad assumptions is not a new thing.<p>People are always advocating egress filtering because &quot;if only everybody would do it ...&quot;, but it&#x27;s a classic tragedy of the commons. Egress filtering doesn&#x27;t meaningfully help the network doing it and it may cause ugly problems with asymmetric routes and the like, so the number of networks that don&#x27;t do it is large enough to be meaningful. And if you get close enough to the core of the internet it&#x27;s basically impossible anyway because there is no practical way to keep track of which address ranges a particular interface should legitimately be sending traffic from when the list encompasses half the address ranges on the internet and can change at any time.<p>The upshot being it&#x27;s not at all difficult for an attacker to get hold of a connection that doesn&#x27;t do egress filtering, and that isn&#x27;t ever going to change.