People are good with dealing with a small number of simple things that can be stacked together. Throw in a human-readable data stream, and you're set to understand and use a stack of simple programs.
People are not good with dealing with a single monstrous object of unfathomable proportions, they will try to break it down in things they understand. If the thing is too complex, with too many inputs, too many outputs and too many states, this is a recipe for confusion. This is why overly complicated things always fail in face of simple things.
One could argue that FTP/SFTP was just as good as transferring bytes over network, but HTTP/1.0 won because it was simpler.
HTTP/2 was written to tickle the egos of its developers, following the principle - it is hard to write, it is hard to read. And its downfall is going to come from this problem.
The problem is that they catch porn, in the first place. Who is the government to tell me what I can and can't watch, provided I don't hurt anyone directly or indirectly.
Next thing you know, the government is going to tell me who to vote in and out the office.
Regulation has its purpose - all public utilities are regulated. Taxi is a public utility, and as such the society prefers protect the profits of the cabbies in exchange for regulated safety standards, maximal prices, e.g. for the airport rides, and special protection for the customers. Otherwise, the competition (a taxi driver business has a very low entry barrier, you just need a car) will drive down the prices and the quality of the service.
A fit analogy - replace "Uber" in your retoric with "low cost airline", and see how happy would you be to fly an airline unregulated by FAA.
The same crowd here, that roots for Uber, screams for net neutrality and want to have the ISPs regulated as common carriers. The cognitive dissonance astounds me.
I mean, the fix consists in making sure that attr.config has all the 64 bits cleared -
on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled.
on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared.
I may be wrong though, as I didn't scan through all the affected code.
So, the paper argues that we all should reply to these scams, in order to make economically infeasible for the attacker to promote this kind of attack - drawn them in noise.
On the other hand, increasing noise will lead to even more sophisticated attacks and increasingly cunning attackers - evolutionary pressure in action.