[quarterwave]

A speculative thought:

Apart from being distributed, the insidious power of DDoS appears to lie in "subscriber-calling-server". Why not go the other way around? At least only for specific subscription services, not general purpose web access.

The situation of a DDoS attack is first communicated by the web service provider texting a subscriber, who texts back their present IP address. The web service provider then "calls" the subscriber from a hitherto unknown IP address. Of course, that address could be leaked too, but at least it's not obvious public knowledge like a DNS entry.

Sounds like circuit switched telephony/modems rather than packet switching, but can it be implemented in software?

[sirsar]

A great deal of consumers are behind NAT, and punching through that is a huge pain. UPnP is sketchy, STUN is difficult, and custom schemes like uTP are undocumented. You'll get the occasional consumer who is willing to forward a port just to connect to your service, but not very often.