All cloud storage networks, coin or otherwise, are vulnerable to DDOS attacks, where attackers cause renters or hosts to spend enormous sums of money by repeatedly downloading the same files.- The typical solution to these DDOS attacks remains "IP blocking". For TCP/IP, this can be effective, and when coupled with some sort of tracing back to the source, results in DDOS attacks that wane and can be responded to fairly rapidly.
- The practice of IP blocking has spawned an open and somewhat contentious network of public and private IP blocklists. While it is likely that these blocklists will be relevant for storage coins, there will be undoubtedly be a need for blocklists to be maintained that are specific to cloud storage protocols.
- Blocklists, even if fairly maintained, are centralized and many use DNS for distribution (see https://en.wikipedia.org/wiki/DNSBL). A blockchain protocol for blacklisting may be ideal, with nominations, evidence, voting and expiration all occurring "on chain". (It should be obvious why blocklists would greatly benefit from decentralization)
All storage coins are additionally vulnerable to a "not really redundant" Sybil attack. - Any attacker can quite simply spin up many instances of the protocol on a single host - increasing his exposure and income - while completely defeating the purpose of redundant storage.
- There is currently no way for a renter or user to know where its hosts physically reside, and whether they are on the same machine or not.
- One way of mitigating this is to publish IP addresses of hosts as a part of file contracts or storage advertisements. Renters should then prefer IP's that are somewhat distributed across the IP space. This can, of course be defeated by routing diverse IP's to the same data center. But this can be trivially detected and violators can then be published via the same IP blocklists above... using either DNSBL or blockchain tech.
In summary:- Any time you are "hosting" data, you need to deal with DDOS attacks.
- However you solve it, I don't care: this solution will, de facto, provide an analogous solution for Sybil attacks on storage network redundancy
So don't worry about Sia/Storj sybil attacks. They are just inverted DDOS attacks, and those have to be solved anyway.