I did not implement it myself but here's a link to an Implementation Guide, developed by the community: https://www.manrs.org/isps/bcop/

You're telling me that, basically, an attacker says "you've already said you trust me" and the server answers "sure, I did"? Wow.

"Researchers from Akamai, Cloudflare, Flashpoint, Google, Oracle Dyn, RiskIQ, Team Cymru, and other organizations cooperated to combat this botnet." Kudos to that!

One of the comments on the Krebs article points to a Reddit comment from "Anna-Senpai" posted five days ago, before the article was published (note: contains strong language): https://www.reddit.com/r/AskReddit/comments/5nqq3c/serious_p...