I don't give a shit how it works they should find a way to not allow some kids to take down their service simple as that.
There is a way.
Take the Internet as it exists now. All of it. From every country, every ISP, every Datacenter, and throw it on a fire.
Now, start from scratch, and write a new protocol that prohibits the kind of mechanics by which a ddos uses the current protocol against itself.
Now take your Internet 2.0, and make the it standard, for the whole world, convince everyone to use it.
Easy!
Cool, didn't know that. Why doesn't Sony/MS do the same if it is more resistant?
My guess would be money. It's in Amazon's best interests to make AWS secure, since it's a product they sell, and when you're selling server/cloud uptime is king. AWS *is* the product, so they spend the money to make it good.
Sony and MS sell consoles. While PSN and Live are a part of the package, neither are focused entirely on having flawless online infrastructure (though MS does do it better since they piggyback their gaming servers off existing enterprise infrastructure). XBL is surprisingly robust at weathering bad ddos storms, but not immune. Though I'd bet both are very concerned about these kinds of attacks, but I'm unsure what the tipping point would be where they'd consider spending the money to help mitigate future attacks like this.
It boils down to money, I'd guess. Let's say that installing ddos protection costs $100,000 to protect against a 1 Gbps attack. So you install that. Then the next time an attack happens, it's 10Gbps, and you're not prepared. So you pay and install more mitigation, open up a few more datacenters, spread the system around a bit more so it doesn't have a single point of failure. That set you back a million. Now you're hit with a 400Gbps attack. You're not perpared. So for next time, you spend all that money, pay all the monthly costs, etc, for a 400Gbps attack that... doesn't come. Doesn't come. You're now losing 5 million a year on protection that isn't being put to use, because the kids that might attack you got bored.... so when do you call it quits? Then the instant you scale back on mitigation, boom, there's a 500Gbps attack and you're vulnerable again.
There's just no good way to win in this kind of situation - you can either overspend and hope the money was worth it, or underspend and hope people understand when shit goes down.
After this attack, I'm sure there are many angry phonecalls happening around Sony, and meetings being planned to see what can be done, who is responsible for letting this happen, what will it cost to fix, and who's going to not get a bonus next year to cover the cost of preventing this again. I wouldn't be surprised if, in the future, Sony stops trying to do this themselves and shunts their whole infrastructure over to another company to handle, or a different company (not sure who's handling PSN right now, if it's them, or a third party).
I'm sure that a lot of the newer ddos protection agencies are very eager to let Sony know they can help, for a fee.