Subject: RE: What I mumbled at the mike today...

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Aug 2004 10:49:54 -0700

> > speaking from the point of view of one trying to break in, it
> > establishes a priori targets before entry is gained.  simply put,
> > names that don't need to be exposed should not be exposed.
> 
> the people who agree with you and are serious about such, are already
> using split-view dns.  outsiders don't see things that they shouldn't
> see.

Split DNS has absolutely no viability in a Web Services extranet
application.

None

Nada

Zip

Zero

The UDDI services used to advertise an connect the services is protected
using SSL and access control.

If it is not possible to store names securely in DNS then either that 
function will have to be served in UDDI or we will have to develop
a suitable DNS security fix in another forum.

The ratio of useful discussion on technical issues to trying to talk 
down real world requirements in this list is very very low. I would
estimate about 1:20 or less.

If a significant constituency declares that an issue is a showstopper 
then further discussion of the issue is pointless. There is no argument
that the European registries are not a significant constituency.

The DNS is nowhere near so pretty that it needs preservation as a 
national treasure. 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "David A. Ulevitch" <[email-masked]>
Date: Mon, 9 Aug 2004 11:13:07 -0700 (PDT)

<quote who="Hallam-Baker, Phillip">
> Split DNS has absolutely no viability in a Web Services extranet

Okay, so don't use it there.  Split DNS, by definition, would be
considered tangential to an extranet.  ie, the extranet is on one side of
the split and doesn't know about the other.  If your extranet needs a peek
inside, I suggest evaluating a VPN or alternate solution.

> using SSL and access control.

...unrelated...?

> a suitable DNS security fix in another forum.

define "store names securely" -- the machine can be secured, the split
horizons (or views) can be secure.  the network can be secure.  what part
of secure do you really want?  The ability for it to not be enumerated?  I
thought this discussion was over.

-davidu

----------------------------------------------------
   David A. Ulevitch - Founder, EveryDNS.Net
   http://david.ulevitch.com -- http://everydns.net
----------------------------------------------------

---

From: Alex Bligh <[email-masked]>
Date: Mon, 09 Aug 2004 19:34:03 +0100

> Split DNS has absolutely no viability in a Web Services extranet
...
> a suitable DNS security fix in another forum.

Seems to me the above argument is equally applicable, mutatis mutandis,
to interorganization SIP & SIP URIs.

Alex