Subject: Re: New working group document ?

From: Stefan Schmidt <[email-masked]>
Date: Wed, 1 Nov 2006 21:32:47 +0100

On Mon, Oct 30, 2006 at 08:38:47PM +0100, Peter Koch wrote:
> after several reads of the document I think it's a good essay about DNS
> spoofing and "size" of the threat (given references to 2006's figures), but I'm
> not sure what purpose it should serve as a WG document.
> 
> Admitted, it collects some of the folklore or implementors wisdom (and might
> be the first document that says the query has to be sent back with the
> response), but what's the intended status?
> I don't see many interoperability issues, so Standards Track might be a tough
> road.  Should it be a BCP for implementors? Or is it meant only as an addendum
> to RFC 3833 (informational)?
...
> I'm willing to review but before I commit I'd like to know again what's
> the intended outcome?  Clarifications of the base spec, BCP for
> implementors, BCP for operators or just documentation?

I would say given the potential threat DNS spoofing attacks might have right
now if someone was to implement them we are obliged to take all feasible steps
to fight it.
As an operator of recursive DNS service for a large DSL broadband ISP i really
would like to see this document in the Standards Track for the threat is not
going to vanish by praying everybody will apply BCP38 to their border routers
someday - history has shown that there have been some black sheep in that field
ever since Cisco invented uRPF.

As Bert Huberts own creation (PowerDNS recursor[2]) as well as Dan Bernsteins
dnscache [1] already implement the mechanisms proposed by this document i must
say, yes there are no interoperability issues i know of but this should be a
good thing, right?

	Stefan

[1] http://cr.yp.to/djbdns/forgery.html
[2] http://docs.powerdns.com/recursor-details.html#ANTI-SPOOFING
-- 
"If there's nothing wrong with me... there must be something wrong with the
universe."
- Crusher, ST-TNG

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Thu, 2 Nov 2006 10:32:54 +0100

> going to vanish by praying everybody will apply BCP38 to their border routers

Also, internet access providers can't assume the problem is only beyond
their borders. Your own users, or servers in the same LAN are in a very good
position to spoof you.

BCP 38 is a great thing, and the draft mentions it, but we're not there yet.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services