Re: [dane] Network errors ARE attacks - on the end-to-end-principle

[Yoav Nir <[e-mail]>]

On May 16, 2012, at 12:43 PM, Martin Rex wrote:

> John Gilmore wrote:
>> 
>>> But it's better then disabling TLSA at all in the face
>>> of DNS errors (where we assume most errors are genuine network errors
>>> and not attacks).
>> 
>> "Genuine network errors" from buggy proxies or intentional firewalls
>> or intentional or accidental censorship systems ARE attacks.  They are
>> attacks on the fundamental end-to-end premise of the Internet.
> 
> Where have you been during the last 10 years?
> There is no such thing an a "fundamental end-to-end premise" on the
> Internet.  And if it ever existed, it ceased to exist ~10 years ago.

15. Most networks have a NAT, including almost all home networks. Most corporate networks have some kind of firewall. If you want end-to-end, you have to roll your own through IPsec or TLS, and even then you're likely to get load balancers at the server side, and the occasional decrypting proxy on the client side.

Yoav