IETF Logo Mail Archive

Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

Ralf Weber <denic@eng.colt.net> Fri, 08 August 2008 07:48 UTC

Return-Path: <owner-namedroppers@ops.ietf.org>
X-Original-To: ietfarch-dnsext-archive@core3.amsl.com
Delivered-To: ietfarch-dnsext-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF0AA3A68C0; Fri, 8 Aug 2008 00:48:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.514
X-Spam-Level: *
X-Spam-Status: No, score=1.514 tagged_above=-999 required=5 tests=[AWL=0.463, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l4OlqpOSUJpc; Fri, 8 Aug 2008 00:48:19 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8AEC63A6C89; Fri, 8 Aug 2008 00:48:19 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1KRMda-000Oph-9c for namedroppers-data@psg.com; Fri, 08 Aug 2008 07:43:50 +0000
Received: from [212.74.77.49] (helo=smtp.lon.dcn.colt.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <denic@eng.colt.net>) id 1KRMdU-000Onu-Ue for namedroppers@ops.ietf.org; Fri, 08 Aug 2008 07:43:48 +0000
Received: from [194.45.79.6] (quo.fra.ws.COLT.NET [212.74.79.242]) by smtp.lon.dcn.colt.net (Postfix) with ESMTP id 73F2735833; Fri, 8 Aug 2008 09:43:43 +0200 (CEST)
Message-Id: <B786FB32-89AB-412E-A502-1CEB9A404041@eng.colt.net>
From: Ralf Weber <denic@eng.colt.net>
To: Duane at e164 dot org <duane@e164.org>, bert hubert <bert.hubert@netherlabs.nl>, Namedroppers <namedroppers@ops.ietf.org>
In-Reply-To: <489BF4C8.9000309@e164.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Apple Message framework v928.1)
Subject: Re: OFFTOPIC: DNSSEC groupthink versus improving DNS
Date: Fri, 08 Aug 2008 09:43:42 +0200
References: <489AD5E3.20708@nlnetlabs.nl> <20080807134236.GA19024@outpost.ds9a.nl> <E3BF6308-12F6-4269-B949-2853E5E8F607@eng.colt.net> <489BF4C8.9000309@e164.org>
X-Mailer: Apple Mail (2.928.1)
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk
List-ID: <namedroppers.ops.ietf.org>

Moin!

On Aug 8, 2008, at 09:24 , Duane at e164 dot org wrote:

> Ralf Weber wrote:
>
>> The reason it changed is that we, or to be more precise a customer  
>> was
>> hit by cache poisoning, and I had show up at there board and  
>> explain it
>> to them.
>
> Thanks for proving my point, people won't do anything until something
> happens to them personally.
Well this might happen more often now when the hackers do code that  
utilises Dan Kaminskys findings. And it just need to happen to the  
"right" people, as we see with IPv6 now that which is at least getting  
some traction after governments endorsed it.

>> Is there a technology that can prove that the answer I am getting  
>> from my DNS resolver is correct?
>
> Don't use someone else's resolver for starters,
Hmm shall I stop offering resolving service to our customers, so that  
they can have their own ;-).

> then reduce the TTL to
> almost nothing and the chance of being effected is greatly reduced, of
> course DNSSEC won't solve this problem without critical mass either so
> even if you deploy or utilise DNSSEC you could still be effected by
> cache poisoning.
True, but if A and B agree on using it they can at least secure the  
resolving of A and Bs domains, and if C, D and E join them when a TLD  
operator offers DNSSEC domains they will be also secured. So it will  
get better the more people do it, and the of non DNSSEC servers to  
speak to DNSSEC servers is at least defined (unless IPv6).

So long
-Ralf
---
Ralf Weber
Platform Infrastructure Manager
Colt Telecom GmbH
Herriotstrasse 4
60528 Frankfurt
Germany
DDI: +49 (0)69 56606 2780 Internal OneDial: 8 491 2780
Fax: +49 (0)69 56606 6280
Email: Ralf.Weber@colt.net
http://www.colt.net/

Data | Voice | Managed Services

*****************************************
COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland *
Tel +49 (0)69 56606 0 * Fax +49 (0)69 56606 2222 *
Geschäftsführer: Albertus Marinus Oosterom (Vors.), Rita Thies *
Amtsgericht Frankfurt/Main HRB 53898 * USt.-IdNr. DE 220 772 475



--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

v2.23.0 | Report a Bug | By Email