Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Paul Vixie <[e-mail]>]

> From: Duane <[e-mail]>
> 
> You summed it up so nicely, they have put so much time and effort into
> this that they can't see if there are other options because they are
> blinded by the blinkers they have on, to go forward no matter what the
> cost or no matter what other solutions could solve the same problem.

as a possible proposed "they" in that example, i wonder what other option
will allow arbitrary end users to be sure that an NXDOMAIN has not been
remapped by their ISP or by their RDNS?  or that a secondary name service
provider (or a primary name service provider for that matter) hasn't added
a wildcard to catch typo's in their customer domains and send them to an
advertising server?  in other words, what other options provide end-to-end
data integrity for DNS?  if all you've got is hop-by-hop, i'm uninterested.

amit klein and dan kaminsky have showed us some off-path attacks, to which
dan bernstein and amit klein and david dagon have shown us some RDNS-only
defenses.  but provider-in-the-middle and more generally man-in-the-middle
attacks are on-path not off-path.  i want protection against on-path
attacks, as well as against all possible future off-path attacks.  you're
right that i'm dismissing proposals that do not address those requirements.
now you know exactly why.

> > How would such person defend against being assessed to suffer from
> > groupthink or tunnelvission?
> 
> All I've heard lately is shouts of enable DNSSEC now, or die, frankly
> I'm not very moved by them nor anyone else I know, it's 2008 and DNSSEC
> is using a model even X.509 threw out years ago and has been trying to
> fix every since.

after watching masataka's superior approach get railroaded into a ditch
back in 1996 or 1997 or so, i can no longer get bogged down in how ugly
the protocol is or how ugly was the process that begat that protocol.  my
pragmatic concerns are only, is it end-to-end, and can it be made to work?

show me an option that's end-to-end and can be made to work and i'll pay
close attention and if it's real i'll say "dnssec or this other thing are
the only real solutions."

but show me a hop-by-hop solution and i'll say "this isn't complete" and if
it requires a replacement or upgrade of both RDNS and ADNS nodes then i'll
say "at that price i'd prefer end-to-end data integrity, please."

let's stop talking personalities and focus on the engineering economics.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>