Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Ralf Weber <[e-mail]>]

Moin!

On Aug 7, 2008, at 15:42 , bert hubert wrote:

> On Thu, Aug 07, 2008 at 01:00:51PM +0200, Wouter Wijngaards wrote:
>> The best solution is of course DNSSEC. Crypto signatures instead of
>> randomisation games. Enable DNSSEC validation now.
>
> Not specifically aimed at you Wouter, but it appears the most vocal  
> people
> in the DNS world are starting to suffer from "groupthink".
Ok so let me state my opinion as someone who argued against DNSSEC  
until last year hopefully does not fall into the "groupthink" theory.

The reason it changed is that we, or to be more precise a customer was  
hit by cache poisoning, and I had show up at there board and explain  
it to them.

So there question was and I raise it to the WG here:
Is there a technology that can prove that the answer I am getting from  
my DNS resolver is correct?
To my limited knowledge the only answer to the above question is:
Yes DNSSEC can do this.
But please tell me if you know another solution.

All other solutions proposed here so far only lower the chance of an  
attacker to poison the cache. But still with a 0.0001% chance the  
attacker might just have that lucky packet and poison your cache. So  
why I think it is good to do countermeasures none of them can assure  
me that I won't be hit by cache poisoning.

Also as stated elsewhere here, if someone today wanted to secure DNS  
between him and his business partners he could do it today without  
involving anyone else but him and the business partners (and this is  
happening).

Now having played around with DNSSEC for a year now I also must say  
that it does it's job, but with the current software and tools  
available it's simply not ready for widespread adoption. But this is a  
problem that can be solved, there is IMHO nothing wrong with the  
protocol, it's the tools that don't offer a user friendly way to  
deploy it.

So people should focus on getting the tools right.

So long
-Ralf
---
Ralf Weber
Platform Infrastructure Manager
Colt Telecom GmbH
Herriotstrasse 4
60528 Frankfurt
Germany
DDI: [phone] Internal OneDial: 8 491 2780
Fax: [phone]
Email: [e-mail]
http://www.colt.net/

Data | Voice | Managed Services

*****************************************
COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland *
Tel [phone] * Fax [phone] *
Geschäftsführer: Albertus Marinus Oosterom (Vors.), Rita Thies *
Amtsgericht Frankfurt/Main HRB 53898 * USt.-IdNr. DE 220 772 475



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>