Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz

["John Levine" <[e-mail]>]

>> Please see the previous gazillion messages from people who are using
>> RPZ in production to keep malware away from their users.
>> 
>> Also see the previous gazillion messages noting that governments do
>> all sorts of DNS censorship now and don't need RPZ.
>> 
>> Could you explain in more detail why you don't believe operators will
>> continue to use RPZ to protect their users, and why you think hostile
>> actors will do things with RPZ that they couldn't do now?
>
>I was specifically asking about the redirect/record replacement
>behavior, not the nxdomain/blocking behavior.

Providers routinely use sandboxing to quarantine infected users both
to protect their other users (malware can't contact C&C) and to force
them to do something about it, since they can't see anything other
than web sites with cleanup tools.  

I've talked to providers who tell me that this is the least bad way
they've found to get their users to clean up infected boxes.  Even if
a provider could afford to calli them on the phone, it doesn't work,
first because users not unreasonably think it's a scam, and second
because the malware doesn't bother them, only other people, so they
blow off advice to fix it.

So I reiterate the same two questions.

R's,
John