IETF Logo Mail Archive

Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz

Nolan Berry <nolan.berry@RACKSPACE.COM> Wed, 21 December 2016 20:45 UTC

Return-Path: <nolan.berry@RACKSPACE.COM>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9E361295F0 for <dnsop@ietfa.amsl.com>; Wed, 21 Dec 2016 12:45:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5
X-Spam-Level:
X-Spam-Status: No, score=-5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7kfddmzrKMx6 for <dnsop@ietfa.amsl.com>; Wed, 21 Dec 2016 12:45:01 -0800 (PST)
Received: from esg01.rackspace.com (esg03.rackspace.com [104.130.178.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13EF31295E7 for <dnsop@ietf.org>; Wed, 21 Dec 2016 12:45:01 -0800 (PST)
Received: from smtpout.rackspace.com (unknown [10.12.51.27]) by Websense Email with ESMTPS id 300353E76FA4F for <dnsop@ietf.org>; Wed, 21 Dec 2016 20:45:00 +0000 (UTC)
Received: from 544149-OEXCH10.ror-uc.rackspace.com (10.12.51.27) by 544149-OEXCH10.ror-uc.rackspace.com (10.12.51.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.544.27; Wed, 21 Dec 2016 14:44:59 -0600
Received: from 544149-OEXCH10.ror-uc.rackspace.com ([fe80::a9b4:eb1f:fbff:fa9b]) by 544149-OEXCH10.ror-uc.rackspace.com ([fe80::a9b4:eb1f:fbff:fa9b%26]) with mapi id 15.01.0544.027; Wed, 21 Dec 2016 14:44:59 -0600
From: Nolan Berry <nolan.berry@RACKSPACE.COM>
To: dnsop <dnsop@ietf.org>
Thread-Topic: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz
Thread-Index: AQHSWtQlucKJlbl/i0GIcuxSjdzIeqERbHYAgADm2wCAAIrHAIAAEV8AgAAEL4CAABahAIAABDeAgAAC6oCAACdwAP//pk9M
Date: Wed, 21 Dec 2016 20:44:59 +0000
Message-ID: <72b8eca59f50481ab700570dffe2ea3b@RACKSPACE.COM>
References: <C18E2D4E-EE89-4AF6-B4A0-FAD1A7A01B5E@vpnc.org> <5248A099-7E1F-437A-A1B7-C300F917D273@fl1ger.de> <CACfw2hj4VfuqsM-jRpxNc+bWNsUcSid+Y=r9U5jsA-0ZLbLRUg@mail.gmail.com> <20161221.163826.74705202.sthaug@nethelp.no> <alpine.LRH.2.20.1612211047200.13966@bofh.nohats.ca> <CAAiTEH_-LGUkpmPjDRsKpnPhXev1sNdF_2yaVXKmeWMJ7vm_eg@mail.gmail.com> <6C982A3A-721C-4094-A04F-059698581321@fugue.com> <CAAiTEH_LOUhCSRuDNggTK9f1iWw6dCQB2bJQ7FVyYn3MH49KUQ@mail.gmail.com>, <20161221200104.GK13486@mournblade.imrryr.org>
In-Reply-To: <20161221200104.GK13486@mournblade.imrryr.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.12.51.4]
Content-Type: multipart/alternative; boundary="_000_72b8eca59f50481ab700570dffe2ea3bRACKSPACECOM_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/I4UCk_0XvtK4LVAyvrTh4OhwRD8>
Subject: Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Dec 2016 20:45:03 -0000

Hello,

I will keep my feedback short and to the point.  We have implemented RPZ across our resolvers and it has been a fantastic tool to stop botnet C&Cs and outbound DDoS attacks.  I just wanted to say it has been an extremely valuable tool to us here at Rackspace and provide some positive feedback since this thread seems fairly negative.

Nolan Berry

Linux Systems Engineer

DNS Engineering

Rackspace Hosting


________________________________
From: DNSOP <dnsop-bounces@ietf.org> on behalf of Viktor Dukhovni <ietf-dane@dukhovni.org>
Sent: Wednesday, December 21, 2016 2:01 PM
To: dnsop
Subject: Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz

On Wed, Dec 21, 2016 at 12:39:55PM -0500, Matthew Pounsett wrote:

> RPZ is not the ideal, but it works, and goes beyond being deployable-it is
> deployed.

I am curious to understand how RPZ zone transfers are (intended to
be) secured.  It sounds like the reason for standardizing RPZ is
to allow interoperable sharing of policies via replication of zone
data, and so an appropriate security mechanism would seem to be
desirable here to authenticate the transfer of data from the RPZ
master zone.  Is there a related specification for that?

As a (long-ago) emigre from the then Soviet Union, I am loathe to
see the IETF standardizing scalable censorship mechanisms, however
well intentioned.  Let's hope that skepticism of such "progress"
can evolve without the personal experience of having lived under
a totalitarian regime.

Once the infrastructure that RPZ makes possible is deployed at
scale, it will surely become increasingly difficult to bypass.
This proposal is a major step towards building the Great Firewall
of <your CountryName>, and should I believe be resisted.

--
        Viktor.

_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

v2.15.0 | Report a Bug | By Email