Re: [DNSOP] draft-ietf-dnsop-reflectors-are-evil-05.txt

[Dean Anderson <[e-mail]>]

On Tue, 4 Dec 2007, Edward Lewis wrote:

> http://www.ietf.org/internet-drafts/draft-ietf-dnsop-reflectors-are-evil-05.txt
> 
> 1) (Somewhat jokingly) I would strike the first word ("Recently") as 
> the attacks were almost two years ago now.  

Yes. And those attacks seemed to be contrived at the time. Perhaps the
attack described isn't (as I previously argued) a genuine concern.

"generation of massive amounts of traffic" is also a misnomer. None of
the attacks generated very large amounts of traffic in comparison with
other types of DOS attacks.  Perhaps 'generation of a significant amount
of traffic'

The draft still asserts incorrectly that 

   DNS authoritative servers which do not provide recursion to clients
   can also be used as amplifiers; however, the amplification potential
   is greatly reduced when authoritative servers are used. 

The exact same traffic can be generated with authority servers.  
Authority abuse traffic is much more difficult to mitigate, and so is a
much worse problem that recursor traffic. The draft should state the
facts, otherwise it is misleading.

> In the spirit of "sending text" it might be more appropriate to start
> with "Once upon a time...".

I disagree. IETF Documents should have a serious subject, and a serious
tone.

> 2) I guess I should get over the fact that "are-evil" is part of the 
> the file name and that will go away when this document gets out of 
> the RFC Editor.  I think the tone of the document is right as is, 
> recommending ways to have name servers not offer free and unchecked 
> services unless the owner is aware.

I'm not sure this should be ignored. Anyone who looks up the document
history will find that name.  It doesn't ever really go away.  While
there are no official requirements on document names, I think they
should avoid religious and unprofessional terms. If nothing else, it
reflects both on the author, and on the IETF because the IETF accepted
to work on the document with the offensive name.  I think this is a good
reason to oppose this document.

> 3) I was a bit troubled by the discussion in the room on Monday. 
> Parts of the discussion were hard to hear (the acoustics plus my 
> aging ears) and I my laptop was off (no jabber for me).  It sounded 
> like someone (not present) claimed that they required open resolvers 
> for roaming.  The discussion seemed to criticize that comment because 
> it is not generalizable, but I think that wasn't the intent.  I 
> thought the comment was offered as a reason why a blanket prohibition 
> against open resolvers was a bad idea.
> 
> I would be against a campaign to cajole people into closing open 
> resolvers.  One reason is that I don't believe that the problem is 
> the open resolvers but the inherent nature of UDP involved.  Two is 
> that it is up to operators to decide how to responsibly operate their 
> network (and it is up to the IETF to give them the educational 
> materials they need).
> 
> I think the document is a good balance.  It recommends closing access 
> to resolvers but does not berate those that leave them open.  (Unless 
> I missed something.)  It lists approaches to selective openness.  I 
> apologize if I lost the train of thought of the mic discussion.

I think the document needs to include discussion of the more serious 
attack vectors using authority servers. Even though this has been 
discussed, and is more difficult to mitigate, and a more serious problem 
that administrators may need guidance in how to handle, this is 
completely ignored. 

This document is just an 'open relays are bad' document, couched in DNS 
terms.  

I am strongly opposed to this document, so long as it contains incorrect
and misleading claims.


		--Dean




-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   



_______________________________________________
DNSOP mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/dnsop