IETF Logo Mail Archive

Re: [DNSOP] I-D Action: draft-vixie-dns-rpz-04.txt

"Adrien de Croy" <adrien@qbik.com> Sun, 18 December 2016 23:45 UTC

Return-Path: <adrien@qbik.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEB8E12969C for <dnsop@ietfa.amsl.com>; Sun, 18 Dec 2016 15:45:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5
X-Spam-Level:
X-Spam-Status: No, score=-5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-3.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eouCSWxJpBY1 for <dnsop@ietfa.amsl.com>; Sun, 18 Dec 2016 15:45:37 -0800 (PST)
Received: from smtp.qbik.com (smtp.qbik.com [122.56.26.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 505F71296C0 for <dnsop@ietf.org>; Sun, 18 Dec 2016 15:45:36 -0800 (PST)
Received: From [192.168.1.146] (unverified [192.168.1.146]) by SMTP Server [192.168.1.3] (WinGate SMTP Receiver v9.0.0 (Build 5900)) with SMTP id <0000919565@smtp.qbik.com>; Mon, 19 Dec 2016 12:45:34 +1300
From: Adrien de Croy <adrien@qbik.com>
To: Scott Schmit <i.grok@comcast.net>, "dnsop@ietf.org" <dnsop@ietf.org>
Date: Sun, 18 Dec 2016 23:45:34 +0000
Message-Id: <em8c69a376-3e56-437d-8fe4-d70af6aa0e63@bodybag>
In-Reply-To: <20161218224231.GB16301@odin.ulthar.us>
User-Agent: eM_Client/6.0.24928.0
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="------=_MB5C0FDC24-2510-4810-AB65-F9C5C54235DF"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/b5RJ5tdwz6vq1RWNbIAGaURkmJs>
Subject: Re: [DNSOP] I-D Action: draft-vixie-dns-rpz-04.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
Reply-To: Adrien de Croy <adrien@qbik.com>
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 18 Dec 2016 23:45:41 -0000

 > If the admin's goal is to block access to malicious sites, then they
 > want to block the traffic, not falsify DNS.  If the goal is to warn
 > users away from bad places, they can publish the list as a filter for
 > end-system firewalls.


That may be your view about how blocking should work, but a lot of 
companies are using systems like OpenDNS who would beg to differ with 
you.

In terms of many of the metrics admins like such as simplicity, 
effectiveness, cost etc, then spoofing DNS comes out very favourably.

v2.23.0 | Report a Bug | By Email