IETF Logo Mail Archive

Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz

william manning <chinese.apricot@gmail.com> Thu, 29 December 2016 21:51 UTC

Return-Path: <chinese.apricot@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33A491296DA for <dnsop@ietfa.amsl.com>; Thu, 29 Dec 2016 13:51:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WWTjPlHtVgKQ for <dnsop@ietfa.amsl.com>; Thu, 29 Dec 2016 13:51:50 -0800 (PST)
Received: from mail-io0-x233.google.com (mail-io0-x233.google.com [IPv6:2607:f8b0:4001:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36EAD12969B for <dnsop@ietf.org>; Thu, 29 Dec 2016 13:51:50 -0800 (PST)
Received: by mail-io0-x233.google.com with SMTP id n85so127283424ioi.2 for <dnsop@ietf.org>; Thu, 29 Dec 2016 13:51:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=wJP0BW4imafwRteTq+TnIUNtkFHkZUqRBLO6BL7CRpg=; b=jKYlf7vwd0QgLBOW4t2wVhUIO31tc5JsNpO2phgje1CuIzs6EB5OXlYliiR33vrkes DVJfYbCjG1ZEp0Eb1bnU45CYakiuoveM7l7LABEszeD5VJvnYtmzxymQaDaMDR86BQ26 /WFO6IvSvKb7Jz3xhdTHDIHBvNlVLhol3dIf8eBuemubDtvore+9LnVZCT7Eb46zrSKJ VE2uw9vK6jwSfguf9Uoga3C1TyU2DcaXH52kkbGPYG+EyYNUWdfSMH/wDJqgNjHZVIQP FVE72tjHs9r6ArQ5XRpBhv1/AGknP90UGqq/5za79icmejjpp3cKqXZHnty+Mr0MabFD 62Kg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wJP0BW4imafwRteTq+TnIUNtkFHkZUqRBLO6BL7CRpg=; b=Tb3J3nb111hQ9BISyhzb8MRNgAZmeH+oUW+f0M1uQ3XIQ9XcO1TTQ9u5G75x/dV6RD tHiJCKAGEZZU8Da2r5eCcgGDUoYSIICvMG+xc0F4kxZ4uBlQ7+u1pnAC1zy872lO1irb 5NBiqNzWTBhDSWZZ+7sORrGonV5jJaZUFj2w8O/g4suTSrJTZDO1lhJyaN8zJtAhy1vy dJ08kGb11Pk4lhV7jMhPaB/hr487FGoxtHKfymVGg6bYynx05xbFOyRzsSmqbCnaWyfw U0W8wexMPh95jHA/QKVhLVQbCaygFUdvj6uYB66WDhbtM2WV35CiwyoGFtgfwFzwHrln ftMw==
X-Gm-Message-State: AIkVDXImCJhlKmxffHWDlUhfTQ5AiYVSXM34PGhbN1bKDO5Guj5OaKCCrE75Vdw2UBUEimGw4Fbj6xK9zdT25Q==
X-Received: by 10.107.154.14 with SMTP id c14mr31857215ioe.0.1483048309543; Thu, 29 Dec 2016 13:51:49 -0800 (PST)
MIME-Version: 1.0
Received: by 10.107.159.137 with HTTP; Thu, 29 Dec 2016 13:51:48 -0800 (PST)
In-Reply-To: <201612291815.uBTIFdW4015802@calcite.rhyolite.com>
References: <kHKKXtEjTQZYFAGI@highwayman.com> <201612291815.uBTIFdW4015802@calcite.rhyolite.com>
From: william manning <chinese.apricot@gmail.com>
Date: Thu, 29 Dec 2016 13:51:48 -0800
Message-ID: <CACfw2hi4Yu87CEfAaDLT0GuzQ8_nEF8hAnfXsPa4NmixB35cAA@mail.gmail.com>
To: Vernon Schryver <vjs@rhyolite.com>
Content-Type: multipart/alternative; boundary="001a1140fc0cacd8710544d31777"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/fpDtijvJd4icHkd08wYx_oNhGMY>
Cc: dnsop <dnsop@ietf.org>
Subject: Re: [DNSOP] DNSOP Call for Adoption draft-vixie-dns-rpz
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Dec 2016 21:51:52 -0000

"lets standardize this 'cause everyone does it"  sounds like the medical
community should have standardized on whiskey & leaches & coat hangers
because thats what everyone did.  if this work does proceed, i'd like to
insist that it carry a disclaimer that it is designed specifically for
closed networks and is not to be used in the Internet.
Indeed, thedraft is very clear this is for enclaves and not for open
Internet use.


/Wm

On Thu, Dec 29, 2016 at 10:15 AM, Vernon Schryver <vjs@rhyolite.com> wrote:

> > From: Richard Clayton <richard@highwayman.com>
>
> > Everyone involved understands that there isn't at present a turnkey
> > application that the other 5% (and indeed all the in-house corporate
> > systems) could deploy....
>
> I do not understand that.
> If the command `nslookup -q=txt -class=CHAOS version.bind` to a UNIX
> shell or Windows command prompt on your desktop says anything about
> BIND, then chances are good that you are already using one of the
> turnkey applications that in-house corporate systems and others have
> already deployed and could configure.  Even if there is no sign of
> BIND9 from that `nslookup` command, the odds are good that the recursive
> server you use has an RPZ taint or will have within months.
>
>
> > So although deploying RPZ does a reasonable job of papering over the
> > cracks in our response to cybercrime I think that on balance it's too
> > dangerous a tool for the IETF to wish to bless in any way -- it's poor
> > social hygiene to standardise these types of tools.
>
> While I understand how a reasonable person can hold that position,
> I think the papered cracks are not only less bad, but the best that
> can be hoped for in the real world.
>
>
> > I also note from reading the draft that this blessing will freeze in
> > some rather ugly design (with the authors arguing that the installed
> > base cannot adjust to something cleaner).
>
> That is not the intended meaning of the draft.  Instead it tried to
> acknowledge the extreme difficulty of changing an installed base.
> Words that convey that intended meaning would be appreciated.
>
>
> Vernon Schryver    vjs@rhyolite.com
>
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop
>

v2.15.0 | Report a Bug | By Email