IETF Logo Mail Archive

Re: [DNSOP] DNSOP Call for Adoption - draft-west-let-localhost-be-localhost

Richard Barnes <rlb@ipv.sx> Tue, 12 September 2017 17:04 UTC

Return-Path: <rlb@ipv.sx>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04C67132EC1 for <dnsop@ietfa.amsl.com>; Tue, 12 Sep 2017 10:04:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DCZv5epVqGdb for <dnsop@ietfa.amsl.com>; Tue, 12 Sep 2017 10:04:46 -0700 (PDT)
Received: from mail-wr0-x230.google.com (mail-wr0-x230.google.com [IPv6:2a00:1450:400c:c0c::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9435132D79 for <dnsop@ietf.org>; Tue, 12 Sep 2017 10:04:45 -0700 (PDT)
Received: by mail-wr0-x230.google.com with SMTP id 108so24106099wra.5 for <dnsop@ietf.org>; Tue, 12 Sep 2017 10:04:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=lhaXzl9PHExR4t5cBrHiKhiGmgVZQJhWpXiIR3qLf48=; b=c7ojVn89NV/YQPXDAd+C5Ep1fztyjF1dvvvOukJBW6dbO8hEJE5HlpNsRf8hxnhkuI 5ap1PoG5Mwu2mnuClwHLrgiJClP32SZCCj2yyLUdR4VIZxCul7mzSPWJwLB1Lb/qY7Vm GmupPc7v6TRtedG+Bnrm46jIEBNVvrcbUtwA/iZ7kkreZxY5iqKlH0zADci3YJ+3A1Og ZdRjTUiafLRMu64P+FF7IyJV3GkUGUwOeCh0OungTo8LTLu6VDviYzk3lVzpUaSgLCWi VLWsVsc1+h7POO7M7pJNSPHyZffQQYzvhvaWfgtfZsNpD1Ld/vFSVMGWBOb24v7kMuaC NySA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=lhaXzl9PHExR4t5cBrHiKhiGmgVZQJhWpXiIR3qLf48=; b=bHm+X5CANinW+F41swjJ8bM/m24yrdoXeoVJaOseIoM7KUxMvSOse4GlxELySl19ub 7MMDOCXAf0X42Mbwful1JEY3vFrZTeQU/8eWz4vvMAW3y8uLt7UqFhpoh/LTwXvHxyGd nKopckIM4JUMVkIR96soQq1/qratab5ptPVFAj4kXmhgWNcaB2X+4N2lEK9yjXf8KLG1 UZjjeCvmTzHve8VNTg3T4IvGCcJum5X1pnjj/+8KCIwLewVRTXJsgY14NgFDZtnDV+MP ewdnYI8acX70/HqpVsRzimpbGVr6axMScMlDKiit5zVEfp0pVCflJP7PHz1AuF2hquCo 7KJQ==
X-Gm-Message-State: AHPjjUgY/69GM6C+ZtZjiOBtZb8lc0ihNoXqgAWYegbGiiTt39yp4ULQ 6kmscZKHdJao58vkYh4YBLfAQBRdjmHIIiQR8A==
X-Google-Smtp-Source: ADKCNb6Hxg9zYf0FaH0ERZDqjJWLv5x2eGc+qr/Lm8ky5UTWAh9LkZj9w+6tHZFsFyB+BY8lcRECSFztp//BvRve+fM=
X-Received: by 10.223.161.194 with SMTP id v2mr13554396wrv.45.1505235884187; Tue, 12 Sep 2017 10:04:44 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.28.159.200 with HTTP; Tue, 12 Sep 2017 10:04:43 -0700 (PDT)
In-Reply-To: <alpine.DEB.2.11.1709121646180.2676@grey.csi.cam.ac.uk>
References: <20170911013510.17202.qmail@ary.lan> <yblr2vcxzjn.fsf@w7.hardakers.net> <alpine.DEB.2.11.1709121124250.2628@grey.csi.cam.ac.uk> <59B7F771.5020607@redbarn.org> <alpine.DEB.2.11.1709121646180.2676@grey.csi.cam.ac.uk>
From: Richard Barnes <rlb@ipv.sx>
Date: Tue, 12 Sep 2017 10:04:43 -0700
Message-ID: <CAL02cgRj6R8hRUP810+eDdGVg1VovFYHAq_fA6uqiLAYdmt3LQ@mail.gmail.com>
To: Tony Finch <dot@dotat.at>
Cc: Paul Vixie <paul@redbarn.org>, dnsop <dnsop@ietf.org>, John Levine <johnl@taugh.com>, Wes Hardaker <wjhns1@hardakers.net>
Content-Type: multipart/alternative; boundary="f403045f2ed62ea4d90559010a26"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/vEcnkW5jTgvqhdSB68Xh9sPCdpI>
Subject: Re: [DNSOP] DNSOP Call for Adoption - draft-west-let-localhost-be-localhost
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 12 Sep 2017 17:04:48 -0000

On Tue, Sep 12, 2017 at 8:54 AM, Tony Finch <dot@dotat.at> wrote:

> Paul Vixie <paul@redbarn.org> wrote:
> >
> > while i've generally included a localhost.$ORIGIN A RR in zones that
> appear in
> > my stub resolver search lists, in order that "localhost" be found,
>
> I agree with the rest of your message but I want to highlight this bit
> because it is directly related to the main reason this draft exists.
>
> Your localhost records (like the ones I deleted from cam.ac.uk last week)
> are troublesome for the web browser same origin security policy: they can
> lead to vulnerabilites when your websites are accessed from multi-user
> machines and in other more obscure circumstances - for details, see
> http://seclists.org/bugtraq/2008/Jan/270


Cf.
https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00#section-4.1

When something shouldn't work, it shouldn't work.

--Richard



>
>
> Tony.
> --
> f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/  -  I xn--zr8h
> punycode
> Tyne, Dogger: Westerly backing southeastrly 4 or 5, occasionally 6 at
> first,
> then becoming cyclonic, mainly northwesterly later, 6 to gale 8,
> occasionally
> severe gale 9 later in south. Moderate or rough, occasionally very rough
> later
> in south. Rain. Good occasionally poor.
>
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop
>

v2.23.0 | Report a Bug | By Email