Re: [dnssd] Security through Obscurity

On 23 Jul 2014, at 21:51, RJ Atkinson <rja.lists@gmail.com> wrote:

> 
> (NOTE WELL: I am not a WG Chair, IESG member, IAB member,
> or authorised spokesperson for anyone other than myself.)
> 
> 
> Earlier Doug Otis wrote:
>> It is not safe to advertise such addresses in DNS, 
>> especially when security depends on address obscurity.
> 
> 
> I believe that the the vast majority of security folks
> would object to the notion that obscurity is a mechanism 
> capable of providing any meaningful security.
> 
> If a client were to ask me for advice on protecting their
> interior services or interior devices from the global Internet, 
> I would suggest at least a firewall (ranging from router ACLs 
> to an air-gap: depending upon their local needs and threat model) 
> and possibly also other measures (again, depending upon local
> needs and threat model).  Operational security is not 
> one-size-fits-all, in my experience, but relying upon 
> security-through-obscurity seems unwise to me.

Indeed. Though I’d argue that work such as RFC 7217 still has value.

>> It sounds like Ran wants to configure devices within a data-center.
> 
> 
> Incorrect.  To be very clear, my post to DNS-SD WG from earlier 
> this week definitely was NOT focused on data centre environments. 

I certainly didn’t take it that way.

Tim

> 
> Yours,
> 
> Ran
> 
> _______________________________________________
> dnssd mailing list
> dnssd@ietf.org
> https://www.ietf.org/mailman/listinfo/dnssd