Re: [dnssd] Stephen Farrell's No Objection on draft-ietf-dnssd-requirements-05: (with COMMENT)

[Stephen Farrell <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hiya,

On 17/03/15 20:25, Tom Pusateri wrote:
> I'm not sure I understand your scenario.
> 
> Clients issue searches in the form of unicast DNS queries to DNS 
> servers (or proxies). This is the same as with wide-area bonjour. 
> Only now, this may cause the proxies to issue their own multicast 
> queries on a local network in order to ensure their cache is
> current. The original client's searches are never broadcast further
> than they were before. A bad actor would have to intercept the
> unicast queries from the client (which may be TLS encoded). To do
> this, the bad actor must have compromised some network device to do
> this.

So I don't think the above is clear from the requirements draft,
which is all I've so far read. It may be clear later that there's
no significant new threat in this respect due to a specific design
having been adopted, and if so that's good.

S.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBAgAGBQJVCI5uAAoJEC88hzaAX42if+kH/162SKw51bx/T1hp25ey5aQ2
pJm9GRCnVjEuvF4UqOmaybeG6GE/CfI+r3cpH8xpxBbBT64HTw89/Ww1hzYX9suu
nEDaOjocCADuPIOYItG0m+LoPWpx4NOVwiu7/MC/8wXBH25SbhNjGm/PwCmTVhrA
uI6vQLoQryS+M1IxZIqAYoRM9TEFjrMnOWm6XwsrYzzheRiKFTUO/u33c9W1Ic+B
tljQTWQ4sDhVPLHnJ1d4NH1to2RN8WSt1tedgtwfRK9ZCC6YuRTf/Qo33AW5wDJW
tWV74yeIMANRR4Lp48KXuUV/AaiQTw5/CNDt1Ug9hNQ3dLJqA25A5zI5oq3nZ+s=
=CK7A
-----END PGP SIGNATURE-----