Re: [dnssd] WG last call on draft-ietf-dnssd-mdns-dns-interop-01

[Douglas Otis <[e-mail]>]

On 7/18/15 10:29 PM, Andrew Sullivan wrote:
> On Sat, Jul 18, 2015 at 07:22:39PM +0000, Dave Thaler wrote:
>> 1) First sentence of section 3 missing end parenthesis:
>>>   Any interoperability between DNS (including prevailing operational
>>>   conventions and other resolution technologies will require
>>
>> I believe the end parenthesis belongs after "conventions".
> 
> Thanks, yes.
> 
>>
>> 2) Security Considerations:
>>>   This memo presents some requirements for future development, but does
>>>   not specify anything.  Therefore, it has no implications for security.
>>
>> The second sentence does not logically follow from the first sentence.
>> Specifically, does this memo surface any special requirements for security? 
>> If not, just say there are no additional security-specific requirements.
> 
> Well, _I_ don't think there are any more.  Doug seems to think so, but
> I can't exactly make out what he wants.
> 
>> 3) Appendix A: Add note to RFC editor to remove this section before publication?

Dear Andrew,

As noted in
https://www.kb.cert.org/vuls/id/550620
https://tools.ietf.org/html/draft-rafiee-dnssd-mdns-threatmodel-03#section-3.9.4.1
https://tools.ietf.org/html/draft-rafiee-dnssd-mdns-threatmodel-03#section-3.9.5

There are specific and significant security concerns related
to locally defined resources conveyed by mDNS. Interop
details relating to profiles might benefit security by
including a strategy to ascertain whether zones or labels
may have been established using mDNS via a proxy into DNS.

This might include the detection of a non-compliant IDNA
label or resources containing RFC1918 address space or
addresses below a ULA prefix.

Regards,
Douglas Otis