[dnssd] Security through Obscurity

[RJ Atkinson <[e-mail]>]

(NOTE WELL: I am not a WG Chair, IESG member, IAB member,
or authorised spokesperson for anyone other than myself.)


Earlier Doug Otis wrote:
> It is not safe to advertise such addresses in DNS, 
> especially when security depends on address obscurity.


I believe that the the vast majority of security folks
would object to the notion that obscurity is a mechanism 
capable of providing any meaningful security.

If a client were to ask me for advice on protecting their
interior services or interior devices from the global Internet, 
I would suggest at least a firewall (ranging from router ACLs 
to an air-gap: depending upon their local needs and threat model) 
and possibly also other measures (again, depending upon local
needs and threat model).  Operational security is not 
one-size-fits-all, in my experience, but relying upon 
security-through-obscurity seems unwise to me.


> It sounds like Ran wants to configure devices within a data-center.


Incorrect.  To be very clear, my post to DNS-SD WG from earlier 
this week definitely was NOT focused on data centre environments. 

Yours,

Ran