Re: Summary of the LLMNR Last Call

Russ Allbery <rra@stanford.edu> Tue, 20 September 2005 05:01 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EHaGT-0005cT-1J; Tue, 20 Sep 2005 01:01:57 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EHaGR-0005c2-3l for ietf@megatron.ietf.org; Tue, 20 Sep 2005 01:01:55 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA21949 for <ietf@ietf.org>; Tue, 20 Sep 2005 01:01:54 -0400 (EDT)
Received: from smtp3.stanford.edu ([171.67.16.138]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EHaMB-0000CS-7T for ietf@ietf.org; Tue, 20 Sep 2005 01:07:52 -0400
Received: from windlord.stanford.edu (windlord.Stanford.EDU [171.64.19.147]) by smtp3.Stanford.EDU (8.12.11/8.12.11) with ESMTP id j8K51eYU002448; Mon, 19 Sep 2005 22:01:40 -0700
Received: by windlord.stanford.edu (Postfix, from userid 1000) id 0573CE7CA7; Mon, 19 Sep 2005 22:01:40 -0700 (PDT)
From: Russ Allbery <rra@stanford.edu>
To: Bernard Aboba <aboba@internaut.com>
In-Reply-To: <Pine.LNX.4.61.0509192043550.28535@internaut.com> (Bernard Aboba's message of "Mon, 19 Sep 2005 21:31:05 -0700 (PDT)")
Organization: The Eyrie
References: <Pine.LNX.4.61.0509191647510.23762@internaut.com> <p0620074fbf5509dd070a@[192.168.2.2]> <Pine.LNX.4.61.0509192043550.28535@internaut.com>
Date: Mon, 19 Sep 2005 22:01:39 -0700
Message-ID: <87y85swcwc.fsf@windlord.stanford.edu>
User-Agent: Gnus/5.110004 (No Gnus v0.4) XEmacs/21.4.17 (linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c
Cc: Margaret Wasserman <margaret@thingmagic.com>, ietf@ietf.org
Subject: Re: Summary of the LLMNR Last Call
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
Sender: ietf-bounces@ietf.org
Errors-To: ietf-bounces@ietf.org

Bernard Aboba <aboba@internaut.com> writes:

> b. Confusion between security issues and namespace separation.  In
> peer-to-peer name resolution protocols, it is possible for a responder
> to demonstrate ownership of a name, via mechanisms such as DNSSEC.  It
> is also possible for a responder to demonstrate membership in a trusted
> group, such as via TSIG or IPsec.  If DNSSEC is available, spoofing
> attacks are not possible, and querying for FQDNs does not expose the
> sender to additional vulnerabilities.  Both the mDNS and LLMNR
> specifications agree on this point.

We agree that home burglary is a serious problem.  This is why we
recommend that everyone hire an armed guard for their house.  If your
house is monitored by armed guards, burglary is very unlikely.  Given that
there is an effective security mechanism available, there's really no need
to consider simple deterrants that won't provide true security.

> c. Lack of consideration of existing practice.  Internet hosts have used
> multiple name resolution mechanisms based on a single API for more than
> two decades, with no ill effects.

"No ill effects" is a horribly inaccurate description of the effects of
that design.  A much more accurate description would be that Internet
hosts have used multiple name resolution mechanisms through a single API
out of necessity for more than two decades, have suffered frequent ill
effects up to and including major outages because of it, but have
struggled along with that design because there are some features provided
by it that are too useful to completely dismiss in general.  That being
said, most systems attempt to avoid using those features when feasible and
attempt to make all sources of information match exactly to avoid the
serious and often hard-to-diagnose problems of conflicting information.

If you think that using /etc/hosts, NIS, and DNS at the same time on
systems to provide name resolution is a *success* story, your perceptions
of the practical problems of name resolution in Internet hosts is
drastically different than mine.  You've also had to maintain far less
code to try to work around bizarre inconsistencies in gethostbyname
responses than I have.

> I must admit that at one point, I did not see value in funding the RFC
> Editor to publish documents outside of the IETF process, via the RFC
> Editor Individual Submission route, described in RFC 3932.  However, now
> it has become abundantly evident that this represents an important
> safety mechanism that needs to be preserved going forward.

I suppose that's one reaction to a general IETF mailing list consensus
that a protocol raises serious concerns.  I don't think it's a
particularly useful one, though.

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>

_______________________________________________
Ietf mailing list
Ietf@ietf.org
https://www1.ietf.org/mailman/listinfo/ietf