IETF Logo Mail Archive

Re: [mif] DNS selection with HE-MIF

Ted Lemon <Ted.Lemon@nominum.com> Sun, 03 February 2013 16:06 UTC

Return-Path: <Ted.Lemon@nominum.com>
X-Original-To: mif@ietfa.amsl.com
Delivered-To: mif@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4040821F8605 for <mif@ietfa.amsl.com>; Sun, 3 Feb 2013 08:06:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.555
X-Spam-Level:
X-Spam-Status: No, score=-106.555 tagged_above=-999 required=5 tests=[AWL=0.044, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6FcEqn2z9LD6 for <mif@ietfa.amsl.com>; Sun, 3 Feb 2013 08:06:00 -0800 (PST)
Received: from exprod7og111.obsmtp.com (exprod7og111.obsmtp.com [64.18.2.175]) by ietfa.amsl.com (Postfix) with ESMTP id 9C58421F84E0 for <mif@ietf.org>; Sun, 3 Feb 2013 08:06:00 -0800 (PST)
Received: from shell-too.nominum.com ([64.89.228.229]) (using TLSv1) by exprod7ob111.postini.com ([64.18.6.12]) with SMTP ID DSNKUQ6K6OYVtGlmVaQF7Wl8nIkVFMw8R4sQ@postini.com; Sun, 03 Feb 2013 08:06:00 PST
Received: from archivist.nominum.com (archivist.nominum.com [64.89.228.108]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by shell-too.nominum.com (Postfix) with ESMTP id 390571B8536 for <mif@ietf.org>; Sun, 3 Feb 2013 08:06:00 -0800 (PST)
Received: from webmail.nominum.com (cas-01.win.nominum.com [64.89.228.131]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (Client CN "mail.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by archivist.nominum.com (Postfix) with ESMTPS id 30934190043; Sun, 3 Feb 2013 08:06:00 -0800 (PST) (envelope-from Ted.Lemon@nominum.com)
Received: from MBX-01.WIN.NOMINUM.COM ([64.89.228.133]) by CAS-01.WIN.NOMINUM.COM ([64.89.228.131]) with mapi id 14.02.0318.004; Sun, 3 Feb 2013 08:05:55 -0800
From: Ted Lemon <Ted.Lemon@nominum.com>
To: Keith Moore <moore@network-heretics.com>
Thread-Topic: [mif] DNS selection with HE-MIF
Thread-Index: AQHOAhiC0CZRnojC20SeBNCskG9mTphowXmAgAALy4CAAAVXAA==
Date: Sun, 03 Feb 2013 16:05:54 +0000
Message-ID: <8D23D4052ABE7A4490E77B1A012B63074747BCF6@mbx-01.win.nominum.com>
References: <CAM+vMERak2vAoYFeSLRep2xjpm480qPjutyv4-tV=KtU0XO=fw@mail.gmail.com> <8D23D4052ABE7A4490E77B1A012B630747479BA9@mbx-01.win.nominum.com> <CAM+vMETvE==qUZO2_rhyUB+=ChUR4a9CoTCF+q=gBL2cRA+0UA@mail.gmail.com> <8D23D4052ABE7A4490E77B1A012B63074747BB1E@mbx-01.win.nominum.com> <510E8667.3020608@network-heretics.com>
In-Reply-To: <510E8667.3020608@network-heretics.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [192.168.1.10]
Content-Type: text/plain; charset="us-ascii"
Content-ID: <35AEE5C94A04CA40A9EB956D5B89BEDB@nominum.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "<mif@ietf.org>" <mif@ietf.org>
Subject: Re: [mif] DNS selection with HE-MIF
X-BeenThere: mif@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Multiple Interface Discussion List <mif.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mif>, <mailto:mif-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/mif>
List-Post: <mailto:mif@ietf.org>
List-Help: <mailto:mif-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mif>, <mailto:mif-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Feb 2013 16:06:01 -0000

On Feb 3, 2013, at 10:46 AM, Keith Moore <moore@network-heretics.com> wrote:
> Problem is, this is bad for the Internet architecture, as it basically encourages using DNS as a routing protocol.

I think using DNS for CDNs is a bad idea, and it's also something that I think people are moving away from, but it is an issue, so I described it.   All of the use cases I described are essentially abuses of the DNS; the question is whether we will spec out something that is robust in the face of these abuses, or whether we will spec out something that simply falls over and dies when people abuse the DNS.

In my mind, these scenarios are essentially DoS attack scenarios: the end user is being attacked by the DNS provider in a provisioning domain, who is giving them corrupt data that will negatively impact their use of the network.   The question is, do we allow that attack to spill over into other provisioning domains, or do we spec out a standard that prevents such spill-over?

v2.23.0 | Report a Bug | By Email