Re: [dnsext] the same in old days, was making names the same NEED protocol changes?

[Alex Bligh <[e-mail]>]

--On 27 February 2011 13:37:17 -0500 "John R. Levine" <[e-mail]> 
wrote:

>>> The primary shortcoming I see is a security issue: anyone can set a
>>> BNAME to make a random name equivalent to one of mine.
>
>> How does this differ from DNAME?
>
> Not in any important way I can see.  But I'm not aware of any application
> servers that autoconfigure based on DNAME, either.

I think I'm being thick here. Doesn't the BNAME reference go the
wrong way to autoconfigure a server based on it in a manner where
there can be a security problem as a result? IE Mallory's BNAME
record tells you which zone Mallory's zone is equivalent to.
Mallory's BNAME record does not tell you which other zones
(incl. Mallory's) are equivalent to yours. What would make
your server query Mallory's BNAME record at config time anyway?

-- 
Alex Bligh
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext