4 ms·

To be honest though, ANY is mostly used for reflection/amplification attacks or to scrape domain records. Sure there are legitimate uses for them but I can't th

by daenney 10y ago

To be honest though, ANY is mostly used for reflection/amplification attacks or to scrape domain records. Sure there are legitimate uses for them but I can't think of many that need to happen over the internet vs. only allowing that from specific trusted parties. And yes I'm aware that it can be useful as a debugging tool. There are also ISP recursors that don't allow ANY queries through for similar reasons so relying on it will cause trouble for some and there are other broken implementations in the wild. Though ANY can be useful it shouldn't be assumed that it'll work. What I'm thinking they could've done in the case of ANY is to respond with truncated and switch to TCP mode at which point it becomes harder to do the spoofing dance and (ab)use ANY as a DNS amplification attack to DDoS a target. Unfortunately that does put an extra cost on the DNS server which might also be undesirable. However that would've probably been a worthwhile tradeoff. There's an IETF draft that attempts to provide some guidance in the area of the ANY query: https://tools.ietf.org/html/draft-ietf-dnsop-refuse-any-04 https://tools.ietf.org/html/draft-ietf-dnsop-refuse-any-04

fapjacks 10y ago
Well, two out of the three people proposing that document work for Cloudflare. The other works for Dyn. It's clear what their motivation is. And this is not the first time they've filed a document just like that, and it will expire this year just like it has in the past. That document is bullshit. It's trying to now change the standard after they've already broken their DNS implementations.
- chrisbolt 10y ago
  Your comment doesn't address ANY of the arguments you're replying to. Are ANY queries typically used outside of attacks, scraping, or diagnosis? Is there a reason they need to be served over UDP? > Well, two out of the three people proposing that document work for Cloudflare. The other works for Dyn. Two companies that have some experience with dealing with DNS attacks. Their motivation may be self-serving, but they're not the ones doing the attacking.
  - fapjacks 10y ago
    No, they're the ones tossing the standard and then trying to retroactively change it. Cloudflare sucks.

by daenney 10y ago

fapjacks 10y ago

Well, two out of the three people proposing that document work for Cloudflare. The other works for Dyn. It's clear what their motivation is. And this is not the first time they've filed a document just like that, and it will expire this year just like it has in the past. That document is bullshit. It's trying to now change the standard after they've already broken their DNS implementations.

chrisbolt 10y ago
Your comment doesn't address ANY of the arguments you're replying to. Are ANY queries typically used outside of attacks, scraping, or diagnosis? Is there a reason they need to be served over UDP? > Well, two out of the three people proposing that document work for Cloudflare. The other works for Dyn. Two companies that have some experience with dealing with DNS attacks. Their motivation may be self-serving, but they're not the ones doing the attacking.
- fapjacks 10y ago
  No, they're the ones tossing the standard and then trying to retroactively change it. Cloudflare sucks.