7 ms·

Paul Vixie: Taking Back the DNS

73 points by blasdel 16y ago

didtrade 16y ago
<a href="http://www.didtrade.com/>www.didtrade.com http://www.didtrade.com/>www.didtrade.co... Online sell fashion goods,Accept PayPal.cheap replica fashion goods for sale from china free shipping</a> <a href="http://www.didtrade.com/Replica-Children-Suit-category277.html>Replica http://www.didtrade.com/Replica-Children-Suit-category277.ht... Children-suit free shipping</a> <a href="http://www.didtrade.com/Replica-Tshirt-category172.html>Replica http://www.didtrade.com/Replica-Tshirt-category172.html>... t-shirts free shipping</a> <a href="http://www.didtrade.com/Replica-Children-Tshirts-category276.html>Replica http://www.didtrade.com/Replica-Children-Tshirts-category276... Children-coat free shipping</a> <a href="http://www.didtrade.com/Replica-Children-Jeans-category430.html>Replica http://www.didtrade.com/Replica-Children-Jeans-category430.h... Children-pants free shipping</a> <a href="http://www.didtrade.com/Fashion-UGGwomenBoot-category405.html>Replica http://www.didtrade.com/Fashion-UGGwomenBoot-category405.htm... UGG boots free shipping</a> <a href="http://www.didtrade.com/Replica-EdHardy-Handbag-category153.html>Replica http://www.didtrade.com/Replica-EdHardy-Handbag-category153.... Edhardy handbags free shipping</a> <a href="http://www.didtrade.com/Replica-LV-Handbag-category150.html>Replica http://www.didtrade.com/Replica-LV-Handbag-category150.html&... LV handbags free shipping</a> <a href="http://www.didtrade.com/Replica-DG-Handbag-category148.html>Replica http://www.didtrade.com/Replica-DG-Handbag-category148.html&... DG handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Gucci-Handbag-category154.html>Replica http://www.didtrade.com/Replica-Gucci-Handbag-category154.ht... Gucci handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Chanel-Handbag-category155.html>Replica http://www.didtrade.com/Replica-Chanel-Handbag-category155.h... chanel handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Fendi-handbag-category348.html>Replica http://www.didtrade.com/Replica-Fendi-handbag-category348.ht... fendi handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Swim-category168.html>Replica http://www.didtrade.com/Replica-Swim-category168.html>&#... Swimwear free shipping</a> <a href="http://www.didtrade.com/Replica-Versace-Handbag-category149.html>Replica http://www.didtrade.com/Replica-Versace-Handbag-category149.... Versace handbags free shipping</a> <a href="http://www.didtrade.com/Replica-coach-Handbag-category156.html>Replica http://www.didtrade.com/Replica-coach-Handbag-category156.ht... coach handbags free shipping</a> <a href="http://www.didtrade.com/Replica--juicy-handbag-category202.html>Replica http://www.didtrade.com/Replica--juicy-handbag-category202.h... juicy handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Burberry-Handbag-category185.html>Replica http://www.didtrade.com/Replica-Burberry-Handbag-category185... Burberry handbags free shipping</a> <a href="http://www.didtrade.com/Replica-CA-Handbag-category162.html>Replica http://www.didtrade.com/Replica-CA-Handbag-category162.html&... CA handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Dior-Handbag-category163.html>Replica http://www.didtrade.com/Replica-Dior-Handbag-category163.htm... Dior handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Watches-category174.html>Replica http://www.didtrade.com/Replica-Watches-category174.html&#62... watches free shipping</a> <a href="http://www.didtrade.com/Replica-Perfume-category178.html>Replica http://www.didtrade.com/Replica-Perfume-category178.html&#62... Perfume free shipping</a> <a href="http://www.didtrade.com/Replica--Wallets-category186.html>Replica http://www.didtrade.com/Replica--Wallets-category186.html&#6... brand wallet free shipping</a> <a href="http://www.didtrade.com/replica-jeans-category147.html>Replica http://www.didtrade.com/replica-jeans-category147.html>&... Jeans free shipping</a> <a href="http://www.didtrade.com/Replica-Jewelry-category180.html>Replica http://www.didtrade.com/Replica-Jewelry-category180.html&#62... Jewelry free shipping</a> <a href="http://www.didtrade.com/Replica-Sungla-category177.html>Replica http://www.didtrade.com/Replica-Sungla-category177.html>... Sunglasses free shipping</a> <a href="http://www.didtrade.com/Replica-Belt-category173.html>Replica http://www.didtrade.com/Replica-Belt-category173.html>&#... Belt free shipping</a> <a href="http://www.didtrade.com/Acceories-category184.html>Replica http://www.didtrade.com/Acceories-category184.html><... Accessories free shipping</a> <a href="http://www.didtrade.com/>Replica http://www.didtrade.com/>Replica AAA Handbags free shipping</a> <a href="http://www.tradeshown.com/>accept http://www.tradeshown.com/>accept PayPal</a> <a href="http://www.tradeshown.com/>free http://www.tradeshown.com/>free shipping</a> <a href="http://www.tradeshown.com/>coach http://www.tradeshown.com/>coach handbag</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica brand</a> <a href="http://www.tradeshown.com/>bags,purse,wallet</a> bags,purse,wa... /> <a href="http://www.tradeshown.com/>fashion http://www.tradeshown.com/>fashion jeans</a> <a href="http://www.tradeshown.com/>famous http://www.tradeshown.com/>famous wholesale</a> <a href="http://www.tradeshown.com/>chanel http://www.tradeshown.com/>chanel handbag</a> <a href="http://www.tradeshown.com/>rolex http://www.tradeshown.com/>rolex watches</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica shoe</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica apparel</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica jewelry</a> <a href="http://www.tradeshown.com/>Replica http://www.tradeshown.com/>Replica Children</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica belt</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica suit</a> <a href="http://www.tradeshown.com/>Replica http://www.tradeshown.com/>Replica Scarves</a> <a href="http://www.tradeshown.com/>Replica http://www.tradeshown.com/>Replica Perfume</a> <a href="http://www.tradeshown.com/>fashion http://www.tradeshown.com/>fashion caps</a> <a href="http://www.tradeshown.com/>LV http://www.tradeshown.com/>LV handbag</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica sunglass</a> <a href="http://www.tradeshown.com/>7* http://www.tradeshown.com/>7* star handbags</a> <a href="http://www.tradeshown.com/>wholesale http://www.tradeshown.com/>wholesale apparel</a> <a href="http://www.tradeshown.com/>chanel http://www.tradeshown.com/>chanel jewelry</a> <a href="http://www.tradeshown.com/>DG http://www.tradeshown.com/>DG handbag</a> <a href="http://www.tradeshown.com/>Versace http://www.tradeshown.com/>Versace handbag</a> <a href="http://www.tradeshown.com/>Jimmy http://www.tradeshown.com/>Jimmy Choo Handbag</a> <a href="http://www.tradeshown.com/>Lacoste http://www.tradeshown.com/>Lacoste Handbag</a> <a href="http://www.tradeshown.com/>Juicy http://www.tradeshown.com/>Juicy handbag</a> <a href="http://www.tradeshown.com/>Burberry http://www.tradeshown.com/>Burberry handbag</a> <a href="http://www.tradeshown.com/>EdHardy http://www.tradeshown.com/>EdHardy Handbag</a> <a href="http://www.tradeshown.com/>Gucci http://www.tradeshown.com/>Gucci handbag</a> <a href="http://www.tradeshown.com/>DooneyBourke http://www.tradeshown.com/>DooneyBourke handbag</a> <a href="http://www.tradeshown.com/>Hermes http://www.tradeshown.com/>Hermes handbag</a> <a href="http://www.tradeshown.com/>Prada http://www.tradeshown.com/>Prada handbag</a> <a href="http://www.tradeshown.com/>Fendi http://www.tradeshown.com/>Fendi handbag</a> <a href="http://www.tradeshown.com/>Dior http://www.tradeshown.com/>Dior Handbag</a> <a href="http://www.tradeshown.com/>TR http://www.tradeshown.com/>TR Jeans</a> <a href="http://www.tradeshown.com/>AF http://www.tradeshown.com/>AF Jeans</a> <a href="http://www.tradeshown.com/>ED http://www.tradeshown.com/>ED Jeans</a> <a href="http://www.tradeshown.com/>Polo http://www.tradeshown.com/>Polo T-shirts</a> <a href="http://www.tradeshown.com/>AF http://www.tradeshown.com/>AF T-shirts</a> <a href="http://www.tradeshown.com/>Nike http://www.tradeshown.com/>Nike Sport Shoes</a> <a href="http://www.tradeshown.com/>Jordan http://www.tradeshown.com/>Jordan Sport Shoes</a>
thaumaturgy 16y ago
I really hope this latest internet vigilante project from Paul falls flat on its face. To say that his RBL project failed to stop spam is a candidate for 'understatement of the decade'; it not only completely, unutterably, miserably, and totally failed to even slow down spam in any measurable way, but it created an unending series of headaches for system administrators and customers caught in the middle of warring ISPs. Coincidentally, just a few minutes ago -- just before loading up HN for the first time in a while -- I received an email from one of my clients asking me for advice. Their domain provider has been listed by SORBS, the domain provider is arguing that the listing was unwarranted and is refusing to pay any of the $50 "fine" that SORBS may request, if they request it. I have had to handle situations like this at least several times a year, and I'm not even an ISP. Another of my clients, a while back, briefly had their DSL IP listed in an RBL. They don't run a mail server from that IP, I vigilantly monitor their network for any signs of abuse so I'm fairly confident that there are no zombies on the network, and everyone's workstation is configured to send mail to an outbound mail server. Despite all this, the temporary listing in the RBL caused intermittent email disruption with misconfigured recipient servers that were incorrectly checking email headers for intermediate IPs listed in the RBL (mostly, ISPs using Barracuda Networks' latest bits of vomit). I contacted the RBL through the appropriate channels, and a few days later the block was removed without any other response or explanation from them. This is absurdity. This is not how a healthy "internet" can work. This juvenile "my network, my rules" approach is no different from opposition to net neutrality. This isn't a small network of universities and hobbyists anymore; this is a global network of businesses that, for better or worse, rely on this system to handle important and time-sensitive information. I would argue that, if you're an internet service provider or are otherwise accepting payment from customers for the purposes of handling some aspect of their electronic communications, then you are duty-bound to take every reasonable effort to ensure that all communications destined for them are able to reach them, and all of their communications are able to reach their destination. That means, for example, not subscribing to RBLs for the sake of lightening the load on your mail server and silently dropping email without notification to your customer. There are better ways to handle spam now -- greylisting, user-configurable controls, etc. -- and issues in DNS are already being worked on by groups providing services to end users. I would really prefer not to see the adoption of another RBL-like system, since the first one managed to fail so spectacularly at all of its goals.
blocke 16y ago
Sad to say blacklisting malicious domains to mitigate the damage from e-mail based phishing attacks targeting .edus is something I've had to do in the past. I'm definitely interested in seeing what kind of community develops around this patch. If a good .edu focused anti-phishing feed shows up I'd strongly consider using it at work.
thyrsus 16y ago
What will, e.g., China do with this technology?
- mike-cardwell 16y ago
  Absolutely nothing that they can't already do, and do on a regular basis.
- dedward 16y ago
  There's no technologically huge breakthrough, just a suggestion that, instead of higher level abstractions, this could be handled by a simple, compatible modification to the existing DNS protocol. This is something that administrators already do through less elegant and less scalable methods. It's trivial to put together a list of domains, or subscribe to a list, and have them resolve differnetly.
robotkad 16y ago
Awesome. Censorship built right into BIND. Why didn't Senator Conroy think of this?
- dedward 16y ago
  As long as the root servers don't start using it, it remains a localized issue....
sabat 16y ago
If this was actually an implementation of "my network, my rules," I suppose it would be OK. From what I've read, though, it's not. It's "my Internet, my rules." Just like RBL, if some random sysadmin decides he doesn't like your domain name, it goes on a blacklist and you will vanish from most of the Internet.
- dedward 16y ago
  It sounds more like "My internet, my rules, but I'm also going to make those rules available to others in case they care to use them somehow." Some jackass who abuses that system will be systematically ignored.
dedward 16y ago
Reading the spec - this is really a fairly elegant re-purposing/hack of the DNS mechanism to allow DNS administrators to have their servers configured to use their existing protocol stacks to "subscribe" to other administrator-configured policy servers, and to have lookups screened against them. Just like we do with DNSRBL now for mail. It's completely up to the DNS server administrator which policy servers they are going to configure or not, including using none at all. In short - I don't see what all the negative fuss is over - corporate networks already filter based on subscribed lists via proxies, home-made things, etc - this is just bringing that ability into the DNS stack in an elegant way.
- qjz 16y ago
  It's trivial to blackhole a domain if you run your own DNS, without adding any new features to bind. I do it all the time, by becoming authoritative at whatever level of the domain I need. But it takes special consideration and monitoring to avoid creating new problems. The threat here is that someone will identify a "bad website" and blacklist the domain via some publicly available policy server, which suddenly makes all services, not just HTTP, unavailable. For example, this means you might not be able to notify the admins of a domain via email if they host a blog (possibly yours) that gets exploited. Due to the fundamental nature of the service DNS provides, this could be an easy way to DOS an entire domain and all of its services.
jws 16y ago
How have they learned from the debacle of RBLs and censoring firewalls? I finally stopped running my own mail servers after 20 years because of the block lists. The RBL's continued false, silent bans caused too many mail delivery failures. The RBL's don't care about me, so I had to outsource to a mail provider so large the RBL's have to care.[1] On censoring firewalls. There are businesses which cause their competitors to be blocked by http censorship lists. It is unlawful, but the censorship engines accept anonymous input to make their decisions and it isn't hard to hide the tortious interference. Will DNS blocking have a similar effect of squelching the small and the new? Will it be abusable by nefarious people? [1] For many years I didn't see RBLs as a problem, until I no longer controlled a large block of IPs that I had had from the early days of the internet. Now I have servers in mixed blocks. and most useless of all for email and web servers, reused IPs. (Blockers sometimes remember the sins of years ago and reinstate blocks based on a previous owner.)
kiwidrew 16y ago
I can't help but imagine the terrible implications this has for new startups. Want to launch your awesome new webapp? Too bad, because your domain is "too new" and so nobody's DNS will resolve it yet. And so your first task will be to go around to all of the DNSRBL organizations and plead with them to put you on the "good guys" list; as others have pointed out, if the current crop of e-mail RBL groups are anything to go by, this will be a frustrating and opaque process. The network infrastructure shouldn't be in the business of enforcing policy, period. This is exactly the same slippery slope as the net neutrality debate, and in just the same way, it favours the existing players and those with the deepest pockets. Do we, as startups, really need yet another disadvantage?
datd00d 16y ago
I am with thaumaturgy, i hope this fails its just another application of old school thinking. The same thought processes that brought us these horribly designed protocols and their bandaid fixes (dns sec anyone?). Hopefully these old guys will just retire and leave ietf and other such organization that they seem to monopolize to the generation they created this mess for.
maw 16y ago
In economics, there's a distinction between the normative and the positive. The former describes what ought to be and the latter describes what is. The concept seems relevant here. Operators ought not block mail solely due to some RBL data. Users ought not report legitimate mail as spam and those reported "spams" ought not be fed into blacklists. (I gave up on Vipul's Razor as a bad job once I noticed that this happens.) System administrators ought to focus on providing useful mail service—blocking spam ought to be an aftereffect. And so on. Not enough of these are. They sometimes are, of course, but it just takes a few system administrators with fucked up priorities to ruin it for the rest of us. Vixie's proposal won't help anybody.

7 ms·

Paul Vixie: Taking Back the DNS

73 points by blasdel 16y ago

didtrade 16y ago
<a href="http://www.didtrade.com/>www.didtrade.com http://www.didtrade.com/>www.didtrade.co... Online sell fashion goods,Accept PayPal.cheap replica fashion goods for sale from china free shipping</a> <a href="http://www.didtrade.com/Replica-Children-Suit-category277.html>Replica http://www.didtrade.com/Replica-Children-Suit-category277.ht... Children-suit free shipping</a> <a href="http://www.didtrade.com/Replica-Tshirt-category172.html>Replica http://www.didtrade.com/Replica-Tshirt-category172.html>... t-shirts free shipping</a> <a href="http://www.didtrade.com/Replica-Children-Tshirts-category276.html>Replica http://www.didtrade.com/Replica-Children-Tshirts-category276... Children-coat free shipping</a> <a href="http://www.didtrade.com/Replica-Children-Jeans-category430.html>Replica http://www.didtrade.com/Replica-Children-Jeans-category430.h... Children-pants free shipping</a> <a href="http://www.didtrade.com/Fashion-UGGwomenBoot-category405.html>Replica http://www.didtrade.com/Fashion-UGGwomenBoot-category405.htm... UGG boots free shipping</a> <a href="http://www.didtrade.com/Replica-EdHardy-Handbag-category153.html>Replica http://www.didtrade.com/Replica-EdHardy-Handbag-category153.... Edhardy handbags free shipping</a> <a href="http://www.didtrade.com/Replica-LV-Handbag-category150.html>Replica http://www.didtrade.com/Replica-LV-Handbag-category150.html&... LV handbags free shipping</a> <a href="http://www.didtrade.com/Replica-DG-Handbag-category148.html>Replica http://www.didtrade.com/Replica-DG-Handbag-category148.html&... DG handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Gucci-Handbag-category154.html>Replica http://www.didtrade.com/Replica-Gucci-Handbag-category154.ht... Gucci handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Chanel-Handbag-category155.html>Replica http://www.didtrade.com/Replica-Chanel-Handbag-category155.h... chanel handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Fendi-handbag-category348.html>Replica http://www.didtrade.com/Replica-Fendi-handbag-category348.ht... fendi handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Swim-category168.html>Replica http://www.didtrade.com/Replica-Swim-category168.html>&#... Swimwear free shipping</a> <a href="http://www.didtrade.com/Replica-Versace-Handbag-category149.html>Replica http://www.didtrade.com/Replica-Versace-Handbag-category149.... Versace handbags free shipping</a> <a href="http://www.didtrade.com/Replica-coach-Handbag-category156.html>Replica http://www.didtrade.com/Replica-coach-Handbag-category156.ht... coach handbags free shipping</a> <a href="http://www.didtrade.com/Replica--juicy-handbag-category202.html>Replica http://www.didtrade.com/Replica--juicy-handbag-category202.h... juicy handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Burberry-Handbag-category185.html>Replica http://www.didtrade.com/Replica-Burberry-Handbag-category185... Burberry handbags free shipping</a> <a href="http://www.didtrade.com/Replica-CA-Handbag-category162.html>Replica http://www.didtrade.com/Replica-CA-Handbag-category162.html&... CA handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Dior-Handbag-category163.html>Replica http://www.didtrade.com/Replica-Dior-Handbag-category163.htm... Dior handbags free shipping</a> <a href="http://www.didtrade.com/Replica-Watches-category174.html>Replica http://www.didtrade.com/Replica-Watches-category174.html&#62... watches free shipping</a> <a href="http://www.didtrade.com/Replica-Perfume-category178.html>Replica http://www.didtrade.com/Replica-Perfume-category178.html&#62... Perfume free shipping</a> <a href="http://www.didtrade.com/Replica--Wallets-category186.html>Replica http://www.didtrade.com/Replica--Wallets-category186.html&#6... brand wallet free shipping</a> <a href="http://www.didtrade.com/replica-jeans-category147.html>Replica http://www.didtrade.com/replica-jeans-category147.html>&... Jeans free shipping</a> <a href="http://www.didtrade.com/Replica-Jewelry-category180.html>Replica http://www.didtrade.com/Replica-Jewelry-category180.html&#62... Jewelry free shipping</a> <a href="http://www.didtrade.com/Replica-Sungla-category177.html>Replica http://www.didtrade.com/Replica-Sungla-category177.html>... Sunglasses free shipping</a> <a href="http://www.didtrade.com/Replica-Belt-category173.html>Replica http://www.didtrade.com/Replica-Belt-category173.html>&#... Belt free shipping</a> <a href="http://www.didtrade.com/Acceories-category184.html>Replica http://www.didtrade.com/Acceories-category184.html><... Accessories free shipping</a> <a href="http://www.didtrade.com/>Replica http://www.didtrade.com/>Replica AAA Handbags free shipping</a> <a href="http://www.tradeshown.com/>accept http://www.tradeshown.com/>accept PayPal</a> <a href="http://www.tradeshown.com/>free http://www.tradeshown.com/>free shipping</a> <a href="http://www.tradeshown.com/>coach http://www.tradeshown.com/>coach handbag</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica brand</a> <a href="http://www.tradeshown.com/>bags,purse,wallet</a> bags,purse,wa... /> <a href="http://www.tradeshown.com/>fashion http://www.tradeshown.com/>fashion jeans</a> <a href="http://www.tradeshown.com/>famous http://www.tradeshown.com/>famous wholesale</a> <a href="http://www.tradeshown.com/>chanel http://www.tradeshown.com/>chanel handbag</a> <a href="http://www.tradeshown.com/>rolex http://www.tradeshown.com/>rolex watches</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica shoe</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica apparel</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica jewelry</a> <a href="http://www.tradeshown.com/>Replica http://www.tradeshown.com/>Replica Children</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica belt</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica suit</a> <a href="http://www.tradeshown.com/>Replica http://www.tradeshown.com/>Replica Scarves</a> <a href="http://www.tradeshown.com/>Replica http://www.tradeshown.com/>Replica Perfume</a> <a href="http://www.tradeshown.com/>fashion http://www.tradeshown.com/>fashion caps</a> <a href="http://www.tradeshown.com/>LV http://www.tradeshown.com/>LV handbag</a> <a href="http://www.tradeshown.com/>replica http://www.tradeshown.com/>replica sunglass</a> <a href="http://www.tradeshown.com/>7* http://www.tradeshown.com/>7* star handbags</a> <a href="http://www.tradeshown.com/>wholesale http://www.tradeshown.com/>wholesale apparel</a> <a href="http://www.tradeshown.com/>chanel http://www.tradeshown.com/>chanel jewelry</a> <a href="http://www.tradeshown.com/>DG http://www.tradeshown.com/>DG handbag</a> <a href="http://www.tradeshown.com/>Versace http://www.tradeshown.com/>Versace handbag</a> <a href="http://www.tradeshown.com/>Jimmy http://www.tradeshown.com/>Jimmy Choo Handbag</a> <a href="http://www.tradeshown.com/>Lacoste http://www.tradeshown.com/>Lacoste Handbag</a> <a href="http://www.tradeshown.com/>Juicy http://www.tradeshown.com/>Juicy handbag</a> <a href="http://www.tradeshown.com/>Burberry http://www.tradeshown.com/>Burberry handbag</a> <a href="http://www.tradeshown.com/>EdHardy http://www.tradeshown.com/>EdHardy Handbag</a> <a href="http://www.tradeshown.com/>Gucci http://www.tradeshown.com/>Gucci handbag</a> <a href="http://www.tradeshown.com/>DooneyBourke http://www.tradeshown.com/>DooneyBourke handbag</a> <a href="http://www.tradeshown.com/>Hermes http://www.tradeshown.com/>Hermes handbag</a> <a href="http://www.tradeshown.com/>Prada http://www.tradeshown.com/>Prada handbag</a> <a href="http://www.tradeshown.com/>Fendi http://www.tradeshown.com/>Fendi handbag</a> <a href="http://www.tradeshown.com/>Dior http://www.tradeshown.com/>Dior Handbag</a> <a href="http://www.tradeshown.com/>TR http://www.tradeshown.com/>TR Jeans</a> <a href="http://www.tradeshown.com/>AF http://www.tradeshown.com/>AF Jeans</a> <a href="http://www.tradeshown.com/>ED http://www.tradeshown.com/>ED Jeans</a> <a href="http://www.tradeshown.com/>Polo http://www.tradeshown.com/>Polo T-shirts</a> <a href="http://www.tradeshown.com/>AF http://www.tradeshown.com/>AF T-shirts</a> <a href="http://www.tradeshown.com/>Nike http://www.tradeshown.com/>Nike Sport Shoes</a> <a href="http://www.tradeshown.com/>Jordan http://www.tradeshown.com/>Jordan Sport Shoes</a>
thaumaturgy 16y ago
I really hope this latest internet vigilante project from Paul falls flat on its face. To say that his RBL project failed to stop spam is a candidate for 'understatement of the decade'; it not only completely, unutterably, miserably, and totally failed to even slow down spam in any measurable way, but it created an unending series of headaches for system administrators and customers caught in the middle of warring ISPs. Coincidentally, just a few minutes ago -- just before loading up HN for the first time in a while -- I received an email from one of my clients asking me for advice. Their domain provider has been listed by SORBS, the domain provider is arguing that the listing was unwarranted and is refusing to pay any of the $50 "fine" that SORBS may request, if they request it. I have had to handle situations like this at least several times a year, and I'm not even an ISP. Another of my clients, a while back, briefly had their DSL IP listed in an RBL. They don't run a mail server from that IP, I vigilantly monitor their network for any signs of abuse so I'm fairly confident that there are no zombies on the network, and everyone's workstation is configured to send mail to an outbound mail server. Despite all this, the temporary listing in the RBL caused intermittent email disruption with misconfigured recipient servers that were incorrectly checking email headers for intermediate IPs listed in the RBL (mostly, ISPs using Barracuda Networks' latest bits of vomit). I contacted the RBL through the appropriate channels, and a few days later the block was removed without any other response or explanation from them. This is absurdity. This is not how a healthy "internet" can work. This juvenile "my network, my rules" approach is no different from opposition to net neutrality. This isn't a small network of universities and hobbyists anymore; this is a global network of businesses that, for better or worse, rely on this system to handle important and time-sensitive information. I would argue that, if you're an internet service provider or are otherwise accepting payment from customers for the purposes of handling some aspect of their electronic communications, then you are duty-bound to take every reasonable effort to ensure that all communications destined for them are able to reach them, and all of their communications are able to reach their destination. That means, for example, not subscribing to RBLs for the sake of lightening the load on your mail server and silently dropping email without notification to your customer. There are better ways to handle spam now -- greylisting, user-configurable controls, etc. -- and issues in DNS are already being worked on by groups providing services to end users. I would really prefer not to see the adoption of another RBL-like system, since the first one managed to fail so spectacularly at all of its goals.
blocke 16y ago
Sad to say blacklisting malicious domains to mitigate the damage from e-mail based phishing attacks targeting .edus is something I've had to do in the past. I'm definitely interested in seeing what kind of community develops around this patch. If a good .edu focused anti-phishing feed shows up I'd strongly consider using it at work.
thyrsus 16y ago
What will, e.g., China do with this technology?
- mike-cardwell 16y ago
  Absolutely nothing that they can't already do, and do on a regular basis.
- dedward 16y ago
  There's no technologically huge breakthrough, just a suggestion that, instead of higher level abstractions, this could be handled by a simple, compatible modification to the existing DNS protocol. This is something that administrators already do through less elegant and less scalable methods. It's trivial to put together a list of domains, or subscribe to a list, and have them resolve differnetly.
robotkad 16y ago
Awesome. Censorship built right into BIND. Why didn't Senator Conroy think of this?
- dedward 16y ago
  As long as the root servers don't start using it, it remains a localized issue....
sabat 16y ago
If this was actually an implementation of "my network, my rules," I suppose it would be OK. From what I've read, though, it's not. It's "my Internet, my rules." Just like RBL, if some random sysadmin decides he doesn't like your domain name, it goes on a blacklist and you will vanish from most of the Internet.
- dedward 16y ago
  It sounds more like "My internet, my rules, but I'm also going to make those rules available to others in case they care to use them somehow." Some jackass who abuses that system will be systematically ignored.
dedward 16y ago
Reading the spec - this is really a fairly elegant re-purposing/hack of the DNS mechanism to allow DNS administrators to have their servers configured to use their existing protocol stacks to "subscribe" to other administrator-configured policy servers, and to have lookups screened against them. Just like we do with DNSRBL now for mail. It's completely up to the DNS server administrator which policy servers they are going to configure or not, including using none at all. In short - I don't see what all the negative fuss is over - corporate networks already filter based on subscribed lists via proxies, home-made things, etc - this is just bringing that ability into the DNS stack in an elegant way.
- qjz 16y ago
  It's trivial to blackhole a domain if you run your own DNS, without adding any new features to bind. I do it all the time, by becoming authoritative at whatever level of the domain I need. But it takes special consideration and monitoring to avoid creating new problems. The threat here is that someone will identify a "bad website" and blacklist the domain via some publicly available policy server, which suddenly makes all services, not just HTTP, unavailable. For example, this means you might not be able to notify the admins of a domain via email if they host a blog (possibly yours) that gets exploited. Due to the fundamental nature of the service DNS provides, this could be an easy way to DOS an entire domain and all of its services.
jws 16y ago
How have they learned from the debacle of RBLs and censoring firewalls? I finally stopped running my own mail servers after 20 years because of the block lists. The RBL's continued false, silent bans caused too many mail delivery failures. The RBL's don't care about me, so I had to outsource to a mail provider so large the RBL's have to care.[1] On censoring firewalls. There are businesses which cause their competitors to be blocked by http censorship lists. It is unlawful, but the censorship engines accept anonymous input to make their decisions and it isn't hard to hide the tortious interference. Will DNS blocking have a similar effect of squelching the small and the new? Will it be abusable by nefarious people? [1] For many years I didn't see RBLs as a problem, until I no longer controlled a large block of IPs that I had had from the early days of the internet. Now I have servers in mixed blocks. and most useless of all for email and web servers, reused IPs. (Blockers sometimes remember the sins of years ago and reinstate blocks based on a previous owner.)
kiwidrew 16y ago
I can't help but imagine the terrible implications this has for new startups. Want to launch your awesome new webapp? Too bad, because your domain is "too new" and so nobody's DNS will resolve it yet. And so your first task will be to go around to all of the DNSRBL organizations and plead with them to put you on the "good guys" list; as others have pointed out, if the current crop of e-mail RBL groups are anything to go by, this will be a frustrating and opaque process. The network infrastructure shouldn't be in the business of enforcing policy, period. This is exactly the same slippery slope as the net neutrality debate, and in just the same way, it favours the existing players and those with the deepest pockets. Do we, as startups, really need yet another disadvantage?
datd00d 16y ago
I am with thaumaturgy, i hope this fails its just another application of old school thinking. The same thought processes that brought us these horribly designed protocols and their bandaid fixes (dns sec anyone?). Hopefully these old guys will just retire and leave ietf and other such organization that they seem to monopolize to the generation they created this mess for.
maw 16y ago
In economics, there's a distinction between the normative and the positive. The former describes what ought to be and the latter describes what is. The concept seems relevant here. Operators ought not block mail solely due to some RBL data. Users ought not report legitimate mail as spam and those reported "spams" ought not be fed into blacklists. (I gave up on Vipul's Razor as a bad job once I noticed that this happens.) System administrators ought to focus on providing useful mail service—blocking spam ought to be an aftereffect. And so on. Not enough of these are. They sometimes are, of course, but it just takes a few system administrators with fucked up priorities to ruin it for the rest of us. Vixie's proposal won't help anybody.