4 ms·
Reading the spec - this is really a fairly elegant re-purposing/hack of the DNS mechanism to allow DNS administrators to have their servers configured to use t
by dedward 16y ago
Reading the spec - this is really a fairly elegant re-purposing/hack of the DNS mechanism to allow DNS administrators to have their servers configured to use their existing protocol stacks to "subscribe" to other administrator-configured policy servers, and to have lookups screened against them. Just like we do with DNSRBL now for mail.
It's completely up to the DNS server administrator which policy servers they are going to configure or not, including using none at all.
In short - I don't see what all the negative fuss is over - corporate networks already filter based on subscribed lists via proxies, home-made things, etc - this is just bringing that ability into the DNS stack in an elegant way.
- qjz 16y agoIt's trivial to blackhole a domain if you run your own DNS, without adding any new features to bind. I do it all the time, by becoming authoritative at whatever level of the domain I need. But it takes special consideration and monitoring to avoid creating new problems. The threat here is that someone will identify a "bad website" and blacklist the domain via some publicly available policy server, which suddenly makes all services, not just HTTP, unavailable. For example, this means you might not be able to notify the admins of a domain via email if they host a blog (possibly yours) that gets exploited. Due to the fundamental nature of the service DNS provides, this could be an easy way to DOS an entire domain and all of its services.